ANALYSIS OF FMCS SYSTEMS, 

CONTROLS, AND LEGAL 

COMPLIANCE

December 2023
1

Assurance Statement of the Chief Operating Officer, Performing the Duties of the Director

The Federal Mediation and Conciliation Service (FMCS)’s senior leaders are responsible for managing 

risks and maintaining effective internal control to meet the objectives of Sections 2 and 4 of the Federal 

Managers’ Financial Integrity Act (FMFIA) as detailed in the General Accountability Office (GAO)’s

Standards for Internal Control in the Federal Government (The Green Book) and implemented through the

Office of Management and Budget (OMB) Circular A-123. Furthermore, as detailed in OMB Memorandum 

M-16-17, Agency internal controls are now an integral part of the FMCS’s Enterprise Risk Management

(ERM) framework.

Based on its annual assessment of the adequacy of its internal controls, the FMCS is able to provide an 

unmodified statement of assurance that its internal controls and financial management systems met the 

objectives of FMFIA as of September 30, 2023. 

In making this statement, the FMCS relies upon independent and self-assessments of its internal controls. 

Independent assessments in support of this statement include the results of the annual Federal Employee 

Viewpoint Survey (FEVS) and the annual Agency financial statement audit. The FMCS also generates a 

summary assessment of its internal management controls through an annual manager/supervisor 

questionnaire. Finally, the efforts of the Agency Chief Operating Officer (COO), Chief Information Officer 

(CIO), Chief Human Capitol Officer (CHCO), General Counsel, and Head of Contracting Activity (HCA), 

and others, similarly provide specific assurances in areas that lie outside the scope of the FEVS, annual 

audit, or annual management questionnaire. 

It is worth noting that the FMCS does not have an Inspector General. Instead, the FMCS relies upon its, 

General Counsel, Budget Director, and Finance Director to assist with oversight and enforcement activities.

Given the small size of the Agency and the strength of its internal controls, I believe that this arrangement 

is more than reasonable and adequate for meeting the Agency’s obligations under FMFIA.

Gregory Goldstein 

Chief Operating Officer, Performing the Duties of the Director

December 20, 2023 
2

Table of Contents

Introduction ............................................................................................................................................3

Responsibilities Under OMB Circular A-123 ........................................................................................4

Summary of 2023 Internal Control Review ...........................................................................................5

Results of FMFIA Manager Questionnaire, 2023 ..................................................................................6

Statement of Assurance ..........................................................................................................................7

Training............................................................................................................................................7

Federal Employment Viewpoint Survey (FEVS) ............................................................................7

Federal Information Security Management Act (FISMA)...............................................................8

Biennial Fee Reviews ......................................................................................................................9

Improper Payments Information Act (IPIA) of 2002.......................................................................9

Statement of Assurance for Internal Control over Financial Reporting...............................................11

Financial Management Systems ....................................................................................................11

Annual Financial Statement Audit.................................................................................................11

Appendix A – Statistical Summary of Performance ............................................................................12

Section 2: Internal Control Systems ..............................................................................................12

Section 4: Financial Management Systems ...................................................................................13

Appendix B – Review Process.............................................................................................................14

Assessable Units............................................................................................................................14

Appendix C – Progress Report of High Risk Areas.............................................................................15

Appendix D – Material Weaknesses in Internal Controls....................................................................16
3

Introduction

FMCS is an independent Federal agency whose primary statutory mission is to prevent or 

minimize labor-management disputes affecting interstate commerce by providing mediation, 

conciliation, and arbitration services. The FMCS performs these activities in both the private and 

public sectors, except for the railroad and airline industries, which are covered by the Railway 

Labor Act [45 U.S.C. § 151 et seq.].

The FMCS conducts operations at its Washington, DC headquarters, 6 district offices, and 3 field 

offices. At the close of 2023, the FMCS had 202 employees, 201 of which were permanent. Of 

that number, 143 were delivering core services (0241 series). The FMCS receives most of the 

funding needed to support its operations through direct appropriations.

For 2023, Congress provided the FMCS with an appropriation of $53.7 million, plus an additional 

$482,000 in spending authority for three Economy Act reimbursable employee details.
4

Responsibilities Under OMB Circular A-123

As detailed in OMB Circular A-123, FMCS is responsible for establishing and maintaining internal 

control to achieve the objectives of effective and efficient operations, reliable financial reporting, 

and compliance with applicable laws and regulations. The FMCS must consistently apply the 

internal control standards to meet each of the internal control objectives and to assess internal 

control effectiveness. Annually, management must provide assurances on internal control in its 

Performance and Accountability Report, including a separate assurance on internal control over 

financial reporting, along with a report on identified material weaknesses and corrective actions.

