FARM CREDIT SYSTEM INSURANCE CORPORATION

POLICY STATEMENT ON

INTERNAL CONTROLS AND AUDIT COVERAGE

DATED: JANUARY 27, 2022

Purpose

The purpose of this policy statement is to ensure: 

• the quality, integrity and transparency of FCSIC’s operations and financial reports; 

• FCSIC’s compliance with all applicable legal requirements and prudent business 

practices; and that 

• FCSIC management carries out the Board’s commitment to a strong system of 

enterprise risk management and internal controls. 

Background 

The Farm Credit System Insurance Corporation (Corporation or FCSIC) Board of Directors 

(Board) has demonstrated its commitment to accurate and transparent financial reporting since 

1990 by directing the preparation of financial statements and requiring an annual independent 

audit of those statements in voluntary compliance with the primary requirements of the Chief 

Financial Officers Act of 1990. The results of the audit are published each year in the 

Corporation’s Annual Report, which is posted on the Corporation’s web site. 

Since 1981, the Office of Management and Budget (OMB) Circular No. A-123 (A-123) and 

the Federal Managers’ Financial Integrity Act (FMFIA) have been at the center of Federal 

requirements to improve accountability in Federal programs and operations. In July 2016, 

OMB updated Circular A-123 by adding enterprise risk management to an agency’s internal 

control process. According to this revised policy statement, the efficient and effective 

operation of the Corporation is promoted by an integrated risk management and internal 

control system that includes not only accounting controls but also administrative controls over

its business activities to ensure attainment of program goals and objectives, compliance with 

all applicable statutes, and accurate and timely external financial reporting. Management is 

responsible for designing and implementing an enterprise risk management program and 

internal control process throughout the entire organizational structure and areas relative to 

strategic decisions, budget, program management, and operations support. In designing an 

enterprise risk management program, management must identify risks, quantify them, and 

establish a risk tolerance threshold so that corrective action options for control deficiencies can 

be selected. Possible corrective action options include acceptance, avoidance, mitigation, and 

transfer/sharing of the risk. 

Adequate internal controls over financial reporting and the assessment of the effectiveness 

of these controls serve to enhance the quality of reporting, identify any potential 

weaknesses, and maintain confidence in stakeholders of Corporation reports. Thus, FCSIC 

management makes representations on the adequacy of the internal control environment. 

Management reviews internal controls and compliance with laws and policies in its
2 

management representation letters to the independent external auditor for the special 

purpose audit for government year-end, as requested by OMB, and its calendar year-end 

General Accepted Accounting Principle (GAAP) based financial statement audit. FCSIC 

management also makes representations on the adequacy of internal controls in its annual 

report to Congress and OMB pursuant to the FMFIA. 

OMB designated FCSIC a “significant” component agency for the purpose of the combined 

financial statements of the U.S. Government due to the materiality of select balance sheet line 

items. OMB requested a special purpose audit as part of FCSIC’s filing of the fiscal year-end 

reports. The independent auditor, following the agreed-upon procedures and the materiality

threshold approved by the Government Accountability Office (GAO) (the auditor for the 

financial statement of the U.S. Government) audits the Corporation’s material line items such 

as investments in U.S. Treasuries and the premium receivables as of September 30th. The 

special purpose audited financial statements for fiscal year-end are then included in the 

Financial Report of the United States Government. 

The calendar year-end GAAP audit provides assurance to Congress and other stakeholders of 

the Corporation. It is included in the Corporation’s annual report to Congress. The audited 

calendar year-end financial statements are also included in the Federal Farm Credit System 

Funding Corporation’s annual information statements. Regardless of calendar or fiscal yearend audits, the independent auditor conducts its audits in accordance with auditing standards 

generally accepted in the United States, the standards applicable to financial audits contained in 

U.S. Government Auditing Standards issued by the Comptroller General of the United, and 

Office of Management and Budget Bulletin for the applicable year, Audit Requirements for 

Federal Financial Statements. The independent auditors also annually attest to and report 

on the effectiveness of its internal controls over financial reporting. 

To establish its commitment to the concept of a strong enterprise risk management and internal control 

system, and provide clear direction to management, the Board adopts the following policy statement.

Policy Statement

The Corporation shall establish and maintain a comprehensive risk management process and integrate it 

with a cost-effective system of accounting and administrative internal controls to provide the following 

reasonable assurances that:

i. All goals and objectives of the Corporation are planned and carried out in accordance 

with applicable provisions of laws, regulations and Board policies; 

ii. All obligations and costs are safeguarded against waste, loss, or unauthorized use; 

iii.All funds, property, and other assets are safeguarded against waste, loss or unauthorized 

use;

iv. All revenues and expenditures applicable to Corporation operations are properly recorded 

and accounted for to maintain accountability over the assets and to permit the 

preparation of financial statements in accordance with generally accepted accounting 
3 

principles and the requirements set out in U.S. Department of Treasury’s Financial 

Manual (TFM); and

v. All programs and administrative activities are managed efficiently to fulfill the mission of the 

Corporation.

The establishment and maintenance of the Corporation’s internal control system shall be executed 

in accordance with the Board’s direction, the requirements of the FMFIA, and guidelines set forth 

by the GAO and the OMB. The Corporation’s internal control system shall include the following 

components:

• A financial management system that conforms to Federal Financial Management System 

Requirements; 

• An enterprise risk management program which identifies, measures, and control risks; 

• An annually signed management assurance statement from corporate officers regarding the 

effectiveness of internal controls and compliance with laws and regulations. If anyone 

refuses to sign, then the person and reason for the refusal will be disclosed. The 

Corporation's annual report will be approved by the FCSIC Chairman; 

• An annual report to the Audit Committee of the review of Management’s assessment of 

the effectiveness of internal control performed according to the requirements of FMFIA, 

and any applicable corrective actions performed to remediate control deficiencies; 

• Policies and procedures that foster compliance with laws, regulations and 

government ethics, including annual ethics training and maintenance of a policy, 

procedures, and delegation manual related to administrative and program functions 

available to staff and reviewed and updated annually;

• Whistleblower Procedures that provide how employees may report suspected 

wrongdoing, how FCSIC officers will report complaints to the Audit Committee and

how FCSIC will respond to employee complaints; 

• An annual report by the Corporation’s General Counsel to the Audit Committee on 

whistleblower activity affecting the Corporation; 

• A financial statement audit conducted annually by an independent public auditor free 

of potential conflicts of interest. Corporation audit engagements shall be conducted in 

accordance with the Board’s audit committee charter; 

• To avoid conflicts of interest or the appearance thereof, the independent audit firm 

cannot have an accounting partner or concurring partner, or lead audit team member 

who was an employee, officer or director of the Corporation for the 12 months prior 

to contracting for audit services or within one year of its conclusion. In addition, the 
4 

qualified public accounting firm must rotate the lead and reviewing audit partners 

after five consecutive years of service for a five-year time-out period; 

• The independent auditor’s attestation to, and report on, the effectiveness of the 

Corporation’s internal control over financial reporting. The report will state whether 

the internal control over the financial reporting process is effective, report internal 

control weaknesses, if any, and recommend corrective action, if needed; 

• Regular reports from senior management to the Board addressing the Corporation’s 

compliance and operational risk oversight responsibilities; 

• Periodic operational audits conducted by an independent audit firm or other 

appropriate experienced consultant;

• Opening and annual audits of any receiverships; and

• Quarterly reports to the Board regarding the results of any audits conducted during 

the period and the status of incorporating any recommendations made by the 

auditors.