United States General Accounting Office

GAO Testimony

Before the Subcommittee on Oversight and Investigations,

Committee on Commerce, House of Representatives

For Release on Delivery

Expected at

10:30 a.m.

Wednesday,

April 1, 1998

INTERNAL CONTROL

Essential for Safeguarding

Assets, Compliance With

Laws and Regulations, and

Reliable Financial Reporting

Statement of Robert W. Gramling

Director, Corporate Audits and Standards

Accounting and Information Management Division

GAO/T-AIMD-98-125

Summary 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

The importance of internal controls cannot be understated, especially in a

large, complex organization like the federal government. Internal control

is the first line of defense against fraud, waste, and abuse and helps

agencies achieve their missions effectively and efficiently. My testimony

discusses three questions: (1) What is internal control? (2) Why is it

important? and (3) What happens when it breaks down?

What Is Internal Control? Internal control is concerned with stewardship

and accountability of resources consumed while striving to accomplish an

agency’s mission with effective results. Specifically, GAO’s Standards for

Internal Controls in the Federal Government defines internal control as

“the plan of organization and methods and procedures adopted by

management to ensure resource use is consistent with laws, regulations,

and policies; that resources are safeguarded against waste, loss, and

misuse; and that reliable information is obtained, maintained, and fairly

disclosed in reports.” Internal control is synonymous with management

control in that the broad objectives of internal control cover all aspects of

agency operations. Although ultimate responsibility for internal controls

rests with management, all employees have a role in the effective

operation of internal controls established by management. Effective

internal control provides reasonable, not absolute, assurance that an

agency’s activities are being accomplished in accordance with its control

objectives.

Why Is Internal Control Important? Internal control helps management

achieve the mission of the agency and prevent or detect improper

activities. The cost of fraud cannot always be measured in dollars.

Improper activities erode public confidence in the government. In 1982,

the Congress passed the Federal Managers’ Financial Integrity Act

requiring (1) agencies to annually evaluate their internal controls, (2) GAO

to issue internal controls standards, and (3) OMB to issue guidelines for

agencies to follow in assessing their internal controls. Agencies were

required to report annually to the President and the Congress whether

their internal controls complied with GAO’s standards. The Integrity Act

was beneficial in focusing management and employee attention on the

importance of internal control. Although progress was made, internal

control problems continued. More recently, the Congress has enacted a

number of statutes to provide a framework for performance-based

management and accountability. These statutes include the Chief

Financial Officers Act of 1990, as expanded by the Government

Management Reform Act of 1994 (to ensure more reliable financial

reporting); the Government Performance and Results Act of 1993

Page 1 GAO/T-AIMD-98-125
Summary 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

(requiring agency strategic and annual performance planning); and the

Federal Financial Management Improvement Act of 1996 (to improve

federal financial management systems).

What Happens When Internal Controls Are Not Effective? Weak internal

controls pose a significant risk to the government—losses in the millions,

or even billions, of dollars can and do occur. For example, weak internal

controls contributed significantly to the failure of over 700 savings and

loans in the 1980s, costing the taxpayers hundreds of billions of dollars. In

the health care area, the Health and Human Services Inspector General

estimated that $23 billion of $163 billion in processed fee-for-service

payments during fiscal year 1996 were improper. GAO and others have

reported that weak internal controls over safeguarding and accounting for

government property are a serious continuing problem. GAO’s 1997

high-risk series identifies major areas of government operations where the

risks of losses to the government is high and where achieving program

goals is jeopardized.

Effective internal controls are essential to achieving agency missions.

Management and employees should focus not necessarily on more

controls, but on more effective controls.

Page 2 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

Mr. Chairman and Members of the Subcommittee:

We are pleased to be here today to discuss the subject of internal control.

Its importance cannot be understated, especially in the large, complex

operating environment of the federal government. Internal control is the

first line of defense against fraud, waste, and abuse and helps to ensure

that an entity’s mission is achieved in the most effective and efficient

manner. Although the subject of internal control usually surfaces for

discussion after improprieties or inefficiencies are found, good managers

are always aware of and seek ways to help improve operations through

effective internal control. As you requested, my testimony today will

discuss the following questions: (1) What is internal control? (2) Why is it

important? and (3) What happens when it breaks down?