Circular A-123 also requires agencies and individual Federal managers to take systematic and 

proactive measures to (i) develop and implement appropriate, cost-effective internal control for 

results-oriented management; (ii) assess the adequacy of internal control in Federal programs and 

operations; (iii) separately assess and document internal control over financial reporting; (iv) 

identify needed improvements; (v) take corresponding corrective action; and (vi) report annually 

on internal control through management assurance statements.
5

Summary of 2023 Internal Control Review

The FMCS internal controls system is a continuous built-in component of operations, effected by people, 

that provides reasonable assurance, that the agency’s objectives will be achieved, ensures that the FMCS 

conducts activities efficiently and effectively, reports reliable information about operations, and complies 

with applicable laws and regulations. Additionally, the FMCS’s internal control system provides reasonable 

assurance that:

• Employees have access to the information they need in order to make sound decisions.

• Obligations and costs are in compliance with applicable laws.

• Assets are safeguarded against waste, loss, and unauthorized use of appropriations.

• Revenues and expenditures applicable to Agency operations are properly recorded and 

accounted for, permitting accurate accounts, reliable financial reports, and full accountability 

for assets.

• Programs are efficiently and effectively carried out in accordance with applicable laws and 

management policy.

During 2023, the FMCS used a managers’ questionnaire to review the effectiveness of its internal control 

systems in accordance with FMFIA and GAO requirements, OMB guidance, and general best practices. 

The FMCS substantially revised its questionnaire in 2017 to include ERM-related elements and issues and 

to create a consistent and simplified analysis framework. 

The 2023 FMFIA management questionnaire contained 28 questions in a “Yes”-”No” format or on a scale 

of “Not at all Effective”, “Slightly Effective”, “Moderately Effective”, “Very Effective” or “Extremely 

Effective.” 

In all, 23 FMCS managers and supervisors (100 percent of managers/supervisors were determined eligible 

by the General Counsel’s office) responded to the questionnaire. Questionnaire results are tabulated below. 

For questions of effectiveness, a higher average score indicates that respondents felt the FMCS was more 

effective in the area of concern. Yes/No question results are expressed as a percentage which indicates the 

percentage of “Yes” answers. 

While the overall result of the questionnaire indicates that the FMCS is very to extremely effective in most 

areas, responses to several questions suggest room for improvement. Some concerns were centered around 

the ability for offices or regions to carry out its work if an employee was unexpectedly absent for 10 

consecutive days or longer, financial resources allocated to help meet performance goals and/or objectives, 

and emergency COOP plans that are documented and communicated. The response concerning financial 

resources to support goals may be indicative of possible limited availability of federal funding. 

The FMCS questionnaire also provided respondents with an opportunity to expand upon provided answers 

or to address other areas of concern. Seven respondents provided additional comments. One respondent 

commented about the need for additional staffing to meet the FMCS’s mission. Another respondent 

commented that there is ongoing concern about gaps in their coordination of activities across units and the 

lack of tools for creating, managing, and using SOPs. A repeated concern in the additional comments was 

for better communication regarding COOP. 
6

Results of FMFIA Manager Questionnaire, 2023

The FMCS evaluated its management control systems for operations for the fiscal year ended September 

30, 2023. The result is that the FMCS can provide reasonable assurance that internal controls over 

operations were operating effectively as of September 30, 2023.

Mission and Employee Performance 2023

Organizational Clarity Maintained 100%

Performance Goals Written 91%

Supervisor Reviews Performance Goals 96%

Subordinates Review Performance Goals 100%

Goals Support FMCS Mission 4.4

Operational Issues

Business Processes Written 91%

Subordinates Review Business Processes 96%

Business Processes Support Operations 4.2

Subordinates Follow Business Processes 4.1

Standard Operating Procedures Written 87%

Subordinates Follow SOPs 4.2

Operations Sustainable During Extended Absence 3.5

Position Description Matched to Job Duties 4.3

Subordinates Perform Duties 4.5

Subordinates Effectuate Improvements 4.1

Financial Resources Support Goals 3.8

Material Resources Support Goals 4.1

Compliance Issues

Procedures Protect Against Fraud & Abuse 4.0

Capital Assets Safeguarded 4.1

Improper Travel Reimbursements Prevented 4.3

Improper Procurement Card Puchases Prevented 4.1

Accurate Time & Attendance Ensured 4.0

Practices Prevent Workplace Discrimination 4.2

Prevent Ethics Violations 4.0

Communication Systems Help Meet Goals 4.3

Computer Access Rules Protect Agency Data 4.2

Emergency Plans Documented 3.6

Emergency Plans Communicated 3.4
7

Statement of Assurance

Section 2 of FMFIA requires that Federal agencies report, on the basis of annual assessments, any material 

weaknesses that have been identified in connection with their internal controls.

