I11Il11111 Il11 114276 11111 11111 11111 1111 I111 

- 

Executive Reporting 

On Internal Controls 

In Government 

i xu& K* - 

I 

rPrepared For The General Accounting Office 

By A Task Force Of The Association Of i Government Accountants7 

1 i /c' - .\ 8 /-z/J5? //I cf276 /U I --- 

I b 057 

I 
COMPTROLLER GENERAL OF THE UNITED STATES 

WASHINGTON n c. zow 

The Accounting and Aw3ith-q Act of 1950 requires the heads of 

the executive agencies to establish and maintain effective internal 

accomting ard administrative control systems. 

the General muntirq Office (6AI)) to apprcnre the agencies' accmun+q 

systems and GAD has regularly advised agencies that their systems vvlll 

mt be apKaved unless they have effective internal mtrols. 

fied by a recent bill, entitled the "Financial Integrity Prt of 1980," 

which was proposed before the Congress. 

quire orgoing evaluations and reprts on internal control systans of each 

executive agency. 

axtrol systems, the Association of wernnent kcountants (-1 established a task force to help provide guidance and assistance to ccplgressional 'camittees anl Federal agencies in developing &amlards and pracedures for executive agencies to evaluate and report on their internal 

armtrol systems. 

The same Act requires 

Interest in the need for strong intend control system is exarrpli- 

?he bill, if passed, would re 

lh an ongoing effort of support of effective internal 

'ibis dccunent entitled "Executive Reportins on Internal cbntrols in 

Gcwenment" was recently wrpleted by the AGA task grwp. It provides a 

general discussion on the definition and objectives of internal amounting 

arid adninistrative controls as well as suggesting reportirag requb-exnts c;a t could be adopted whether or not the praposed legislation is passed. 

We in GW believe this is an excellent docunent for bringing out fmther awareness for the need of strong internal wrtrols, and we are certainly 

enmuraged by the fine cuntribution of the task force of the Association 

of Gwerrnnent Accomtants. We swrt the objectives of this dccunent as 

well as the conrepts and principles provided in it. 

valwble for informational purposes as well as a vehicle to enaxlfage involvanent in streqthening internal controls in wemnent. 

We are providing it to you for your infomtion. 

Tnis dcrunent is 

of the united states 

i 
EXECUTIVE REPORTING ON 

INTERNAL CONTROLS IN GOVERNMENT 
AGA TASK FORCE 

ON FEDERAL EXECUTIVE REPORTING 

ON INTERNAL CONTROL 

Executive reporting on internal control has received great professional 

interest and has been the subject of heated discussions as to its pros and cons. Most of the controversy resulted from the Foreign Corrupt Practices 

Act of 1977 and the Securities and Exchange Commission's proposal to implement 

the Act with a requirement that certain companies provide a statement on the 

effectiveness of internal control systems with their annual reports. Further, 

certain Congressional cornittees became interested in proposing legislation 

that would require Federal executives to prepare annual reports on the 

adequacy of agency internal control. 

In April, 1979, Arthur Schoenhaut, the National President, offered AGA's 

assistance to the U.S. Comptroller General in developing standards dealing 

with a Federal Executive report on Internal Control. In May, the Comptroller 

General accepted the offer, and the succeeding National President Frank Sat0 

appointed a Task Force to propose such standards. 

The Task Force's mission was to debate or review the pros and cons 

of the executive reporting or the need for such legislation, but was to provide standards and procedures that can be followed if and when such legislation should be passed. For the past year the Task Force has worked seriously, diligently and enthusiastically to meet this mandate. We, the Task 

Force members, are proud and pleased to present this document in fulfilling our mission. It is our ardent hope and belief that this document will go a long way in advancing the state of the art in the very critical area of inter- 

~l control. We are all pleased and honored to have been part of this effort. 

Mr. Susumu Uyeda 

Executive Director 

Joint Financial Management Improvement Program 

Mr. Wallace E. Busbee 

Assistant Inspector 

General for Audit 

Veterans Pdministration 

Mr. John Crehan 

Director for Accounting 

Department of Defense 

Mr. H. Carlyle Griffith 

Associate Assistant 

Inspector General 

for Audit 

- 

Policy 

- 

Veterans Administration 

Mr. Edward J. Haller 

Partner 

Price Waterhouse & Co. 

- 

Mr. Andrew J. Kapfer 

Director, Division of 

Accounting Systems 

and Procedures 

Department of Health 

and Human Services 

Mr. Gary 8. Peck 

Systems Accountant 

Department of Health 

and Human Services 

Mr. Ronald J. Points 

Group Director, FGMS 

General Accounting Office 

- 

Mvision 

Mr. Joseph Rothschild 

Auditor 

Department of Housing 

and Urban Development 

Mr. Cornelius E. Tierney 

Part ne r 

Arthur Young ti Co. 

Mr. John Toole 

Assistant Director, 

Federal Programs 

Emst & Uhinney 

Mr. Kenneth Winne 

Supervisory Systems 

General Accounting Office 

- 

- 

Accountant 

More than 25 years p 

of the Foreign Corrupt P 

tenance of proper record 

systems in the private . 

Budget and Accounting R 

ments of all major Feder 

effective systems of int 

there were undoubtedly m 

intervening period could 

ment toward the developm 

undoubtedly slower than 

legislation and often ma 

resources to the task. 

been consumed in the ach 

approval of agency accou 

increased emphasis on th 

systems. 

The importance of ir 

tions of an entity, be i 

ally demonstrated in Con 

during and subsequent to 

late 70's the Goverment , 

of illegal, unauthorized 

of what has later been dc 

thereby underlining the . 

Government. The seeming 

of scandalous examples 0: 

government during a time 

iting legislation, such I 
I 

i 

, 

I 

! 

I 

I 

i 

I 

I 

I 

I 

More than 25 years prior to the enactment by the Congress 

of the Foreign Corrupt Practices Act (FCPA) mandating the maintenance of proper recordkeeping and internal accounting control 

systems in the private sector, a provision was included in the 

Budget and Accounting Procedures Act of 1950 requiring managements of all major Federal departments to implement and maintain 

effective systems of internal control in Government. Although 

there were undoubtedly many who took this charge seriously, the 

intervening period could be characterized as one in which movement toward the development of effective Government systems was 

undoubtedly slower than contemplated by the drafters of the 

legislation and often marked by the allocation of inadequate 

resources to the task. Certainly the length of time which has 

been consumed in the achievement of the General Accounting Office 

approval of agency accounting systems evidences a need for 

increased emphasis on the importance of accounting and control 

systems . 

The importance of internal controls in the financial operations of an entity, be it public or private, has been dramatically demonstrated in Congressional testimony and other responses 

during and subsequent to the passage of FCPA legislation. 

late 70's the Goverment also experienced a rash of its om form 

of illegal, unauthorized, and questionable payments in the form 

of what has later been described as fraud, waste and abuse, 

thereby underlining the importance of the internal controls in 

Government. 

of scandalous examples of fraud, waste and abuse at all levels of 

government during a time when the public was initiating tax limiting legislation, such as "Proposition 13", has caused senior 

In the 

The seemingly unending disclosure of a broad range 

-i- 
Government officials to place increased emphasis on the importance and need to substantially improve internal controls in the 

Federal Government. 

1 

The Comptroller General of the United States has made numerous statements related to his concern with the inadequacies of 

internal controls in Government and has continuously reemphasized 

his early conviction that: 

Our prime concern should be directed toward construct- It 

ing systems of management control that will prevent fraud and 

abuse, make it more difficult, and decrease the likelihood of 

error and waste." 

The executive and legislative branches of the Government 

have responded directly and effectively in their resolve to 

substantially improve Government's response to the widely-held 

opinion that internal controls, at all levels of Government, 

require dramatic and timely Fmprovement. Evidence of their 

action has been demonstrated through the passage of Inspector 

General legislation in 1978, with a goal to increase emphasis 

on the prevention and detection of fraud, waste and abuse in 

Government. Also, the establishment by the Office of Management 

and Budget of its Financial Priorities Program in 1979 evidences 

their resolve to improving the accountability structure of all 

executive agencies. That program includes a number of initiatives to improve accounting practices and procedures and basic 

internal controls within agencies and departments. 

The most recent action taken has been the introduction of the 

Financial Integrity Act of 1980 (Act) which has as its primary 

goal providing additional assurances that senior officials in 

Government view their responsibility for internal control systems 

- ii - 

most seriously. The Act 

nesses receive Congress: 

time as effective action 

the legislation will nec 

procedures within agenci 

and continuous monitorin 

control systems. 

It is the purpose of 

guidance to senior admin: 

ernment, by assisting th 

o obtain a clear 1 

of the legislati 

o assess their pe. 

organization's 

the legislation. 

o identify the rea 

and 

o understand how c 

legislation thro 

evaluations and 

It is expected that provi 

with a clearer understand 

internal control systems1 

level of coordination bet 

achieving compliance with 

It is important to re1 

herein deals principally 

to organize a review to d 

systems. It does not deal 

whether individual control 
most seriously. 

nesses receive Congressional and public disclosure until such 

time as effective action is taken to correct them. Accordingly, 

the legislation will necessitate the implementation of effective 

procedures within agencies and departments to assure the timely 

and continuous monitoring of the effectiveness of their internal 

control systems. 

The Act requires that identified system weak- 

\ 

obtain a clear understanding of the scope and objectives / 

of the leg is la t ion ; 

assess their personal responsibility for assuring their 

organization's compliance with the substance and form of 

the legislation; 

identify the resources required to achieve compliance; 

and 

understand how compliance may be achieved with the 

legislation through the performance of meaningful 

evaluations and effective reporting. 

1 

\. It is the purpose of this document to provide meaningful 

guidance to senior administrative officials of the Federal Government, by assisting them: 

o 

o 

I o 

o 

It is expected that providing administrative and program managers 

with a clearer understanding of the meaning and significance of 

internal control systems will foster the achievement of a higher 

level of coordination between them and financial managers in 

achieving compliance with the Act. 

It is important to recognize that the material included 

herein deals principally In what factors to consider and how 

to organize a review to determine the effectiveness of control 

systems. 

whether individual controls are effective or ineffective-- 

It does not deal directly with the process of assessin 

i 

/, 

- iii - 
necessary or unneccesary. 

organizations and firms, has provided a wealth of information on 

how to evaluate the adequacy of individual controls surrounding 

activities or functions. However, insufficient information is 

currently available to senior executives and managers as to the 

factors to be considered and the organizational steps which 

should be taken to assure timely and accurate feed-back on the 

status and effectiveness of the internal control systems within 

their organizations. 

standing of the objectives of internal control systems. 

The accounting profession, through its 

hrther there is a need for improved underI 

It should be remembered, however, that even the most well 

designed systems of internal control have inherent limitations. 

They cannot provide absolute assurances that errors, omissions, 

or commissions of improper acts will not occur. 

grams which distribute funds or services through intermediary 

Governments or other organizations present additional risks and 

control limitations, since program control effectiveness will be 

dependent upon personnel and systems not totally under the control of the sponsoring Federal agency. 

Government pro- 

***** 

While the Congress and the Public hold Government in general 

accountable for the effectiveness of its systems of internal control, the establishment and maintenance of such systems has 

always been the specific responsibility of the heads of Federal 

departments and agencies. 

intended to assist them in executing their responsibilities 

effectively . 

The guidance provided herein is 

I Internal Controls--.’ 

- The Scope of Cc 

- What are Interr 

- The Relationshj 

- ADP Considerat: 

- How Should Evai 

- Expected Resul: 

I1 Identifying Control 

- Introduction 

- Legislation Ob- 

- Common Control 

- Common Control 

- Specific Contrc 

111 Achieving CompliancE 

- Planning and 0 

- Establishing tf 

- Formulating Ke: 

- Assigning Proj 

- Reporting by tt 

- Reporting by t 

Leg is lat ion 

Ob j ec t ives 

IV Reporting . . . . 