What Is Internal

Control?

Internal control can be simply defined as the methods by which an

organization governs its activities to effectively and efficiently accomplish

its mission. More specifically, internal control is concerned with

stewardship and accountability of resources consumed in the process of

striving to accomplish an entity’s mission with effective results. In that

respect, we have defined internal control in our Standards for Internal

Controls in the Federal Government as follows:

“The plan of organization and methods and procedures adopted by management to ensure

that resource use is consistent with laws, regulations, and policies; that resources are

safeguarded against waste, loss, and misuse; and that reliable data are obtained,

maintained, and fairly disclosed in reports.”

Internal control should not be looked upon as separate, specialized

systems within an agency. Rather, internal control should be recognized as

an integral part of each system that management uses to regulate and

guide its operations. Internal control is synonymous with management

control in that the broad objectives of internal control cover all aspects of

agency operations. Although ultimate responsibility for good internal

control rests with management, all employees have a role in the effective

operation of internal control that has been set by management.

Understanding of internal control can be enhanced by focusing on two

basic aspects of internal control: objectives and techniques. Objectives are

the goals or purposes to be achieved, while techniques are the

mechanisms (the procedures, processes, physical arrangements,

organizational structures, and assignments of responsibility and authority,

Page 3 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

to name a few) that achieve the goal. All internal controls have objectives

and techniques. In practice, internal control starts with defining entitywide

objectives and then more specific objectives throughout the various levels

in the entity. Techniques are then implemented to achieve the objectives.

In its simplest form, internal control is practiced by citizens in the daily

routine of everyday life. For example, when you leave your home and lock

the door or when you lock your car at the mall or on a street, you are

practicing a form of internal control. The objective is to protect your

assets against undesired access, and your technique is to physically secure

your assets by locks. In another routine, when you write a check, you

record the check in the ledger or on your personal computer. The

objective is to control the money in your checking account by knowing the

balance. The technique is to document the check amount and the balance.

Periodically, you compare the checking account transactions and balances

you have recorded with the bank statement. Your objective is to ensure

the accuracy of your records to avoid costly mistakes. Your technique is to

perform the reconciliation.

These same types of concepts form the basis for internal control in

business operations and the operation of government. The nature of their

operations is, of course, significantly larger and more complex, as is the

inherent risk of ensuring that assets are safeguarded, laws and regulations

are complied with, and data used for decision-making and reporting are

reliable. Focusing a discussion on objectives and techniques, the

acquisition, receipt, use, and disposal of property, such as computer

equipment, can illustrate the practice of internal control in the operation

of government activities.

Internal control at the activity level such as procuring equipment should

be preceded, at a higher organizational level, by policy and planning

control objectives and control techniques that govern overall agency

operations in achieving mission objectives. Examples of high-level control

objectives that logically follow a pattern include the following:

• The mission of the agency should be set in accordance with laws,

regulations, and administration and management policy.

• Agency components should be defined in accordance with the overall

mission of the agency.

• Missions of the agency and components should be documented and

communicated to agency personnel.

Page 4 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

• Plans and budgets should be developed in accordance with the missions of

the agency and its components.

• Policies and procedures should be defined and communicated to achieve

the objectives defined in plans and budgets.

• Authorizations should be in accordance with policies and procedures.

• Systems of monitoring and reporting the results of agency activities should

be defined.

• Transactions should be classified or coded to permit the preparation of

reports to meet management’s needs and other reporting requirements.

• Access to assets should be permitted only in accordance with laws,

regulations, and management’s policy.

Examples of control techniques to help achieve the objectives include the

following:

• agency and component mission statements approved by management and

its legal counsel;

• training of personnel in mission and objectives;

• long and short-range plans developed related to budgets;

• monitoring of results against plans and budgets;

• policies and procedures defined and communicated to all levels of the

organization and periodically reviewed and revised based on internal

reviews;

• authorizations defined, controls set to ensure authorizations are made, and

authorizations periodically reviewed;

• classifications of accounts set to permit the capture and reporting of data

to prepare required reports; and

• physical restrictions on access to assets and records, and training in

security provided to employees.