Based on its annual assessment of the adequacy of its internal controls, the FMCS is able to provide an 

unmodified statement of assurance that its internal controls met the objectives of FMFIA as of September 

30, 2023.

1

In making this assessment, the FMCS relies upon evaluations in the following areas:

Training

The FMCS requires its employees to complete a variety of trainings to ensure its workforce meets IT 

security, ethics, and procurement standards. Highlights from 2023 include:

• 91% of all employees completed annual IT security awareness training.

• 100% of all new employees completed ethics training during onboarding.

• 82% of all employees required to file an Office of Government Ethics (OGE) Form 450

completed annual ethics training.

• 94% of all 17 Contracting Officer Representative (COR)s have completed (re)certification within 

the past two years.

• 100% of all 26 procurement card holders have completed (re)training within the past three years.

Federal Employment Viewpoint Survey (FEVS)

The Office of Personnel Management administers the annual FEVS to help measure employees' perceptions 

of whether, and to what extent, conditions characterizing successful organizations are present in their 

agencies. Survey results provide valuable insight into the challenges agency leaders face in ensuring that 

they maintain an effective and motivated workforce. The FMCS has consistently scored as one of the best 

places to work in the Federal Government, including #1 rankings among small agencies in 2017 and 2018.

A few highlights from the 2023 FEVS results for the FMCS:

• 60.8% Response rate overall.

• 100% responded positively that “My work unit has the job-relevant knowledge and skills 

necessary to accomplish organizational goals.”

• 90% responded positively to “My agency is successful at accomplishing its mission.”

• 86% responded positively that “I know how my work relates to the agency's goals.”

• 100% responded positively that “Employees are protected from health and safety hazards on the 

job.”

1 An “unmodified” opinion is equivalent to a “clean” or “unqualified” opinion under American Institute of 

Certified Public Accountants (AICPA) standards.
8

Federal Information Security Management Act (FISMA) 

As mandated by FISMA, the FMCS continues to maintain an information security program to support the 

confidentiality, integrity, and availability of agency information and information systems. The FMCS has 

been working diligently throughout FY 2023 to protect agency information systems, electronic assets and 

the information contained on them. The agency has performed routine IT security and maintenance 

operations, as well as implementing programmatic and technological improvements to reduce agency 

cybersecurity risks.

The FMCS IT accomplishments for FY 2023 related to FISMA include the following: continued 

participation in the CDM Defend F dashboard enabling Okta based Multi-Factor Authentication (MFA) for 

all employees using Qualys agents aligned with DHS CISA’s distributed and automated CDM initiatives, 

100 percent implementation for all FMCS’s users to require PIV for computer login and MFA access to all 

Office 365 and Azure based applications and services, 99.9 percent network migration from physical on 

premises network to MS Azure cloud based infrastructure, greatly increasing our flexibility and COOP 

capabilities, successful launch of a web based notice submission and service request portal to eliminate 

paper forms (F-7, IAA, Requests for Mediation Services) and reduce repetitive and error prone data input 

by private, public, and other federal customers. Implementation of Microsoft Intune for all GFE devices. 

Discontinuance of Bring Your Own Device (BYOD) access for all FMCS employees and contractors. 

Implementation of Zscaler suite to manage cloud based security and remote access.

FISMA requires that the FMCS maintain a comprehensive framework for ensuring the effectiveness of 

information security controls over information resources that support Federal operations and assets. Within 

this framework the FMCS must provide information security controls proportionate with the risk and 

potential harm of not having these controls in place. Furthermore, FISMA requires that the FMCS report 

“significant deficiencies” found under FISMA as material weaknesses under FMFIA.

Multi-Factor Authentication – In FY 2023 the FMCS has fully implemented PIV based security for 

computer login and MFA based authentication to all Office 365 and azure-based applications for all users. 

The FMCS has configured secure cross-agency VPN based connection paths utilizing Zscaler agents for 

OPM, Treasury and USDA sites requiring PIV access from defined points.

Cloud First – In FY 2023 the FMCS has completed the migration of the critical physical network 

infrastructure to Microsoft Azure based networking, including our COOP environment, leaving only a basic 

physical network for local end users to provide secure internet access and work-suite physical security 

capabilities. The FMCS continues to leverage OneDrive and SharePoint for file storage and shared 

information for all users. Information on traditional servers has been migrated to azure based virtual servers. 