- The Annual Repr 

Departments &c 

- Suggested Contc 

- Inspector Genei 

- Director of Om 

V Other Evaluation Cor 

- The Importance 

- Organizational 

- Symptoms of Con 

- Limitations Ink 

Appendix A - The 

Appendix B - Biblr 

- iv - 

c 
TABLE OF CONTENTS 

Page 

I Internal Controls--A Basic Understanding ........ 1 

- 

Legislation - What are Internal Controls 

- 

- ADP Considerations 

- How Should Evaluations Be Conducted 

- Expected Results 

The Scope of Control Review Contemplated by the 

The Relationship Between Objectives and Controls 

I1 Identifying Control Objectives ............. 11 

- Introduction 

- Legislation Objectives 

- Common Control Techniques and Specific Control 

- Common Control Techniques- 

- Specific Control Objectives 

Objectives 

111 Achieving Compliance with Financial Integrity Act ... 24 

- Planning and Organizing the Project 

- Establishing the Steering Committee 

- Formulating Key Evaluation Policies 

- Assigning Project Director Responsibilities 

- Reporting by the Project Team 

- Reporting by the Steering Committee 

IV Reporting ....................... 36 

- 

Departments and Agencies - 

- 

- Director of OMB Reporting 

The Annual Reports of the Chief Executives of 

Suggested Content of Agency Reports on Controls 

Inspector General and Internal Auditor Reporting 

V Other Evaluation Considerations ............ 40 

- 

- Organizational Responsibilities 

- Symptoms of Control Deficiencies 

- Limitations Inherent in Control Systems 

The Importance of the Control Fnvironment 

Appendix A . The Financial Integrity Act of 1980 ... 47 

Appendix B . Bibliography .............. 51 

-v- 
-1- 

/- 

The Scope o 

I 

INTERNAL CONTROLS--A BASIC UNDERSTANDING 

the Control Review Contemplated by the Legislation 

The Financial Integrity Act of 1980 specifies that the head 

of each executive agency designated by the Office of Management 

and Budget will be required to submit annually, to the President, 

a report on the adequacy of their agency‘s system of internal 

accounting and administrative controls. 

report on those controls which are designed to provide reasonable 

assurance that the following control objectives are achieved: 

The Act requires a 

(1) 

(2) 

All obligations and costs were in compliance with 

applicable law; 

All funds, property and other assets were safeguarded 

against waste, loss, unauthorized use or misappropriation; and 

All revenues and expenditures applicable to agency 

operations were properly recorded and accounted for to 

permit the preparation of accounts and reliable financial and statistlcal reports and to maintain accountability over the assets. 

(3) 

What Are Internal Controls 

Probably the most difficult task in conveying an understanding of what is meant by the broad term Internal Controls is to 

agree upon a definition which is clearly understood by persons 

who have little or no background in the field of administration 

and financial management. 

How do internal controls relate to accounting systems? Accordingly, one must first address the complementary relationship 

The first question usually raised is; 

between accounting sy 

detailed understandin, 

internal control syst 

Accounting system, 

components: (1) the . 

their inherent accoun 

manually posted or ma( 

duties and responsibi 

the organizational sti 

to be performed by pel 

accounting process, tl 

tion system or form oi 

financial activity. 

It is a fundamentr 

that the organization 

cedures to be performe 

as to preclude any one 

and executing ,financia 

appropriate “segregat’F 

ment of key control pr 

organizational element 

Internal Accountin 

Institute of Certifiel 

organization and the p 

with safeguarding of a 

records . . . . 11 

In addition to accc 

organization will imp1 

trols usually referred 
-2- 

! 

I 

I 

! 

! 

1 

I 

i 

between accounting systems and controls before attempting a more 

detailed understanding of factors affecting the quality of 

internal control systems. 

Accounting systems, in a broad sense, include four principal 

components: (1) the system hardware, namely general ledgers and 

their inherent account structures, whether they be in the form of 

manually posted or machine processed records, (2) the assigned 

duties and responsibilitles for maintenance of those records or 

the organizational structure adopted, (3) the specific procedures 

to be performed by persons in the execution of their role in the 

accounting process, the procedural controls, and (4) the information system or form of periodic reports which summarize incurred 

financial activity. 

It is a fundamental premise of a sound accounting system 

that the organization of personnel and the specification of procedures to be performed should be constructed in such a fashion 

as to preclude any one individual from authorizing, approving 

and executing-financial transactions. This is achieved through 

appropriate "segregation of duties" which results in the assignment of key control procedures to different persons or different 

organizational elements. 

Internal Accounting Control has been defined by the American 

Institute of Certified Public Accountants as ". . . the plan of 

organization and the procedures and records that are concerned 

with safeguarding of assets and the reliability of financial 

records . . . . I1 

In addition to accounting related internal controls, every 

organization will implement a wide spectrum of additional controls usually referred to as Internal Administrative Controls. 
-3- 

Administrative Controls are designed to provide a structure to 

carry out other organizational objectives such as planning, 

productivity, programmatic quality, economy, efficiency, and 

effectiveness. 

accounting controls have often been referred to by a number of 

alternative titles and terms. 

is obviously of less importance than understanding the use and 

role of each such controls within the organization. 

In practice administrative controls and internal 

The significance of the title used 

In its Standards for Audit of Governmental Organizations, 

Programs, Activities and Functions, the General Accounting Office 

included both accounting and administrative controls in its definition of internal control in Government. Internal Control is 

defined as: 

"The plan of organization and all the coordinate methods 

and measures adopted to safeguard assets, check the 

accuracy and reliability of accounting data, (accounting 

controls), promote operational efficiency, and encourage 

adherence to rEscribed managerial policies (administrative controlsy . In performing a review of controls within a Governmental 

organization, it might be considered desirable to review each 

type (accounting and administrative) separately. However, in 

practice this is rarely, if ever, practical since managerial 

dectsions in the administrative control area can often have a 

direct influence on the quality and adequacy of accounting controls. In a simple, but nonetheless effective example, the 

establishment within a unit of Government of administrative 

controls to foster and encourage a high level of supervision 

and review of employee performance can be expected to have a 

significant influence on the quality of employees' execution of 

accounting controls. 

Accordingly, whtle 

accounting controls can 

of the adequacy of the 

usually necessitate a r 

extent that they (1) es 

environment, (2) influe 

control procedures requ 

accounting control objAdministrative cont 

ronment generally relat 

example: (1) have an r 

responsibilities, (2) c' 

(3) act as an incentive 

(4) provide reasonable 

asstgned procedures app 

action. 

Some administrative 

nificant influence on t 

required within the sys 

decision which permits 

payments at regional or 

ferent series of accoun 

system which permits lo, 

one centralized process: 

Also, as pointed ou' 

trative controls can sti 

ing controls. The head 

administrative procedur 

responsibility to close 

financial, as well as p' 
-4- 

Accordingly, while the presence or absence of specific 

accounting controls can usually be readily determined, a review 

of the adequacy of the overall accounting control system will 

usually necessitate a review of administrative controls to the 

extent that they (1) establish an appropriate accounting control 

environment, (2) influence the nature of internal accounting 

control procedures required, or (3) help to satisfy internal 

accounting control objectives. 

Administrative controls which can influence the control environment generally relate to those such as indicated in the 

example: (1) have an effect upon employees awareness of their 

responsibilities, (2) create a positive organizational attitude, 

(3) act as an incentive to employees to follow procedures, and 

(4) provide reasonable assurance that the failure to perform 

assigned procedures appropriately will result in disciplinary 

action. 

Some administrative control procedures can also have a significant influence on the type of internal accounting controls 

required within the system. 

decision which permits borrowers under loan programs to make 

payments at regional or district offices will necessitate a different series of accounting controls than those accompanying a 

system which permits loan repayments to be processed only through 

one centralized processing center. 

For example, an administrative 

Also, as pointed out, the implementation of certain administrative controls can strengthen or mitigate the need for accounting controls. The head of a department or agency may institute 

administrative procedures which delegate to program managers the 

responsibility to closely monitor and accept responsibility for 

financial, as well as programmatic activity. It is likely that 

, 
I 

I! 

i 

1: 

I 

I 

! 

/- 

i ,I 

-5- 

in the performance of their responsibilities program managers 

will, through their review and inquiry into the appropriateness 

of reported financial results, act as a monitor of the accounting 

system. In these circumstances program managers serve in the 

dual capacity of carrying out both a programmatic (administrative) and accounting control function. 

In summary the term, Internal Controls, is broad and includes 

both accounting and administrative controls. 

the administrative or accounting area are implemented through the 

segregation of key control duties and responsibilities among 

employees and the establishment of specific operating procedures 

which specify the manner in which their functions will be conducted. 

assets and the accuracy and reliability of accounting transactions and reporting. 

designed to encourage adherence to prescribed managerial policies 

and promote operational efficiency. 

Controls in either 

Accounting controls deal principally with safeguarding 

Administrative controls are typically 

While the control evaluation procedure discussed herein is 

- not designed to evaluate admhistrative controls to assure efficiency and effectiveness, undoubtedly insights will be gained 

into these areas through this process. Further, it must be 

remembered that the adequacy of accounting controls can often be 

significantly influenced, positively or negatively, by administrative controls adopted by the organization. 

As agreed by a wide spectrum of authors on the subject of 

control evaluation . . . an understanding of the distinction 

between accounting and administrative controls is useful for 

purposes of obtaining a fundamental knowledge of their interrelationship. However, the importance of the distinction becomes 

less significant if the attention of a control evaluation focuses 

more appropriately upc 

trying to achieve thrc 

it might be contended 

the Act are more closl 

trols, that observatic 

Rather, it should be t 

the adequacy of both 

terns which are designe 

objectives of the Act. 

While the use of p 

identify customary or 

value, they should be 

the sole procedure for 

The Relationship Betwel 

There is substanti 

evaluation of a control 

of the organization's i 

management will conver. 

in the Act) which relat 

specific control objeci 

and types of transactic 

identifiable relat ionst 

and the financial or c. 

is sought. 

Some difference of 

should be performed on 

tional) basis; neverthe 
!S 

-6- 

more appropriately upon the objectives which the organization is 

trying to achieve through the implementation of controls. While 

it might be contended by some that the objectives specified in 

the Act are more closely related to traditional accounting controls, that observation should not be viewed with significance. 

Rather, it should be the intention of department heads to assess 

the adequacy of both accounting and administrative control systems which are designed to achieve the previously listed broad 

objectives of the Act. 

While the use of predetermined detailed checklists which 

identify customary or traditional control techniques can be of 

value, they should be utilized as a tool and not relied upon as 

the sole procedure for conducting control evaluations. 

The Relationship Between Objectives and Controls 

There is substantial agreement among professionals that an 

evaluation of a control system must begin with an identification 

of the organization's control objectives. 

management will convert broad control objectives (such as those 

in the Act) which relate to the organization as a whole, into 

specific control objectives for all affected organizational units 

and types of transactions. In most cases there will be a readily 

identifiable relationship between specified control objectives 

and the financial or operational risks against which protection 

is sought. 

It is assumed that 

Some difference of opinion exists as to whether evaluations 

should be performed on a transactional or organizational (functional) basis; nevertheless, under either approach specification 
I 

-7- 

I 

! 

I 

1 

I 

! 

I 

! 

1 

f 

t 

r 

i 

t 

i 

I 

I 

I 

of meaningful objectives is critical to the successful performance of a control evaluation. 

tenance of adequate internal accounting controls is an appropriate overall objective for an executive department, effective 

determination of whether that overall objective is being achieved 

will necessitate the identification and review of numerous supporting objectives. Such a supporting payroll objective would be 

that--all employee overtime is approved prior to being paid. It 

would be expected that many supporting objectives of this nature 

would be expressed through policy statements or regulations. 