The policy and planning control objectives and techniques provide a

framework to conduct agency operations and to account for resources and

results. Without that framework, administration and legislative goals may

not be achieved; laws and regulations may be violated; operations may not

be effective and efficient and may be misdirected; unauthorized activities

may occur; inaccurate reports to management and others may occur;

fraud, waste, and abuse is more likely to occur and be concealed; assets

may be stolen or lost; and ultimately the agency is in danger of not

achieving its mission.

Within this higher level framework for guiding and operating the agency,

specific activities take place to achieve the agency’s mission and the

Page 5 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

intended results. The procurement and management of computer

equipment is an example of such a specific activity. Objectives and

techniques should be established for each activity’s specific control. As

examples of control objectives, vendors should be approved in accordance

with laws, regulations, and management’s policy, as should the types,

quantities, and approved purchase prices of computer equipment. As

examples of related control techniques, criteria for approving vendors

should be established and approved vendor master files should be

controlled, and the purchase governed by criteria, such as obtaining

competitive bids and setting specifications of the equipment to be

procured. Likewise, control objectives should be set for the receiving

process. For example, only equipment that meets contract or purchase

order terms should be accepted, and equipment accepted should be

accurately and promptly reported. Related control techniques include

(1) detailed comparison of equipment received to a copy of the purchase

order, (2) prenumbered controlled receiving documents that are

accounted for, and (3) maintenance of receiving logs. Throughout the

purchasing and receiving of equipment there needs to be appropriate

separation of duties and interface with the accounting function to achieve

funds control, timely payments, and inventorying and control of equipment

received.

Equipment received should be safeguarded to prevent unauthorized

access and use. For example, in addition to physical security, equipment

should be tagged with identification numbers and placed into inventory

records. Equipment placed into service should only be issued to

authorized users and records of the issuances should be maintained to

achieve accountability. Further, physical inventories should be taken

periodically and compared with inventory records. Differences in counts

and records should be resolved in a timely manner and appropriate

corrective actions taken. Also, equipment retired from use should be in

accordance with management’s policies, including establishing

appropriate safeguards to prevent unauthorized information that may be

stored in the equipment from being disclosed.

It is important to recognize that internal controls can be designed to

provide reasonable, not absolute, assurance that an organization’s

activities are being accomplished in accordance with its objectives. The

American Institute of Certified Public Accountants—in Statement of

Auditing Standards Number 55—identified internal control limitations,

such as the possibility of errors arising from such causes as

misunderstanding of instructions, mistakes of judgment, and personal

Page 6 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

carelessness. Also, procedures whose effectiveness depends on

segregation of duties can be circumvented by collusion. Similarly,

management authorizations may be ineffective against errors or fraud

perpetrated by management. In addition, the standard of reasonable

assurance recognizes that the cost of internal control should not exceed

the benefit derived. Reasonable assurance equates to a satisfactory level of

confidence under given considerations of costs, benefits, and risks.

Why Is Internal

Control Important?

The cost of fraud, waste, and abuse cannot always be measured in dollars

and cents. Such improper activities erode public confidence in the

government’s ability to efficiently and effectively manage its programs.

Management at a number of federal government agencies are faced with

tight budgets and fewer personnel. In such an environment, related

operating factors, such as executive and middle management turnover and

the diversity and complexity of government operations, can provide a

fertile environment for internal control weakness and the resulting

undesired consequences.

It has been almost 50 years since the Congress formally recognized the

importance of internal control. The Accounting and Auditing Act of 1950

required, among other things, that agency heads establish and maintain

effective internal controls over all funds, property, and other assets for

which an agency is responsible. However, the ensuing years up through

the 1970s saw the government experience a crisis of poor controls.

To help restore confidence in government and to improve operations, the

Congress passed the Federal Managers’ Financial Integrity Act of 1982.

