F E D E R A L D E P O S I T I N S U R A N C E C O R P O R A T I O N 125

5Chapter Five

Management

Control

Enterprise Risk Management

The Office of Enterprise Risk Management, under 

the auspices of the Chief Financial Officer organization, is responsible for corporate oversight of 

internal control and enterprise risk management 

(ERM). This includes ensuring that the FDIC’s 

operations and programs are effective and efficient 

and that internal controls are sufficient to minimize 

exposure to waste and mismanagement. The FDIC 

recognizes the importance of a strong risk management and internal control program and has adopted 

a more proactive and enterprise-wide approach to 

managing risk. This approach focuses on the 

identification and mitigation of risk consistently 

and effectively throughout the Corporation, with 

emphasis on those areas/issues most directly related 

to the FDIC’s overall mission. As an independent 

government corporation, the FDIC has different 

requirements than appropriated federal government 

agencies; nevertheless, its ERM program seeks to 

comply with the spirit of the following standards, 

among others: 

Federal Managers’ Financial Integrity Act 

(FMFIA);

Chief Financial Officers Act (CFO Act);

Government Performance and Results Act 

(GPRA);

Federal Information Security Management Act 

(FISMA); and

OMB Circular A-123.

The CFO Act extends to the FDIC the FMFIA 

requirements for establishing, evaluating and 

reporting on internal controls. The FMFIA requires 

agencies to annually provide a statement of assurance regarding the effectiveness of management, 

administrative and accounting controls, and 

financial management systems.

The FDIC has developed and implemented management, administrative and financial systems 

controls that reasonably ensure that:

Programs are efficiently and effectively carried 

out in accordance with applicable laws and 

management policies;

Programs and resources are safeguarded against 

waste, fraud and mismanagement;

Obligations and costs comply with applicable 

laws; and

Reliable, complete, and timely data are maintained for decision-making and reporting 

purposes.

 ́

 ́

 ́

 ́

 ́

 ́

 ́

 ́

 ́
126 2 0 0 8 A n n u l R e p or

The FDIC’s control standards incorporate the 

Government Accountability Office’s (GAO) 

Standards for Internal Control in the Federal 

Government. Good internal control systems are 

essential for ensuring the proper conduct of FDIC 

business and the accomplishment of management 

objectives by serving as checks and balances against 

undesirable actions or outcomes.

As part of the Corporation’s continued commitment 

to establish and maintain effective and efficient 

internal controls, FDIC management routinely 

conducts reviews of internal control systems. The 

results of these reviews, as well as consideration of 

the results of audits, evaluations and reviews 

conducted by the GAO, the Office of Inspector 

General (OIG) and other outside entities, are used 

as a basis for the FDIC’s reporting on the condition 

of the Corporation’s internal control activities.

Material Weaknesses

Material weaknesses are control shortcomings in 

operations or systems that, among other things, 

severely impair or threaten the organization’s 

ability to accomplish its mission or to prepare 

timely, accurate financial statements or reports. 

Such shortcomings are of sufficient magnitude that 

the Corporation is obliged to report them to 

external stakeholders.

To determine the existence of material weaknesses, 

the FDIC has assessed the results of management 

evaluations and external audits of the Corporation’s 

risk management and internal control systems 

conducted in 2008, as well as management actions 

taken to address issues identified in these audits 

and evaluations. Based on this assessment and 

application of other criteria, the FDIC concludes 

that no material weaknesses existed within the 

Corporation’s operations for 2008. This is the 

eleventh consecutive year that the FDIC has not 

had a material weakness; however, FDIC management will continue to focus on high priority areas, 

including the Temporary Liquidity Guarantee 

Program, IT systems security, resolution of bank 

failures, and privacy, among others. The FDIC will 

also address all control issues raised by GAO 

related to its 2008 financial statement audits. 

Management Report on

Final Actions

As required under amended Section 5 of the 

Inspector General Act of 1978, the FDIC must 

report information on final action taken by 

management on certain audit reports. For the 

federal fiscal year period October 1, 2007, through 

September 30, 2008, there were no audit reports in 

the following categories:

1. Management Report on Final Action on Audits 

with Disallowed Costs;

2. Management Report on Final Action on Audits 

with Recommendations to Put Funds to Better 

Use; and

3. Audit Reports without Final Actions but with 

Management Decisions over One Year Old.