As an example, while the mainAS a further example, dissecting a small portion of one control objective specified in the legislation would identify the 

overall organizational objective that: 

"all . . . property . . . (is) safeguarded against . . . unauthorized use . . . 11 

In most agencies the achievement of that overall objective 

will frequently necessitate the identification of a significant 

number of supporting objectives relating to the often wide variety of property which is entrusted to the care of the agency 

and a specification of what, in each case, constitutes unauthorized use. 

identify control objectives will encourage management to address 

and establish positions on a number of issues which may not have 

been previously specified in either Federal regulations or previous agency policies. 

and abuse are created simply because inadequate attention is 

focused on defining control system objectives and organizational 

It is expected that in many cases the necessity to 

Many times opportunities for fraud, waste 

policy. 

Once the objectives of a control system are identified, an 

effective evaluation to determine whether they are being achieved 

can commence. The sub 

or not Objectives are 

whether the controls r 

accounting or administ 

To assist departme 

control objectives app 

Chapter Two contains a 

pal objectives usually 

tional areas in Governr 

ADP Considerations 

Most systems invol, 

equipment and systems. 

dependent on the adequr 

during the development 

the computer equipment 

design control should 

of effective and adequs 

auditability of systems 

aspects of their develc 

How Should Evaluations 

The unique attribut 

program and administrat 

delineating a single el 

lacking in conducting 

within public as well 

these factors a model 

evaluations has been de 

of this guide. The plal 
-8- 

1 

! 

I 

I 

I 

i 

i 

i 

i 

i 

! 

can commence. 

or not objectives are being achieved, with little concern as to 

whether the controls relied upon are identified as either 

accounting or administrative controls. 

The subsequent evaluation will focus upon whether 

To assist departments and agencies in the development of 

control objectives applicable to their own organizations, 

Chapter Two contains a discussion and description of the principal objectives usually related to frequently encountered functional areas in Government organizations. 

ADP Considerations 

Most systems involve the use of Automatic Data Processing 

equipment and systems. 

dependent on the adequacy and the emphasis placed on controls 

during the development, installation, maintenance and use of 

the computer equipment and software. 

design control should be designed to ensure the development 

of effective and adequately controlled syatems. 

auditability of systems should be addressed throughout all 

aspects of their development. 

The reliability of an ADP eystem 3.8 

System specification and 

Additionally, 

How Should Evaluations Be Conducted 

The unique attributes of each Government organization, 

program and administrative function do not lend themselves to 

delineating a single evaluation method. 

lacking in conducting overall organizational control as8essments 

within public as well as in the private sector. 

these factors a model Action Plan to conduct internal control 

evaluations has been developed and is described in Chapter 111 

of this guide. 

Likewise experience ie 

Considering 

The plan is developed in six major otepr from a 
-9- 

description of the head of the department's initial role, to the 

final independent review and opinion by management on the effectiveness of the department's or agency's control system. 

The Action Plan described utilizes a Project Team approach. 

The intent of the plan is to systematically evaluate existing 

systems from those estimated to have the largest risk potential 

to those with the smallest risk or vulnerability. 

trol environment is subject to change, (i.e., personnel competency, integrity and sufficiency, along with program scope and 

objectives) higher risk areas will require reexamination on a 

more frequent basis. 

Since the conExpected Results 

In assessing whether the organization's control objectives 

are reasonably achieved the evaluators of the system will become 

principally involved in a review to determine whether (1) procedures adopted are appropriate in the circumstances, (2) key 

duties and responsibilities are properly segregated, and (3) policies and procedures are satisfactorily documented, communicated 

and executed. 

Many contend that one of the most important aspects of any 

control system is how effectively individuals perform their 

functions. Consequently, in the performance of a control evaluation, the reviewers should be expected to arrive at a determination as to whether persons performing key functions appear 

to be executing their responsibility properly. They will also 

consider whether responsibilities are assigned to an appropriate 

level within the organizational structure. Evaluating whether 

key functions are properly assigned within the organization to 

individuals capable by training and experience to execute them 

effectively, is of no 

evaluation than is juc 

themselves. 
- 10 - 

effectively, is of no less Fmportance to the outcome of the 

evaluation than is judging the appropriateness of the procedures 

themselves. 
- 11 - 

I1 

IDENTIFYING CONTROL OBJECTIVES 

INTRODUCTION 

The previous Chapter included a discussion of the relationship between control objectives and control systems and procedures. 

agreement on the objectives of control systems prior to 

commencing a review to determine their adequacy. 

It emphasized the importance of obtaining management 

It is highly unlikely that any two Government organizations 

will agree upon a single statement of control objectives. 

certain similarities may exist, the control objectives of each 

agency would be expected to reflect the differing nature of their 

operations and constituencies, as well as management philosophies 

of the organization. 

While 

It should be stressed that in establishing overall departmental control objectives, the legislative as well as the procedural and specific control objectives, covered in this Chapter, 

should be considered. The detail level of control desired should 

be clearly defined based on a vulnerability analysis or other 

management decisions. 

A number of the texts referred to in the bibliography recommend that the evaluations be performed on either a transaction 

basis (e.g., cash receipts, disbursements, etc.) or alternatively 

on a functional basis by system (e.g., payrolls, procurements, 

etc.). 

matter of personal preference. 

that the common thread among all of the recommended procedures 

The selection of either basis appears to be largely a 

However, it should be emphasized 

is the requirement that 

clearly specified and :: 

the review process. 

The logic of this a€ 

identify the desired ent 

effectiveness of its ack 

used to achieve certain 

whether transactions ar 

the objectives would ne'. 

LEGISLATIVE OBJECTIVES 

Financial Integrity 

As mentioned earliei 

Act requires annual opir 

adequacy of their agenc. 

states that for these pi 

tem of internal control 

that: 

o All applicable obligations law; 

o All funds, pro. 

against waste, 

tion; and 

o All revenues ~ 

operations wer 

to permit the 

financial and s accountability 

The Act provides fu1 

dated internal control i 

established by the Budge 
Y 

- 12 - 

is the requirement that objectives of the control system be 

clearly specified and agreed upon prior to implementation of 

the review process. 

The logic of this approach seems clear. Certainly one must 

identify the desired end result before attempting to assess the 

effectiveness of its achievement. In addition, while the methods 

used to achieve certain objectives vary significantly based upon 

whether transactions are processed manually or using ADP systems, 

the objectives would nevertheless be expected to remain the same. 

LEGISLATIVE OBJECTIVES 

Financial Integrity Act (Act) 

AS mentioned earlier, the executive report required by the 

Act requires annual opinion by the head of an agency as to the 

adequacy of their agency’s systems of internal controls. 

states that for these purposes, the general objectives of a system of internal control are to provide reasonable assurances 

that : 

The Act 

o All obligations and costs were Ln compliance with 

applicable law; 

o All funds, property, and other assets were safeguarded 

a ainst waste, loss, unauthorized use or misappropriat8on; and 

o All revenues and expenditures applicable to agency 

operations were properly recorded and accounted for 

to permit the preparation of accounts and reliable 

financial and statistical reports and to maintain 

accountability over the assets. 

The Act provldes further specificity to the previously mandated internal control responsibility of the heads of agencies 

established by the Budget and Accounting Act of 1950. 
I 

i 

- 13 - 

Budget and Accounting Act of 1950 

The 1950 Act places responsibility for establishing and maintaining adequate systems of internal control upon the head of 

each executive agency. 

tems conform to the accounting principles, standards, and related 

requirements prescribed by the Comptroller General of the United 

States and that the systems be approved by him. 

It also prescribes that accounting sysAccounting systems are considered an integral part of internal control systems. 

which each agency's accounting system should provide. 

The 1950 Act defined the general objectives 

These are: 

o Full disclosure of the financial results of agency i activities; I 

o Production of adequate financial information needed for 

agency management purposes; 

o Effective control over the accountability for all funds, 

property, and other assets for which each agency is 

responsible; 

Reliable accounting results to serve as the basis for 

preparation and support of agency budget requests, for 

controlling the execution of the budgets, and for 

providing financial information required by the Office 

of Management and Budget; 

Suitable integration of agency accounting with the 

control accounting; and 

Reporting operations of the Treasury Department. 

o 

o 

o 

COMMON CONTROL TECHNIQUES AND SPECIFIC CONTROL OBJECTIVES 

Assuring adequacy of controls and compliance to prescribed 

control procedures through an annual evaluation is necessary to 

provide an agency head with a basis for the required annual 

report to the President. The transaction systems or functions 

usually found in Gover 

evaluation are : 

Overall Functfons 

--accounting 

--automatic c 

Payment Functions 

- -payroll 

--contracts 

- - gr ants 

--loans and 

--pensions 

--payables - -trave 1 

Co 1 lect ion Func t it 

--accounts r 

- -collection2 

Other Functions a1 

--cash and n 

--letters of 

--capital as. 

It should be reco 

identified, it will u 

cify control objectivf 

it would usually be pi 

the contracts area to 

ing and personal serv 

priate to further spec 

upon the nature of re' 

and other not-for-pro 

right or wrong answer 

tives should be speci. 

b 
- 14 - 

usually found in Government organizations which will require 

evaluation are: 

Overall Functions and Activities 

--accounting and reporting --automatic data processing 

Payment Functions and Activities 

--payroll 

--contracts 

--grants 

--loans and loan guaranty 

--pensions 

- -travel 

--payables 

Collection Functions and Activities 

--accounts receivable 

- -eo1 lect ions 

Other Functions and Activities 

--cash and negotiable instruments 

--letters of credit 

--capital assets and material inventories 

It should be recognized that even within the functional areas 

identified, it will usually be appropriate for agencies to specify control objectives to a subfunctional level. As an example, 

it would usually be practical to separately specify objectives in 

the contracts area to the sublevel of tangible property contractIng and personal service contracts. Similarly it may be appropriate to further specify objectives in the grants area based 

upon the nature of recipients such as colleges and universities 

and other not-for-profit civic organizations. While there is no 

right or wrong answer as to the depth or level to which objectives should be specified, as a general rule, it is expected that 
i 

- 15 - 

objectives be specified to the same level that controls are 

expected to be implemented. 

from performing more tk 

Sty, such as authorlzin 

diaburs ing . The remainder of this chapter will be devoted to a discussion 

of (1) common control techniques applicable to all systems, followed by (2) an identification of specific control objectives 

associated with the previously identified transaction systems, 

functions or activities. 

Supervision 

Effective systems 0. 

control require strict . 

Qualified and continuoui 

agency management that 

safeguard the resources 

i 

COWN CONTROL TECHNIQUES 

Documents t ion 

Security of Property anc 

If controls are expected to operate effectively it is 

essential that control procedures, policies, authorities and 

responsibilities be clearly and adequately documented. Once 

documented they should be available to personnel involved in 

their execution. 

tions manuals and organization charts which describe and depict 

the role and responsibilities of all individuals engaged in the 

coatrol 8yatem. 

a8surances that the method of, and responsibility for, following 

procedures is clearly communicated it is often a valuable tool in 

tratning new employees. 

Documentation usually takes the form of operaNot only does proper docmentation provide 

I 

The preservation anc 

the Government is impon 

misuse. Generally, pro' 

of accounting records, 

other assets of the agen 

employed to ensure that 

procedures exist and are 

Internal Audit 

An internal audit or 

continuously monitor pol. 

to all fiscal and accoun 

reviews should include e: 

Also, procedures should 

ings and recommendations. 

by management. 

Segregation of Duties 

'! A basic tenet of a sound internal control system is that no 

individual or small group of individuals should be in a position 

to control all aspects of a transaction. 

be aegregated and tasks should be structured to preclude them 

Responsibilities should 

i 

ii 

I/ I 

I 
a 

- 16 - 

from performing more than one "key" processing function or activity, such as authorizing, approving, certifying, accounting, and 

disbursing. 

Supervision 

Effective systems of internal accounting and administrative 

control require strict adherence to procedures and practices. 

Qualified and continuous supervision is necessary to assure 

agency management that desired procedures are being applied to 

safeguard the resources of the agency. 