The Integrity Act required, among other items, that

• we establish internal control standards that agencies are required to

adhere to,

• the Office of Management and Budget (OMB) issue guidelines for agencies

to follow in annually assessing their internal controls,

• agencies annually evaluate their internal controls and prepare a statement

to the President and the Congress on whether their internal controls

comply with the standards issued by GAO,

1

 and

• agency reports include material internal control weaknesses identified and

plans for correcting the weaknesses.

1

The Integrity Act also requires each agency’s annual statement to include a separate report on

whether the agency’s accounting system conforms to principles, standards, and related requirements

prescribed by GAO. OMB Circular A-127, Financial Management Systems, revised July 23, 1993,

prescribes policies and standards for agencies to follow in reporting on financial management systems.

Page 7 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

OMB has issued agency guidance2 that sets forth the requirements for

establishing, periodically assessing, correcting, and reporting on controls

required by the Integrity Act. Regarding the identification and reporting of

deficiencies, OMB’s guidance states that “a deficiency should be reported if

it is or should be of interest to the next level of management. Agency

employees and managers generally report deficiencies to the next

supervisory level, which allows the chain of command structure to

determine the relative importance of each deficiency.” The guidance

further states that “a deficiency that the agency head determines to be

significant enough to be reported outside the agency (i.e., included in the

annual Integrity Act report to the President and the Congress) shall be

considered a ’material weakness.’” The guidance encourages reporting of

deficiencies by recognizing that such reporting reflects positively on the

agency’s commitment to recognizing and addressing management

problems and, conversely, failing to report a known deficiency reflects

adversely on the agency.

In 1983, we issued internal control standards as required by the Integrity

Act. In developing the standards, we drew on our previously issued

guidance and experts throughout the government, private sector, and

academic communities. The internal control standards consist of five

general standards, six specific standards, and one audit resolution

standard.3

 The five general standards require (1) a supportive attitude

toward controls by managers and employees, (2) competent personnel,

(3) internal controls that provide reasonable assurance that objectives are

achieved, (4) the development of internal control objectives for each

agency activity, and (5) control techniques that are effective and efficient

in accomplishing internal control objectives. The six specific control

standards identify basic techniques to help achieve control objectives. The

standards address

• documentation of control objectives and techniques and all pertinent

aspects of transactions;

• required prompt and proper recording of all transactions;

• executing transactions and events according to management’s directives;

2

OMB Circular A-123, Management Accountability and Control, revised June 21, 1995.

3

Although the standards issued in 1983 remain conceptually sound, we are revising them to recognize

current terminology developed by the private sector with assistance from GAO and others and to give

greater recognition to the ever increasing use of information technology. (Internal Control: Standards

for Internal Control in the Federal Government - Exposure Draft (GAO/AIMD-98-21.3.1,

December 1997)).

Page 8 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

• separation of duties between authorizing, processing, recording, and

reviewing transactions;

• qualified and continuous supervision to ensure that control objectives are

achieved; and

• limiting access to resources and records to authorized persons to provide

accountability for the custody and use of resources.

Finally, the audit resolution standard requires managers to promptly

evaluate findings, determine proper resolution, and establish corrective

action or otherwise resolve audit findings. Attachment I provides a

complete definition of the standards and Standards for Internal Controls in

the Federal Government provides additional explanation of the standards.

The Integrity Act was beneficial in focusing management and employee

attention on the importance of internal control to achieving an agency’s

mission. However, agency reports required under the Integrity Act

disclosed so many internal control weaknesses that additional measures

were needed to provide for effective program management and

accountability. Since the Integrity Act, the Congress has enacted a number

of statutes to provide a framework for performance-based management

and accountability. These statutes include the following:

• The Chief Financial Officers Act of 1990, as expanded by the Government

Management Reform Act of 1994, laid the foundation for government to

better ensure reliable financial information through audited financial

statements.

