0:'eop seal executive office of the president office of management and budget washington, d.c. 20503 the director . july 15,',
1:'2016 m1617 f executive departments and agencies shaun donovan signature from: subject: omb circular no. a123, managements responsibility for enterprise',
2:'risk management and internal control the administration has emphasized the importance ofhaving appropriate risk management processes and systems to identify',
3:'challenges early, to bring them to the attention of agency leadership, and to develop solutions. to that end, the office',
4:'of management and budget omb is updating this circular to ensure federal managers are effectively managing risks an agency faces',
5:'toward achieving its strategic objectives and arising from its activities and operations. these expanded responsibilities reinforce the purposes of the',
6:'federal managers financial integrity act fmfia and the government performance and results act modernization act gprama, and support the administrations',
7:'commitment to improve the efficiency and effectiveness of government. since 1981, omb circular no. a123 a123 and fmfia have been',
8:'at the center of federal requirements to improve accountability in federal programs and operations. over the years, government operations have',
9:'changed dramatically, becoming increasingly complex and driven by changes in technology. at the same time, resources are constrained and stakeholders',
10:'expect greater program integrity, efficiency and transparency into government operations. the policy changes in this circular modernize existing efforts by',
11:'requiring agencies to implement an enterprise risk management erm capability coordinated with the strategic planning and strategic review process established',
12:'by gprama, and the internal control processes required by fmfia and government accountability office gaos green book. this integrated governance',
13:'structure will improve mission delivery, reduce costs, and focus corrective actions towards key risks. implementation ofthis policy will engage all',
14:'agency management, beyond the traditional ownership of omb circular no. a123 by the chief financial officer community. in particular, it',
15:'will require leadership from the agency chief operating officer and performance improvement officer, and close collaboration across all agency mission',
16:'and missionsupport functions. successful implementation of this circular requires agencies to establish and foster an open, transparent culture that encourages',
17:'people to communicate information about potential risks and other concerns with their superiors without fear of retaliation or blame. similarly,',
18:'agency managers, inspectors general ig and other auditors should establish a new set of parameters encouraging the free flow of',
19:'information about agency risk points and corrective measure adoption. an open and transparent culture results in the earlier identification of',
20:'risk, allowing the opportunity to develop a collaborative response, ultimately leading to a more resilient government. this revision ofthe circular',
21:'has gone through an extensive deliberative process with agencies and their ig teams, and including consultation with the gao and',
22:'many outside groups who seek more efficient and effective delivery of governmental services. this revised circular is effective for fiscal',
23:'year fy 2016 and supersedes all previous versions. appendices a, b, c, and d of omb circular no. a123 remain',
24:'in effect. updates to the gao greenbook are effective for fy 2016. erm implementation requirements are effective for fy 2017.',
25:'omb plans to work closely with the presidents management council, executive councils, and the council oflnspectors general on integrity and',
26:'efficiency cigie to provide further implementation guidance. attachment: omb circular no. a123, managements responsibility for enterprise risk management and internal',
27:'control attachment omb circular no. a123, management’s responsibility for enterprise risk management and internal control purpose: this circular defines management’s',
28:'responsibilities for enterprise risk management erm and internal control. the circular provides updated implementation guidance to federal managers to improve',
29:'accountability and effectiveness of federal programs as well as mission support operations through implementation of erm practices and by establishing,',
30:'maintaining, and assessing internal control effectiveness. the circular emphasizes the need to integrate and coordinate risk management and strong and',
31:'effective internal control into existing business activities and as an integral part of managing an agency. authority: this circular is',
32:'issued under the authority of the federal managers financial integrity act fmfia of 1982 as codified in 31 u.s.c. 3512,',
33:'and the government performance results act gpra modernization act, public law 111352. policy: each federal employee is responsible for safeguarding',
34:'federal assets and the efficient delivery of services to the public. federal leaders and managers are responsible for establishing goals',
35:'and objectives around operating environments, ensuring compliance with relevant laws and regulations, and managing both expected and unexpected or unanticipated',
