U.S. ENVIRONMENTAL PROTECTION AGENCY 

OFFICE OF INSPECTOR GENERAL 

Catalyst for Improving the Environment 

Early Warning Report 

EPA Should Use FMFIA to 

Improve Programmatic Operations

 Report No. 09-P-0203 

 August 6, 2009 

GAO 

Standards 

OMB 

Circular 

A-123 

FMFIA 

EPA 

Order 

1000.24 
Report Contributors: Patrick Gilbride 

 Erin Barnes-Weaver 

Karen L. Hamilton 

Bryan Holtrop 

Mary Anne Strasser 

Abbreviations 

EPA U.S. Environmental Protection Agency 

FMFIA Federal Managers’ Financial Integrity Act 

FY Fiscal Year 

GAO Government Accountability Office 

GPRA Government Performance and Results Act 

NPM National Program Manager 

OCFO Office of the Chief Financial Officer 

OIG Office of Inspector General 

OMB Office of Management and Budget 

OPPTS Office of Prevention, Pesticides, and Toxic Substances 

ORD Office of Research and Development 

OSWER Office of Solid Waste and Emergency Response 

PART Program Assessment Rating Tool 

Cover photo:	 Cover of EPA guidance document, Management Integrity at EPA: A 

Manager’s “How To” Guide for Program Reviews: Seeing the Forest and the 

Trees (EPA-205-B-96-001, March 1996), and other management integrity 

guidance. 
U.S. Environmental Protection Agency Report No. 09-P-0203 

August 6, 2009 Office of Inspector General 

At a Glance
 

Catalyst for Improving the Environment 

Why We Did This Review 

We conducted this review to 

determine how the U.S. 

Environmental Protection 

Agency (EPA) develops 

annual guidance under the

Federal Managers’ Financial 

Integrity Act (FMFIA). We 

asked whether EPA offices 

integrate FMFIA internal

control standards into 

programmatic operations. We 

also asked whether offices use 

Government Accountability

Office (GAO) guidance to

develop and monitor internal 

controls. 

Background 

FMFIA requires federal

agency managers to annually 

evaluate and indicate whether 

their agencies’ internal 

controls comply with 

standards prescribed by GAO.

FMFIA requirements purport 

to provide reasonable 

assurance that agencies 

maintain adequate internal

control systems to prevent 

against fraud, waste, abuse,

and mismanagement. 

For further information, 

contact our Office of 

Congressional, Public Affairs 

and Management at 

(202) 566-2391. 

To view the full report, 

click on the following link: 

www.epa.gov/oig/reports/2009/ 

20090806-09-P-0203.pdf 

EPA Should Use FMFIA to 

Improve Programmatic Operations

 What We Found 

EPA has not implemented and used FMFIA to improve program operations, as 

intended by federal and Agency guidance. Although EPA offices rely on annual 

guidance that the Office of the Chief Financial Officer (OCFO) issues, 

•	 EPA offices have not developed internal control review strategies that include 

elements such as the Government Performance and Results Act (GPRA); 

•	 OCFO’s guidance and training have not provided staff and managers with 

adequate awareness of GAO’s internal control standards; 

•	 OCFO’s guidance, until recently, has not required offices to report on 

compliance with all GAO standards; and 

•	 OCFO did not devote needed resources to validate assurance letters. 

Per Agency guidance, OCFO is responsible for ensuring and implementing a 

strategy for validating EPA’s compliance with FMFIA. However, OCFO relies on 

Assistant and Regional Administrators to verify letters’ program elements before 

certifying them. EPA offices view FMFIA reporting as an administrative task, 

rather than an opportunity to assess program results and identify risks toward 

achieving goals. As a result, the Administrator has little assurance when signing 

EPA’s letter that offices reviewed program operations. Additional emphasis on 

FMFIA’s importance could result in more certain, documented assurance in the 

Agency’s Performance and Accountability Report that EPA programs annually 

evaluate internal controls to comply with GAO’s standards and deter fraud, waste, 

and mismanagement. 

What We Recommend 

We recommended that EPA’s Administrator support internal controls by 

announcing the Fiscal Year (FY) 2010 FMFIA process and requiring that senior 

managers attend training. We also recommended that the Chief Financial Officer 

develop comprehensive, tiered FMFIA training for managers and staff; revise the 

internal checklist used as part of the strategy for validating Agency-wide FMFIA 

compliance; codify its validation strategy; and develop FY 2010 FMFIA guidance 

that contains OCFO FY 2009 supplemental guidance. EPA initially agreed with 

all but one of our recommendations. The Agency agreed when we revised that 

recommendation’s language to focus on OCFO’s internal tool to validate letters. 
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D.C. 20460 

OFFICE OF 

INSPECTOR GENERAL 

August 6, 2009 

MEMORANDUM 

SUBJECT:	 EPA Should Use FMFIA to Improve Programmatic Operations 

 Report No. 09-P-0203 

FROM: Melissa M. Heist 

Assistant Inspector General for Audit 

TO: Lisa P. Jackson 

Administrator 

Office of the Administrator 

Maryann Froehlich 

 Acting Chief Financial Officer 

Office of the Chief Financial Officer 

The Office of Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA) 

conducted this report on the subject audit. This report contains findings that describe problems 

we identified and corrective actions we recommend. This report represents our opinion and does 

not necessarily represent the final EPA position. EPA managers will make final determinations 

on matters in this report in accordance with established audit resolution procedures. 

The estimated cost of this report – calculated by multiplying the project’s staff days by the 

applicable daily full cost billing rates in effect at the time – is $212,476. 

Action Required 

In accordance with EPA Manual 2750, EPA’s Audit Management Process, you are required to 

provide a written response to this report within 90 calendar days. You should include a 

corrective actions plan for agreed upon actions, including milestone dates. We have no 

objections to the further release of this report to the public. This report will be available at 

http://www.epa.gov/oig. 

