November 1999 Standards for Interna

Control in the Federa

Government

GAO/AIMD-00-21.3.1

Federal policymakers and program manag

continually seeking ways to better achieve 

missions and program results, in other wo

are seeking ways to improve accountabilit

factor in helping achieve such outcomes a

operational problems is to implement appr

internal control. Effective internal control 

in managing change to cope with shifting

environments and evolving demands and p

programs change and as agencies strive to 

operational processes and implement new

technological developments, management 

continually assess and evaluate its interna

assure that the control activities being use

effective and updated when necessary.

The Federal Managers’ Financial Integrity 

(FMFIA) requires the General Accounting O

to issue standards for internal control in g

The standards provide the overall framewo

establishing and maintaining internal cont

identifying and addressing major performa

management challenges and areas at great

fraud, waste, abuse, and mismanagement. 

Management and Budget (OMB) Circular A

Management Accountability and Control, r

June 21, 1995, provides the specific require

assessing and reporting on controls. The te

control in this document is synonymous w

management control (as used in OMB Circu

A-123) that covers all aspects of an agency

operations (programmatic, financial, and

compliance).

Recently, other laws have prompted renew

on internal control. The Government Perfo

and Results Act of 1993 requires agencies 

their missions, set strategic and annual pe

goals, and measure and report on perform

Page 1 GAO/AIMD-00-
toward those goals. Internal control plays 

significant role in helping managers achiev

goals. Also, the Chief Financial Officers Ac

calls for financial management systems to 

with internal control standards, and the Fe

Financial Management Improvement Act o

identifies internal control as an integral pa

improving financial management systems.

Rapid advances in information technology 

highlighted the need for updated internal c

guidance related to modern computer syst

management of human capital has gained 

as a significant part of internal control. Fu

the private sector has updated its internal 

guidance with the issuance of Internal Con

Integrated Framework, published by the C

of Sponsoring Organizations of the Treadw

Commission (COSO). Consequently, we hav

developed this standards update which su

our previously issued “Standards for Intern

in the Federal Government.”

This update gives greater recognition to th

increasing use of information technology t

critical government operations, recognizes 

importance of human capital, and incorpo

appropriate, the relevant updated internal 

guidance developed in the private sector. T

standards are effective beginning with fisc

and the Federal Managers Financial Integr

reports covering that year.

Page 2 GAO/AIMD-00-
We appreciate the efforts of government o

public accounting professionals, and other 

of the financial community and academia w

provided valuable assistance in developing 

standards.

David M. Walker

Comptroller General

of the United States

Page 3 GAO/AIMD-00-
The following definition, objectives, and fu

concepts provide the foundation for the in

control standards.

Definition and

Objectives Internal Control

An integral component of an organization’s 

management that provides reasonable ass

that the following objectives are being ach

• effectiveness and efficiency of operations

• reliability of financial reporting, and 

• compliance with applicable laws and regu

Internal control is a major part of managin

organization. It comprises the plans, meth

procedures used to meet missions, goals, a

objectives and, in doing so, supports

performance-based management. Internal 

serves as the first line of defense in safegu

assets and preventing and detecting errors 

In short, internal control, which is synonym

management control, helps government pr

managers achieve desired results through 

stewardship of public resources.

Internal control should provide reasonable 

that the objectives of the agency are being 

the following categories:

Page 4 GAO/AIMD-00-
• Effectiveness and efficiency of operations 

the use of the entity’s resources.

• Reliability of financial reporting, including 

budget execution, financial statements, an

reports for internal and external use.

• Compliance with applicable laws and regu

A subset of these objectives is the safegua

assets. Internal control should be designed 

reasonable assurance regarding prevention 

prompt detection of unauthorized acquisit

disposition of an agency’s assets.

Fundamental

Concepts Internal Control

• A continuous built-in component of oper

• Effected by people.

• Provides reasonable assurance, not abs

assurance.