36:'events. they are responsible for implementing management practices that identify, assess, respond, and report on risks. risk management practices must',
37:'be forwardlooking and designed to help leaders make better decisions, alleviate threats and to identify previously unknown opportunities to improve',
38:'the efficiency and effectiveness of government operations. management is also responsible for establishing and maintaining internal controls to achieve specific',
39:'internal control objectives related to operations, reporting, and compliance. management must consistently apply these internal control standards to meet the',
40:'internal control principles and related components outlined in this circular and to assess and report on internal control effectiveness at',
41:'least annually. risk management practices must be taken into account when designing internal controls and assessing their effectiveness. annually, agencies',
42:'must develop a risk profile coordinated with their annual strategic reviews. further, management must provide assurances on internal control effectiveness',
43:'in its agency financial report afr or the performance and accountability report par. information regarding identified material weaknesses and corrective',
44:'actions should be included in any of the three preceding reports. requirements: office of management and budget omb circular no.',
45:'a123 requires agencies to integrate risk management and internal control functions. the circular also establishes an assessment process based on',
46:'the government accountability office’s gao standards for internal control in the federal government known as the green book that management',
47:'must implement in order to properly assess and improve internal controls over operations, reporting, and compliance. the primary compliance indicators',
48:'that management must consider when implementing omb circular no. a123, include: management is responsible for the establishment of a governance',
49:'structure to effectively implement, direct and oversee implementation of the circular and all the provisions of a robust process of',
50:'risk management and internal control. implementation of the circular should leverage existing offices or functions within the organization that currently',
51:'monitor risks and the effectiveness of the organization’s internal control. agencies should develop a maturity model approach1 to the adoption',
52:'of an erm framework. for fy 2016, agencies are encouraged to develop an approach to implement erm. for fy 2017',
53:'and thereafter agencies must continuously build risk identification capabilities into the framework to identify new or emerging risks, and/or changes',
54:'in existing risks see section ii.c. for additional details. management must evaluate the effectiveness of internal controls annually using gao’s',
55:'standards for internal control in the federal government. the green book 1 see https://www.rims.org/resources/erm/pages/riskmaturitymodel.aspx for an example maturity model. throughout',
56:'the circular, the terms “must” and “will” denote a requirement that management will comply with in all cases. “should,” indicates',
57:'a presumptively mandatory requirement except in circumstances where the requirement is not relevant for the agency. “may” or “could,” indicate',
58:'best practices that may be adopted at the discretion of management. effective date: this circular is effective upon publication. appendices',
59:'a, b, c, and d of omb circular no. a123 remain in effect. applicability: this circular is applicable to each',
60:'executive agency. all other nonexecutive agencies of the federal government are encouraged to adopt the circular. inquiries: further information concerning',
61:'this circular can be obtained from the office of federal financial management 202 3953993 or the office of performance and',
62:'personnel management, 202 3955670 office of management and budget, washington, dc 20503. copies: copies of this circular may be obtained',
63:'from www.whitehouse.gov/omb. significant revisions to omb circular no. a123 section revision to a123 purpose of revision transmittal to the circular',
64:'changed title from omb circular no. a123, management’s responsibility for internal control to omb circular no. a123, management’s responsibility for',
65:'enterprise risk management and internal control title changed to align better with the focus of the circular towards an enterprise',
66:'risk management framework. restructure former section i, introduction, section ii, standards, and section iii, integrated internal control framework restructured as',
67:'described below. appendix a, internal control over financial reporting icofr removed from the body of a123 and renamed to appendix',
68:'a, internal control over reporting icor introduce enterprise risk management guidance; eliminate areas of duplication; and balance emphasis on operations,',
69:'compliance, and reporting. based on the significance of gao standards for internal control changes related to internal control over reporting;',
70:'omb plans to issue the prior appendix a as a standalone document. appendices a, b, c, and d of omb',
71:'circular no. a123 remain in effect. throughout circular referenced erm concepts and guidelines based on the committee of sponsoring organizations',
