Farm Credit Administration

Office of Inspector General

Audit Report

Farm Credit Administration’s 

Enterprise Risk Management and 

Internal Control Program

A-22-01

June 9, 2022
1501 Farm Credit Drive, McLean, VA 22102 703-883-4030 www.fca.gov/about/inspector-general

June 9, 2022 

The Honorable Glen R. Smith, Board Chairman 

The Honorable Jeffery S. Hall, Board Member

Farm Credit Administration

1501 Farm Credit Drive

McLean, Virginia 22102-5090

 

Dear Chairman Smith and Board Member Hall:

The Office of Inspector General (OIG) completed an audit of the Farm Credit Administration’s Enterprise 

Risk Management (ERM) and internal control program. The objective of this audit was to determine 

whether FCA had established an adequate ERM and internal control program. 

FCA had developed an ERM process, including an annual risk profile with prioritized risks, 

responsible offices, risk responses, and mitigating strategies. However, improvements are needed 

in the areas of risk monitoring, updating the risk appetite, addressing risk, and providing 

communication and training. For internal controls, FCA had developed a new risk and control selfassessment process, but it was not fully or consistently implemented. We also identified 

inconsistencies and incomplete processes related to risk information, reviews of service 

organizations, and monitoring improvements identified through internal control reviews. 

We made eight recommendations to improve the ERM and internal control program. FCA 

management agreed with the recommendations and provided corrective actions that were 

responsive to our recommendations. 

We appreciate the courtesies and professionalism extended by FCA to our staff during the audit. If you 

have any questions about this audit, we would be pleased to meet with you at your convenience. 

Respectfully,

Sonya K. Cerne 

Assistant Inspector General for Audits, Inspections, and Evaluations
EXECUTIVE SUMMARY

Farm Credit Administration’s Enterprise Risk Management 

and Internal Control Program 

Report No. A-22-01 June 9, 2022

Objective 

The objective of this audit was to 

determine whether FCA has 

established an adequate Enterprise 

Risk Management (ERM) and internal 

control program.

Recommendations

The Office of Inspector General made 

eight recommendations to the Office 

of the Chief Financial Officer to 

improve the ERM and internal control 

program. The recommendations 

relate to developing structured 

processes; updating policies, 

procedures, and guidance; 

implementing established internal 

control review processes; developing 

processes to review service 

organization control reports; training 

personnel; and developing a process 

to monitor gaps and 

recommendations identified in 

internal control reviews.

Agency Response

Management provided responsive 

corrective actions for the 

recommendations made in the 

report. Management agreed with all 

of the recommendations.

Why We did This Audit

The Farm Credit Administration (FCA) manages risks to address its 

mission. ERM provides an agency-wide approach to addressing the full 

spectrum of risks by understanding the impact of risks as an interrelated 

portfolio rather than addressing risks in silos. Internal control is a 

process that provides reasonable assurance that the objectives of the 

entity are achieved.

How We Did This Audit

We reviewed FCA’s ERM and internal control program. We reviewed 

FCA’s risk profiles and the process to update risk information. We 

reviewed the agency’s Management Control Plans and reviewed a 

sample of internal control reviews completed across Agency offices. For 

the reviews in our sample, we determined how the review was 

documented, when the review was completed, and whether deficiencies 

were identified. 

What We Found

We found FCA conducted annual risk assessments to identify risks, risk 

ratings, responsible offices, responses to risks, and mitigating 

strategies. The Agency had developed a new internal control review 

process to document internal control reviews using a risk and control 

matrix. Policies and procedures were developed to document 

requirements for both ERM and internal control evaluations.

However, we identified needed improvements to the Agency’s ERM and 

internal control processes. Specifically, we identified improvements 

related to risk monitoring, updating the risk appetite, addressing risk, 

and providing communication and training. Although the Agency 

developed a new internal control review process, it was not fully or 

consistently implemented. In addition, we identified improvements 

related to planning, reviews of service organizations, and monitoring 

internal control improvements. 
TABLE OF CONTENTS

Background .................................................................................................................................... 1

Farm Credit Administration................................................................................................................................ 1

Enterprise Risk Management ............................................................................................................................ 1

Internal Control....................................................................................................................................................... 2

Offices and Personnel with ERM and Internal Control Responsibilities............................................ 3

Prior Office of Inspector General Reports Relating to ERM and Internal Control

...................................................................................................................................................................................... 3

Objectives, Scope, and Methodology ......................................................................................... 4

Objective ................................................................................................................................................................... 4

Scope.......................................................................................................................................................................... 4