The fundamental concepts provide the und

framework for designing and applying the 

Internal Control Is a

Continuous Built-in

Component of

Operations

Internal control is not one event, but a ser

actions and activities that occur throughou

entity’s operations and on an ongoing basi

control should be recognized as an integra

each system that management uses to regu

guide its operations rather than as a separ

within an agency. In this sense, internal co

management control that is built into the e

Page 5 GAO/AIMD-00-
part of its infrastructure to help managers 

entity and achieve their aims on an ongoin

Internal Control Is

Effected by People

People are what make internal control wo

responsibility for good internal control res

managers. Management sets the objectives

control mechanisms and activities in place

monitors and evaluates the control. Howev

personnel in the organization play importa

making it happen.

Internal Control

Provides Reasonable

Assurance, Not

Absolute Assurance

Management should design and implemen

control based on the related cost and bene

matter how well designed and operated, in

control cannot provide absolute assurance 

agency objectives will be met. Factors out

control or influence of management can af

entity’s ability to achieve all of its goals. Fo

human mistakes, judgment errors, and act

collusion to circumvent control can affect 

agency objectives. Therefore, once in plac

control provides reasonable, not absolute, 

of meeting agency objectives.

Page 6 GAO/AIMD-00-
Presentation of

the Standards

The Five Standards for Internal Contro

• Control Environment

• Risk Assessment

• Control Activities

• Information and Communications

• Monitoring

These standards define the minimum level 

acceptable for internal control in governm

provide the basis against which internal co

be evaluated. These standards apply to all 

an agency’s operations: programmatic, fin

compliance. However, they are not intende

or interfere with duly granted authority re

developing legislation, rule-making, or oth

discretionary policy-making in an agency. 

standards provide a general framework. In

implementing these standards, manageme

responsible for developing the detailed po

procedures, and practices to fit their agenc

operations and to ensure that they are buil

an integral part of operations.

In the following material, each of these sta

presented in a short, concise statement. A

information is provided to help managers 

the standards into their daily operations.

Page 7 GAO/AIMD-00-
Control

Environment

Management and employees should estab

and maintain an environment throughout t

organization that sets a positive and supp

attitude toward internal control and consci

management.

A positive control environment is the foun

all other standards. It provides discipline a

structure as well as the climate which influ

quality of internal control. Several key fact

the control environment.

One factor is the integrity and ethical valu

maintained and demonstrated by managem

staff. Agency management plays a key role 

providing leadership in this area, especiall

and maintaining the organization’s ethical 

providing guidance for proper behavior, re

temptations for unethical behavior, and pr

discipline when appropriate.

Another factor is management’s commitm

competence. All personnel need to posses

maintain a level of competence that allows 

accomplish their assigned duties, as well a

understand the importance of developing a

implementing good internal control. Mana

needs to identify appropriate knowledge a

needed for various jobs and provide neede

as well as candid and constructive counse

performance appraisals.

Page 8 GAO/AIMD-00-
Management’s philosophy and operating s

affect the environment. This factor determ

degree of risk the agency is willing to take 

management’s philosophy towards

performance-based management. Further, 

and philosophy of management toward inf

systems, accounting, personnel functions, 

and audits and evaluations can have a prof

on internal control.

Another factor affecting the environment i

agency’s organizational structure. It provid

management’s framework for planning, dir

controlling operations to achieve agency o

good internal control environment require

agency’s organizational structure clearly d

areas of authority and responsibility and e

appropriate lines of reporting.

The environment is also affected by the m

which the agency delegates authority and

responsibility throughout the organization

delegation covers authority and responsib

operating activities, reporting relationship

authorization protocols.

Good human capital policies and practices 

another critical environmental factor. This 

establishing appropriate practices for hirin

orienting, training, evaluating, counseling, 

compensating, and disciplining personnel. 

includes providing a proper amount of sup

A final factor affecting the environment is 

agency’s relationship with the Congress an

oversight agencies such as OMB. Congress 

the programs that agencies undertake and 

their progress and central agencies provid

guidance on many different matters. In add

Page 9 GAO/AIMD-00-
Inspectors General and internal senior ma

councils can contribute to a good overall c

environment.

Risk Assessment

Internal control should provide for an ass

of the risks the agency faces from both ex

and internal sources.

A precondition to risk assessment is the

establishment of clear, consistent agency o

Risk assessment is the identification and a

relevant risks associated with achieving th

objectives, such as those defined in strateg

annual performance plans developed unde

Government Performance and Results Act

forming a basis for determining how risks 

managed.