If you or your staff has any questions regarding this report, please contact me at (202) 566-0899 

or heist.melissa@epa.gov, or Patrick Gilbride, Director for Audit, Risk and Program 

Performance Issues, at (303) 312-6969 or gilbride.patrick@epa.gov. 
EPA Should Use FMFIA to Improve Programmatic Operations Report No. 09-P-0203 

Table of Contents 

Purpose .................................................................................................................. 1 

Background ........................................................................................................... 1 

Scope and Methodology....................................................................................... 6 

Findings ................................................................................................................. 7 

Conclusion............................................................................................................. 11 

Recommendations ................................................................................................ 12 

Agency Comments and OIG Evaluation.............................................................. 13 

Status of Recommendations and Potential Monetary Benefits ........................ 14 

Appendices 

A Agency Response to Draft Report................................................................. 15 

B Distribution ...................................................................................................... 19 
Report No. 09-P-0203 

Purpose 

We conducted this review to determine how EPA develops and uses annual 

guidance under the Federal Managers’ Financial Integrity Act (FMFIA). We 

asked whether EPA offices fully integrate internal control standards under FMFIA 

into their programmatic operations. We also asked whether EPA offices use 

available Government Accountability Office (GAO) guidance to develop and 

monitor their internal controls. We found that several EPA offices had not 

demonstrated compliance with GAO’s Standards for Internal Control in the 

Federal Government in Fiscal Year (FY) 2008 assurance letters. While EPA’s 

FY 2009 FMFIA reporting ends in mid-August 2009, we wanted to communicate 

our observations and recommendations to influence the FY 2009 process and 

enhance how the Agency develops FY 2010 guidance. 

Background 

Federal Management Integrity Criteria 

FMFIA requires federal agency managers to establish internal accounting and 

administrative controls in accordance with standards prescribed by the 

Comptroller General (hereafter referred to as “GAO’s Standards”). FMFIA 

requires federal agency managers to annually evaluate and report on the 

effectiveness of internal controls and financial accounting systems in accordance 

with, respectively, Sections 2 and 4 of FMFIA. FMFIA also requires federal 

agency managers to annually evaluate, in accordance with Office of Management 

Budget (OMB) guidelines, whether their agencies’ internal controls comply with 

GAO’s Standards and issue a statement of assurance and indicate full compliance 

or non-compliance. 

OMB Circular A-123, dated December 21, 2004, describes federal managers’ 

responsibilities for internal control, stating that management is responsible for 

establishing and maintaining internal control to achieve the objectives of (1) 

effective and efficient operations, (2) reliable financial reporting, and (3) 

compliance with applicable laws and regulations. Appendix A of the Circular 

requires federal agencies to separately assess effectiveness of internal controls 

over financial reporting. The Circular also states that “Management shall 

consistently apply the internal control standards to meet each of the internal 

control objectives and to assess internal control effectiveness.” OMB Circular A123 provides guidance to federal managers on meeting requirements of FMFIA. 

The Circular states that “Internal control guarantees neither the success of agency 

programs, nor the absence of waste, fraud, and mismanagement, but is a means of 

managing the risk associated with Federal programs and operations.” By 

including “programs and operations,” OMB emphasized goals set by the 

organization, risks agencies face in meeting those goals, whether agencies have 

identified and assessed risks, and whether agencies have taken steps to manage 

those risks. The Circular requires federal managers to take systematic and 

1 
Report No. 09-P-0203 

proactive measures to develop and implement appropriate internal controls for 

results-oriented management. 

The Circular describes the requirements of FMFIA as “an umbrella under which 

other reviews, evaluations, and audits should be coordinated and considered to 

support management’s assertion about the effectiveness of internal control over 

operations, financial reporting, and compliance with laws and regulations.” 

“Other reviews” that FMFIA reporting should coordinate and consider include 

activities under the Government Performance and Results Act (GPRA), such as 

developing strategic plans, setting performance goals and measures, and reporting 

annually on actual performance results compared to goals. These efforts all 

support an overall internal control framework illustrated in Figure 1.1. 

Figure 1.1: EPA’s Internal Control Program – A Visual Overview 

Source: EPA training, EPA Internal Control and Management Integrity: Make It Second Nature, 

issued (via EPA’s Intranet) on May 28, 2008 (slide 11 of 21). 

As required by FMFIA, GAO established the Standards for Internal Control in 

the Federal Government listed in OMB Circular A-123 (see Table 1.1 on the next 

page). 

The Standards provide the overall framework for establishing and maintaining 

internal control, and for identifying and addressing performance and management 

challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. 

The Standards compose a major part of managing an organization, including 

plans, methods, and procedures used to meet missions, goals, and objectives and, 

in doing so, support performance-based management. 

2 
Report No. 09-P-0203 

Table 1.1: GAO’s Standards for Internal Control in the Federal Government 

1. Control 

Environment 

This standard establishes and maintains an environment 

throughout the organization that sets a positive and supporting 

attitude toward internal control and conscientious 

management. This includes establishing goals, objectives, 

and performance measures at the entity and activity level. 

2. Risk 

Assessment 

Once the goals, objectives, and measures have been defined, 

the risks that could impede the efficient and effective 

achievement of those objectives are identified. This includes 

an assessment of the risks the agency faces from both 

internal and external sources. Risk assessment includes 

identifying and analyzing relevant risks associated with 

achieving objectives, such as those defined in strategic and 

annual performance plans developed under GPRA, and form 

a basis for determining how to manage risks. Management 

needs to comprehensively identify risks and should consider 

all significant interactions between the entity and other parties 

as well as internal factors at both the entity-wide and activity 

levels. 

3. Control 

Activities 

These are the policies, procedures, techniques, and 

mechanisms that implement management’s direction toward 

achievement of goals. Internal control activities help ensure 

that management’s directives are carried out. 

4. Information and 

Communications 

This standard includes data and information (performance and 

financial) to determine whether the organization is meeting its 

goals and objectives and maintaining accountability over 

resources. 

5. Monitoring Internal control monitoring should assess the quality of 

performance over time and ensure that findings of audits and 

other reviews are promptly resolved. 

Source: OIG summary of GAO’s Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (November 1999). 

EPA Management Integrity Guidance and Policy 

EPA issued Order 1000.24, Management’s Responsibility for Internal Control, as 

the Agency’s strategy for implementing FMFIA. The Order specifies how EPA: 

•	 Prescribes policies, procedures, and standards for internal controls at 

EPA. 