• In response to the savings and loan crisis and the growing list of bank

failures in the early 1990s, the Federal Deposit Insurance Corporation

Improvement Act of 1991 required depository institutions whose assets

exceeded certain amounts to prepare an annual statement of

management’s responsibility for establishing and maintaining adequate

internal controls, including an assessment of the effectiveness of the

controls. Also, the institution’s independent auditors are required to attest

to the fair presentation of management’s assertion on internal control

effectiveness.

• The Government Performance and Results Act of 1993 requires, among

other items, that agencies identify their missions, strategic goals, and

approaches (strategies) for achieving the goals. The act also requires

agencies to report on their performance, using performance measures, in

meeting the goals.

• The Federal Financial Management Improvement Act of 1996 requires that

auditors auditing financial statements pursuant to the expanded Chief

Page 9 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

Financial Officers Act report whether each agency is maintaining financial

management systems that comply substantially with federal financial

management systems requirements, federal accounting standards, and the

government’s standard general ledger at the transaction level.

Our report, The Statutory Framework for Performance-Based Management

and Accountability (GAO/AIMD-98-52, January 28, 1998) provides more

detailed information on the purpose, requirements, and implementation

status of these acts. In addition, that report refers to a number of other

critically important statutes that address debt collection, credit reform,

prompt pay, inspectors general, and information resources management.

Although these acts address specific problem areas, sound internal

controls are an essential factor in the success of these statutes. For

example, the Results Act focuses on results through strategic and annual

planning and performance reporting. Sound internal control is critical to

effectively and efficiently achieving management’s plans and for obtaining

accurate data to support performance measures.

What Happens When

Internal Controls Are

Not Effective?

Weak internal controls pose a significant risk to government agencies.

History has shown that serious neglect will result in losses to the

government that can total millions, and even billions, of dollars over time.

As previously mentioned, the loss of confidence in government that results

can be equally serious. Although examples of poor internal controls could

be drawn from many federal programs, three key areas illustrate the

extent of the problems—health care, banking, and property.

Health Care The Department of Human and Human Services Inspector General

reported this past year4

 that out of $163.6 billion in processed

fee-for-service payments reported by the Health Care Financing

Administration (HCFA) during fiscal year 1996—the latest year for which

reliable numbers were available—an estimated $23.2 billion, or about

14.6 percent of the total payments, were improper. Consequently, the

Inspector General recommended that HCFA implement internal controls

designed to detect and prevent improper payments to correct four

weaknesses where (1) insufficient or no documentation supporting claims

existed, (2) medical necessity was not established, (3) incorrect

classification (called coding) of information existed, and

(4) unsubstantiated/unallowable services were paid.

4

Report on the Financial Statement Audit of the Health Care Financing Administration for Fiscal Year

1996, Department of Health and Human Services, Inspector General (A-17-95-0096, July 1997).

Page 10 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

Banking During the 1980s, the savings and loan industry experienced severe

financial losses. Extremely high interest rates caused institutions to pay

high costs for deposits and other funds while earning low yields on their

long-term portfolios. Many institutions took inappropriate or risky

approaches in attempting to increase their capital. These approaches

included accounting methods to artificially inflate the institutions’ capital

position and diversifying their investments into potentially more

profitable, but riskier, activities. The profitability of many of these

investments depended heavily on continued inflation in real estate values

to make them economically viable. In many cases, weak internal controls

at these institutions and noncompliance with laws and regulations

increased the risk of these activities and contributed significantly to the

ultimate failure of over 700 institutions. This crisis cost the taxpayers

hundreds of billions of dollars.5

Making profitable loans is the heart of a successful savings and loan

institution. Boards of directors and senior management did not actively

monitor the loan award and administrative processes to ensure excessive

risks in making loans were not taken. In fact, excessive risk-taking in

making loans was encouraged, resulting in a lack of effective monitoring

of loan performance that allowed poorly performing loans to continue to

deteriorate. Also, loan documentation was a frequent problem that further

evidenced weak internal supervision of loan officers and created

difficulties in valuing and selling loans after the institutions failed.