Security of Property and Records 

The preservation and safekeeping of property and records of 

Generally , procedures should include physical security 

the Government is important to the prevention of their loas or 

misuse. 

of accounting records, negotiable instruments or securities, and 

other assets of the agency. Accordingly, procedures should be 

employed to ensure that appropriate recordkeeping and archival 

procedures exist and are followed. 

Internal Audit 

An internal audit or review function should be organized to 

continuously monitor policies, procedures, and practices related 

to all fiscal and accounting activities. 

reviews should include examining and testing of transactions. 

Also, procedures should exist to assure followup of audit findings and recommendations, and to assure timely corrective action 

by management. 

Where appropriate 
I 

- 17 - 

Competency of Personnel 

Personnel should be competent, by education, training and 

experience, to execute the control responsibility to which they 

are assigned. 

execute the responsibilities of the positions they hold, agency 

heads cannot expect the effective execution of control policies, 

procedures and practices. 

Unless personnel are technically qualified to 

SPECIFIC CONTROL OBJECTIVES 

The following represent control objectives associated with 

the previously identified transaction systems or functions which 

should be considered in performing a control evaluation. 

previously noted these objectives must, of course, be tailored to 

the unique control requirements of each agency and its 

management. 

As 

Accounting and Reporting 

a. 

b. 

C. 

d. 

Authorization and recordkeeping procedures provide 

proper, accurate, complete and timely accounting records 

and reports of assets, liabilities, commltments, obligations, receipts and revenues, expenditures, costs, and 

disbursements of the agency. 

Financial reports provide necessary information in the 

format required by managers to assess performance and 

stewardship regarding financial viability, program 

activity, fiscal compliance and accountability. 

Accounting systems are properly documented and changes 

to them are made in an adequately controlled environment 

so as to prevent unauthorized changes. 

Accounting systems are maintained in accordance with 

approved designs and in accordance with legislative and 

executive branch policies and criteria. 

I 

I 

I 

i 

I 

i 1 

I 

! 

! 

I I 

i 

1 

I 

I 

i 

I 

I 

i 

! 

I 

1 

i 

i I 

e. Accounting syst 

the Comptroller 

identify and re 

approval by Off 

action is taken 

preventing appr 

g. Timely and peri 

that subsidiary 

ledger balances 

h. Timely and peri 

cash account ba 

the Treasury. 

i. Timely and per1 

expenditures ax 

analyzed. 

j. Temporarily unc 

timely distrib, 

Automatic Data Processir 

a. Systems providt 

input, adequat 

sensitive inpu, 

complete and t. 

b. Data are safeg 

improper changc 

c. Controls inclu 

detect unautho: 

instructions T 

on a “need to 

to existing pr 

(4) appropriat 

d. Systems produc 

and timely . 

f . Administrative 

9 

Payroll 

a. Appropriate au 

the appointmen 

personnel . 
I 

- 18 - 

I e. 

I 

I 

I f. 

I h. I 8 

! 

Accounting systems are submitted for timely approval to 

the Comptroller General. identify and resolve matters preventing approval. 

Administrative controls are submitted for timely 

approval by Office of Management and Budget. 

action is taken to identify and resolve matters 

preventing approval. 

Timely and periodic reconciliations are made to ensure 

that subsidiary records are in agreement with general ledger balances. 

Timely and periodic reconciliations are made of agency 

cash account balances with those of the Department of 

the Treasury. 

Timely action is taken to 

Timely 

i. Timely and periodic comparisons of budget and actual 

expenditures are made and significant variances 

analyzed. 

Temporarily undistributed expenditures are properly and 

timely distributed to proper accounts. 

j. 

Automatic Data Processing ! 

a. Systems provide for proper authorization of transaction 

input, adequate edit checks and necessary safeguard of 

sensitive input forms to insure accurate, proper, 

complete and timely entry of information. 

Data are safeguarded to prevent unauthorized access, 

improper changes or loss. 

b. 

c. Controls include: (1) approprLate operational lo s to 

detect unauthorized use of the system; (2) operat f ng 

instructions providing adequate information to operators 

on a "need to know" basis; (3) new programs and changes 

to existing programs are specifically authorized; and 

(4) appropriate change control procedures. 

Systems produce intended outputs accurately, completely 

and timely . d. 

I Payroll 

a. Appropriate authority is established and documented for 

the appointment, change, and termination of all 

personnel. 

i 
/- 

I 

- 19 - 

b. All compensation complies with current statutory or 

c. Opportunities for duplicate or other improper payments 

d. 

regulatory limitations. 

are minimized. 

Timely, accurate and complete attendance reporting is 

achieved. 

Contracts 

a. 

b. 

Cd. 

Grants 

a. 

b. 

C. 

d. 

e. 

A reasonable number of responsible bidders are solicited 

for each significant procurement to insure adequate 

competition. I 

Objective evaluation of all bids and proposals, strict 

corn liance with contract award procedures and consistent! y applied contract administrative controls. 

Control over Government-furnished property and equipment 

is established to ensure that contractors are safeguarding, accounting, inventorying, preserving, maintaining, 

and reporting accurately the Government properties in 

their possession. 

Prompt and appropriate contract close-out actions are 

taken . 

Adequate description and availability of Federal assistance are publicized when appropriate. For entitlement 

grants, factors used in distribution formulas are 

accurately maintained. 

Financial and compliance audits of grantee activity are 

performed at least once every two years. 

Grantees' cost allocation plans' are reviewed and 

overhead rates are negotiated periodically. 

Grantees' procurement procedures are reviewed for 

compliance with regulations. 

Grantees' program eligibility requirements are sufficiently detailed to ensure that the program beneficiaries are qualified to receive prescribed benefits. 

f. Grantees implem 

accounting syst 

evaluated. 

g. Grantees assur 

equipment are p 

safeguarded anc 

h. Prompt and appr 

taken. 

Loans and Loan Guaranty 

a. 

b. 

C. 

d. 

e. 

f. 

Applications fi 

for appropriatc 

other qualifyil 

Title to properecorded, filec 

Periodic aged 1 

reviewed and t 

Loan and loan 

trolled and re 

the applicable 

Periodic estim 

balances. Suc 

management. 

Proper write-c 

forgiveness 05 

Pens ions 

a. Files are maiT 

evidence of &i 

original and I 

b. Recipients ar 

responsibilitj 

c. Benefits paid 

to the same c 
I 

- 20 - 

i 

I 

I 

f. Grantees implement sound organizational, budgetary and 

accounting systems that are periodically reviewed and 

evaluated. 

Grantees assure that Government-financed property and 

equipment are properly accounted for, inventoried, 

safeguarded and maintained. 

Prompt and appropriate grant close-out actions are 

taken. 

Loans and Loan Guaranty 

g. 

h. 

a. 

b. 

C. 

d. 

e. 

f. 

Applications for loans and loan guarant are evaluated 

for appropriateness of eligibility, colrateral , and 

other qualifying criteria prior to approval. 

Title to property used as collateral is properly 

recorded, filed, and secured by a responsible custodian. 

Periodic aged reports of loan balances due are prepared, 

reviewed and timely collection action taken. 

Loan and loan guaranty repayments are collected, controlled and reported in a manner that is consistent with 

the applicable appropriation or other public law. 

Periodic estimates are made of uncollectible loan 

balances. 

management. 

Proper write-off, conversion, and settlement or 

forgiveness of delinquent loans is assured. 

Such estimates are timely reported to 

Pensions 

a. Files are maintained for each recipient containing 

evidence of eligibility and approval and computation of 

original and subsequent changes to payments. 

Recipients are made aware of their personal 

responsibilities for continuance of payments. 

Benefits paid to survivors or beneficiaries are subject 

to the same controls as other payments. 

b. 

c. 
- 21 - 

Travel 

%' a. Proper controls are observed for issuing, recordin 

verifying, processing, reconciling, accounting, an 

reporting obligations, expenditures, and disbursements 

for travel and transportation. 

The Standard Government Travel Regulations are implemented through appropriate administrative procedures 

which are updated as required. 

b. 

Payable8 

a. 

b. Prepayment examinations and certificat€ons of perforAll payables and other claims against the Government are 

promptly and accurately recorded. 

mance are made to ensure validity and clerical accuracy 

of claims prior to payment. 

Account8 Receivable (other than loans or loan guaranty) 

8. All receivables are recorded accurately and promptly. 

b. Periodic reports of aged receivables are prepared, 

reviewed and timely collection action taken. 

Separate accounts for major categories of receivables 

are maintained to facilitate clear and full disclosure 

of agency resources in its financial reports. 

ables that may not be collectible. 

separately reported on a periodic and timely basis. 

forgiveness of receivables are assured. 

c. 

d. Periodic estimates are made of the portion of receivSuch estimates are 

e. ,Roper write-off, conversion, and settlement or 

Collections 

a. Payments are made to a designated person other than the 

agency Claims or Program Officer. 

guarded while in the custody of the agency and are 

promptly transferred to the Treasury. 

All collections are promptly and accurately recorded in 

the accounts. 

Claims are safeb. 

! 

I 

I 

i 

c. Timely follow, 

due to the Go. 

collect ion, it 

are utilized. 

Cash and Negotiable In; 

a. Physical secui 

and negotiabl~ 

b. The following 

o Cash; 

o Check si5 

o Signature 

o Blank ch6 

o Partiall; 

o Mutilate4 

prompt 1 y . c. All receipts 

Letters of Credit 

a. Letters of cr 

recipients whc 

Federal Goverr 

system. 

b. Amounts avails 

strained to - authority; mor 

based on cash 

C. Drawdowns from 

recipients do 

d. Expenditure re 

reports to ass 

purpose. 

Capital Assets and Mate 

a. The distinctio: 

ture is clear1 

b. Only authorize 

C. All receipts o 

recorded in so' 
- 22 - 

c. Timely follow-up and collection are made of all amounts 

due to the Government and all procedures €or effecting 

collection, including offset and installment payments, 

are utilized. 

Cash and Negotiable Instruments 

a. Physical security safeguards are maintained where cash 

and negotiable instruments are stored and processed. 

b. The following items are protected from unauthorized use: 

o Cash; 

o Check signing machines; 

o Signature dies; 

o 

o 

o Mutilated or voided checks and bonds. 

All receipts are properly recorded and deposited 

promptly. 

Blank checks, bonds, drafts and other securities; 

Partially prepared checks and bonds; and 

c. 

Letters of Credit 

a. Letters of credit are issued only to large dollar 

recipients who have a continuing relationship with the 

Federal Government and have an adequate cash management 

system. 

strained to assure they do not exceed available award 

authority; monthly limits on drawdowns are established 

based on cash flow needs. 

c. Drawdowns from letters of credit are monitored to assure 

recipients do not draw in excess of current needs. 

Expenditure reports are required and compared to program 

reports to assure funds are used for their intended 

purpose. 

b. Amounts available under letters of credit are cond. 

Capital Assets and Material Inventories 

a. The distinction between a capital and operating expenditure is clearly identified for accounting purposes. 

Only authorized and needed property is ordered. 

recorded in source documents and accounting records. 

b. 

c. All receipts of property are timely and accurately 
- 23 - 

d. lktailed subsidiary records are maintained for individual capital assets and significant categories of material inventories; these are periodically reconciled to 

control accounts. 

Periodic physical verification is made of the existence 

and condition of property and inventories. 

Physical count8 of property and inventories are reliable 

(i.e., accurate, complete and timely) and accounting record8 are adjusted accordingly. 

g. Physical security measures are commensurate with the 

size, type, and value of property. 

h. All issues, transfers, retiremente, losses, and other 

variance8 are timely reported end accounted for. 

e. 

f. 