•	 Outlines Agency senior managers’ roles and responsibilities for 

developing, implementing, assessing, documenting, improving, and 

reporting on internal controls. 

•	 Incorporates specific requirements for assessing internal controls over 

financial reporting. 

•	 Provides tools to help managers monitor both overall program 

progress and the effectiveness of day-to-day operations (e.g., EPA 

Management Integrity Principles1

). 

1

 EPA first developed its Management Integrity Principles in 1996. The 10 Principles are (1) guidance, (2) 

accountability, (3) feedback, (4) competency, (5) quality data, (6) separation, (7) comparison, (8) identification, 

3 
Report No. 09-P-0203 

EPA Order 1000.24 requires the Administrator to foster an environment that 

supports awareness and compliance with internal controls. EPA’s Order also 

requires Assistant and Regional Administrators to develop systematic review 

strategies and advises them to use GAO’s Standards as the basis for determining 

the effectiveness of internal controls. The Order also requires senior managers to 

annually evaluate whether their programs’ internal controls effectively meet 

GAO’s Standards and attest to the soundness of internal controls for their 

respective organizations. Per EPA’s Order, senior managers annually issue 

assurance letters to the Administrator that report results of evaluations and their 

programs’ compliance status with GAO’s Standards. The Order requires that 

systematic review strategies are consistent and coordinate with Agency-wide 

processes used to develop and report on program performance measures and 

results, such as GPRA and reviews under OMB’s Program Assessment Rating 

Tool (PART). For example, EPA’s Office of the Chief Financial Officer (OCFO) 

annually issues National Program Manager (NPM) guidance to promote 

consistency, describe priorities and strategies, and report on performance 

commitments in order to strengthen planning and accountability processes and 

better align measures. 

The Order further designates senior managers (e.g., Deputy Administrator, 

Assistant, and Regional Administrators) to implement internal control 

frameworks and assure continual progress to strengthen internal controls 

(reported annually in EPA’s Performance and Accountability Report). The 

Order also requires senior managers to designate a Management Integrity 

Advisor who serves as the organization’s staff contact responsible for 

disseminating pertinent information regarding the Agency’s management 

integrity program. The Order outlines specific responsibilities for OCFO listed 

in Table 1.2 (on the next page). 

(9) review, and (10) correction. EPA advocates that managers incorporate the Principles into existing management 

processes, program strategies, and guidance to strengthen program operations. 

4 
Report No. 09-P-0203 

Table 1.2: OCFO Responsibilities per EPA Order 1000.24 

Chief Financial Officer 

• Develop and administer EPA’s guidance to ensure compliance with FMFIA 

and OMB Circular A-123; 

• Ensure that the Agency implements FMFIA and OMB Circular A-123 at 

appropriate organizational levels; and 

• Provide annual management integrity/A-123 guidance to the Agency. 

Office of Planning, Analysis, and Accountability 

• Plan, develop, and implement national policies for ensuring EPA’s 

compliance with FMFIA; 

• Develop and implement a strategy for validating Agency-wide compliance 

with FMFIA; 

• Develop the form and content of the Administrator’s annual statement of 

assurance on management controls based on recommendations and 

annual assurance letters from senior managers/senior assessment team; 

• Maintain technical expertise in the field of internal controls; 

• Provide technical assistance to program managers and staff; and 

• Provide supplemental guidance and training materials as needed to support 

senior managers in interpreting and applying EPA Order 1000.24. 

Source: EPA Order 1000.24 “Management’s Responsibility for Internal Control” (July 18, 

2008). 

OCFO issues annual guidance to program and regional offices on complying with 

FMFIA, and for FYs 2008 and 2009, OCFO’s guidance included a reporting 

template with specific instructions for completing each section of assurance 

letters. For example, in FYs 2008 and 2009, OCFO’s annual guidance included 

seven specific elements program and regional offices needed to address in 

assurance letters under the Control Environment standard.2 OCFO’s guidance 

also listed significant financial processes to review, such as accounts receivable, 

grants, procurement, accounts payable, and payroll, as well as core administrative 

areas (e.g. purchase card, property management, funds control). OCFO also 

attached the Internal Control Evaluation Checklist, an abbreviated version of 

GAO’s full Internal Control Management and Evaluation Tool that Assistant and 

Regional Administrators could use to evaluate their internal controls. The FY 

2009 guidance required offices to complete the Checklist and retain a copy as 

supporting documentation. The FY 2009 guidance also provided references to 

obtain full text of GAO’s Standards and EPA’s Order. Program and regional 

office assurance letters provide the basis for the Agency’s annual assurance 

statement. The Agency’s Performance and Accountability Reports due to the 

President and Congress each year describe progress made to strengthen internal 

controls. 

2

 OCFO identified the following seven “control environment” elements for which offices needed to report in 

assurance letters: (1) integrity and ethical values, (2) commitment to competence, (3) management’s philosophy and 

operating style, (4) organizational structure, (5) assignment of authority and responsibility, (6) human resource 

policies and practices, and (7) oversight groups. OCFO said it drew these elements from GAO’s Standards and 

focused on them due to past questions from Agency offices on the control environment. 

5 
Report No. 09-P-0203 

Scope and Methodology 

We conducted our review, in accordance with Government Auditing Standards, 

from January to May 2009.3 Government Auditing Standards require that we plan 

and perform the review to provide a reasonable basis for our findings and 

conclusions, and we believe the evidence we obtained meets that standard based 

upon our review objectives. Our review findings only address EPA’s 

implementation of Section 2 of FMFIA (internal control over programs), and not 

Section 4 (financial accounting systems) or Appendix A of OMB Circular A-123 

(internal control over financial reporting). While evaluating how EPA’s Office of 