Management needs to comprehensively id

and should consider all significant interact

between the entity and other parties as we

internal factors at both the entitywide and 

level. Risk identification methods may inc

qualitative and quantitative ranking activit

management conferences, forecasting and 

planning, and consideration of findings fro

and other assessments.

Once risks have been identified, they shou

analyzed for their possible effect. Risk ana

generally includes estimating the risk’s sig

assessing the likelihood of its occurrence, 

Page 10 GAO/AIMD-00-
deciding how to manage the risk and what 

should be taken. The specific risk analysis

methodology used can vary by agency bec

differences in agencies’ missions and the d

qualitatively and quantitatively assigning r

Because governmental, economic, industr

regulatory, and operating conditions conti

change, mechanisms should be provided t

and deal with any special risks prompted b

changes.

Control Activities

Internal control activities help ensure tha

management's directives are carried out. 

control activities should be effective and 

in accomplishing the agency's control ob

Control activities are the policies, procedu

techniques, and mechanisms that enforce

management’s directives, such as the proc

adhering to requirements for budget devel

execution. They help ensure that actions a

address risks. Control activities are an inte

an entity’s planning, implementing, review

accountability for stewardship of governm

resources and achieving effective results.

Control activities occur at all levels and fu

the entity. They include a wide range of di

activities such as approvals, authorization

verifications, reconciliations, performance 

Page 11 GAO/AIMD-00-
maintenance of security, and the creation 

maintenance of related records which pro

evidence of execution of these activities a

appropriate documentation. Control activi

applied in a computerized information sys

environment or through manual processes

Activities may be classified by specific con

objectives, such as ensuring completeness 

accuracy of information processing.

Examples of Control

Activities

• Top level reviews of actual performance

• Reviews by management at the function

 activity level,

• Management of human capital,

• Controls over information processing,

• Physical control over vulnerable assets

• Establishment and review of performan

measures and indicators,

• Segregation of duties,

• Proper execution of transactions and ev

• Accurate and timely recording of transa

 and events,

• Access restrictions to and accountability 

resources and records, and 

• Appropriate documentation of transactio

internal control.

There are certain categories of control act

are common to all agencies. Examples inc

following:

Page 12 GAO/AIMD-00-
Top Level Reviews of

Actual Performance

Management should track major agency ac

and compare these to the plans, goals, and 

established under the Government Perform

Results Act.

Reviews by Management

at the Functional or

Activity Level

Managers also need to compare actual per

to planned or expected results throughout 

organization and analyze significant differ

Management of Human

Capital

Effective management of an organization’s

workforce—its human capital—is essentia

achieving results and an important part of 

control. Management should view human 

an asset rather than a cost. Only when the 

personnel for the job are on board and are 

the right training, tools, structure, incentiv

responsibilities is operational success pos

Management should ensure that skill need

continually assessed and that the organiza

to obtain a workforce that has the required 

match those necessary to achieve organiza

goals. Training should be aimed at develop

retaining employee skill levels to meet cha

organizational needs. Qualified and contin

supervision should be provided to ensure 

control objectives are achieved. Performan

evaluation and feedback, supplemented by 

effective reward system, should be design

employees understand the connection betw

performance and the organization’s succes

of its human capital planning, managemen

also consider how best to retain valuable e

plan for their eventual succession, and ens

continuity of needed skills and abilities.

Controls Over

Information Processing

A variety of control activities are used in in

processing. Examples include edit checks 

entered, accounting for transactions in nu

sequences, comparing file totals with cont

Page 13 GAO/AIMD-00-
accounts, and controlling access to data, f

programs. Further guidance on control act

information processing is provided below 

“Control Activities Specific for Informatio

Physical Control Over

Vulnerable Assets

An agency must establish physical control 

and safeguard vulnerable assets. Example

security for and limited access to assets su

securities, inventories, and equipment whi

vulnerable to risk of loss or unauthorized u

assets should be periodically counted and 

to control records.