ACHIEVING C 

- 

The Act (Appendix A; 

to express annually an c 

tion's system of interne 

ment, each department or 

Plan to conduct continuc 

will form the basis for 

This Chapter discuss 

and performing a succesa 

vides a bibliography con 

publications that outlim 

The factors to consi 

described in six phases 

o Planning and 0 

o Establishing t 

o Formulating Ke; 

o Assigning Pro: 

o Reporting by tk 

o Reporting by tr 

The principal Actior 

roles are: (1) the heac 

initiate the development 

t direction, and be accoux 
- 24 - 

111 

ACHIEVING COMPLIANCE WITH THE FINANCIAL 

INTEGRITY ACT (ACT) 

The Act (Appendix A) requires each department or agency head 

to express annually an opinion on the adequacy of their organization's system of internal controls. To comply with this requirement, each department or agency will need to develop an Action 

Plan to conduct continuous internal control evaluations which 

will form the basis for the annual opinion or report. 

This Chapter discusses one systematic approach to organizing 

and performing a successful control evaluation. Appendix B provides a bibliography containing references to a number of other 

publications that outline alternative approaches. 

The factors to consider in developing an Action Plan are 

described in six phases, as follows: 

o 

o Establiehing the Steering Committee; 

o Formulating Key hraluation Policies; 

o Assigning Project Director Responsibilities; 

o Reporting by the Project Teams; and 

o 

Planning and Organizing the Evaluation Process; 

Reporting by the Steering Committee. 

The principal Action Plan participants and their overall 

roles are: (1) the head of a department or agency who must 

initiate the development of the Action Plan, give it policy 

direction, and be accountable for its results; (2) a Steering 1 
- 25 - 

Committee that is composed of senior members of the organization's major staff and operating components, converts the head 

of the department's or agency's broad policies into measurable 

goals, and provides policy guidance to Project Teams who are 

charged with performing the actual control evaluations; (3) Project Teams chosen from the organization's major operating components to perform control evaluations of assigned activities or 

functions; (4) a Project Team Director, who supervises the 

activities of the Project Teams in their performance of control 

evaluations; and (5) the Inspector General or Director of Audit 

who furnishes advisory assistance and separately reports on 

internal control matters as part of their normal surveillance 

process. A typical Control Evaluation Project is depicted in the 

accompanying flow chart in Figure 1. 

PLANNING AND ORGANIZING THE EVALUATION PROCESS 

Senior management officials should implement the intent of 

the Act through careful planning, close supervision, and continuing support. 

what resources are to be applied to achieve control evaluation 

objectives are fundamental considerations. The Actlon Plan 

leading to the evaluation process should be important enough to 

be included in management's overall operating plans. 

What is done and when, who is responsible, and 

The Action Plan may provide for multi-year execution, since 

all significant functions and activities may not require or be 

able to be evaluated annually. Additionally, since programs and 

activities are subject to change or restructuring, the Action 

Plan should be sufficiently flexible so as to be able to accommodate changed circumstances by allowing adjustments to the evaluation process. 
Control Evah~atlon Project 

~2 I 2 

t 11 

-Program 

Evaluate - Funclion Project 

Teams d .ActMlkS 

P 1 I Legal 

I Finance 

v Program 

Prolecl 

- Director 

Steering 

Cornmiltea selecl Department or 

Agency Head Legislation 

-I 

- 

1 - Interview 

- Document 

. rest I 

- 

Summary 

.. 1 I 

- 

I Legal 

I Finance 

Program I 

Prolecl 

- Director select Steering 

Cornmiltea selecl Department or 

Agency Head Legislation 

+ 

4 . Evaluate 

---- -I 

I 

tnilrate Plan i- Communicate Plan 

to Stall 

i 

IdentifylEvaluate Risk 

Policy 6 Standard 

Personnel Requirements 

Establish Responsibilities 

I 

Planning 

Assess Priorrties 

Assure Compliance 

Asstgn Personnel 

0 

I 

h) 

a\ 

I 
- 27 - 

The authority to conduct a control evaluation should be 

delegated from the agency head to a Steering Committee charged 

with the responsibility to prepare the Action Plan and oversee 

the conduct of detail control evaluations. To establish the 

proper environment for conducting the evaluation, the department 

or agency head should communicate to all principal staff members 

of the organization the intent and key provisions of the Action 

Plan and the Steering Committee's responsibility and role. 

ESTABLISHING THE STEERING COMMITTEE 

The primary role of the Steering Committee is to formulate 

broad policies, monitor the progress of the evaluation, review 

the results of Project Team evaluation efforts, and formulate 

overall conclusions on control effectiveness. Ultimately, the 

product of its efforts will serve as the basis for the department 

or agency head's annual opinion on internal controls expressed to 

the President, the Congress and the Public. 

The Steering Committee's role is most crucial to the performance of a successful evaluation. The policies it formulates 

will affect the quality and completeness of the control evaluamembers be selected to serve on the Steering Committee. 

I 

I tion. Therefore, it is essential that competent and dedicated 

1 

I 

! knowledge and experience in such areas as: 

Factors to be considered in selecting Committee members are 

1. Program areas, particularly those which are large, 

complex, and/or perceived as risky; 

2. Legal, legislative, and regulatory matters; 

3. Financial and administrative operations; 

4. Procurement of goods and services; 

5. Internal review 

and 

6. Automatic data 1 

Membership should be 

ulation of balanced polic 

assessment of control ev 

tive assessments is enhar 

that the Steering Commit; 

entire organization and 

they are permanently assi 

FORMULATING KEY EYALUATIO 

The Steering Committe 

in the following areas: 

1. Identifying 

the first undertakings o€ 

characterize and identify 

inherent in the departmen 

vulnerability must be ca~ 

mined which organizationa 

should be evaluated and i 

Organizations face bo 

The former relates to ford 

catastrophes, legislation. 

and standards. Internal:] 

loss attributable to acts 

either by their intentionc 

to the organization's estr 

acceptable ethical conduc' 
- 28 - 

5. Internal review, audit, or Inspector General activities; 

6. Automatic data processing. 

and 

Membership should be sufficiently broad to ensure the formulation of balanced policies and procedures, and the objective 

assessment of control evaluation results. Opportunity for objective assessments is enhanced if the agency head makes it clear 

that the Steering Committee members have a responsibility to the 

entire organization and not the organizational units to which 

they are permanently assigned. 

FORMULATING KEY EVALUATION POLICIES 

The Steering Committee will formulate key evaluation policies 

in the followhg areas: 

1. Identifying and Evaluating Control Risk. One of 

the first undertakings of the Steering Committee should be to 

characterize and identify the types of control risks that are 

inherent in the department's or agency's operations. 

vulnerability must be carefully assessed before it can be determined which organizational programs, functions or activities 

should be evaluated and in what sequence or priority. 

Risk and 

Organizations face both external and internal control risks. 

The former relates to forces outside of the organization such as 

catastrophes, legislation, court decisions, societal reactions 

and standards. Internal risk is an organization's exposure to 

loss attributable to acts of its own officials and employees 

either by their intentional or unintentional failure to adhere 

to the organization's established practices and procedures and 

acceptable ethical conduct. 
.- 

- 29 - 

The Steering Committee should establish management's defined 

level of acceptable risk. That is the point beyond which management is = willing to (1) tolerate loss of assets and revenues; 

(2) accept a margin of error in reports and information; (3) permit illegal or unethical acts; and (4) sustain adverse public 

opinion. 

Identifying the acceptable level of risk within elements of 

the organization will be a key factor in determining the activities to be evaluated and the extent or scope of the review to be 

conducted. 

The Vulnerability Assessment Grid in Figure 2 is one example 

of how program function or activity risk can be assessed and 

documented. 

tiles of control vulnerability--High, Limited, Moderate, and 

Little. 

ity are listed in each level, modified by a qualitative description appropriate to each level of vulnerability. Each factor is 

graded for the activity or function being evaluated by identifying the quartile description which most clearly characterizes 

that aspect of the function or activity. Finally, the Risk 

Point Value assigned to each factor is totaled and compared to 

other activities to establish relative vulnerability. The levels 

of vulnerability, designed factors, and grading system can be 

altered to suit the judgments of each department or agency 

Steerlng Committee. 

The Grid consists of four designated levels or quarThose factors which are considered to impact vulnerabil2. Establish Policies and Standards. The Steering 

Committee should formulate policies or standards which will guide 

Project Team performance. At a minimum, these policies should 

encompass: 
L. 

a 

m t. 

UI Y d Ir 

Vulnerability Assessment Grld 

VULNERABILITY FACTORS 

t Highly Controlled - Little Vulnerability 

- Precise Legislative Authority 

- Minimal Budget Authority/Outlays 

- Complete Government Program Adminlstration 

- Ample Administrative Resources Provided 

- No Commercial Value 

- Minimal Public Involvement 

- Extensive Written Procedures 

- Timely and Adequate Financial Reporting 

Little Control - Limited Vulnerablllty 

- Unspecilic Legislative Authority 

- Limited Budget Aulhority/Outlays 

- Mostly Third Party Program Administration 

- Minimal Administrative Resources Provided 

- Limited Commercial Value 

- Selective Public Involvement 

- Partially Effective Written Procedures 

- Financial Report Not Comprehensive 

VULNERABILITY FACTORS 1 RISK I 

VALUE 

- Moderately Controllei- Moderate Vulnerability 

- Broad Legislative Authority 

- Moderate Budget Authority/Outlays 

- Joint Third Parly 8 Government Program Admin, 

- Adequate Administrative Resources Provided 

- Substantial Commercial Value 

- Moderate Public Involvement 

- Essential Areas Have Written Procedures 

- Financial Reports Adequate But Not Timely 

I 

W 

0 

I 

- Vague Legislative Authority 

- Large Budget Authority/Outlays 

- All Third Party Program Administration 

- No Administrative Resources Provided 

- High Commercial Value 

- Widespread Public Involvement 

- No Written Procedures 

- Late and Incomplete Financial Reporting 

n 

d’ 

5 

m 

Iu 
- 31 - 

a. 

b. 

C. 

d. 

e. 

Working paper documentation standards to be 

used in conducting evaluations. 

Performance standards and guidelines including 

the appropriate use of testing techniques such 

as statistical sampling, simulation and modeling, processing of fictitious transactions, 

etc. 

The appropriate use of the reports of 

independent third parties on internal control 

and related matters. 

Materiality guidance for purposes of 

establishing reportable control weaknesses. 

Guidelines for the reporting of weaknesses to 

line management and subsequent follow-up to 

assure timely corrective action. 

3. Defining Personnel Requirements. Project success 

will greatly depend upon the quantity and quality of staff 

resources available to perform the evaluation. One of the 

Steering Committee's principal responsibilities should be to 

establish prelimlnary time goals for the completion of the evaluation and the identification of staff resources needed to support 

the Action Plan. The Committee should also be responsible for 

securing a management commitment to provide the required manpower 

resources neceessary to meet established time goals. 

To supplement assigned Project Team personnel, operating 

management of the program functions or activities being evaluated can be invited to participate ln the conduct of evaluations. 

The principal reasons f 

representatives in the 

increased insights and ! 

uated; (2) strengthen m 

and (3) promote acceptar 

correction of weaknesses 

The Committee shoulc 

which it is considered 

experts in such areas - 

personnel, insurance, ps 

Closely related to r 

use of internal audit OB 

cumstances kthey should 

4. Documentin 

To achieve a successful, 

tion, the roles and resp 

clearly stated and under 

ing Committee, Project 

participants. Their aut 

formally documented. In 

the Action Plan should > 

agency or department heat 

ization. Line managemen 

effort is critical to ac, 

on their understanding 0. 

program and administrati. 

asked to cooperate with 

resources to the evaluatl 

agement support for the I 

continuing support and c 
- 32 - 

The principal reasons for incorporating operating management 

representatives in the evaluation process is to: (1) add 

increased insights and perspectives into the areas being evaluated; (2) strengthen managerial commitment to the project; 

and (3) promote acceptance of the evaluation results and timely 

correction of weaknesses. 