Research and Development (ORD) implements FMFIA,4

 we identified issues 

related to OCFO’s Agency-wide management integrity guidance. We reviewed 

OCFO’s FY 2009 FMFIA guidance issued on December 22, 2008. Following 

OCFO’s issuance of FY 2009 guidance, we participated in meetings that OCFO 

held on the Agency’s FY 2009 FMFIA reporting process, and spoke with OCFO 

about enhancing its reporting template. We provided written comments to OCFO 

on January 30, 2009, suggesting that they revise the FY 2009 FMFIA guidance 

reporting template. We also reviewed FY 2008 assurance letters from three 

program5

 and four regional6 offices, and interviewed the Management Integrity 

Advisors in each office on their awareness and understanding of internal controls 

and examples of internal control compliance in assurance letters. The 

size/resource budget of program and regional offices we reviewed include some 

of the largest dollar and full-time equivalent components of the Agency, and 

OCFO recommended three of the seven offices as examples of good FMFIA 

processes/assurance letters.7 

Recently, the Office of Inspector General (OIG) issued a memorandum 

recommending ways to strengthen management integrity processes affecting 

specific activities under the American Recovery and Reinvestment Act of 2009,8 

whereas this report addresses EPA’s FMFIA reporting process generally. We 

issue this early warning report to bring to the Agency’s attention findings that 

could impact FMFIA reporting by EPA offices in FY 2009 (reports due to the 

Administrator by August 14, 2009) and to influence development of FY 2010 

guidance. 

3

 Related facts and observations arose during our current review of ORD’s FMFIA implementation.
 4

 We anticipate issuing our final report on ORD’s FMFIA implementation in the fall of 2009.
 5 We reviewed fiscal 2008 FMFIA assurance letters from EPA’s ORD, Office of Solid Waste and Emergency 

Response (OSWER), and Office of Prevention, Pesticides, and Toxic Substances (OPPTS). 6 We reviewed fiscal 2008 FMFIA assurance letters from EPA Regions 1, 2, 5, and 9. 

7

 OCFO recommended that we review assurance letters from OSWER, OPPTS, and Region 5. 8

 US EPA OIG Special Report, Recommendation to Strengthen Management Integrity Processes Affecting Recovery 

Act Activities, Report No. 09-X-0145, April 27, 2009. 

6 
Report No. 09-P-0203 

Findings 

EPA Offices Have Not Developed Systematic Internal Control Review 

Strategies 

Based on our review of FY 2008 assurance letters, all seven EPA offices we 

examined had not developed strategies that systematically and annually assess the 

effectiveness and compliance of their programmatic internal controls with GAO’s 

Standards. Our review found that strategies did not address whether offices 

established and evaluated internal controls over their programs in accordance with 

GAO’s Standards. In addition, strategies did not address implementation of other 

statutory requirements such as GPRA or annual performance plans and 

performance measures associated with NPM Guidance. For example, 2008 NPM 

Guidance for OSWER identified six priority areas under its remedial program; 

however neither the OSWER nor regional assurance letters we reviewed 

addressed these priority areas or measures. Similarly, NPM Guidance for EPA’s 

clean air program identified priority areas specifically for the Agency’s regional 

offices, such as reducing diesel emissions; however, no regional letter we 

reviewed mentioned risks or accomplishments related to that goal. We found that 

strategies did not use GAO’s Standards and did not consider program 

performance information such as GPRA measures. Further, most Advisors 

described FMFIA as primarily addressing administrative and financial elements 

(as opposed to program performance), and all Advisors acknowledged that their 

offices had not conducted risk or vulnerability assessments to identify needed 

controls. OCFO recently issued a document to explain roles and responsibilities 

between Advisors and lead region program staff. OCFO believes its document 

will allow regions an opportunity to provide a consolidated regional perspective 

to the appropriate NPM on current weaknesses or other emerging issues. 

EPA Order 1000.24 requires that Assistant and Regional Administrators develop 

and implement strategies to show how they will evaluate their internal controls 

and the information they will use to report how they comply with FMFIA in their 

annual assurance letters. The Order states that program managers have flexibility 

in designing review strategies and directs them to use all credible sources of 

information to assess effectiveness of internal controls. Information sources 

specified by the Order include OIG and GAO audits, program evaluations, PART 

or other similar reviews, and knowledge gained from daily operations. The Order 

also notes that, in addition to FMFIA, managers should consider “other statutory 

requirements” (such as GPRA) as part of the Agency’s system of internal 

controls, and that “processes, plans, policies, procedures, and performance 

measures help organizations achieve results.” The Order further states that 

Assistant and Regional Administrators should conduct their own reviews to 

ensure they have the information necessary to make their evaluations (including a 

plan to validate whether they achieved desired results). Further, OCFO’s FY 

2008 FMFIA guidance required that Assistant and Regional Administrators 

provide a detailed description of their review strategies for assessing how well 

7 
Report No. 09-P-0203 

internal controls over their programs perform, may be improved, and the degree to 

which they identify and address significant vulnerabilities. Results of these 

systematic review strategies provide the basis for annual assurance letters upon 

which the Administrator relies to assess the Agency’s overall compliance with 

FMFIA. 

Agency Staff and Managers Need Additional Internal Control Training 

Advisors we interviewed had a range of training experience on FMFIA 

requirements. The majority of Advisors (four of seven) we interviewed believed 

they could benefit from additional training, especially on internal control 

standards and programmatic reviews.9

 One senior manager suggested that OCFO 

consider tiered training for senior managers and Advisors that emphasizes, 

respectively, requirements per EPA Order 1000.24 and “nuts and bolts” of 

implementing and reporting (such as required administrative reviews, reporting 

elements, and milestone dates). Advisors suggested other elements, including 

training on: 

•	 Conducting internal control reviews for program staff (not just 

financial staff), and 

•	 Making OCFO’s checklist useful for senior managers, perhaps by 

including specific programmatic examples. 

EPA Order 1000.24 requires OCFO’s Office of Planning, Analysis, and 

Accountability to provide technical assistance and training to support program 

managers and staff. In FY 2008, OCFO offered a discretionary online training 

course, moderated by the Deputy Administrator, to briefly introduce internal 

control responsibilities. In 2008, in collaboration with OIG staff, OCFO offered 

staff-level training for Management Integrity Advisors that outlined basic steps 

for conducting a program review and provided tools and examples of how to 

document results of reviews. In response to requests for technical assistance, 

OCFO staff conducted individual management integrity briefings for senior 

managers in two offices.10 Additionally, OCFO holds one to two “kick-off” 

meetings or teleconferences with Management Integrity Advisors and senior 

managers upon issuing the annual guidance/template, which both OCFO and 

Advisors view as training on FMFIA requirements. 

