102

Enterprise Risk

Management

The Office of Enterprise Risk

Management is responsible for 

corporate oversight of internal control

and enterprise risk management. This

includes ensuring that the FDIC's

operations and programs are effective

and efficient and that internal controls

are sufficient to minimize exposure

to waste, fraud, and mismanagement.

The FDIC recognizes the importance

of a strong risk management and

internal control program and has

adopted a more proactive and 

enterprise-wide approach to managing risk. This approach focuses on

the identification, quantification and

mitigation of risk consistently and

effectively throughout the Corporation.

An effective enterprise risk management program ensures adequate

compliance with key authorities,

including but not limited to the: 

● Federal Managers’ Financial 

Integrity Act (FMFIA)

● Chief Financial Officers Act 

(CFO Act)

● Government Performance and 

Results Act (GPRA)

● Federal Information Security 

Management Act (FISMA)

● OMB Circular A-123

The CFO Act extends to the FDIC the

FMFIA requirements for establishing,

evaluating and reporting on internal

controls. The FMFIA requires 

agencies to annually provide a

statement of assurance regarding

the effectiveness of management,

administrative and accounting 

controls, and financial management

systems.

The FDIC has developed and implemented management, administrative

and financial system controls that

reasonably ensure that:

● Programs are efficiently and 

effectively carried out in accordance

with applicable laws and 

management policies;

● Programs and resources are 

safeguarded against waste, fraud 

and mismanagement;

● Obligations and costs comply 

with applicable laws; and

● Reliable, complete, and timely 

data are maintained for decisionmaking and reporting purposes.

The FDIC's control standards 

incorporate the GAO’s Standards 

for Internal Controls in the Federal

Government. Good internal control

systems are essential for ensuring the

proper conduct of FDIC business and

the accomplishment of management

objectives by serving as checks and

balances against undesirable actions

or outcomes.

V. Management Control
107

As part of the Corporation's 

continued commitment to establish

and maintain effective and efficient

internal controls, FDIC management

routinely conducts reviews of internal

control systems. The results of these

reviews, as well as consideration 

of audits, evaluations and reviews

conducted by the U.S. Government

Accountability Office (GAO), the

Office of Inspector General (OIG)

and other outside entities, are used

as a basis for the FDIC's reporting

on the condition of the Corporation's

internal control activities.

Material Weaknesses

Material weaknesses are control

shortcomings in operations or systems

which, among other things, severely

impair or threaten the organization’s

ability to accomplish its mission or 

to prepare timely, accurate financial

statements or reports. The shortcomings are of sufficient magnitude

that the Corporation is obliged to

report them to external stakeholders.

To determine the existence of

material weaknesses, the FDIC 

has assessed the results of 

management evaluations and 

external audits of the Corporation's

risk management and internal control

systems conducted in 2005, as well

as management actions taken to

address issues identified in these

audits and evaluations. Based on 

this assessment and application of

other criteria, the FDIC concludes

that no material weaknesses existed

103

within the Corporation's operations

for 2005. This is the eighth consecutive year that the FDIC has not had 

a material weakness; however, 

FDIC management will continue 

to focus on high priority areas,

including IT systems security, 

the New Financial Environment,

disaster recovery, privacy, and 

contract oversight management,

among others. The FDIC will also

address all control issues raised by

GAO in its 2005 financial statement

audit report. 

Management Report 

on Final Action

As required under amended Section 

5 of the Inspector General’s Act, 

the tables on the following pages 

provide information on final action

taken by management on audit

reports for the federal fiscal 

year period, October 1, 2004–

September 30, 2005.
Table 1

Management Report 

on Final Action on Audits 

with Disallowed Costs

For Fiscal Year 2005 

(October 1, 2004-September 30, 2005)

Table 2

Management Report 

on Final Action on Audits 

with Recommendations 

to Put Funds to Better Use

For Fiscal Year 2005

(October 1, 2004-September 30, 2005)

104

Number Disallowed 

of Costs

Audit Reports Reports (000’s)