Methodology........................................................................................................................................................... 4

Audit Results.................................................................................................................................. 5

Enterprise Risk Management................................................................................................................................. 6

Risk Monitoring...................................................................................................................................................... 6

Risk Appetite and Addressing Risk ................................................................................................................. 6

Communication and Training............................................................................................................................ 7

Root Causes .................................................................................................................................................................. 7

Structured Processes ............................................................................................................................................ 7

PPM 1009 on the ERM Process......................................................................................................................... 8

Impact............................................................................................................................................................................. 8

Recommendation....................................................................................................................................................... 8

FCA Response.......................................................................................................................................................... 8

OIG Response.......................................................................................................................................................... 9

Internal Controls ......................................................................................................................................................... 9

Internal Control Review Process....................................................................................................................... 9

Internal Control Review Sample.................................................................................................................... 10

Inconsistent Risk Ratings ................................................................................................................................. 10

Service Organization Reviews ........................................................................................................................ 11

Internal Control Improvements ..................................................................................................................... 11

Root Causes ............................................................................................................................................................... 12

Implementation Strategy................................................................................................................................. 12
Service Organization Control Reports ........................................................................................................ 13

Training................................................................................................................................................................... 13

Monitoring Improvements .............................................................................................................................. 13

Impact.......................................................................................................................................................................... 13

Recommendations .................................................................................................................................................. 14

FCA Response....................................................................................................................................................... 14

OIG Response....................................................................................................................................................... 14

Management Comments ............................................................................................................ 15

Acronyms .....................................................................................................................................17
1 

BACKGROUND

Farm Credit Administration

The Farm Credit Administration (FCA or Agency) is an independent federal agency responsible for 

regulating, examining, and supervising the Farm Credit System (System) and the Federal 

Agricultural Mortgage Corporation (Farmer Mac). The Agency is responsible for ensuring that all 

System institutions are safe, sound, and dependable sources of credit and related services for all 

creditworthy and eligible persons in agriculture and rural America. A key element of managing 

challenges and threats to the mission is risk management. Federal agencies are responsible for 

implementing management practices that effectively identify, assess, respond, and report on risks. 

Enterprise Risk Management

On July 15, 2016, the Office of Management and Budget (OMB) issued an updated Circular A-123, 

Management’s Responsibility for Enterprise Risk Management and Internal Control (A-123). A-123 

requires agencies to implement an Enterprise Risk Management (ERM) capability coordinated with 

strategic planning and internal control processes required by the Federal Managers’ Financial 

Integrity Act and the Government Accountability Office’s Standards for Internal Control in the 

Federal Government (Green Book). 

A-123 defines management’s responsibility for ERM and internal controls and requires these 

functions to be integrated. ERM is an agency-wide approach to addressing the full spectrum of 

an organization’s risks by understanding the impact of risks as an interrelated portfolio, rather 

than addressing risks within silos. While there are many approaches to implement ERM, A-123 

states that most include the following elements: 

• Establish the context- understanding and articulating the internal and external 

environments of the organization, 

• Initial risk identification- using a structured and systematic approach to recognizing where 

the potential for undesired outcomes or opportunities can arise, 

• Analyze and evaluate risks- considering the causes, sources, probability of the risk 

occurring, the potential positive or negative outcomes, and then prioritizing the results of 

the analysis, 

• Develop alternatives- systematically identifying and assessing a range of risk response 

options guided by risk appetite, 

• Respond to risks- making decisions about the best option(s) among a number of 

alternatives, and then preparing and executing the selected response strategy, 

• Monitor and review- evaluating and monitoring performance to determine whether the 

implemented risk management options achieved the stated goals and objectives, and 

• Continuous risk identification- must be an iterative process, occurring throughout the year 

to include surveillance of leading indicators of future risk from internal and external 

environments.
2 

Each year, agencies are required to develop a risk profile. The primary purpose of the risk profile 

is to provide an analysis of the risks an agency faces toward achieving its strategic objectives and 

to identify appropriate options for addressing significant risks. As part of developing a risk profile, 

agencies must determine those risks for which the appropriate response includes implementation 

of formal internal control activities. 

Internal Control

A key factor for accountability is to implement an effective internal control system. The Green 

Book defines internal control as a process effected by an entity’s oversight body, management, 

and other personnel that provides reasonable assurance that the objectives of the entity are 

achieved. The Green Book provides the framework and criteria for designing, implementing, and 

operating an effective system of internal control. The framework includes five components and 

seventeen required principles.1

 

The 17 Principles Supporting the Five Components of Internal Control

To monitor and assess internal controls, FCA develops an Agency-wide Management Control Plan 

each fiscal year (FY). The Management Control Plan includes review elements for each Agency 

office, the risk for each element, and the applicable review cycle. The Management Control Plan 

assigns a risk of high, medium, or low for each review element, which correlates with the internal 

control review cycle. 