OCFO agrees on the need for more in-depth training on assessing risk, developing 

program review strategies based on GAO’s Standards, and reporting on how key 

activities fit together and expects to develop a strategy for comprehensive, tiered 

training by the end of FY 2009. 

9

 During our interviews, we had to define and describe GAO’s Standards to most Advisors. Most Advisors were 

also not familiar with EPA’s 1996 guidance document that listed the Agency’s ten management integrity principles. 

10 OCFO said it briefed managers in OSWER and the Administrator’s Office. 

8 
Report No. 09-P-0203 

OCFO Recently Strengthened Its FMFIA Guidance to Better Align 

with EPA Order 1000.24 

In FY 2008 OCFO revised its guidance from previous years to require that 

Agency senior managers evaluate their program’s internal controls in accordance 

with GAO’s five standards. As an attachment to the guidance, OCFO included an 

assurance letter template that provided “specific instructions” for reporting results 

of internal control evaluations. However, the template only required reporting on 

one of the five GAO Standards, “control environment.” OCFO explained that it 

outlined this standard in detail because Advisors and others expressed the greatest 

confusion over what to include in a discussion of “control environment.” OCFO 

believes its guidance implicitly requires program and regional offices to apply 

GAO’s Standards and that, by following OCFO’s guidance, offices will in effect 

address all five standards. OCFO staff said it was not their responsibility to 

dictate to program and regional offices what to include in their program review 

strategy or how to conduct their assessments. However, OCFO agreed that its 

responsibility includes providing direction on steps in the FMFIA reporting 

process, and OCFO’s annual guidance and template specifies the reporting format 

EPA offices must follow. OCFO acknowledges that most offices follow their 

template. Management Integrity Advisors we interviewed said OCFO’s guidance 

provides administrative processes for completing assurance letters, and all 

Advisors stated they followed OCFO’s guidance/template. During our 

interviews, we found that half of the Advisors were not familiar with GAO’s 

Standards. Despite this, all Advisors we interviewed believed their offices’ 

assurance letters addressed all five standards, but could not provide examples as 

to how letters addressed the Standards. All but one assurance letter we reviewed 

did not comprehensively address the seven “control environment” elements 

specified in Agency FMFIA guidance.11 All assurance letters we reviewed did 

not indicate that offices had conducted “risk assessment” on vulnerabilities 

toward meeting program goals, and did not assess and report on performance 

measures (a “control activity”). 

In its FY 2009 FMFIA guidance issued on December 22, 2008, OCFO maintained 

the same template from FY 2008 guidance requiring that assurance letters address 

only the “control environment” standard, but not the other four GAO Standards. 

We met with OCFO in January 2009 on ways to enhance the FY 2009 template to 

address all standards and documented our suggestions in a memorandum to the 

Acting Chief Financial Officer.12 We undertook our review of seven offices’ FY 

2008 assurance letters to find further support for our suggestions to OCFO. Our 

ongoing communications with OCFO,13 coupled with newly developed 

management integrity processes affecting specific activities under the American 

11 Region 9’s fiscal 2008 assurance letter provided a detailed description of activities related to all seven control 

environment elements. 

12 Melissa Heist, OIG’s Assistant Inspector General for Audit, issued the memorandum to Maryann Froehlich,
 

EPA’s Acting Chief Financial Officer, on January 30, 2009. 

13 We briefed OCFO on our letter review results on April 14, 2009, and in a draft report issued on May 5, 2009. 

9 
Report No. 09-P-0203 

Recovery and Reinvestment Act of 2009, resulted in OCFO’s decision to issue 

supplemental FY 2009 FMFIA guidance. We reviewed OCFO’s draft 

supplemental guidance and suggested specific text – including programmatic 

examples – for OCFO to provide in its guidance. OCFO’s supplemental FY 2009 

FMFIA guidance, issued on May 19, 2009, included our suggestions. OCFO’s 

supplemental guidance: 

•	 Revised language for the general statement of assurance that all 

Assistant and Regional Administrators must include in assurance 

letters to more clearly address whether they assessed internal controls 

and comply with GAO’s Standards; 

•	 Defined all five GAO Standards; and 

•	 Provided examples of programmatic activities related to each GAO 

Standard. 

OCFO Has Not Validated Annual Assurance Letters 

OCFO said its validation strategy does not include validating the content and 

accuracy of offices’ assurance letters. OCFO assumes offices take seriously 

statements in assurance letters asserting compliance, and noted that accountable 

officials – Assistant and Regional Administrators – should verify assurance letter 

content to make compliance determinations. Management integrity staff in 

OCFO’s Office of Planning, Analysis, and Accountability said they assume that if 

an office conducted a review and indicated no material weaknesses, then that 

office did what it was supposed to do. OCFO does not ask offices to show that 

everything is fine. 

EPA Order 1000.24 requires OCFO to develop and implement a strategy for 

validating Agency-wide compliance with FMFIA and OMB Circular A-123. To 

date, OCFO has not compiled a written strategy but said it will to include 

activities such as annual guidance, kick-off meeting and update meetings, and 

ongoing communication with Advisors – all of which we view as providing 

guidance and advising up-front as opposed to validating end results. Management 

Integrity Advisors we interviewed expect OCFO to communicate any problems 

with their offices’ assurance letters. Advisors assumed their FY 2008 assurance 

letters met reporting requirements since OCFO accepted letters without comment. 

OCFO told us that when it receives assurance letters from program and regional 

offices, OCFO reviews them primarily for completeness against guidance and to 

identify current and new material weaknesses, management challenges, and 

emerging issues that warrant the Administrator’s attention. OCFO uses an 

internal checklist to ensure that offices’ letters addressed template headings and 

other requirements from OCFO’s annual guidance. OCFO acknowledged that it 

does not review assurance letters to verify that offices reported all internal and 

external reviews, results of those reviews related to programmatic controls, or 

whether offices addressed all elements in the checklist excerpted from GAO’s 

10 
Report No. 09-P-0203 

tool. To date, OCFO has limited resources to oversee annual FMFIA reporting on 

programmatic elements,14 and OCFO considers its staffing levels adequate. 