Establishment and

Review of Performance

Measures and Indicators

Activities need to be established to monito

performance measures and indicators. The

could call for comparisons and assessmen

different sets of data to one another so tha

of the relationships can be made and appr

actions taken. Controls should also be aim

validating the propriety and integrity of bo

organizational and individual performance 

and indicators.

Segregation of Duties Key duties and responsibilities need to be 

segregated among different people to redu

of error or fraud. This should include sepa

responsibilities for authorizing transaction

processing and recording them, reviewing 

transactions, and handling any related ass

individual should control all key aspects o

transaction or event.

Proper Execution of

Transactions and Events

Transactions and other significant events s

authorized and executed only by persons a

within the scope of their authority. This is 

principal means of assuring that only valid

transactions to exchange, transfer, use, or 

resources and other events are initiated or 

Page 14 GAO/AIMD-00-
into. Authorizations should be clearly com

to managers and employees.

Accurate and Timely

Recording of

Transactions and Events

Transactions should be promptly recorded 

maintain their relevance and value to man

controlling operations and making decisio

applies to the entire process or life cycle o

transaction or event from the initiation an

authorization through its final classificatio

summary records. In addition, control acti

to ensure that all transactions are complet

accurately recorded.

Access Restrictions to

and Accountability for

Resources and Records

Access to resources and records should be 

authorized individuals, and accountability 

custody and use should be assigned and m

Periodic comparison of resources with the 

accountability should be made to help red

of errors, fraud, misuse, or unauthorized a

Appropriate

Documentation of

Transactions and

Internal Control

Internal control and all transactions and o

significant events need to be clearly docum

the documentation should be readily avail

examination. The documentation should a

management directives, administrative po

operating manuals and may be in paper or 

form. All documentation and records shou

properly managed and maintained.

These examples are meant only to illustrat

and variety of control activities that may b

agency managers. They are not all-inclusiv

not include particular control activities tha

may need.

Furthermore, an agency’s internal control 

flexible to allow agencies to tailor control 

fit their special needs. The specific contro

used by a given agency may be different fr

Page 15 GAO/AIMD-00-
used by others due to a number of factors. 

could include specific threats they face an

incur; differences in objectives; manageria

size and complexity of the organization; op

environment; sensitivity and value of data; 

requirements for system reliability, availab

performance.

Control Activities

Specific for

Information Systems • General Control

• Application Control

There are two broad groupings of informa

systems control - general control and appl

control. General control applies to all info

systems—mainframe, minicomputer, netw

end-user environments. Application contro

designed to cover the processing of data w

application software.

General Control This category includes entitywide security 

planning, management, control over data c

operations, system software acquisition an

maintenance, access security, and applica

development and maintenance. More spec

• Data center and client-server operations c

include backup and recovery procedures, 

contingency and disaster planning. In addi

center operations controls also include job 

scheduling procedures and controls over o

activities.

Page 16 GAO/AIMD-00-
• System software control includes control o

acquisition, implementation, and maintena

system software including the operating sy

data-based management systems,

telecommunications, security software, an

programs.

• Access security control protects the system

network from inappropriate access and un

use by hackers and other trespassers or in

use by agency personnel. Specific control 

include frequent changes of dial-up numbe

dial-back access; restrictions on users to a

only to system functions that they need; so

hardware “firewalls” to restrict access to a

computers, and networks by external pers

frequent changes of passwords and deacti

former employees’ passwords.

• Application system development and main

control provides the structure for safely de

new systems and modifying existing system

Included are documentation requirements

authorizations for undertaking projects; an

testing, and approvals of development and

modification activities before placing syste

operation. An alternative to in-house deve

the procurement of commercial software, 

is necessary to ensure that selected softwa

the user’s needs, and that it is properly pla

operation.

Application Control This category of control is designed to hel

completeness, accuracy, authorization, an

all transactions during application process

Control should be installed at an applicatio

interfaces with other systems to ensure th

are received and are valid and outputs are 

properly distributed. An example is compu

checks built into the system to review the 

existence, and reasonableness of data.

Page 17 GAO/AIMD-00-
General and application control over comp

systems are interrelated. General control s

functioning of application control, and bot

needed to ensure complete and accurate in

processing. If the general control is inadeq

application control is unlikely to function 

and could be overridden.