1 The Green Book includes a complete description of components, principles, and attributes explaining the 

principles. The Green Book can be viewed at https://www.gao.gov/greenbook. 
3 

Offices and Personnel with ERM and Internal Control Responsibilities

FCA’s Chief Financial Officer is responsible for coordinating FCA’s ERM and internal control efforts 

and ensuring compliance with associated requirements. The Office of the Chief Financial Officer 

(OCFO) also has a staff member dedicated to risk management and internal control initiatives. For 

all other Agency personnel, ERM and internal control responsibilities are a collateral duty. The FCA 

Board provides oversight of the Agency’s risk management capabilities and the FCA Board 

Chairman submits an annual assurance statement on the effectiveness of internal controls. FCA’s 

Chief Operating Officer (COO) has overall responsibility for operations, management functions, 

and performance outcomes. Each FCA office is involved in implementing processes and controls 

to identify, assess, and report on risks. FCA maintains a Senior Assessment Team, with 

representatives from each programmatic office,2 to conduct assessments of internal controls in 

their own offices based on the Management Control Plan.

Requirements for the ERM and internal control program are documented in policies and 

procedures. Policies and Procedures Manual (PPM) 1009, Enterprise Risk Management Program

(October 2020), describes roles and responsibilities and the Agency’s required annual risk 

assessment. PPM 1007, Evaluation of Internal Control Systems (May 2021), describes guidelines, 

requirements, and procedures for the Agency’s risk and control self-assessment process. 

Prior Office of Inspector General Reports Relating to ERM and Internal Control

The FCA Office of Inspector General (OIG) issued an audit report in July 2005, Performance 

Management and Internal Control Program (05-02), to determine whether the Agency is 

adequately verifying and validating performance measure accomplishments presented in the FCA 

Performance and Accountability Report. The review also evaluated the adequacy of supporting 

documentation for the Agency’s internal control program review assessments. The audit 

determined the Agency’s internal management control program could be enhanced to be a more 

systematic integration of internal control review efforts and approached and written in a more 

standardized format. The report included an agreed-upon action and two recommendations:

1. The Office of Policy and Analysis Director will revise the process on reporting performance 

results for supplemental approach to provide a better match between the numbers of 

supplemental approach that are used during the rulemaking process for a single 

regulatory initiative. Also, the Director will review supplemental approaches counted in the 

Performance and Accountability Report to ensure methods used are consistent with the 

supplemental approach definition.

2 The Senior Assessment Team includes personnel in OCFO, the Office of Examination, Office of Agency 

Services (OAS), Office of Information Technology (OIT), Office of Regulatory Policy, Office of General 

Counsel, Office of Data Analytics and Economics (ODAE), Office of Congressional and Public Affairs, Office 

of Secondary Market Oversight (OSMO), Office of Equal Employment Opportunity and Inclusion, and Office 

of the Board.
4 

2. The Chief of Staff should establish a senior assessment team as suggested by OMB Circular 

No. A-123, “Management Responsibility for Internal Control,” December 2004, to ensure 

a consistent level perspective is applied to the internal control program.

3. Prototype the Committee of Sponsoring Organization framework on several agencies’ 

processes and obtain staff recommendations on how it can be adopted for Farm Credit 

Administration environment.

All items were closed by December 2006.

OBJECTIVES, SCOPE, AND METHODOLOGY

Objective

The objective of this audit was to determine whether FCA has established an adequate ERM and 

internal control program. We performed this audit at FCA’s headquarters in McLean, Virginia from 

December 2021 through May 2022. 

Scope

The scope of the audit was limited to FCA’s ERM and internal control program from FY 2019 to FY 

2021. 

Methodology

We took the following steps to accomplish the objective: 

• Identified and reviewed related laws, regulations, circulars, guidance, and other 

background information applicable to the objective; 

• Identified and reviewed applicable internal FCA policies and procedures; 

• Reviewed prior FCA OIG and other external reviews related to the audit objective;

• Interviewed OCFO personnel and OIT personnel involved in development of the risk 

dashboard; and

• Reviewed risk documentation, the risk dashboard, Management Control Plans, annual 

internal control reporting documentation, and a sample of internal control reviews.