72:'of the treadway commission coso, international organization for standards iso and the united kingdom’s orange book, management of risk –',
73:'principles and concepts.2 provide additional erm implementation guidance. section i. introduction changed the focus of the introduction to illustrate management’s',
74:'responsibility to manage risk, the relationships between a 123 and part 6 of a11, federal performance framework, and internal controls',
75:'and enterprise risk management. provide an overview of the integration of internal controls and enterprise risk management section ii. establishing',
76:'enterprise risk management in management practices addition of a new section. provide for more effective risk management and internal control',
77:'in the federal government. section iii. establishing and operating an effective internal control system addition of a new section. provide',
78:'evaluation guidance for the new gao green book. 2 references to nonfederal government entities are provided to illustrate best practices',
79:'and do not signify endorsement by the federal government. section revision to a123 purpose of revision section iv. assessing internal',
80:'control included a summary of updated standards of internal control in the federal government and related documentation and assessment requirements.',
81:'provide evaluation guidance for the new gao green book. section v. correcting internal control deficiencies included minimum requirements for corrective',
82:'action plans. emphasize root cause analysis, accountability, and collaboration with offices of inspectors general. section vi. reporting on internal control',
83:'requires a single assurance statement consistent with the original requirement of the federal managers financial integrity act fmfia. provide a',
84:'risk based approach and balance emphasis between operations, reporting, and compliance internal control objectives. section vii. additional considerations addition of',
85:'a new section. provide additional considerations for emerging issues including: managing privacy risks, integrating acquisition assessments with the new gao',
86:'green book, managing grant risks and managing antideficiency act risks. table of contents i. introduction 7 ii. establishing enterprise risk',
87:'management in management practices 9 a. governance 12 b. risk profiles 13 b1. identification of objectives 16 b2. identification of',
88:'risk 16 b3. inherent risk assessment 17 b4. current risk response 18 b5. residual risk assessment 19 b6. proposed action',
89:'19 b7. proposed risk response category 19 c. implementation 19 d. role of auditors in enterprise risk management 21 iii.',
90:'establishing and operating an effective system of internal control 22 a. governance. 23 b. establish entity level control 24 b1.',
91:'service organizations 24 b2. managing fraud risks in federal programs 26 iv. assessing internal control 29 a. documentation requirements 29',
92:'b. sources of information 29 c. identification of deficiencies 30 d. internal control evaluation approach 31 v. correcting internal control',
93:'deficiencies 35 a. importance of correcting internal control deficiencies 35 b. corrective action plan requirements 35 c. audit follow up',
94:'and cooperative audit resolution and oversight initiatives 36 vi. reporting on internal controls 37 a. annual assurance statement. 37 b.',
95:'reporting pursuant to integration of enterprise risk management and internal control 37 c. reporting pursuant to omb circular no. a123,',
96:'appendix a 37 d. reporting pursuant to omb circular no. a130, appendix i 38 e. reporting pursuant to section 2—31',
97:'u.s.c. 3512d 2 38 f. reporting pursuant to section 4—31 u.s.c. 3512d 2 b 38 g. government corporations 39 h.',
98:'classified matters 39 i. agencies obtaining audit opinions on internal control 43 vii.additional considerations 44a. managing privacy risks in federal',
99:'programs 44 b. conducting acquisition assessments under omb circular no. a123 46 c. managing grants risks in federal programs 47',
100:'d. managing antideficiency act risks 48 list of tables table 1 illustrative example of a risk profile 15 table 2',
101:'summary of green book components and principles of internal control 23 table 3 illustrative internal control evaluation – control environment',
102:'33 table 4 principle and component evaluation 33 table 5 overall assessment of a system of internal control 34 table',
103:'6 summary of omb circular no. a123 reporting requirements 40 table 7 comparison of omb acquisition framework and gao green',
104:'book 47 list of figures figure 1 the relationship between internal controls and enterprise risk management 8 figure 2 illustrative',
105:'example of an enterprise risk management model 11 figure 3 erm development and implementation deadlines 20 list of exhibits exhibit',
106:'1 illustrative unmodified assurance statement 42 exhibit 2 illustrative modified assurance statement 42 exhibit 3 illustrative statement of no assurance',
107:'43 i. introduction federal leaders and managers are responsible for establishing and achieving goals and objectives, seizing opportunities to improve',
108:'effectiveness and efficiency of operations, providing reliable reporting, and maintaining compliance with relevant laws and regulations. they are also responsible',