The Committee should also address those circumstances in 

which it is considered appropriate to use outside consultants or 

experts in such areas as ADP, engineering, financial, legal, 

personnel, insurance, procurement, statistics, and economics. 

Closely related to resource policy issues is the appropriate 

use of internal audit or Inspector General staff. 

cumstances kthey should be limited to an advisory role. 

In most cir4. Documenting and Communicating Responsibilities. 

To achieve a successful, complete, orderly, and timely evaluation, the roles and responsibilities of each participant must be 

clearly stated and understood. This includes those of the Steering Committee, Project Teams, the Project Tehm Director and other 

participants. Their authorities and responsibilities should be 

formally documented. 

the Action Plan should be formalized in writing, approved by the 

agency or department head, and communicated throughout the organization. Line management support for the control evaluation 

effort is critical to achieving succe8s and is predicated largely 

on their understanding of its goals and objectives. 

program and administrative elements of the organization will be 

asked to cooperate with Project Team efforts and contribute staff 

resources to the evaluation. Their clear understanding of management support for the project will provide assurances of their 

continuing support and cooperation. 

In addition, the goals and objectives of 

Further, 
- 33 - 

ASSIGNING PROJECT DIRECTOR RESPONSIBILITIES expected to summar's 

the reaction of op 

mendat ions presente 

in the report on tt 

alternative control 

nesses identified. 

Planning, executing, evaluating and preparing timely reports 

on a series of diverse internal control evaluations requires significant organization. 

Project Teams should be formed under the direct supervision 

of a Project Team Director to conduct the individual program or 

activity evaluations specified by the Steering Committee. The 

Project Team Mrector will be the focal point for: 

assigned evaluation projects; (2) assigning project priorities, 

as well as specific evaluation tasks; (3) assuring compliance 

with standards and guidelines established by the Steering Committee; (4) arranging for manpower and logistha1 support; 

(5) acting as the senior spokesperson in dealing with management of the functions or activities being reviewed; (6) evaluating Project Team results; and (7) preparing reports to the 

Steering Committee. 

(1) planning 

It is likely that several different functions or activities 

will be reviewed simultaneously by different Project Teams. 

Accordingly, to assure that project staff is used effectively, 

sound project management techniques should be used. 

phases should be defined with fixed time goals and required 

interim progress reports. 

schedules, and PERT charts for large complex reviews are useful 

tools in monitoring activities of this nature. 

Project 

Milestone charts, baseline planning 

REPORTING BY THE PROJECT TEAMS 

At the conclusion of a Project Team's evaluation of internal 

controls within an assigned function or activity, it will prepare 

a report summarizing the results of its findings. The report is 

The report shot; 

estimated to be ino 

estimate of the cos 

enhancements, a sug 

mendations , and tk 

conducting the rev5 

function being evd 

evaluation or by a' 

should also be incB 

The Project Tez 

conclusions with til 

activity. This mg 

Project Team' s exia 

to the report any< 

appropriate and s&f 

Commit tee. 

REPORTING BY THE SI 

Although not Ti 

Committee must of 'r 

to the head of the 

with the results df 

mittee, will usus11 

department head' 8 
- 34 - 

i 

expected to summarize major control weaknesses identified and 

the reaction of operating management to the issues and recommendations presented. 

in the report on the extent to which other compensating or 

alternative controls could be relied upon to mitigate any weaknesses identified. 

It would also be appropriate to comment 

The report should suggest the extent of efforts and resources 

estimated to be involved in correcting reported weaknesses, an 

estimate of the cost benefit relationship of recommended control 

enhancements, a suggested time frame for implementation of recommendations, and the extent and degree of cooperation received in 

conducting the review. 

function being evaluated to weaknesses reported in a previous 

evaluation or by other evaluators, such as the Inspector General, 

should also be included. 

The responsiveness of management of the 

The Project Team Director will review each report and its 

conclusions with the Project Team and management of the affected 

activity. This may be accomplished through participation in the 

Project Team's exft conference. The Project Director will add 

to the report any clarifying or amplifying information deemed 

appropriate and schedule the report for review by the Steering 

Committee. 

REPORTING BY THE STEERING COMMTTEE 

Although not ltmited in its communications, the Steering 

Committee must of necessity submit at least one report annually 

to the head of the department or agency. This report, together 

with the results of personal discussions with the Steering Committee, will usually form the primary basis for the agency or 

department head's report to the President. Accordingly, the 
- 35 - 

annual Steering Committee report must include: 

fication of the reviews conducted during the year; (2) a summary 

of the results of those reviews; (3) the Steering Committee's 

recommended action, where management disagrees with the necessity 

for recommended control improvements; and (4) an estimate of 

resources needed to effect improvements and associated cost benefit considerations. 

will recommend the nature and form of report to be issued to the 

President by the head of the agency. 

content of such a report is included in the following chapter. 

(1) an identiMost importantly the Steering Committee 

Further discussion of the 

The Annual Report of t 

Agencies 

The Act requires t 

by the Office of Manag 

prepare an annual rep0 

of internal accounting 

must be submitted to tl 

the Congress and the plr 

The purpose of the 

central policy agenciej 

control systems in depr 

Federal Government. k 

control systems have a: 

management and they hm 

However, the passage c 

concern of the Congres: 

awareness of the statu, 

that effective control 

It is expected that 

increased management at 

Managements will hencej 

internal control systen 

adequacy before prepari 
- 36 - 

The Annual Report 

Agencies 

IV 

REPORTING 

f the Chief Executive artment I or 

The Act requires the head of each executive agency designated 

by the Office of Management and Budget, beginning in 1981, to 

prepare an annual report on the adequacy of the agency's systems 

of internal accountlng and administrative control. 

must be submitted to the President and shall also be available to 

the Congress and the Public. 

The report 

The purpose of the report is to provide the Congress and 

central policy agencies with an awareness of the adequacy of 

control systems in departments and agencies throughout the 

Federal Government. 

control systems have always been the primary responsibility of 

management and they have been the subject of auditors' reviews. 

However, the passage of the Act demonstrates the increasing 

concern of the Congress and the Public with maintaining an 

awareness of the status of control systems and their conviction 

that effective control systems contribute to better Government. 

Internal accounting and administrative 

It is expected that the reporting requirement will direct 

increased management attention to the importance of controls. 

Managements will henceforth be required to assess their agency's 

internal control systems by making a critical evaluation of their 

adequacy before preparing required annual reports. 
- 37 - 

Suggested Content of Agency Reports on Controls 

Under the Act, the Director of the Office of Management and 

Budget (OMB), in consultation with the Comptroller General, is 

required to establish the exact form of reporting to be used by 

agency executives and provide a general framework to guide them 

in performing evaluations of systems of internal accounting and 

administrative control. However, it is expected that a signif%- 

cant degree of reporting discretion shall be permitted, in which 

case consideration should be given to the following matters. 

The Act states that an adequate system of internal accounting 

and administrative control should provide reasonable, not absolute, assurance that the following objectives are achieved: 

o All obligations and costs were in compliance wlth 

applicable laws; 

o All funds, property, and other assets were safeguarded 

against waste, loss, unauthorized use, or misappropri- ation; and 

operations were properly recorded and accounted for 

to permit the preparation of reliable financial and 

statistical reports and to maintain accountability over 

assets. 

o All revenues and expenditures applicable to agency 

Management's report on its systems of internal control 

should, therefore, address whether in their opinion the systems 

appear to provide reasonable assurance that these objectives were 

achieved during each fiscal year. In this regard the report 

should include management's acceptance of primary responsibility 

for the adequacy of internal accounting and administrative controls. 

If no material weaknes 

during its ongoing evaluat 

concluding that systems pr 

control objectives specifi 

agement. If, however, a r 

weaknesses which indicate 

pletely achieved, manageme 

an unqualified opinion. 1 

identify the material weak 

completely achieving their 

plans for correcting these 

Management should incl 

unresolved findings on int 

or external audit reports. 

corrective action being ta 

concerning uncorrected mat 

audit reports. 

Management may also de 

undertaken to comply with 

example, may include a disl 

ongoing evaluations of int 

controls and the progress I 

t ion. 

In addition, managemeni 

tion of the status of GAO 

design and, where appropri, 

status. It should be reco: 

approval of executive agent 

an initial evaluation of fr 
- 38 - 

rd 

'Y 

m 

Id 

Eisch 

3ng 

0- 

ied 

i- 

~wer 

.ems 

i were 

llity 

:onIf no material weakness has been identified by management 

during its ongoing evaluation of controls, an unqualified opinion 

concluding that systems provide reasonable assurance of achieving 

control objectives specified by the Act can be expressed by management. If, however, a review discloses material control system 

weaknesses which indicate all control objectives may not be completely achieved, management would be precluded from expressing 

an unqualified opinion. 

identify the material weaknesses which prevent the systems from 

completely achieving their objectives and describe management' s 

plans for correcting these weaknesses. 

The report should in these circumstances 

Management should include in its report any explanation on 

unresolved findings on internal controls disclosed in internal 

or external audit reports. Such disclosures should describe the 

corrective action being taken or contemplated with target dates 

concerning uncorrected material weaknesses identified in the 

audit reports. 

Management may also describe the extent of efforts it has 

undertaken to comply with the Act. Such description, for 

example, may include a discussion of the plans adopted to perform 

ongoing evaluations of internal accounting and administrative 

controls and the progress made in completing their implementat ion. 

In addition, management's report should include a description of the status of GAO approval of its accounting system 

design and, where appropriate, plans for achieving approval 

status. It should be recognized, however, that GAO's review and 

approval of executive agency accounting system designs involves 

an initial evaluation of internal accounting controls which will 

F 
- 39 - 

require periodic reevaluations by the agencies after implementat ion. 

OTHER E 

Consideration should also be given to describing the status 

of OMB approval of administrative controls and fund procedures. 

Inspector General or Internal Auditor Reporting 

Inspectors General, as part of their currently required 

semiannual reports to the Congress, are expected to summarize any 

findings, opinions, conclusions or recommendations they may have 

regarding the internal accounting and administrative controls of 

their agency. For those agencies without an Inspector General, 

the head of the internal audit department should be expected to 

prepare a similar report to the head of their department or 

agency. In addition, Inspectors General and Internal Auditors 

are required by the Act to receive, investigate and report any 

allegations that agency employees have provided false or misleading information in connnection with the agency's evaluation 

of its control systems. 

Inspector General and agency head are expected to be complementary, not redundant. 

The reporting responsibilities of the 

Director of OMB Reporting 

After receipt of the Executive reports from departments and 

agencies the Director of OMB is expected to summarize their contents. This summarization will provide an overview of the control environment in the Federal Government as a whole and is 

expected to provide the President and the Congress with a plan 

and timetable for correcting any reported material weaknesses of 

the control systems in the Government. 

The Importance of the Cc 

In the earlier discu 

that administrative cont 

lishing the control enviorganization. In the dE 

controls which are respm 

ment, it was pointed out 

controls which (1) influs 

their individual respons:: 

agement's attitude towam 

environment, and (3) the? 

exists within the organk 

whether failure to complx 

ately measured disciplim 

It is widely accept& 

the credibility of an og 

accounting or administrat 

ronment. It is a frequen 

to create an appropriate 

tional units that has led 

the importance ascribed t 

the Public, additional co: 

A special advisory co 

organized by the American 

ants concluded that "an 07 

internal accounting contri 
- 40 - 

V 

OTHER EVALUATION CONSIDERATIONS 

nd 

In1- 

of 

The Importance of the Control Environment 

In the earlier discussion of controls, it was pointed out 

that administrative controls are largely responsible for establishing the control environment or control consciousness of an 

organization. In the discussion of the types of administrative 

controls which are responsible for creating the control environment, it was pointed out that generally they are the types of 

controls which (1) influence the degree of employee awareness of 

their individual responsibilities, (2) their impression of management's attitude toward maintaining an appropriately controlled 

environment, and (3) their perceptions of the discipline which 

exists within the organization. In short, thetr perception of 

whether failure to comply with controls will result in appropriately measured disciplinary action. 