Tests Performed

 We requested and reviewed the Agency’s risk profiles for 2019, 2020, and 2021. For the 

2021 risk profile, we analyzed risk information in the Agency’s web-based risk dashboard. 

We reviewed the dashboard to identify risks, assigned primary office, inherent risk ratings, 

risk response, mitigating strategies, activity in the dashboard, and personnel assigned to 

risks. 

 We reviewed the Agency’s Management Control Plans for FY 2019, FY 2020, and FY 2021 

to determine what elements were included and how the plans changed.
5 

 We selected and analyzed a judgmental sample of internal control reviews. We 

judgmentally selected 14 of the 56 review elements in the FY 2021 Management Control 

Plan based on FCA offices, review elements, timeframes of reviews, and risk ratings. We 

reviewed the sampled internal control reviews for steps included, dates of the review, and 

whether deficiencies were identified. Because the sample was judgmental, it cannot be 

projected to the population. 

 We requested reviews of service organization control reports for the Bureau of the Fiscal 

Service and National Finance Center. We requested these reviews because they are 

applicable to the internal control reviews in our sample. We determined what steps were 

completed to identify, document, and test relevant controls in the service organization’s 

report.

Generally Accepted Government Auditing Standards

We conducted this audit in accordance with Generally Accepted Government Auditing Standards. 

Those standards require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions based on our audit 

objective. We believe that the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objective. 

We reviewed internal controls identified as significant to the audit objective and did not identify 

any material control weaknesses. Given the interrelatedness with our objective, we determined 

internal control components were significant to our objective. We designed audit procedures to 

assess internal control to the extent necessary to address our objectives. Because our review was 

limited, it would not necessarily have disclosed all internal control deficiencies that may have 

existed at the time of our audit. We also assessed the reliability of data relevant to our audit 

objective and determined that the data was sufficiently reliable. 

We considered the risk of fraud and abuse during our audit, and nothing came to our attention 

to indicate fraud or abuse was occurring.

AUDIT RESULTS

We found FCA began implementing an ERM strategy and revised internal control review process. 

The Agency developed an annual risk profile with prioritized risks, responsible offices, risk 

responses, and mitigating strategies. For internal controls, the Agency prepared an annual 

Management Control Plan describing review elements, risks, and review cycles. The Agency 

developed a new risk and control self-assessment process to document controls, evaluation of 

control design, and tests of operating effectiveness. 

However, we identified opportunities for improvement in the Agency’s ERM and internal control 

program. Specifically, the Agency had not fully developed and documented risk management 

processes. While FCA revised its internal control review process, it was not fully or consistently 

implemented. 
6 

Enterprise Risk Management 

We found FCA developed an ERM process, but improvements are needed in the following areas: 

monitoring risk, updating the risk appetite, addressing risk, and providing additional 

communication and training. 

Risk Monitoring

The risk profile documents the Agency’s analysis of the risks in achieving its strategic objectives 

and identifies appropriate options for addressing significant risks. FCA developed an annual risk 

profile with key risk information, but the process to update the risk profile was siloed and not fully 

documented. In 2019 and 2020, the risk profile was a stand-alone document. It identified risks, 

types of risk, capability to manage risk, the risk outlook, and key mitigating action plans. The final 

profiles did not include the review date or who participated in the review. In 2021, the Agency 

developed a web-based dashboard, which served as its risk profile. The dashboard enhanced risk 

information by creating a centralized repository with real-time information and a prioritized view 

of risks that is accessible to all employees. Furthermore, the dashboard incorporated risk 

responses and an activity log showing who changed risk information. The Agency assigns a 

primary office with responsibility for each risk in the risk dashboard. 

While the risk dashboard was an improvement over the previous process, it did not document 

reviews or approvals of risk information. For the 2021 risk profile, OCFO sent emails and met with 

offices to review and update the risks they were assigned in the dashboard. For the 50 risks in the 

dashboard, 37 had only been modified by OCFO. Of those 37 risks, 33 were noted as being 

modified on a single day in July 2021. In addition, the risk dashboard did not capture reviews by 

responsible personnel. OCFO provided emails and meeting invitations to document responsible 

officials’ reviews of risk information in 2021, but documentation did not address reviews with the 

Office of the Chief Operating Officer. Five risks that affect multiple offices were assigned to the 

COO in the dashboard. Some of these risks were then sent to other offices to review as part of the 

2021 risk profile; however, this process was not fully documented and furthered the Agency’s 

siloed consideration of risks. Furthermore, emails and meeting invitations do not fully evidence 

who participated in the meeting and whether risks were reviewed. 