All file shares, directories and shared data stores have been migrated to azure based virtual servers or 

SharePoint based Teams sites and all physical on-site servers have been virtualized and retired.

Secure Configurations – In FY 2023 the FMCS has continued the practice of updated baseline computer 

imaging so all computers are created with the same initial image, to include automated Hardware Asset 

Management (HWAM), Software Asset Management (SWAM), remote patch and update installation 

capabilities using Endpoint Central, Carbon Black, AlienVault, Microsoft Intune and Azure MS Defender 

agents. The FMCS has continued to expand the Continuous Diagnostics and Mitigation (CDM) capabilities 

by fully participating in DHS Shared Services Defend F project installing Qualys agents on all computers 
9

and sharing the collected data with DHS CISA. The FMCS currently employes several Multi-Factor 

Authentication methods, including Microsoft Authenticator, Google Authenticator, Okta Authenticator, 

Duo authenticator, OMB Max PIV authentication and Login.gov for the various security configurations 

throughout the partially integrated federal workspace.

In FY 2023 the FMCS implemented Zscaler agents on all computers and mobile devices to allow for the 

sundown of the physical VPN appliances. The FMCS has fully implemented Microsoft Intune for device 

management of all GFE issued laptops and mobile devices to control software and hardware installation 

and customization and successful sunset of connections of all BYOD devices for the FMCS users in federal 

workspace.

Continuity of Operations (COOP) and Disaster Recovery – The FMCS participated in the executive branch 

2023 COOP exercise, which tested the Agency communications capabilities between normal operating 

locations and alternate operating facilities. The FMCS physical COOP network environment has been fully 

virtualized. The FMCS maintains a COOP and alternate work/disaster recovery site. In the event of a 

national or local emergency, the FMCS believes that it will be able to maintain core operations without 

significant disruption. Zscaler agents allow for the FMCS security controls to be pushed to the user endpoint 

device so regardless of location or network connection, FMCS electronic assets are operating in a controlled 

and secure manner.

Biennial Fee Reviews

OMB Circular A-25 requires that agencies conduct a biennial review to determine whether user fees should 

be charged for government goods or services and, if so, to establish charges that accurately reflect market 

conditions.

The FMCS sets two different user fees. On an annual basis the FMCS reviews its payroll costs and 

establishes an Economy Act [31 U.S.C. § 1535] rate for the FMCS mediator-provided training and 

mediation. The rate in 2023 reflected agency costs of $130/hour, including wages and benefit costs of $90, 

administrative support of $27, and $13 for overhead.

Biennially, The FMCS also reviews the fees that it charges for its arbitrator listing and arbitration panel 

request fees. As a result of this review, the FMCS increased its arbitration service fees in 2023. In addition, 

the FMCS Institute for Conflict Management uses the Economy Act rate, private instructor fees, and direct 

facility costs to set prices for each training course it offers.

Improper Payments Information Act (IPIA) of 2002

The Improper Payments Information Act of 2002 (IPIA) requires each executive branch agency to annually 

review all programs and activities it administers and identify those that may be susceptible to significant 

improper payments. Significant improper payments are defined as annual improper payments in a program 

exceeding both 2.5 percent of program payments and $10 million. For programs susceptible to significant 

improper payments, the Act requires agencies to report the estimate of improper payments and actions to 

reduce them. OMB Circular A-123, Appendix C, Requirements for Effective Measurement and 

Remediation of Improper Payments, issued in August 2006, provides guidance to implement the 

requirements of the Act and clarifies and updates the requirements in order to support government-wide 

IPIA compliance.
10

In accordance with IPIA, the FMCS reviewed its programs and activities for susceptibility to significant 

improper payments. Approximately 85 percent of the FMCS’s 2023 appropriations were dedicated to 

employee pay and benefits, rent, and reimbursement for employee travel. The remainder of agency expenses 

consists of vendor payments for goods and services provided to the agency. Thus, the FMCS is not 

susceptible to and has not identified any significant problems with improper payments. The Agency is 

nonetheless committed to continuous improvement in the overall accuracy of its accounts payable process.
11

Statement of Assurance for Internal Control over Financial Reporting

Section 4 of FMFIA requires that Federal agencies also report on the basis of annual assessments, any 

material weaknesses that have been identified in connection with their controls over financial reporting.

Based on its annual assessment of the adequacy of its internal controls over financial reporting, the FMCS 

is able to provide an unmodified statement of assurance that its internal controls met the objectives of 

FMFIA as of September 30, 2023.