Property Poor internal controls in the area of government property has existed for

decades. For example, in 1988, we reported that the Defense Logistics

Agency recorded losses of about $23 million for materials because of poor

internal controls.6

 In 1985, we reported that for the prior 16 years, the

Department of State had long-standing internal control weaknesses in

managing an estimated $250 million of personal property.7

 In 1987, we

reported that the National Aeronautics and Space Administration had poor

internal controls over $500 million of property at Goddard Space Flight

Center. We noted that not all property was tagged or recorded in the

accounting records and that property no longer needed by particular units

5

Financial Audit: Resolution Trust Corporation’s 1995 and 1994 Financial Statements

(GAO/AIMD-96-123, July 2, 1996).

6

Financial Management: Examples of Weaknesses (GAO/AFMD-88-35BR, February 25, 1988).

7

Financial Integrity Act: The Government Faces Serious Internal Control and Accounting Systems

Problems (GAO/AFMD-86-14, December 23, 1985).

Page 11 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

was not made available for reuse or effectively controlled against misuse

or theft.8

More recently, we reported that breakdowns exist in the Department of

Defense’s (DOD) ability to protect its assets from fraud, waste, and abuse.

We disclosed that the Army did not have accurate records for its reported

$30 billion in real property or the $8.5 billion reported as government

furnished property in the hands of contractors.9

 Further, we reported that

pervasive weaknesses in DOD’s general computer controls place it at risk of

improper modification; theft; inappropriate disclosure; and destruction of

sensitive personnel, payroll, disbursement, or inventory information.10

High-Risk Areas Beginning in 1990, we began a special effort to review and report on the

federal program areas our work had identified as high risk because of

vulnerabilities to waste, fraud, abuse, and mismanagement. This effort

brought a much-needed central focus on problems that were costing the

government billions of dollars. Our most recent high-risk series issued

focuses of six categories of high risk: (1) providing for accountability and

cost-effective management of defense programs, (2) ensuring that all

revenues are collected and accounted for, (3) obtaining an adequate return

on multibillion dollar investments in information technology,

(4) controlling fraud, waste, and abuse in benefit programs, (5) minimizing

loan program losses, and (6) improving management of federal contracts

at civilian agencies. See attachment II for a listing of the high-risk reports

and our most recent reports and testimony on the Year 2000 computing

crisis.

Conclusion In conclusion, effective internal controls are essential to achieving agency

missions and the results intended by the Congress and the administration

and as reasonably expected by the taxpayers. The lack of consistently

effective internal controls across government has plagued the government

for decades. Legislation has been enacted to provide a framework for

performance-based management and accountability. Effective internal

controls are an essential component of the success of that legislation.

8

Financial Integrity Act: Continuing Efforts Needed to Improve Internal Control and Accounting

Systems (GAO/AFMD-88-10, December 30, 1987).

9

Financial Management: Challenges Facing DOD in Meeting the Goals of the Chief Financial Officers

Act (GAO/T-AIMD-96-01, November 14, 1995).

10DOD High-Risk Areas: Eliminating Underlying Causes Will Avoid Billions of Dollars in Waste

(GAO/NSIAD/AIMD-97-143, May 1, 1997).

Page 12 GAO/T-AIMD-98-125
Statement 

Internal Control: Essential for Safeguarding

Assets, Compliance With Laws and

Regulations, and Reliable Financial

Reporting

However, no system of internal control is perfect, and the controls may

need to be revised as agency missions and service delivery change to meet

new expectations. Management and employees should focus not

necessarily on more controls, but on more effective controls.

Mr. Chairman, this concludes my statement. I would be happy to respond

to any questions that you or other Members of the Subcommittee may

have at this time.

Page 13 GAO/T-AIMD-98-125
Attachment I 

Standards for Internal Controls in the

Federal Government

Internal control standards define the minimum level of quality acceptable

for internal control systems to operate and constitute the criteria against

which systems are to be evaluated. These internal control standards apply

to all operations and administrative functions but are not intended to limit

or interfere with duly granted authority related to the development of

legislation, rule making, or other discretionary policy-making in an agency.

General Standards 1. Reasonable Assurance: Internal control systems are to provide

reasonable assurance that the objectives of the systems will be

accomplished.