109:'for implementing management practices that effectively identify, assess, respond, and report on risks. risks arise from a variety of external',
110:'and internal environments. examples include economic, operational, and organizational change factors, all of which would negatively impact an agency’s ability',
111:'to meet goals and objectives if not resolved. federal leaders and managers achieve these aims through a governance structure defined',
112:'through a variety of sources, including laws enacted by the congress and numerous executive directives and agency policies. most relevant',
113:'to this discussion, the federal government’s core governance processes are defined by office of management and budget omb budget guidance,',
114:'such as omb circular no. a11, which defines the processes by which the executive branch develops and executes strategic plans,',
115:'compiles the president’s budget request, assembles congressional budget justifications, conducts performance reviews, and issues annual performance plans and annual performance',
116:'reports. omb circular no. a123 provides guidance to federal managers on improving the accountability and effectiveness of federal programs and',
117:'operations by identifying and managing risks, establishing requirements to assess, correct, and report on the effectiveness of internal controls. enterprise',
118:'risk management erm and internal control are components of a governance framework. erm as a discipline deals with identifying, assessing,',
119:'and managing risks. through adequate risk management, agencies can concentrate efforts towards key points of failure and reduce or eliminate',
120:'the potential for disruptive events. internal control is a processes effected by an entity’s oversight body, management, and other personnel',
121:'that provides reasonable assurance that the objectives of an entity will be achieved. leading international standards setters in the fields',
122:'of risk management and internal control including both the committee of sponsoring organizations of the treadway commission coso and the',
123:'international organization for standardization iso incorporate internal control as part of the larger risk management process. erm is viewed as',
124:'a part of the overall governance process, and internal controls as an integral part of risk management and erm. this',
125:'relationship is depicted in the following cosobased diagram in figure 1. figure 1 the relationship between internal controls and enterprise',
126:'risk management the remaining sections of this document is organized as follows: section ii of omb circular no. a123 defines',
127:'management’s responsibilities for erm, and includes requirements for identifying and managing risks. most importantly, it encourages agencies to establish a',
128:'risk management council rmc, develop “risk profiles” which identify risks arising from mission and missionsupport operations, and consider those risks',
129:'as part of the annual strategic review process. it complements section 270 of omb circular no. a 11, which discusses',
130:'agency responsibilities for identifying and managing strategic and programmatic risk as part of agency strategic planning, performance management, and performance',
131:'reporting practices. together, these two circulars constitute the erm policy framework for the federal government, with specific erm activities integrated',
132:'and operationalized by federal agencies. section iii of omb circular no. a123 includes guidance for establishing internal controls for those',
133:'risks identified by management as requiring a formal system of internal control to provide reasonable assurance that objectives are achieved.',
134:'for this subset of risks identified by management, this circular prescribes requirements conforming with the standards of internal control in',
135:'the federal government established by the government accountability office gao, more commonly known as the green book. this includes establishing',
136:'and maintaining internal control to achieve specific objectives related to operations, reporting, and compliance; assessing and reporting effectiveness; and providing',
137:'assurances on its agency financial report afr, or the performance and accountability report par. information regarding identified material weaknesses and',
138:'corrective actions should be included in any of the three preceding reports. section iv of omb circular no. a123 discusses',
139:'management’s responsibility to continuously monitor, assess, and improve the effectiveness of internal controls. also discussed are documentation requirements, possible sources',
140:'of information for use in the assessment on internal controls, identification of deficiencies and the internal control evaluation approach. section',
141:'v of omb circular no. a123 provides guidance on correcting internal control deficiencies, corrective action plan requirements and audit follow',
142:'up and resolution initiatives. an agency’s corrective action process provides the ability for management to develop a plan for addressing',
143:'the risk associated with a control deficiency. an agency’s ability to correct control deficiencies is an indicator of the strength',
144:'of its internal control environment. section vi of omb circular no. a123 provides guidance on annual assurance statements and reporting',