Because information technology changes r

controls must evolve to remain effective. C

technology and its application to electroni

commerce and expanding Internet applica

change the specific control activities that m

employed and how they are implemented, 

basic requirements of control will not have 

As more powerful computers place more

responsibility for data processing in the ha

end users, the needed controls should be i

and implemented.

Information and

Communications

Information should be recorded and comm

to management and others within the entit

need it and in a form and within a time fram

enables them to carry out their internal con

other responsibilities.

For an entity to run and control its operati

have relevant, reliable, and timely commun

relating to internal as well as external even

Information is needed throughout the agen

achieve all of its objectives.

Page 18 GAO/AIMD-00-
Program managers need both operational 

financial data to determine whether they a

their agencies’ strategic and annual perfor

plans and meeting their goals for accounta

effective and efficient use of resources. Fo

operating information is required for deve

financial reports. This covers a broad rang

from purchases, subsidies, and other trans

data on fixed assets, inventories, and rece

Operating information is also needed to de

whether the agency is achieving its compli

requirements under various laws and regu

Financial information is needed for both e

internal uses. It is required to develop fina

statements for periodic external reporting

day-to-day basis, to make operating decisi

montinor performance, and allocate resou

Pertinent information should be identified

and distributed in a form and time frame t

people to perform their duties efficiently.

Effective communications should occur in 

sense with information flowing down, acro

the organization. In additional to internal

communications, management should ens

are adequate means of communicating wit

obtaining information from, external stake

that may have a significant impact on the a

achieving its goals. Moreover, effective inf

technology management is critical to achie

reliable, and continuous recording and

communication of information.

Page 19 GAO/AIMD-00-
Monitoring

Internal control monitoring should assess th

of performance over time and ensure that th

of audits and other reviews are promptly res

Internal control should generally be design

assure that ongoing monitoring occurs in t

of normal operations. It is performed cont

is ingrained in the agency’s operations. It i

regular management and supervisory activ

comparisons, reconciliations, and other ac

people take in performing their duties.

Separate evaluations of control can also b

focusing directly on the controls’ effective

specific time. The scope and frequency of 

evaluations should depend primarily on th

assessment of risks and the effectiveness o

monitoring procedures. Separate evaluatio

take the form of self-assessments as well a

control design and direct testing of interna

Separate evaluations also may be perform

agency Inspector General or an external a

Deficiencies found during ongoing monito

through separate evaluations should be

communicated to the individual responsib

function and also to at least one level of m

above that individual. Serious matters sho

reported to top management.

Monitoring of internal control should inclu

and procedures for ensuring that the findin

audits and other reviews are promptly reso

Managers are to (1) promptly evaluate find

Page 20 GAO/AIMD-00-
audits and other reviews, including those s

deficiencies and recommendations reporte

auditors and others who evaluate agencies

operations, (2) determine proper actions i

to findings and recommendations from au

reviews, and (3) complete, within establish

frames, all actions that correct or otherwis

the matters brought to management’s atten

resolution process begins when audit or o

results are reported to management, and is 

only after action has been taken that (1) co

identified deficiencies, (2) produces impro

(3) demonstrates the findings and recomm

do not warrant management action.

Page 21 GAO/AIMD-00-
Ordering Information

The first copy of each GAO report and 

is free. Additional copies are $2 each. 

should be sent to the following addres

accompanied by a check or money ord

out to the Superintendent of Documen

necessary. VISA and MasterCard credi

are accepted, also. Orders for 100 or m

copies to be mailed to a single address 

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

or visit:

Room 1100

700 4th St. NW (corner of 4th & G Sts

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling

(202) 512-6000 or by using fax numbe

(202) 512-6061, or TDD (202) 512-253

Each day, GAO issues a list of newly a

reports and testimony. To receive fac

copies of the daily list or any list from 

30 days, please call (202) 512-6000 us

touchtone phone. A recorded menu w

information on how to obtain these lis

For information on how to access GAO 

on the INTERNET, send an e-mail mes

"info" in the body to: info@www.gao.g

or visit GAO’s World Wide Web Home 

http://www.gao.gov
g 

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Postage & F

GAO

Permit No