2. Supportive Attitude: Managers and employees are to maintain and

demonstrate a positive and supportive attitude toward internal controls at

all times.

3. Competent Personnel: Managers and employees are to have personal

and professional integrity and are to maintain a level of competence that

allows them to accomplish their assigned duties, and understand the

importance of developing and implementing good internal controls.

4. Control Objectives: Internal control objectives are to be identified or

developed for each agency activity and are to be logical, applicable, and

reasonably complete.

5. Control Techniques: Internal control techniques are to be effective and

efficient in accomplishing their internal control objectives.

Specific Standards 1. Documentation: Internal control systems and all transactions and other

significant events are to be clearly documented, and the documentation is

to be readily available for examination.

2. Recording of Transactions and Events: Transactions and other

significant events are to be promptly recorded and properly classified.

3. Execution of Transactions and Events: Transactions and other

significant events are to be authorized and executed only by persons

acting within the scope of their authority.

Page 14 GAO/T-AIMD-98-125
Attachment I 

Standards for Internal Controls in the

Federal Government

4. Separation of Duties: Key duties and responsibilities in authorizing,

processing, recording, and reviewing transactions should be separated

among individuals.

5. Supervision: Qualified and continuous supervision is to be provided to

ensure that internal control objectives are achieved.

6. Access to and Accountability for Resources: Access to resources and

records is to be limited to authorized individuals, and accountability for

the custody and use of resources is to be assigned and maintained.

Periodic comparison shall be made of the resources with the recorded

accountability to determine whether the two agree. The frequency of the

comparison shall be a function of the vulnerability of the asset.

Audit Resolution

Standard

Prompt Resolution of Audit Findings: Managers are to (1) promptly

evaluate findings and recommendations reported by auditors,

(2) determine proper actions in response to audit findings and

recommendations, and (3) complete, within established time frames, all

actions that correct or otherwise resolve the matters brought to

management’s attention.

Page 15 GAO/T-AIMD-98-125
Attachment II 

GAO’s February 1997 High-Risk Series

Reports and Recent GAO Reports and

Testimony on the Year 2000 Computing

Crisis

High-Risk Series

Reports

High-Risk Series: An Overview (GAO/HR-97-1, February 1997).

High-Risk Series: Quick Reference Guide (GAO/HR-97-2, February 1997).

High-Risk Series: Defense Financial Management (GAO/HR-97-3,

February 1997).

High-Risk Series: Defense Contract Management (GAO/HR-97-4,

February 1997).

High-Risk Series: Defense Inventory Management (GAO/HR-97-5,

February 1997).

High-Risk Series: Defense Weapons Systems Acquisition (GAO/HR-97-6,

February 1997).

High-Risk Series: Defense Infrastructure (GAO/HR-97-7, February 1997).

High-Risk Series: IRS Management (GAO/HR-97-8, February 1997).

High-Risk Series: Information Management and Technology (GAO/HR-97-9,

February 1997).

High-Risk Series: Medicare (GAO/HR-97-10, February 1997).

High-Risk Series: Student Financial Aid (GAO/HR-97-11, February 1997).

High-Risk Series: Department of Housing and Urban Development

(GAO/HR-97-12, February 1997).

High-Risk Series: Department of Energy Contract Management

(GAO/HR-97-13, February 1997).

High-Risk Series: Superfund Program Management (GAO/HR-97-14,

February 1997).

High-Risk Program Information on Selected High-Risk Areas (GAO/HR-97-30

May 1997).

Page 16 GAO/T-AIMD-98-125
Attachment II 

GAO’s February 1997 High-Risk Series

Reports and Recent GAO Reports and

Testimony on the Year 2000 Computing

Crisis

Year 2000 Computing

Crises Reports and

Testimony

Year 2000 Computing Crisis: Business Continuity and Contingency

Planning (GAO/ AIMD-10-1.19, Exposure Draft, March 1998).

Year 2000 Readiness: NRC’s Proposed Approach Regarding Nuclear

Powerplants (GAO/AIMD-98-90R, March 6, 1998).

