Enterprise Risk Management

The Office of Enterprise Risk Management, under the auspices of the 

Chief Financial Officer organization, 

is responsible for corporate oversight 

of internal control and enterprise risk 

management (ERM). This includes 

ensuring that the FDIC’s operations 

and programs are effective and 

efficient and that internal controls 

are sufficient to minimize exposure 

to waste and mismanagement. The 

FDIC recognizes the importance of a 

strong risk management and internal 

control program and has adopted a 

more proactive and enterprise-wide 

approach to managing risk. This 

approach focuses on the identification and mitigation of risk consistently and effectively throughout the 

Corporation, with emphasis on those 

areas/issues most directly related to 

our overall missions. As an independent government corporation, the 

FDIC has different requirements than 

the mainstream federal government; 

nevertheless, its ERM program seeks 

to comply with the spirit of the 

following standards, among others: 

• Federal Managers’ Financial 

 Integrity Act (FMFIA);

• Chief Financial Officers Act

 (CFO Act);

• Government Performance 

 and Results Act (GPRA);

• Federal Information Security 

 Management Act (FISMA); and

• OMB Circular A-123.

The CFO Act extends to the FDIC 

the FMFIA requirements for establishing, evaluating and reporting on 

internal controls. The FMFIA requires 

agencies to annually provide a 

statement of assurance regarding 

the effectiveness of management, 

administrative and accounting 

controls, and financial management 

systems.

The FDIC has developed and implemented management, administrative 

and financial system controls that 

reasonably ensure that:

• Programs are efficiently and 

 effectively carried out in 

 accordance with applicable 

 laws and management policies;

• Programs and resources are 

 safeguarded against waste, 

 fraud and mismanagement;

• Obligations and costs comply 

 with applicable laws; and

• Reliable, complete, and timely 

 data are maintained for decision-

 making and reporting purposes.

The FDIC’s control standards incorporate the Government Accountability 

Office’s (GAO) Standards for Internal 

Control in the Federal Government. 

Good internal control systems are 

essential for ensuring the proper 

conduct of FDIC business and the 

accomplishment of management 

objectives by serving as checks and 

balances against undesirable actions 

or outcomes.

As part of the Corporation’s continued 

commitment to establish and maintain

effective and efficient internal controls, 

FDIC management routinely conducts 

reviews of internal control systems. 

The results of these reviews, as well 

as consideration of the results of 

audits, evaluations and reviews 

conducted by the GAO, the Office 

of Inspector General (OIG) and 

other outside entities, are used as 

a basis for the FDIC’s reporting on 

the condition of the Corporation’s 

internal control activities.

Material Weaknesses

Material weaknesses are control 

shortcomings in operations or systems 

that, among other things, severely 

impair or threaten the organization’s 

ability to accomplish its mission or 

to prepare timely, accurate financial 

statements or reports. The shortcomings are of sufficient magnitude 

that the Corporation is obliged to 

report them to external stakeholders.

2006 Annual Report

V. Management Control

104
To determine the existence of material

weaknesses, the FDIC has assessed 

the results of management evaluations

and external audits of the Corporation’s 

risk management and internal control

systems conducted in 2006, as well 

as management actions taken to 

address issues identified in these 

audits and evaluations. Based on this 

assessment and application of other 

criteria, the FDIC concludes that no 

material weaknesses existed within 

the Corporation’s operations for 2006. 

This is the ninth consecutive year 

that the FDIC has not had a material

weakness; however, FDIC management will continue to focus on high 

priority areas, including various 

aspects of deposit insurance reform, 

IT systems security, contract acquisition management, the New Financial 

Environment, emergency response 

plan, privacy, and records management, among others. The FDIC will 

also address all control issues raised 

by GAO related to its 2006 financial 

statement audit report. 

Management Report 

on Final Actions

As required under amended Section 5 

of the Inspector General Act of 1978, 

the tables on the following pages 

provide information on final action 

taken by management on audit 

reports for the federal fiscal year 

period, October 1, 2005, through 

September 30, 2006. 

105
Table 1

Management Report 

on Final Action on Audits 

with Disallowed Costs

For Fiscal Year 2006 

(October 1, 2005 - September 30, 2006)

Table 2

Management Report 

on Final Action on Audits 

with Recommendations 

to Put Funds to Better Use

For Fiscal Year 2006

(October 1, 2005 - September 30, 2006)

● ▲

●

▲

106

 Number Disallowed 

 of Costs

Audit Reports Reports (000’s)

A. Management decisions – final action 

 not taken at beginning of period 2 $ 1,969

B. Management decisions made 

 during the period 1 $ 46

C. Total reports pending final action 

 during the period (A and B) 3 $ 2,015

D. Audit reports on which final action 

 was taken during the period:

 1. Recoveries: 

 a. Collections and offsets 3 $ 36

 b. Other 0 $ 0 

 2. Write-offs 2 $ 1,982 

 3. Total of 1(a), 1(b), and 2 3 $ 2,018

E. Audit reports needing final action 

 at the end of the period 0 $ 0

Two reports have both collections and write-offs, thus the total of 1(a), 1(b), and 2 is three. 

Collections for one report in line D1(a) was more than the amount disallowed in line B for that report; 

thus line D3 exceeds line C.

 Number Funds Put to

 of Better Use

Audit Reports Reports (000’s)

A. Management decisions – final action 

 not taken at beginning of period 0 $ 0

B. Management decisions made 

 during the period 0 $ 0

C. Total reports pending final action 

 during the period (A and B) 0 $ 0

D. Final Action taken during the period:

 1. Value of recommendations 

 implemented (completed) 0 $ 0

 2. Value of recommendations that 

 management concluded should not or

 could not be implemented or completed 0 $ 0

 3. Total of 1 and 2 0 $ 0

E. Audit reports needing final action 

 at the end of the period 0 $ 0
Table 3 

Audit Reports Without Final Actions But With Management Decisions Over One Year Old

For Fiscal Year 2006 (October 1, 2005 - September 30, 2006)

Management Action in Process

Report Number Disallowed

and Issue Date OIG Audit Finding Management Action Costs

1. 03-007 The OIG made recommendations FDIC is working to secure sensitive data $ 0

 11-27-02 for improvements in the FDIC’s in conjunction with implementation of the 

 internal network controls. enterprise encryption project. 

 Expected completion date: 1st quarter 2007. 

2. 04-019 The OIG identified best practices that Management is in the process of reviewing $ 0

 04-30-04 should be associated with the System closure documentation.

 Development Life Cycle methodology 

 and related control framework that Expected completion date: 1st quarter 2007.

 will be adopted by the Corporation. 

3. 05-031 The OIG made recommendations Management is in the process of reviewing $ 0

 09-08-05 to establish an organizational policy closure documentation.

 and system-specific procedures 

 to ensure proper configuration Expected completion date: 1st quarter 2007.

 management of operating system 

 software. 

4. 05-036 The OIG made a recommendation Management is in the process of reviewing the $ 0

 09-21-05 to research the General Services benefits of each of GSA's e-Travel programs.

 Administration's (GSA's) e-Travel Additionally, management will review other 

 Programs and determine whether commercial travel processing systems along

 the travel services available under with FDIC's travel system to determine the 

 the programs could improve or feasibility of adding capabilities available in 

 replace the FDIC's current travel GSA's programs. 

 program. 

 Expected completion date: 3rd quarter 2007.

107