OCFO acknowledged, however, that financial reporting has received emphasis 

over the past few years given extensive reporting requirements in that area in 

OCFO’s annual guidance (e.g. accounts receivable, grants, procurement and 

accounts payable, payroll, purchase card, property management, funds control). 

OCFO’s staff person responsible for management integrity said focus swung too 

far in the direction of financial reviews, thus missing programmatic elements.15 

When we asked whether OCFO intended to review fiscal 2009 assurance letters 

against GAO’s Standards, OCFO responded, “Only in that we have asked offices 

to comply with the checklist.” OCFO has not required offices to provide copies 

of completed checklists; rather offices will retain them for their records. We 

found that for FY 2008 letters we reviewed, offices did not use or complete the 

checklist. This year, OCFO has planned a new program compliance review to 

identify major problem areas and “work with a contractor on where weaknesses 

are in the FMFIA implementation process” at selected Headquarters and regional 

offices to correct the Agency’s management integrity approach in FY 2010. 

OCFO’s review will identify areas where OCFO should strengthen its guidance, 

and gather specific input for developing training plans. We believe OCFO could 

use program compliance review results to also revise its validation strategy to 

include, at a minimum, how EPA offices meet each of the five GAO Standards 

and annually evaluate internal controls established under GAO’s Standards. 

Program compliance reviews could also determine the extent to which offices 

incorporate GPRA measures and NPM Guidance elements into their FMFIA 

reporting and internal control structure. Additionally, OCFO should describe 

components of its validation strategy in FY 2010 guidance to make clear to EPA 

offices what OCFO uses to review assurance letters. 

Conclusion 

Because OCFO did not require – and program and regional offices did not 

evaluate and report on – compliance with GAO’s Standards in FY 2008, EPA 

risked not fully complying with FMFIA. These actions gave the Administrator no 

documented basis upon which to make a compliance determination when signing 

the Agency’s FY 2008 letter. Assistant and Regional Administrators issue 

14 OCFO said it relies on a “team” to focus on the programmatic aspect; however we found that OCFO relies upon 

one project lead in its Office of Planning, Analysis, and Accountability. OCFO said other groups help review 

financial/administrative elements, such as financial reporting and oversight on grants and contracts. 15 OCFO staff said focus shifted shortly after Congress enacted the Sarbanes-Oxley Act on July 30, 2002. The 

legislation set new or enhanced standards for all U.S. public company boards, management and public accounting 

firms and addressed issues relating to (1) auditor independence, (2) corporate responsibility, (3) enhanced financial 

disclosures, and (4) accountability and certifying financial results. OMB revised Circular A-123 on December 21, 

2004, in light of new internal control requirements for publicly-traded companies contained in the Sarbanes-Oxley 

Act of 2002. Then Comptroller Linda Springer said in a memorandum, “The policy changes in this circular are 

intended to strengthen the requirements for conducting management’s assessment of internal control over financial 

reporting.” 

11 
Report No. 09-P-0203 

assurance letters to the Administrator without utilizing strategies that provide a 

sound, documented basis for reasonably assuring that their programs implement 

effective internal controls consistent with EPA Order 1000.24 and comply with 

GAO’s Standards. The Agency’s OCFO-driven FMFIA process has emphasized 

administrative and financial reporting over programmatic performance and – until 

recently – has not integrated other relevant Agency-wide processes such as annual 

performance plans, measures, and results to evaluate internal controls. OCFO’s 

recent emphasis on all five GAO internal control standards, as well as increased 

awareness through training, could help EPA offices improve certifications to the 

Administrator that they have effective and efficient program operations. 

Recommendations 

We recommend that the Chief Financial Officer: 

1.	 Develop a training course on FMFIA that provides (a) senior managers 

with an overall understanding on internal controls and their 

responsibilities in EPA Order 1000.24, and (b) Management Integrity 

Advisors with details on implementing and reporting. 

2.	 Develop fiscal 2010 FMFIA guidance and a reporting template that 

requires reporting all five GAO Standards to ensure consistency with 

OMB Circular A-123 and EPA Order 1000.24. Incorporate language 

in supplemental FMFIA guidance issued on May 19, 2009, into fiscal 

2010 guidance. 

3.	 Revise the internal checklist that OCFO uses as part of its strategy for 

validating Agency-wide FMFIA compliance to confirm that EPA 

offices addressed each of the five GAO standards in evaluating their 

internal controls and identifying weaknesses. Describe, in its annual 

Agency guidance, OCFO's strategy for assessing offices' assurance 

letters for compliance. 

We also recommend that the Administrator foster an environment that supports 

internal control by: 

4. Announcing the FY 2010 FMFIA process that describes the 

significance of annual FMFIA reporting and certification that 

programs comply with GAO’s Standards. 

5. Requiring all Senior Executive Service members, GS-15 managers, 

and Management Integrity Advisors to attend OCFO’s initial FMFIA 

training course and annual updates. 

12 
Report No. 09-P-0203 

Agency Comments and OIG Evaluation 

The Agency agreed with our draft report findings and concurred with our 

recommendations for strengthening EPA’s FMFIA implementation. Initially 

OCFO disagreed with our third recommendation previously worded, “Determine 

staffing levels needed to implement requirements in EPA Order 1000.24 and 

invest adequate resources to validate annual assurance letters against 

administrative, financial, and programmatic review elements.” OCFO said it 

relies on Assistant and Regional Administrators’ signed personal statements of 

assurance as the cornerstone of OCFO’s validation strategy and as the primary 

form of validating compliance with GAO internal control standards. We met with 

OCFO to clarify that our recommendation did not imply that EPA Order 1000.24 

required OCFO to independently test the content of EPA offices’ assurance 

letters; a mandate which OCFO said would require detailed programmatic 

knowledge, technical expertise, and substantial resources. We agree that OCFO 

lacks the technical expertise and resources necessary to perform in-depth reviews 

of letter contents. However, we believe “validating” includes OCFO’s assurance 

that offices applied all relevant information – consistent with our report findings – 

to support signed assurance statements. As such, we discussed with OCFO how 

its validation strategy should address how OCFO assesses how each EPA office 

met – and annually evaluated internal controls established under – each of GAO’s 

five standards. We revised our recommendation wording to reflect our 

discussions and consensus with OCFO. OCFO agreed and said it plans to revise 

the internal checklist it uses to validate assurance letters to include GAO’s five 

standards. OCFO believes it has adequate resources to revise and apply this 

validation strategy. OCFO also believes EPA offices are equipped to address 

expanded requirements (i.e. all five GAO standards) under the planned FY 2010 

FMFIA process. Further, OCFO indicated that its validation strategy is unwritten 

but includes: (1) signed assurance statements, (2) annual guidance, (3) regular 

meetings, (4) training and technical assistance, (5) internal checklist against which 

to review assurance letters, and (6) program compliance reviews. We suggested – 

and OCFO agreed – that it should codify this validation strategy in annual 

guidance to make clear to EPA offices how OCFO validates Agency-wide 

FMFIA compliance. Appendix A includes EPA’s full response. 