A. Management decisions – final action 

not taken at beginning of period 6 $ 3,764

B. Management decisions made 

during the period 2 $ 1,969

C. Total reports pending final action 

during the period (A and B) 8 $ 5,733

D. Audit reports on which final action 

was taken during the period:

1. Recoveries: 4 $ 1,324

a. Collections and offsets 4 $ 1,324

b. Other 0 $ 0

2. Write-offs 4 $ 2,439

3. Total of 1a, 1b, and 2 6 $ 3,763

E. Audit reports needing final action 

at the end of the period 2 $ 1,969

The FDIC agreed to coordinate with the General Services Administration (GSA) on potential cost 

recoveries from the contractor, but after reviewing the OIG's findings, GSA declined to take action 

to pursue recoveries from the contractor. 

Two reports had both collections and write-offs, thus the total of 1(a), 1(b), and 2 is six.

The total is off due to rounding.

Number Funds Put to

of Better Use

Audit Reports Reports (000’s)

A. Management decisions – final action 

not taken at beginning of period 0 $ 0

B. Management decisions made 

during the period 1 $ 602

C. Total reports pending final action 

during the period (A and B) 1 $ 602

D. Final Action taken during the period:

1. Value of recommendations 

implemented (completed) 1 $ 602

2. Value of recommendations that 

management concluded should not or

could not be implemented or completed 0 $ 0

3. Total of 1 and 2 1 $ 602

E. Audit reports needing final action 

at the end of the period 0 $ 0

●

▲

▼

●

▼

▲
105

Table 3 

Audit Reports Without Final Actions But With Management Decisions Over One Year Old

For Fiscal Year 2005 (October 1, 2004-September 30, 2005)

Management Action in Process

Report Number Disallowed

and Issue Date OIG Audit Finding Management Action Costs

1. 03-007 The OIG made recommendations FDIC is working to secure sensitive data in

11-27-02 for improvements in the FDIC's conjunction with implementation of the 

internal network controls. enterprise encryption project. 

Expected completion date:1st quarter 2006. $ 0

2. 03-028 The OIG recommended that Additional time is required to accomplish

04-14-03 the FDIC take a number of actions tasks related to the Intranet PKI components. 

for improvements related to the The FDIC is in the process of issuing MOUs 

public key infrastructure. to external users of sensitive data. 

Expected completion date: 2nd quarter 2006. $ 0

3. 03-041 The OIG made recommendations The FDIC agreed to establish a process to

09-17-03 related to the established process routinely test the accuracy of insurance

metrics for accurate insurance determinations and evaluate results in

determinations. relationship to established benchmarks within 

requirements of a proposed new system. 

Expected completion date: 2nd quarter 2006. $ 0

4. 04-002 The OIG made recommendations The FDIC agreed to explore options for estimating

01-15-04 to improve the service line budgeted service line program maintenance costs

rate-setting process. and determining reasonable adjustments for 

such costs. It is expected that the necessary 

information will be available through the 

New Financial Environment. 

Expected completion date: 4th quarter 2006. $ 0

5. 04-016 The OIG made recommendations The FDIC will continue with its data integrity

03-30-04 to improve the accuracy of the data review of the Corporate Human Resources

used to manage the FDIC's Information System data and initiate 

personnel security program. investigations as appropriate. 

Expected completion date:1st quarter 2006. $ 0

6. 04-019 The OIG made recommendations to Staffing of the newly created Project

04-30-04 improve the system development Management Organization is in progress.

control framework. Expected completion date: 4th quarter 2005. $ 0

7. 04-029 The OIG made recommendations to The FDIC is working to ensure that current

08-09-04 strengthen the quality of the FDIC's contracts essential to business continuity include

Business Continuity Plan. backup arrangements. Additional time is required

to complete the standard language and modify 

the affected contracts. 

Expected completion date:1st quarter 2006. $ 0

8. 04-039 The OIG made recommendations The Chief Information Officer's Council is

09-23-04 to strengthen capital planning and reviewing all information technology projects.

investment management related Expected completion date: 2nd quarter 2006.

guidance, including guidance 

related to the FDIC's investment 

management governance structure. $ 0