Risk Appetite and Addressing Risk

An ERM framework allows agencies to increase risk awareness and transparency, improve risk 

management strategies, and select risk responses based on the Agency’s risk appetite and 

thresholds. Risk appetite is the determination of the amount of risk an organization is willing to 

accept in pursuit of its mission. FCA’s risk appetite was last updated in April 2017. The risk appetite 

is established based on input from the most senior level leadership. However, there have been 

numerous changes to FCA’s senior leadership since April 2017, including the COO, Chief Examiner, 

Chief Human Capital Officer, and Chief Data Officer. 

Agencies apply the risk appetite to determine how risks will be addressed. A key component of 

this process is the identification of alternative responses and strategies to address risk. FCA’s risk 
7 

dashboard included mitigating strategies for each risk, but it did not include details such as current 

and proposed responses, costs of specific strategies, or non-financial implications of alternatives. 

Milestones are another important decision-making and performance management tool. FCA did 

not track milestones for carrying out identified strategies. 

Communication and Training

Risk management communication and training were ad-hoc. PPM 1009 states the ERM Program 

is intended to provide communications and training related to risk management to increase the 

level of awareness and understanding. Risk awareness is essential for senior leaders as well as 

personnel at all levels who may identify risks as part of day-to-day operations. The Agency 

provided limited information documenting communication and training on ERM and risk 

management responsibilities. OCFO stated most training is one-on-one and provided ERM 

briefing materials and meeting invitations from 2019 and 2020. Furthermore, officials stated risk 

information is shared with the Chief Financial Officer, who decides what communication happens 

next, and there is an expectation that leadership is reviewing the risk dashboard. However, the 

Agency did not have set meetings or reporting to communicate on key enterprise risks, share risk 

information with appropriate personnel, or provide training on risk management. 

Root Causes

Several root causes contributed to the identified opportunities to enhance FCA’s ERM strategy. 

Structured Processes

The Agency had not established structured risk management processes. Specifically, the Agency 

did not have organized processes for: 

• Cross-organizational reviews of risks, 

• Monitoring risks throughout the year,

• Approving the risk profile, 

• Updating its risk appetite,

• Evaluating strategies to address risk, or 

• Communicating risk information and responsibilities. 

Structured, formalized processes support timely, consistent, and efficient risk assessment. Because 

risks and responses can change at any time, it is important to define the steps, timeframes, and 

reporting that will take place across the Agency. As a small agency that assigns ERM

responsibilities to office directors with other core duties, FCA may gain efficiencies by integrating 

existing business processes with risk management. As an example, cross-organizational reviews 

of risks and monitoring activities may be accomplished as part of existing meetings with senior 

staff. Additionally, consideration should be given to which processes may be accomplished or 

facilitated through the existing risk dashboard. 
8 

PPM 1009 on the ERM Process

PPM 1009 did not fully document specific procedures for the Agency’s ERM process. PPM 1009 

documents roles and responsibilities, the requirement for an annual risk assessment, and broad 

expectations related to risk management. However, it does not describe specific steps for risk 

management activities across the Agency. As an example, PPM 1009 states management will 

review the risk dashboard on a regular basis, but it does not describe the personnel, timeframes, 

or documentation for such reviews. As another example, PPM 1009 states risk management 

practices should be integrated with internal control functions and coordinated with the strategic 

planning and strategic review process, but it does not explain steps for linking these programs or 

how the Agency will achieve the integration. Documented procedures provide accountability and 

support consistent implementation across Agency offices. Procedures also serve as a guidebook 

and reference material. This is especially important at FCA where risk management is an additional 

duty for all but one staff member.

Impact

Because agencies cannot predict or address every risk, ERM is important as it provides a process 

to identify, measure, assess, and prioritize risks. This risk assessment process helps the Agency to 

effectively achieve its strategic objectives. Effective risk management facilitates continual 

organizational improvement and informs decision-making. By taking a portfolio-based view of 

risks and understanding their combined impact, FCA can determine how to effectively prioritize 

resources, address uncertainty, and mitigate challenges. 

Recommendation

To enhance the Agency’s risk management program:

1. The Office of Inspector General recommends the Office of the Chief Financial Officer 

develop and document structured processes for:

• Cross-organizational reviews of risks;

• Monitoring risk information throughout the year;

• Approving the risk profile;

• Updating the risk appetite;

• Evaluating strategies to address risk; and

• Providing communication and training to personnel with risk management 

responsibilities.

FCA Response

FCA Management agreed with the recommendation. Management agreed to update and approve 

risk profiles. Senior staff will meet quarterly to monitor risk information and mitigating strategies. 