13 
Report No. 09-P-0203 

Status of Recommendations and 

Potential Monetary Benefits 

POTENTIAL MONETARY 

RECOMMENDATIONS BENEFITS (in $000s) 

Rec. 

No. 

1 

2 

3 

4 

5 

Page 

No.

12 

12 

12 

12 

12 

 Subject 

Develop a training course on FMFIA. 

Develop FY 2010 FMFIA guidance and a reporting 

template that requires reporting all five GAO 

Standards to ensure consistency with OMB 

Circular A-123 and EPA Order 1000.24. 

Incorporate language in supplemental FMFIA 

guidance issued on May 19, 2009, into FY 2010 

guidance. 

Revise the internal checklist that OCFO uses as 

part of its strategy for validating Agency-wide 

FMFIA compliance to confirm that EPA offices 

addressed each of the five GAO standards in 

evaluating their internal controls and identifying 

weaknesses. Describe, in its annual Agency 

guidance, OCFO's strategy for assessing offices' 

assurance letters for compliance. 

Announce the FY 2010 FMFIA process that 

describes the significance of annual FMFIA 

reporting and certification that programs comply 

with GAO Standards. 

Require that all Senior Executive Service 

members, GS-15 managers, and Management 

Integrity Advisors attend OCFO’s initial FMFIA 

training course and annual updates. 

Status1 

O 

O 

O 

O 

O 

Action Official 

Chief Financial Officer 

Chief Financial Officer 

Chief Financial Officer 

Administrator 

Administrator 

Planned 

Completion 

Date 

Claimed 

Amount 

Agreed To 

Amount 

1 O = recommendation is open with agreed-to corrective actions pending 

C = recommendation is closed with all agreed-to actions completed 

U = recommendation is undecided with resolution efforts in progress 

14 
Report No. 09-P-0203 

Appendix A 

Agency Response to Draft Report 

July 16, 2009 

MEMORANDUM 

SUBJECT: OCFO Response to Draft Audit Report: EPA Should Use FMFIA to Improve 

 Programmatic Operations (Project No. 08-FY08-0323) 

FROM: Maryann Froehlich /signed by/ Joshua Baylson

 Acting Chief Financial Officer 

TO: Melissa M. Heist 

Assistant Inspector General for Audit 

This memorandum responds to the Office of Inspector General (OIG) draft audit report, 

EPA Should Use FMFIA to Improve Programmatic Operations (Project No. 08-FY08-0323), 

dated June 22, 2009. 

The Office of the Chief Financial Officer (OCFO) appreciates your consideration of the 

comments and suggestions we offered on the discussion draft report, EPA Federal Managers’ 

Financial Integrity Act (FMFIA) Process Improvements, and the resulting modifications 

reflected in this draft report. We are now responding to you on behalf of both OCFO and the 

Office of the Administrator (OA), as your report was issued to both offices. We have worked 

closely with OA to prepare the following consolidated response, which represents the views of 

both offices. 

In general, OA and OCFO agree with the findings presented in the draft report and 

support the majority of OIG’s recommendations for strengthening EPA’s FMFIA 

implementation. We will be working together to implement recommendations for the 

Administrator to continue emphasizing to senior managers the importance of FMFIA and of 

sound internal controls. We do, however, remain concerned about Recommendation 3—that 

OCFO “invest adequate resources to validate annual assurance letters against administrative, 

financial, and programmatic review elements.” We continue to work closely with program and 

regional offices to strengthen their implementation of FMFIA and ensure a sound basis for their 

letters of assurance to the Administrator, which provide the foundation for the Administrator’s 

overall statement of assurance. We believe that OCFO is fulfilling its responsibility, outlined in 

EPA Order 1000.24, to implement a strategy for validating Agency-wide compliance with the 

Integrity Act. 

Please find attached our responses to each of the recommendations contained in the draft 

report. As we have agreed with Patrick Gilbride (via a July 1, 2009 email exchange), we will 

provide planned completion dates for all recommendations once OIG has issued its final report. 

15 
Report No. 09-P-0203 

In addition, I have attached a copy of the draft report that we have annotated with a few specific 

comments and suggestions. If you would like to discuss these attachments further, please have 

your staff contact Debbie Rutherford (202-564-1913) or Annette Morant (202-564-3671) in 

OCFO’s Office of Planning, Analysis, and Accountability. 

We appreciate your sharing these findings and recommendations with OCFO and OA, 

and we look forward to working with you to strengthen the Agency’s management integrity 

program. 

Attachments 

cc: Scott Fulton 

 Ray Spears 

 Josh Baylson 

 Rita Smith 

 Stefan Silzer 

 Patrick Gilbride 

 Erin Barnes-Weaver 

OCFO and OA Response to 

OIG Draft Report Recommendations: 

EPA Should Use FMFIA to Improve Programmatic Operations 

Project No. OA-FY08-0323 

June 22, 2009
 

1.	 Develop a training course on FMFIA that provides (a) senior managers with an overall 

understanding on internal controls and their responsibilities in EPA Order 1000.24, and (b) 

Management Integrity Advisors with details on implementing and reporting. 