Year 2000 Computing Crisis: Federal Deposit Insurance Corporation’s

Efforts to Ensure Bank Systems Are Year 2000 Compliant (GAO/T-AIMD-98-73,

February 10, 1998).

Year 2000 Computing Crisis: FAA Must Act Quickly to Prevent Systems

Failures (GAO/ T-AIMD-98-63, February 4, 1998).

FAA Computer Systems: Limited Progress on Year 2000 Issue Increases

Risk Dramatically (GAO/AIMD-98-45, January 30, 1998).

Defense Computers: Air Force Needs to Strengthen Year 2000 Oversight

(GAO/ AIMD-98-35, January 16, 1998).

Year 2000 Computing Crisis: Actions Needed to Address Credit Union

Systems’ Year 2000 Problem (GAO/T-AIMD-98-48, January 7, 1998).

Veterans Health Administration Facility Systems: Some Progress Made In

Ensuring Year 2000 Compliance, But Challenges Remain (GAO/AIMD-98-31R,

November 7, 1997).

Year 2000 Computing Crisis: National Credit Union Administration’s

Efforts to Ensure Credit Union Systems Are Year 2000 Compliant

(GAO/T-AIMD-98-20, October 22, 1997).

Social Security Administration: Significant Progress Made in Year 2000

Effort, But Key Risks Remain (GAO/T-AIMD-98-6, October 22, 1997).

Defense Computers: Technical Support Is Key to Naval Supply Year 2000

Success (GAO/AIMD-98-7R, October 21, 1997).

Defense Computers: LSSC Needs to Confront Significant Year 2000 Issues

(GAO/ AIMD-97-149, September 26, 1997).

Veterans Affairs Computer Systems: Action Underway Yet Much Work

Remains To Resolve Year 2000 Compliance (GAO/T-AIMD-97-174,

September 25, 1997).

Page 17 GAO/T-AIMD-98-125
Attachment II 

GAO’s February 1997 High-Risk Series

Reports and Recent GAO Reports and

Testimony on the Year 2000 Computing

Crisis

Year 2000 Computing Crisis: Success Depends Upon Strong Management

and Structured Approach (GAO/T-AIMD-97-173, September 25, 1997).

Year 2000 Computing Crisis: An Assessment Guide (GAO/AIMD-10.1.14,

September 1997).

Defense Computers: SSG Needs to Sustain Year 2000 Progress 

(GAO/AIMD-97-120R, August 19, 1997).

Defense Computers: Improvements to DOD Systems Inventory Needed for

Year 2000 Effort (GAO/AIMD-97-112, August 13, 1997).

Defense Computers: Issues Confronting DLA in Addressing Year 2000

Problems (GAO/AIMD-97-106, August 12, 1997).

Defense Computers: DFAS Faces Challenges in Solving the Year 2000

Problem (GAO/AIMD-97-117, August 11, 1997).

Year 2000 Computing Crisis: Time Is Running Out for Federal Agencies to

Prepare for the New Millennium (GAO/T-AIMD-97-129, July 10, 1997).

Veterans Benefits Computer Systems: Uninterrupted Delivery of Benefits

Depends on Timely Correction of Year-2000 Problems (GAO/T-AIMD-97-114,

June 26, 1997).

Veterans Affairs Computer Systems: Risks of VBA’s Year 2000 Efforts

(GAO/AIMD-97-79, May 30, 1997).

Medicare Transaction System: Success Depends Upon Correcting Critical

Managerial and Technical Weaknesses (GAO/AIMD-97-78, May 16, 1997).

Medicare Transaction System: Serious Managerial and Technical

Weaknesses Threaten Modernization (GAO/T-AIMD-97-91, May 16, 1997).

Year 2000 Computing Crisis: Risk of Serious Disruption to Essential

Government Functions Calls for Agency Action Now (GAO/T-AIMD-97-52,

February 27, 1997).

Year 2000 Computing Crisis: Strong Leadership Today Needed To Prevent

Future Disruption of Government Services (GAO/T-AIMD-97-51, February 24,

1997).

(917720) Page 18 GAO/T-AIMD-98-125
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100