2

In making this assessment, the FMCS relies upon evaluations in the following areas:

Financial Management Systems

The Federal Financial Management Improvement Act of 1996 (FFMIA) requires agencies to implement 

and maintain financial management systems that substantially comply with the following three FFMIA 

Section 803(a) requirements:3 (1) Federal Financial Management Systems Requirements, (2) applicable 

Federal accounting standards, and (3) the US Standard General Ledger (USSGL) at the transaction level.

Based on reviews conducted by its independent auditors, the FMCS remained in compliance with FFMIA 

and the FMCS financial system through its shared service provider Treasury-ARC continues to comply 

with GAO principles and requirements.

Annual Financial Statement Audit

Although the independent audit of the FMCS’s annual financial statements does not test all controls relevant 

to the operating objectives broadly defined by FMFIA, an unmodified audit provides additional and strong 

evidence that the FMCS is meeting FMFIA requirements.

In 2023, the FMCS received an unmodified opinion from its independent auditors. This marks the 23rd

consecutive year that the FMCS has received a “clean” audit opinion.

2 An “unmodified” opinion is equivalent to a “clean” or “unqualified” opinion under American Institute of Certified 

Public Accountants (AICPA) standards.

3 FFMIA, Pub. L. No. 104-208, div. A., § 101(f), title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996), reprinted in 

31 U.S.C. § 3512, Statutory Note.
12

Appendix A – Statistical Summary of Performance

Section 2: Internal Control Systems

Overall Compliance: Yes

Year Achieved: 1993

Pending Material Weaknesses: None

Table 1: Internal Control Material Weaknesses

Fiscal Year Number 

Reported

Number 

Corrected Number Pending

1998 2 2 None

1999 None N/A N/A

2000 None N/A N/A

2001 None N/A N/A

2002 None N/A N/A

2003 None N/A N/A

2004 None N/A N/A

2005 None N/A N/A

2006 None N/A N/A

2007 None N/A N/A

2008 None N/A N/A

2009 None N/A N/A

2010 None N/A N/A

2011 None N/A N/A

2012 None N/A N/A

2013 None N/A N/A

2014 None N/A N/A

2015 None N/A N/A

2016 None N/A N/A

2017 None N/A N/A

2018 2 0 2

2019 2 0 2

2020 None 2 0

2021 None N/A N/A

2022 None N/A N/A

2023 None N/A N/A
13

Section 4: Financial Management Systems

Overall Compliance: Yes

Year of Compliance with Financial Information Standards: 1993

Year of Compliance with Systems Functional Standards: 1993

Pending Material non-Compliance: None

Table 2: Financial Management Systems Material Non-Compliance

Fiscal 

Year Number Reported Number Corrected Number Pending

1998 None N/A N/A

1999 None N/A N/A

2000 None N/A N/A

2001 None N/A N/A

2002 None N/A N/A

2003 None N/A N/A

2004 None N/A N/A

2005 None N/A N/A

2006 None N/A N/A

2007 None N/A N/A

2008 None N/A N/A

2009 None N/A N/A

2010 None N/A N/A

2011 None N/A N/A

2012 None N/A N/A

2013 None N/A N/A

2014 None N/A N/A

2015 None N/A N/A

2016 None N/A N/A

2017 None N/A N/A

2018 None N/A N/A

2019 None N/A N/A

2020 None N/A N/A

2021 None N/A N/A

2022 None N/A N/A

2023 None N/A N/A
14

Appendix B – Review Process

Assessable Units

Number of assessable units: 10

Number of alternative reviews planned: 1; conducted: 1

Percentage of assessable units reviewed in-depth: 60%

In FY 2023, the FMCS created an Operational Security and Emergency Management (OSEM) office within 

the COO Office. This change was in response to the Presidential release of the National Security 

Presidential Memorandum-28 (NSPM-28), mandating that every Executive Branch agency implement 

operational security measures by December 31, 2022. In December 2022, the FMCS released Directive 

5812: Operational Security Program, which lists several actions that FMCS must take to meet the 

requirements of NSPM-28. Prior to the new FMCS OSEM, the FMCS had employees with duties focused 

on personnel and physical security in the Offices of Human Resources and Procurement and Operational 

Support (Procurement). It also had employees with secondary duties focused on Continuity of Operations 

(COOP) in the Offices of Procurement and Information Technology. The new OSEM consolidated all 

security, emergency management, and operational programs within the agency to meet the requirements of 

NSPM-28. The FMCS is also hopeful that the new OSEM will address the concerns expressed in the 2023 

FMFIA questionnaire regarding emergency plans that are documented and communicated.
15

Appendix C – Progress Report of High Risk Areas

Not Applicable
16

Appendix D – Material Weaknesses in Internal Controls

None Reported