Concur. OCFO agrees that further training is needed at both senior manager and 

Management Integrity Advisor (MIA) levels. At a June meeting of Assistant Regional 

Administrators, Office of Planning, Analysis, and Accountability (OPAA) staff led a brief 

discussion to help identify training needs and potential approaches and mechanisms. We 

continue to consult with MIAs to determine their training and information needs. In addition, 

beginning in late July/early August, OCFO will be conducting contractor-supported Program 

Compliance Reviews in several selected regional and program offices. Preliminary surveys 

and the on-site reviews will help to diagnose training needs and inform development of 

training tools and materials. (OCFO expects the on-site reviews also to provide some “on the 

spot” training/assistance to MIAs in participating offices.) In addition, OCFO is dedicating 

contract resources to a more comprehensive training effort, and we will be working with 

training experts to explore vehicles/mechanisms for delivering the training. We expect to 

complete development of an Agency-wide strategy for comprehensive, tiered FMFIA 

training by the end of fiscal year 2009. 

16 
Report No. 09-P-0203 

2.	 Develop fiscal 2010 FMFIA guidance and a reporting template that requires reporting all five 

GAO standards to ensure consistency with OMB Circular A-123 and EPA Order 1000.24. 

Incorporate language in supplemental FMFIA guidance issued on May 19, 2009, into fiscal 

2010 guidance. 

Concur. OCFO agrees on the need to revise our guidance and assurance letter template so 

that assurance letters clearly address all five GAO standards. The Acting CFO’s February 

19, 2009 memo to the Assistant Inspector General for Audit makes this commitment for FY 

2010. In developing FY 2010 guidance, we will incorporate elements of the FY 2009 

supplemental guidance issued on May 19, including an emphasis on the need for all 

programs to comply with the five GAO standards for internal control and the revised 

Assistant Administrator (AA) and Regional Administrator (RA) assurance statement 

certifying compliance with the GAO standards. 

3.	 Determine staffing levels needed to implement requirements in EPA Order 1000.24 and 

invest adequate resources to validate annual assurance letters against administrative, 

financial, and programmatic review elements. 

Disagree. EPA holds AAs and RAs accountable for their integrity programs and internal 

controls. OCFO relies on AAs’ and RAs’ signed personal statements of assurance as the 

primary form of validation of compliance with GAO standards for internal control. These 

signed statements testify to the soundness of the internal controls established to protect EPA 

programs from fraud, waste, and abuse. EPA Order 1000.24 requires that OPAA “develop 

and implement a strategy for validating Agency-wide compliance with FMFIA.” The signed 

letters of assurance to the Administrator are the cornerstone of this strategy. OPAA staff use 

a checklist to review annual assurance letters for completeness, ensuring that AAs and RAs 

have adequately addressed all elements set out in annual guidance, as well as to identify 

potential weaknesses or areas of concern for the Administrator’s attention. OPAA’s strategy 

for fostering compliance with FMFIA also includes issuing annual guidance, conducting 

regular meetings with senior managers to review roles and responsibilities, and providing 

training and technical assistance to Agency staff and managers. 

OCFO believes EPA Order 1000.24 was never intended to require that OCFO independently 

validate the content of each of 13 program office and 10 regional office assurance letters, a 

mandate which would require wide-ranging, detailed programmatic knowledge and technical 

expertise as well as substantial resources. OCFO does not agree that the responsibility for 

developing and implementing a strategy to validate the Agency’s compliance with FMFIA 

requires OCFO to “verify that offices reported all internal and external reviews” and the 

“results of those reviews related to programmatic controls” (p. 10). However, OPAA staff do 

carefully review letters to ensure that “offices addressed all elements in the checklist OCFO 

provided along with its’ FY 2008 and 2009 guidance (p. 10),” and we rely on AAs’ and RAs’ 

statements of assurance that they have reviewed internal controls in compliance with GAO 

standards. 

OIG’s statement that “OCFO has one project lead—supported by additional staff—to oversee 

EPA’s management integrity program, including extensive administrative and financial 

reporting activities” is misleading. In fact, OCFO relies on a team within OPAA to focus on 

17 
Report No. 09-P-0203 

the overall Agency FMFIA implementation process and, in particular, the programmatic 

aspect, and a team within its Office of Financial Management to focus on Agency-wide 

financial activities, including controls over financial reporting. In addition, in reviewing 

assurance letters, OCFO collaborates with appropriate program offices, such as the Office of 

Administration and Resource Management and the Office of Environmental Information, to 

assess such components of assurance letters as discussion of grants and contracts, human 

capital, or data quality/information reporting systems. 

OCFO does, however, acknowledge the need to strengthen compliance with FMFIA and 

improve monitoring. Beginning in late July/early August 2009, OPAA will be initiating a 

series of Program Compliance Reviews in selected headquarters and regional offices. To 

augment OPAA efforts, contractor staff with expertise in FMFIA and internal controls will 

conduct on-site visits to assess offices’ documentation for their assurance letters and assist 

them in improving their FY 2010 FMFIA process. These activities will support efforts to 

ensure that assurance letters adequately reflect and validate Agency-wide compliance with 

FMFIA. 

4.	 Announcing the FY 2010 FMFIA process that describes the significance of annual FMFIA 

reporting and certification that programs comply with GAO’s Standards. 

Concur. OCFO will work with the Office of the Administrator to develop an announcement 

or other communication from the Administrator to help launch the FY 2010 FMFIA process. 

The Administrator’s message will stress the importance of the integrity process and of AAs’ 

and RAs’ assurance statements certifying compliance with GAO standards. 

5.	 Requiring all Senior Executive Service members, GS-15 managers, and Management 

Integrity Advisors to attend OCFO’s initial FMFIA training course and annual updates. 

Concur. OCFO will work with OA to incorporate such a direction from the Administrator as 

part of its strategy for tiered, Agency-wide FMFIA training. 

18 
Report No. 09-P-0203 

Appendix B 

Distribution 

Office of the Administrator 

Agency Follow-up Official (the CFO) 

Agency Follow-up Coordinator 

Acting General Counsel 

Associate Administrator for Congressional and Intergovernmental Relations 

Associate Administrator for Public Affairs 

Audit Follow-up Coordinator, Office of the Administrator 

Audit Follow-up Coordinator, Office of the Chief Financial Officer 

Acting Inspector General 

19