It is widely accepted that the most influencing factor on 

the credibility of an organization's control system, be it either 

accounting or administrative, is the state of its control environment. It is a frequent impression that Government often fails 

to create an appropriate control environment within its organizational units that has led to fraud, waste and abuse. Because of 

the importance ascribed to this area by both professionals and 

the Public, additional comments appear particularly warranted. 

A special advisory committee on internal accounting control 

organized by the American Institute of Certified Public Accountants concluded that "an overall evaluation of an organization's 

internal accounting control environment is a necessary prelude 
- 41 - 

to the evaluation of control procedures and techniques." 

committee stated further that: 

The 

. . . a poor control environment would make some I1 

accounting controls inoperative for all intents and 

purposes; for example, individuals would hesitate to 

challenge a management's override of a specific control 

procedure. On the other hand, a strong control environment, for example, one with tight budgetary controls and 

an effective internal audit function, can si nificantly 

complement specific accounting control proceiures and 

techniques .I' 

The committee identified a number of factors which they 

believed to be important to the development of appropriate attitude, awareness, and discipline within an organization. They 

included : 

Organizational Structure--the establishment of appropriate reporting relationships, identification of functions 

to be performed by organizational units, and the establishment of authority, responsibilities, and constraints 

of key positions; 

Personnel--the competence and integrity of the organization's personnel; 

Delegation of Authority and Communication of Responsibilit --appropriate delegation or limitation ot 

----I+ aut ority in a manner that provides assurance that 

responsibilities are effectively discharged; 

Budgets and Financial Reports--formulation and communication of organizational goals through appropriate 

levels of budgeting and financial reporting; 

Organizational Checks and Balances--the establishment of 

an appropriate level of financial control and internal 

auditing; and 

ADP Consideration--when utilized, an awareness of the 

stren ths and exposures inherent in such an installation 

and tie implementation of controls to give recognition 

to their existence. 

While the importance I 

disputed, it remains that 

surrounding the implement 

control system is the ''at 

department or agency towa 

tudes will not only affec 

but also the quality of . 

all of which dramaticall, 

grammatic effectiveness. 

interest in development 

trol environment or contr 

indifference, a control . 

ineffectiveness. This i 

does not implement an aps 

through the use of an eff 

management review, or an 

The importance of the 

phasized. It must be ra 

not self-correcting. Lf 

process is in place to 

be disclosed only by the 

ther, the activities of 

A control system to be e 

conditions. And lastly, 

upon effectiveness of pel 

honesty, their adequacy 

frequent high rate of ch 

places special emphasis 

continuous monitoring pr 

a high level of control 
- 42 - 

While the importance of these individual areas cannot be 

disputed, it remains that the single most determinate factor 

surrounding the implementation and maintenance of an adequate 

control system is the "attitude" of senior management of the 

department or agency toward the importance of controls. Attitudes will not only affect the quality of employee performance, 

but also the quality of accounting, EDP and reporting systems, 

all of which dramatically influence organizational and programmatic effectiveness. If management demonstrates a lack of 

interest in development and maintenance of an appropriate control environment or contributes to its deterioration through 

indifference, a control system will quickly deteriorate into 

ineffectiveness. This is also the likely result if management 

does not implement an appropriate control monitoring procedure 

through the use of an effective internal audit process, periodic 

management review, or an appropriate combination thereof. 

The importance of the monitoring process cannot be overemphasized. It must be remembered that most control systems are 

not self-correcting. If control failures occur and no monitoring 

process is in place to detect their occurrence, the failure might 

be dlsclosed only by the detection of a subsequent fraud. 

ther, the activities of large government departments are dynamic. 

A control system to be effective must be responsive to changing 

conditions. 

upon effectiveness of people and their basic competence and 

honesty, their adequacy in number and their supervision. The 

frequent high rate of change of job assignments in Government 

places special emphasis on the necessity for an effective and 

continuous monitoring process as a check on the maintenance of 

a high level of control compliance and execution. 

FurAnd lastly, control systems are heavily dependent 

a 
- 43 - 

Organizational Responsibilities o Financi21 and c 

not utilized a: 

o Line supervisox 

control compli, 

o No procedures i 

all areas of OF 

timely basis; 

o Internal contrc 

in a timely fas 

o Controls and/or 

t ionship to or: 

resources. 

It is a frequent misconception in the Government that controls are the exclusive domain of the accounting or finance 

areas of the organization. Or even more disconcerting, that programmatic objectives and controls and accounting controls should 

be evaluated on a mutually exclusive basis. Effective execution 

of accounting and reporting activities requires the coordination 

and cooperation of all segments of the organization, be they 

administrative, programmatic or financial. The quality of the 

control environment and the control system, and the public's 

perception of the level of accountability achieved by the organization are totally dependent upon the coordination of administrative, programmatic and financial personnel. 

Symptoms of Control Deficiencies 

Experience has indicated that the existence of one or more 

of the following danger signals will usually be indicative of a 

poorly maintained or vulnerable control system. These symptoms 

may apply to the organization as a whole or to individual departments or activities. 

place a high priority upon a personal evaluation of these areas, 

because they usually dictate the quality of operational, as well 

as financial, control exercised by the organization. These 

danger signals include: 

Newly appointed chief executives usually 

o A clear statement does not exist for standards of 

employee ethical conduct; 

Policy and procedural or operational manuals are either nonexistant or are not currently maintained; 

Lines of organizational authority and responsibility are 

not clearly articulated or are nonexistent; 

o 

o 

Care should be exerc 

these symptoms or danger 

tion, are not permitted 

A number of efforts 

Private Sectors to ident 

usually associated with 

Standing Committee on Me 

Fraud as well as othersA 

conditions which often : 

primary objectives of th 

Waste and Abuse in Gover 

era1 of the United State 

lish information dealing 

factors which have contr 

fraud, waste and abuse i 

provide valuable input t 

control reviews. 

1. Management AccountinWave, 1980, Marshall E. 

Cherrington. 
- 44 - 

o Financial and operational reporting is not timely and is 

not utilized as an effective management tool; 

o Line supervisors ignore or do not adequately monitor 

control compliance; 

o No procedures are established to assure that controls in 

all areas of operation are evaluated on a reasonable and 

timely basis; 

Internal control weaknesses detected are not acted upon 

in a timely fashion; and 

tionship to Organizational exposure to risk of loss of 

resources. 

o 

o Controls and/or control evaluations bear little relaCare should be exercised by all organizations to assure that 

these symptoms or danger signals, if present within the organization, are not permitted to continue unabated. 

A number of efforts are taking place within the Public and 

Private Sectors to identify other symptomatic areas of weakness 

usually associated with inadequate control systems. 

Standing Committee on Methods, Perpetration and Detection of 

Fraud as well as others' have identified and published lists of 

conditions which often signal fraud opportunities. One of the 

primary objectives of the Task Force on Prevention of Fraud, 

Waste and Abuse in Government, organized by the Comptroller General of the United States, has been to study, classify and publish information dealing with those organizational or control 

factors which have contributed to previously disclosed acts of 

fraud, waste and abuse in the Government. These sources can 

provide valuable input to persons organizing and conducting 

control reviews. 

The AICPA'S 

1. Management Accounting, Red Flagging the White Collar Crime 

Wave, 1980, Marshall B. Romney, W. Steve Albrecht and David J. 

Cherrington. 
- 45 - 

Limitations Inherent in Control Systems 

Insofar as accounting control systems are concerned, the 

accounting profession has always recognized that, at best, systems can only be expected to provide reasonable assurance that 

their objectives are achieved. Consequently, no system should 

be implemented without giving effect to costlbenefit considerations. 

system or consideration of system enhancements, controls should 

not be implemented unless a reasonable costlbenefit relationship 

can be established. Of course, it should be recognized that not 

all factors bearing on costlbenefit decisions can be reduced to 

monetary terms and, accordingly, certain decisions will entail 

the use of considerable subjective judgment. 

Whether it be in the initial development of a control 

The American Institute of Certified Public Accountants has 

identified four other limitations of any system of internal 

accounting control. These limitations are generally stated in 

the following terms : 

o In the performance of most control procedures, errors 

can result from misunderstanding of instructions, mistakes of judgment, carelessness, or other personal factors; 

o Control procedures whose effectiveness depends upon segregation of duties can be circumvented by collusion; 

o Control procedures with respect to the execution and 

recording of transactions may be ineffective against 

either errors or irregularities perpetrated by management or inappropriate estimates and judgments by management in the preparation of financial statements; and 

Projection of 

ing controls t: 

that controls I 

conditions or 

control proced 

It should be remembc 

perfect and the need fo: 

as cost/benefit, reasom 

limitations inherent in 

the reviewers of contro: 

of system limitations a 

risk. Additionally, rev 

focus on apparent weakn 

instances of control em 

necessarily €or more CD 
- 46 - 

Projection of the adequacy of current internal accounting controls to future periods is subject to the risk 

that controls may become inadequate due to changes in 

conditions or due to the fact that compliance with 

control procedures may deteriorate. 

It should be remembered that no system of internal control is 

perfect and the need for controls is ever changing. Factors such 

as costfbenefit, reasonable assurance, and the other practical 

limitations inherent in control systems require managements and 

the reviewers of control systems to maintain a constant awareness 

of system limitations as well as organizational vulnerability and 

risk. Additionally, reviews of control systems should not only 

focus on apparent weaknesses but should also give attention to 

instances of control excesses. The need in the Government is not 

necessarily for more controls, but better controls. 

d 
- 47 - 

APPENDIX A 

FINANCIAL INTEGRITY ACT 

A BILL 

To amend the Accounting and Auditing Act of 1950 to require 

ongoing evaluations and reports on the adequacy of the systems of 

internal accounting and administrative control of each executive 

agency. 

Section 1. Short Title. 

This Act may be cited as the FINANCIAL INTEGRITY ACT of 1980. 

Section 2. (a) Findings. 

The Congress hereby finds that: 

Fraud, waste, and mismanagement have caused a serious 

crisis of confidence in Federal government programs and 

agencies. 

Fraud and errors in Federal programs are more likely to 

occur from a lack of effective systems of internal 

accounting and administrative control in the Federal 

agencies. 

Effective systems of internal accounting and 

administrative control provide the basic foundation upon 

which a structure of public accountability must be 

built. 

Effective systems of internal accounting and 

administrative control are necessary to provide 

assurance that Federal assets and funds are adequately 

safeguarded as well as to produce reliable financial 

information €or the agency. 

Systems of internal accounting and administrative 

control are necessarily dynamic and must be continuously 

evaluated and where necessary improved. 

(6) Reports regard1 

internal accoun 

Federal agency . Branch, the Con. 

agency's perfon accountability. 

(b) Policy. 

It is hereby declare1 

(1) Each Federal ag 

internal account 

integral part o 

control of each 

ongoing basis ar 

promptly correci 

(3) All levels of mr 

involve themselr 

systems of intea 

control to mink 

government fund, 

Section 3. As used i 

(a) The term "f 

United Stat 

(b) The term "C 

Comptroller 

(c) The term "I 

Office of 1. 

that: 

(2) The systems of 

Section 4. 

Section 113 of the Ac 

amended (31 U.S.C. 566a) 

the following new subsect 
- 48 - 

f 

on 

ily 

(6) Reports regarding the adequacy of the systems of 

internal accounting and administrative control of each 

Federal agency are necessary to enable the Executive 

Branch, the Congress and the public to evaluate the 

agency's performance of its public responsibilities and 

accountability. 

(b) Policy. 

It is hereby declared to be the policy of the United States 

that: 

(1 1 Each Federal agency must maintain effective s stems of 

internal accounting and administrative conttor as an 

integral part of its management practices. 

The systems of internal accounting and administrative 

control of each Federal agency shall be evaluated on an 

ongoing basis and when detected, weaknesses must be 

promptly corrected. 