145:'requirements in accordance with 31 u.s.c. 3512, that allows for a single assurance statement, government corporations and classified matters. this',
146:'section also provides definitions for a control deficiency, significant deficiency, and a material weakness. section vii of omb circular no.',
147:'a123 discusses additional considerations such as managing privacy risks, conducting acquisition assessments, managing risk to grants and managing antideficiency act',
148:'risks. ii.establishing enterprise risk management inmanagement practices there are several enterprise risk management erm models available to help organizations integrate',
149:'risk management and internal control activities into a common framework. section 270.24 of the office of management and budget omb',
150:'circular no. a11 defines “risk” as the effect of uncertainty on objectives. risk management is a series of coordinated activities',
151:'to direct and control challenges or threats to achieving an organization’s goals and objectives. erm is an effective agencywide approach',
152:'to addressing the full spectrum of the organization’s external and internal risks by understanding the combined impact of risks as',
153:'an interrelated portfolio, rather than addressing risks only within silos. erm provides an enterprisewide, strategicallyaligned portfolio view of organizational challenges',
154:'that provides better insight about how to most effectively prioritize resource allocations to ensure successful mission delivery. while agencies cannot',
155:'respond to all risks related to achieving strategic objectives and performance goals, they must identify, measure, and assess risks related',
156:'to mission delivery. effective risk management: creates and protects value; is an integral part of all organizational processes; is part',
157:'of decisionmaking; explicitly addresses uncertainty; is systematic, structured, and timely; is based on the best available information; is tailored and',
158:'responsive to the evolving risk profile of the agency; takes human and cultural factors into account; is transparent and inclusive;',
159:'is dynamic, iterative, and responsive to change; and facilitates continual improvement of the organization. erm reflects forwardlooking management decisions and',
160:'balancing risks and returns so an agency enhances its value to the taxpayer and increases its ability to achieve its',
161:'strategic objectives. the committee of sponsoring organizations of the treadway commission coso erm framework also includes the concepts of risk',
162:'appetite, risk tolerance, and portfolio view: risk appetite is the broadbased amount of risk an organization is willing to accept',
163:'in pursuit of its mission/vision. it is established by the organization’s most senior level leadership and serves as the guidepost',
164:'to set strategy and select objectives. risk tolerance is the acceptable level of variance in performance relative to the achievement',
165:'of objectives. it is generally established at the program, objective or component level. in setting risk tolerance levels, management considers',
166:'the relative importance of the related objectives and aligns risk tolerance with risk appetite. a portfolio view of risk provides',
167:'insight into all areas of organizational exposure to risksuch as reputational, programmatic performance, financial, information technology, acquisitions, human capital, etc.,',
168:'thus increasing an agency’s chances of experiencing fewer unanticipated outcomes and executing a better assessment of risk associated with changes',
169:'in the environment. erm is beneficial since it addresses a fundamental organizational issue: the need for information about major risks',
170:'to flow both up and down the organization and across its organizational structures to improve the quality of decisionmaking. erm',
171:'seeks to open channels of communication so that managers have access to the information they need to make sound decisions.',
172:'erm seeks to encompass the range of major risks that threatens agencies’ ability to implement their missions, programs, and operations.',
173:'most agencies should build their capabilities, first to conduct more effective risk management, then to implement erm, rating those risks',
174:'in terms of impact, and finally building internal controls to monitor and assess the risk developments at various time points.',
175:'to complete this circle of risk management the agencies must incorporate risk awareness into the agencies’ culture and ways of',
176:'doing business. while there are many approaches that can be taken to implement erm, most include the following elements:3 3',
177:'based on the orange book, management of risk – principles and concepts, october 2004, hm treasury. figure 2 illustrative example',
178:'of an enterprise risk management model 1.establish the context understanding and articulating the internal and external environments of the organization.',
179:'2.initial risk identification using a structured and systematic approach to recognizingwhere the potential for undesired outcomes or opportunities can arise.',
180:'3.analyze and evaluate risks considering the causes, sources, probability of the riskoccurring, the potential positive or negative outcomes, and then',
181:'prioritizing the results of the analysis. 4.develop alternatives systematically identifying and assessing a range of risk response options guided by',