Management also stated the 2017 risk appetite statement will be rescinded and that the Agency 

would procure additional risk management and training services. 

Management estimated the actions will be completed by December 2022.
9 

OIG Response

The OIG finds the actions responsive to our recommendation. OCFO’s response to the 

recommendation can be found in the Management Comments section of the report. 

Internal Controls

We found the Agency did not fully document and implement its new risk and control selfassessment process. Incomplete and inconsistent reviews of control activities may increase risk to 

the Agency.

Internal Control Review Process

Internal control reviews provide an in-depth analysis of controls for specific business processes to 

determine if such controls are designed and operating effectively. PPM 1007, on the evaluation of 

internal control systems, describes steps for assessing internal controls, including: planning and 

scoping; documenting controls and evaluating control design; testing operating effectiveness; 

identifying deficiencies and corrective action plans; and reporting. For reporting, PPM 1007 

instructs offices to use the Assessment of Internal Controls Form (Assessment Form). The form 

includes high-level questions, ratings, and explanations for assigned ratings. Questions addressed 

on the form include: 

• How well has the office delineated management responsibility for this activity?

• How well are goals of this activity documented, monitored, and reported?

• How adequately has line of authority for this activity been established at appropriate 

levels?

• How adequately have internal policies and procedures for this activity been documented, 

evaluated for conformity with laws and regulations, maintained and monitored?

• How well are staff members trained in performing this activity?

• How responsive has management for this activity been to recommendations?

• How adequately has the budget for this activity been monitored against expenditures?

An official stated that the Assessment Form did not address current guidance and was being 

phased out and replaced with a new process using a risk and control matrix. FCA’s risk and control 

matrix documents risks and inherent risk ratings; control activities; evaluations of control design; 

and testing plans to determine whether controls are functioning properly. Despite having 

undergone revisions in 2020 and 2021, PPM 1007 still instructed staff to use the Assessment Form 

for internal control reviews. 
10

Internal Control Review Sample

We selected a judgmental sample of 14 internal control reviews conducted across FCA offices3 to 

determine if the Agency was following the documented internal process. We found that offices 

were inconsistently implementing the new process using the risk and control matrix. Specifically, 

for the 14 reviews we sampled:

• Eight utilized the assessment of internal controls form. Each form included ratings and 

explanations for assigned ratings. However, explanations included varying levels of detail 

and did not provide an in-depth analysis of controls, control design, and tests of operating 

effectiveness. For each review that utilized the Assessment Form, we requested additional 

supporting documentation for the review. We were provided additional supporting 

documentation for two reviews, both from the same office; however, the additional 

support did not fully document controls or control testing. 

• Five utilized the risk and control matrix. However, two were incomplete and did not include 

all components. Specifically, two reviews we sampled, completed by OCFO for FY 2021, 

did not include the test plan. The test plan documents procedures to gain evidence that 

supports the operating effectiveness of each control. This includes documentation of tests 

performed, who conducted testing on what date, and results. 

• One internal control review did not utilize the Assessment Form or the risk and control 

matrix and completed a separate review and report. The review addressed required steps, 

including the scope of work, activities performed, testing, findings, and internal controls. 

The review included supporting documentation and did not identify corrective actions

needed or opportunities for improvement.

Inconsistent Risk Ratings

We identified inconsistencies across the risk identification and assessment process. The risk 

assessment portion of the risk and control matrix calculates inherent risk ratings for risks within 

specific business processes. Business processes are also rated as low, medium, or high risk in the 

Agency’s Management Control Plan. We noted inconsistencies in risk ratings in related business 

processes. Specifically, for the five reviews we sampled, related business processes in the matrix 

did not correlate to overall risk ratings in the Management Control Plan: 

3 To select our sample, we reviewed the Agency’s FY 2021 Management Control Plan, excluding the OIG. 

We judgmentally selected 14 internal control reviews, with at least one from each office. For offices that 

completed multiple reviews, we selected review elements that were rated high or medium risk. Because our 

sample was judgmental, results cannot be projected across the population.
11

Risks in the Management Control Plan and Risk and Control Matrix

Process Responsible Office

Management 

Control Plan Risk 

Rating

Risk and Control 

Matrix Risk 

Assessment 

Compliance with 

Foundations for 

Evidence-Based 

Policymaking Act of 2018

ODAE High Low

Security and Vulnerability 

Testing and Remediation OIT High Low

Assessment Processing OCFO High Medium

Payroll Reconciliation OCFO High Low

General Oversight and 

Supervision of Farmer 

Mac

OSMO Medium Low

Service Organization Reviews

Improvements are needed regarding the process to review service organization control reports. 