All levels of management of the Federal agencies must 

involve themselves in assessing and strengthening the 

systems of internal accounting and administrative 

control to minimize fraud, errors, abuse, and waste of 

government funds. 

Section 3. As used in this Act: 

(a) The term "President" means the President of the 

United States. 

(b) The term "Comptroller General" means the 

Comptroller General of the United States. 

(c) The term "Director" means the Director of the 

Office of Management and Budget. 

Section 4. 

Section 113 of the Accounting and Auditing Act of 1950, as 

amended (31 U.S.C. §66a), is amended by adding at the end thereof 

the following new subsection: 
- 49 - 

(d) (1) To ensure that the requirements of subsection (a) (3) 

of this section are fully complied with, the head of each 

executive agency which the Director determines to be covered by 

this subsection, shall prepare a report stating an opinion on the 

adequacy of the agency's systems of internal accounting and 

administrative control by December 31, 1981, and by December 31 

following the end of each fiscal year thereafter. 

(2) The reports shall be signed by the head of each 

executive agency and addressed to the President. 

shall also be made available to Congress and the public. 

Such reports 

(3) By December 31, 1980, the Comptroller General in 

consultation with the Director shall establish a system of 

reporting and a general framework to guide the agencies in 

performing evaluations on their systems of internal accounting 

and administrative control. The Comptroller General, in 

consultation with the Director, may modify the format for the 

report or the framework for conducting the evaluations from time 

to time as deemed necessary. 

(4) Internal accounting and administrative controls are to 

be defined by the Comptroller General, and shall provide 

reasonable assurances that: 

All obli ations and costs were in compliance with 

applicabfe law. 

All funds, property, and other assets were 

safeguarded against waste, loss, unauthorized use 

or misappropriation. 

All revenues and expenditures applicable to 

agency operations were properly recorded and 

accounted for to permit the preparation of 

accounts and reliable financial and statistical 

reports - 

assets. 

Any inadequacy or mat 

of internal accounting an 

the head of the agency fr 

internal accounting and - 

reasonable assurances tha 

were achieved shall be id 

correcting any such hade 

(5) (a) The Inspector 

no Inspector General exi. 

internal audit staff, sha 

allegation that an emploj 

misleading information ir 

agency's systems of inter 

control or in connection 

report OLI the systems of 

control. 

(b) If, in conr 

subparagrap 

head of the 

determines 

believe the 

provided, k 

head of thE 

(c) The head ot 

referred tc 

take actior 

States Code 

corrective 
- 50 - 

2 

Ih 

e 

reports and to maintain accountability over the 

assets. 

Any inadequacy or material weaknesses in an agency’s systems 

of internal accounting and administrative control which prevents 

the head of the agency from stating that the agency’s systems of 

internal accounting and administrative control provided 

reasonable assurances that each of the objectives specified above 

were achieved shall be identified and the plans and schedule for 

correcting any such inadequacy described in detail. 

(5) (a) The Inspector General of an executive agency or, if 

no Inspector General exists for an agency, the head of the 

internal audit staff, shall receive and investigate any 

allegation that an employee of the agency provided false or 

misleading information in connection with the evaluation of the 

agency’s systems of internal accounting and administrative 

control or in connection with the preparation of the annual 

report oil the systems of internal accounting and administrative 

control. 

(b) If, in connection with any investigation under 

subparagraph (a), the Inspector General or the 

head of the internal audit staff, as appropriate, 

determines that there is reasonable cause to 

believe that false or misleading information was 

provided, he shall report that determination to the 

head of the agency. 

The head of the agency shall review any matter 

referred to him under subparagraph (b) and shall 

take action under Chapter 75 of Title 5, United 

States Code, or such other disciplinary or corrective action as he deems necesssary. 
- 51 - 

BIBLIOGRAPHY 

REPORTS AND PUBLICATIONS 

APPENDIX B 

Audit and Accounting Manual: Nonauthoritative Technical 

Practice Aids, Section AAM 4000 : American Institute of 

Certified Public Accountants, New York, 1979. 

Audit Guide for Assessing Reliability of Computer Output: 

U.S. Department of Commerce/National Bureau of 

Standards. 

Audit Guide for Reliability Assessment of Controls in 

Computerized Systems, (Financial Statement Audits): 

D.S. General Accounting Office, Washington, 1978. 

Commission on Auditor's Responsibilities , "Report Conclusions 

and Recommendations": American Institute of Certified 

Public Accountants, New York, 1978. 

Computer Security Publications: Institute of Computer 

Sciences and Technology - NBS Publications List 91, 

Washington, 19 7 9. 

Conclusions and Recommendations of the Special Advisory 

Committee on Reports by Management: Am erican Institute 

ot Certitied Publi c Accountants, New York, 1979. 

Controlling Assets and Transactions: How to Review and 

Improve Internal Accounting Control: Touche Ross & Co., 

New York, 1979. 

Enhancing Government Accountability, a Program for Evaluating 

Accounting Controls and Improving Public Reporting: 

Price Waterhouse L Co., New York, 1979. 

Evaluating Internal Control - A Guide for Management and 

Directors: Ernst & Wh inney, Cleveland, 1979 

A Focus on the Role of the Internal Auditor: Foundation for 

Auditability Research and Education, Inc., Institute for 

Internal Auditors, Inc. , Altamonte Springs , Florida , 1979. 

REPORTS AND PT 

Glossary for Computer Systt 

Processing Systems Put 

A Guide for Studying and E 

Controls: Ar thur Andr 

Guide to Accounting Contro 

Monitoring Controls Sa 

Guidelines for Automatic 0 

Federal Information fi 

Washington, 1979. 

Pork, 1919. 

Guidelines for Automatic D 

Mana ement: Federal yu'T6T9-T cat on 31, Wash& 

Internal Accounting Contro 

Management : Coopers 

Internal Auditing in Feder 

Standards and Concept, 

Washington , 19 14. 

Internal Control - Element, 

Importance to Managem 

Accountant: American 

Accountants, New York 

Internal Control in U.S. C 

Research Foundation o 

1980. 

Policies and Procedures Ma 

A bAnTi:t;82 encies : 

Reporting on Internal Acco 

Institute of Certifiel 

1980. 
- 52 - 

REPORTS AND PUBLICATIONS (Cont . ) 

F 

IS 

-r 

Glossary for Computer Systems Security: 

A Guide for Studying and Evaluating Internal Accounting 

Federal Information 

Processing Systems Publication 35, Washington, 1976. 

Controls: Arthur Andersen & Co., Chicago 19f8. 

Guide to Accounting Controls: Establishing, Evaluating and 

Monitoring Controls Systems, Price Waterhouse & Co., New 

Pork, 1979. 

Guidelines for Automatic Data Processing Risk Anal sis: 

Federal Information Processing Systems - Pub1 icition 65, 

Washington, 1979. 

Mana ement. Federal In ormation Processing Systems 

Guidelines for Automatic Data Processing Security and Risk 

31, Washingfton, 1974. 

Internal Accounting Control: A Practical Approach for 

Management: Coopers & Lybrand, New York, 1979. 

Internal Auditing in Federal Agencies: Basic Principles, 

Standards and Concepts: U.S. General Accounting Office, 

Washington, 1Yl4. 

Internal Control - Elements of a Coordinated System and Its 

Importance to Management and the Independent Public 

Accountant: American Institute of Certified Public 

Accountants, New York, 1979. 

Internal Control in U.S. Corporations: The State of the Art: 

Research Foundation ot Financial Executives Institute, 

1980. 

A encies Title 2: U.S. General Accounting Otfi ce , Policies and Procedures Manual for Guidance of Federal 

wSi?F--, ngton, 1978 

Reporting on Internal Accounting Control, SAS 30: American 

Institute of Certified Public Accountants, New York, 

1980. 
- 53 - -5 

REPORTS AND PUBLICATIONS (Cont . ) 

ARTICLES AND 

Report on the Special Advisory Committee on Internal 

Accounting Control: American Institute of Certified 

Public Accountants, New York, 1979. 

Oiiice ot Management and Budget Circular Number A-71, 

Security of Federal Automated Information Systems: U.S. 

Transmittal Memorandum No. 1 I 

Standards for the Professional Practice of Internal Auditing: 

Institute of Internal Auditors, Inc., Altamonte Springs, 

Florida, 1978. 

Statement on Auditing Procedures No. 52, "Reports on Internal 

Control Based on Criteria Established by Governmental 

Agencies": 

Accountants, New York, 1972. 

American Institute of Certified Public 

Statement on Auditing Procedure No. 54, "The Auditor's Study 

and Evaluation of Internal Control": American Institute 

of Certified Public Accountants, New York, 1972. 

Statement on Auditing Standards No. 1; Codification of 

Auditing Standards and Procedures, Section 320: 

American Institute of Certified public Accountants , New 

York, 1973. 

Systems Auditability and Control: Institute of Internal 

Auditors, Inc. , Altamonte Springs, Florida, 1977. 

ARTICLES AND BOOKS 

Anthony, R.N., J. Dearden and R.F. Vancil, "Management 

Control Systems: Cases and Readings": 

Anthony, R.N., "Planning and Control Systems: A Framework 

for Analysis": 

Administration, Harvard University, Boston, 1965. 

Graduate School of Business 

Brink, V.Z., J.A. Cashin and H. Witt, Modern Internal 

Auditin : An Operational Approach, Third Edit ion : 

dress, New York, 1973. 

Carmichael, D.R., and J.J. Wi 

Methods, Second Edition: 

Defliese, P.L., K.P. Johnson 

Auditin + , Ninth Edition: 

Deming, R.H., Characteristics 

Control System in an Inc 

School of Business Admir 

Boston, 1978. 

Master, Albert, Jr., and Kenc 

Internal Accounting Cont 

1968. 

Pomeranz, F., A.J. Cancellie1 

"Auditing in the Public 

Lamont, Boston, Ma. 197f 

Romney, Myshall B., Albrecht 

J., Red Flagging the W 

Management Accounting, I 

LEGISLATION i 

Budget and Accounting Rocedi 

Foreign Corrupt Practices Act 

Proposed Amendment to Regulat 

Securities and Exchange 

34-15772, File No. 57-7; 

Proposed SEC Requirement and 

Reports on Accounting CC 

New York, 1979. 

9 U. 5. UlVERNMWT PRINTRG OFFICE : 1981 720 
- 54 - 

ARTICLES AND BOOKS (Cont . ) 

Carmichael, D.R., and J.J. Willingham, Auditing Concepts and 

Methods, Second Edition: McGraw-HI11 Company. 

Defliese, P.L., K.P. Johnson and R.K. MacLeod, Mont omer 

Auditin , Ninth Edition: Ronald Press C0.M 

m+ 

Deming, R.H., Characteristics of an Effective Management 

Control System in an Industrial Organization: 

School of Business Administration, Harvard University, 

Boston, 1978. 

Internal Accounting Control : A Workshop Approach : 

1968. 

Pomeranz, F., A.J. Cancellieri, J.B. Stevens and J.L. Savage, 

"Auditing in the Public Sector": 

Lamont, Boston, Ma. 1976. 

Graduate 

Master, Albert, Jr., and Kenneth S. Johnson, "Assessine 

Warren, Gorham and 

Romney, Mfirshall B., Albrecht, Steve and Cherrington, David 

J., 

Management Accounting, 1980. 

Red Flagging the White Collar Crime Wave" 

LEGISLATION AND REGULATION 

Budget and Accounting Procedures Act of 1950 P.L. 

Foreign Corrupt Practices Act of 1977. 

Proposed Amendment to Regulation 7(a) of Regulation S-K, 

Securities and Exchange Commission 1978 (Release No. 

34-15772, File No. 57-779) 

Reports on Accounting Controls, Price Waterhouse br Co., 

New York, 1979. 

Proposed SEC Requirement and an Action Plan for Management 

t u. S. GOVERNMENT PR3NTINC OFFICE : 1g81 720-023/4814