Service organizations are responsible for providing assurances to customer agencies and assisting 

customers in understanding the relationship between controls at the service organization and 

controls at the customer agency. Service organizations, including the Bureau of the Fiscal Service 

and National Finance Center, are an important part of FCA’s accounting and payroll control 

structure. PPM 1007 states offices should identify, document, and test complementary customer 

agency controls, at FCA, from the service organization’s report. This process helps FCA determine 

whether appropriate controls are in place to support activities at the service organization. We 

requested the Agency’s reviews of service organization control reports for the Bureau of the Fiscal 

Service and National Finance Center for FY 2021. OCFO provided its assessment of the Bureau of 

the Fiscal Service’s report that identified customer agency controls, but it did not include test 

work. An assessment of the National Finance Center’s report was not conducted.

Internal Control Improvements

FCA did not have a process to monitor implementation of improvements identified through 

internal control reviews. One risk and control matrix we sampled included recommendations in 

the FY 2021 test plan. The recommendations addressed specific steps needed to correct the issue 

and identified process owners; however, recommendations did not include targeted completion 

milestones. Five of the Assessment Forms in our sample identified areas for improvement related 
12

to policies and procedures, internal reviews, performance monitoring, and documentation. 

However, the forms did not fully address whether corrective steps would be tracked, responsible 

personnel, or milestones for completion. PPM 1007 states monitoring should be commensurate 

with the severity of the deficiency and that management may, at its discretion, track findings 

considered to be less than a reportable condition. However, the monitoring process was not 

clearly defined. 

Root Causes

Several root causes contributed to FCA’s inconsistent approach to assessing internal controls. 

Addressing identified causes will strengthen the control environment and assurances over key 

controls. 

Implementation Strategy

FCA’s implementation of the new risk and control self-assessment process was inefficient and 

prolonged. The new process was rolled out in 2020. However, it was only used by one office, 

ODAE. Officials stated ODAE was new, so it made sense for them to start using the new process. 

In 2021, one additional office, OSMO, implemented the new process, and two offices partially 

implemented the new process. OCFO utilized the risk and control matrix without completing 

testing, and OIT used the new process for two of its five internal control reviews in 2021. OCFO 

stated that the new process was being implemented in phases and testing for OCFO would be 

implemented in 2022. The agency’s implementation strategy was not based on office size, 

responsibility for the most significant risks, or business processes with the highest risk. By

incrementally implementing the new process for two offices a year, it would take FCA at least until 

2026, six years later, to fully implement the new process for all 11 offices.

Delayed planning also impacts implementation of the new internal control review process. 

Management Control Plans were not completed by the start of the covered period. The 

Management Control Plan documents the Agency’s risk-based internal control review schedule 

for the current FY and the subsequent five FYs. However, the FY 2019 plan was updated in January 

2019, the FY 2020 plan was updated from October 2019 through April 2020, and the FY 2021 plan 

was updated in December 2020. Delayed planning reduces the amount of time to evaluate control 

activities and implement new processes for the highest risk areas. 

Despite recent updates, policies, procedures, and guidance did not reflect the new risk and control 

self-assessment process. As noted, PPM 1007 still referenced the Assessment Form. In addition, 

the Agency prepared annual guidance that still included the Assessment Form as a template. The 

Assessment Form was also not designed to document internal control reviews. Before 2020 

revisions, PPM 1007 explained that the Assessment Form was used to document annual risk 

assessments incorporated in the Agency’s Management Control Plan. The form’s use was 

significantly changed without updates to address the steps to evaluate internal controls.
13

Service Organization Control Reports

PPM 1007 instructs offices to review service organization control reports. However, the Agency 

did not have a process to share reports with responsible offices. OCFO stated OAS was responsible 

for reviewing the National Finance Center’s service organization control report. However, OAS 

stated that they did not receive the report from OCFO in 2021. This review is important because 

agencies are ultimately responsible for services and processes provided by third parties. 

Furthermore, these reviews can help FCA identify relevant controls, ensure the report covers 

applicable periods, and determine the impact of deficiencies on FCA. 

Training

FCA had not emphasized the importance of training personnel in duties and responsibilities 

related to internal controls. Office directors select Senior Assessment Team members to conduct 

internal control reviews of their own offices. These responsibilities are an additional duty and not 

the employee’s core role. An official stated one-on-one training is conducted with individuals that 

transition to the Senior Assessment Team; however, the Agency did not have a formalized training 

process established. Understanding control activities and review requirements is critical for an 

effective evaluation process. Training is especially important when requirements change or new 

processes are implemented. 

Monitoring Improvements

FCA had a decentralized approach to track improvements identified in internal control reviews. 

Offices, and Senior Assessment Team members, are responsible for assessing internal controls, 

evaluating the severity of identified improvements, and monitoring correction of gaps and 

recommendations. Additional accountabilities help to ensure improvements are addressed 

effectively and efficiently. Internal control reviews were also not in a format to facilitate monitoring 

improvements. The risk and control matrix identified design gaps and recommendations, but it 

was not consistently implemented across the Agency. In addition, the risk and control matrix did 

not incorporate targeted milestones to implement needed improvements. The Assessment Form 

did not delineate identified improvements and included these areas in explanations for assigned 

ratings. Because the Assessment Form was not designed to document internal control reviews, it 

was not clear whether identified improvements warranted monitoring of corrective steps.

Impact

Internal controls help the Agency run efficiently and effectively, report reliable information, and 

comply with requirements. An effective internal control system increases the likelihood that 

objectives will be met. When controls are not designed and operating effectively, it increases risk 

across the Agency. Continuous, strategic assessments of control activities provide a mechanism 

to identify and correct deficiencies. Resolving deficiencies is a critical aspect of accountability and 

managing key risks. The assessment process also supports annual assurances on the effectiveness 

of controls across the organization. 
14

Recommendations

To implement and document the internal control program: 

2. The Office of Inspector General recommends the Office of the Chief Financial Officer 

implement the current internal control review process across Farm Credit Administration 

offices.

3. The Office of Inspector General recommends the Office of the Chief Financial Officer

update Policies and Procedures Manual 1007 and annual guidance to reflect the current 

internal control review process.

4. The Office of Inspector General recommends the Office of the Chief Financial Officer 

develop and document timelines for updating the Agency’s Management Control Plan. 

5. The Office of Inspector General recommends the Office of the Chief Financial Officer 

develop and document a process to review service organization control reports.

6. The Office of Inspector General recommends the Office of the Chief Financial Officer 

determine the needs of the Agency related to internal control reviewers. 

7. The Office of Inspector General recommends the Office of the Chief Financial Officer train 

internal control reviewers on requirements and responsibilities.

8. The Office of Inspector General recommends the Office of the Chief Financial Officer 

develop and document a process to monitor gaps and recommendations identified in 

internal control reviews.

FCA Response

Management agreed with the recommendations. Management stated risk and control matrices 

would be developed for additional offices in FY 2022 and FY 2023 and OCFO would update PPM 

1007. Management stated that the Management Control Plan would be replaced with a testing 

schedule based on the risk and control matrix. In addition, OCFO will develop a template to 

document reviews of complementary customer agency controls. For the Senior Assessment Team, 

management stated that members would be assigned to review other offices and services will be 

procured to develop training based on targeted audiences. Lastly, management will develop a 

workflow to document and track gaps and recommendations in internal control reviews.

Management estimated the actions will be completed by November 2023.

OIG Response

The OIG finds the actions responsive to our recommendations. OCFO’s responses to the 

recommendations can be found in the Management Comments section of the report. 

The Agency waived an exit conference.
15

MANAGEMENT COMMENTS
16
17

ACRONYMS

COO Chief Operating Officer

ERM Enterprise Risk Management

Farmer Mac Federal Agricultural Mortgage Corporation

FCA or Agency Farm Credit Administration

FCS or System Farm Credit System

FY fiscal year

OAS Office of Agency Services

OCFO Office of the Chief Financial Officer 

ODAE Office of Data Analytics and Economics

OIG Office of Inspector General

OIT Office of Information Technology

OMB Office of Management and Budget

OSMO Office of Secondary Market Oversight

PPM Policies and Procedures Manual
18

REPORT FRAUD, WASTE, ABUSE, & 

MISMANAGEMENT

Fraud, waste, abuse, and mismanagement in government concerns 

everyone: Office of Inspector General staff, FCA employees, Congress, 

and the general public. We actively solicit allegations of any inefficient 

and wasteful practices, fraud, and mismanagement related to FCA 

programs and operations. You can report allegations to us in several 

ways:

Phone: (800) 437-7322 (Toll-Free) 

(703) 883-4316

Fax: (703) 883-4059

Email: fca-ig-hotline@rcn.com

Mail: 1501 Farm Credit Drive

McLean, VA 22102-5090

To learn more about reporting wrongdoing to the OIG, please visit our 

website at https://www.fca.gov/about/inspector-general.