182:'risk appetite. 5.respond to risks making decisions about the best optionss among a number of alternatives, and then preparing and',
183:'executing the selected response strategy. 6.monitor and review evaluating and monitoring performance to determine whether the implemented risk management options',
184:'achieved the stated goals and objectives. 7.continuous riskidentification must be an iterative process, occurring throughout the year to include surveillance',
185:'of leading indicators of future risk from internal and external environments. the “extended enterprise” consists of interdependent relationships, parentchild relationships,',
186:'and relationships external to an agency. thus, no agency is selfcontained, and risk drivers can arise out of organizations that',
187:'extend beyond the enterprise. these relationships give rise to a need for assurance that risk is being managed in that',
188:'relationship both appropriately and as planned. the risk environment is beyond the boundary of the “extended enterprise.” the environment generates',
189:'risks that cannot be controlled, or constrain the way the organization is permitted to take on or address risk. a.',
190:'governance the responsibilities of managing risks are shared throughout the agency from the highest levels of executive leadership to the',
191:'service delivery staff executing federal programs. industry best practices suggest risk management functions generally have the following characteristics: helping senior',
192:'management develop and implement core policies and procedures withrespect to enterprise risk management, including developing a process to define riskappetite,',
193:'and establish risk thresholds accordingly; ensuring the current risk levels and processes are consistent with the established risktolerance thresholds and',
194:'policies; supporting implementation of effective controls; developing strong reporting systems and analysis that incorporate quantitative andqualitative information to provide effective',
195:'portfolio views of risk; identifying emerging risks, concentrations of risk, and other situations that could beproperly assessed; and elevating critical',
196:'issues to appropriate levels within an agency in a timely fashion. to provide governance for the risk management function, agencies',
197:'may use a risk management council rmc to oversee the establishment of the agency’s risk profile, regular assessment of risk,',
198:'and development of appropriate risk response. rmc structures will vary by agency, and in some cases may be integrated with',
199:'existing management structures. an effective rmc will include senior officials for program operations and missionsupport functions to help ensure those',
200:'risks are identified which have the most significant impact on the mission outcomes of the agency. should agencies choose to',
201:'use an rmc, the rmc should be chaired by the agency chief operating officer coo or a senior official with',
202:'responsibility for the enterprise. in cabinetlevel agencies this is the deputy secretary. to support this work, some agency governance structures',
203:'are beginning to include a chief risk officer cro, or equivalent function who champion agencywide efforts to manage risk within',
204:'the agency and advise senior leaders on the strategicallyaligned portfolio view of risks at the agency. a cro may serve',
205:'as a strategic advisor to the coo and other staff on the integration of enterprise risk management practices into the',
206:'daytoday business operations and decision making. cros generally work with business unit managers within their organizations to identify issues in',
207:'a timely manner to allow for proactive management of the program and to facilitate informed, datadriven decisionmaking. regardless of the',
208:'governance structure developed, agency governance should include a process for considering risk appetite and tolerance levels. the concept of “risk',
209:'appetite” is key to achieving effective erm, and is essential to consider in determining risk responses. although a formally documented',
210:'risk appetite statement is not required, agencies must have a solid understanding of their risk appetite and tolerance levels in',
211:'order to create a comprehensive enterpriselevel risk profile. risk appetite can be considered qualitatively and/or quantitatively and should be factored',
212:'into the process of balancing risks with opportunities. additionally, risk appetite and tolerance levels should be evaluated on a regular',
213:'basis and adjusted accordingly to meet the needs of the organization. see omb circular no. a11 section 270.26, for a',
214:'discussion of the broader risk management roles the rmc should fulfill with respect to strategic reviews. b. risk profiles4 4',
215:'based on the orange book, management of risk – principles and concepts, october 2004, hm treasury. agencies must maintain a',
216:'risk profile. the primary purpose of a risk profile is to provide a thoughtful analysis of the risks an agency',
217:'faces toward achieving its strategic objectives arising from its activities and operations, and to identify appropriate options for addressing significant',
218:'risks. the risk profile assists in facilitating a determination around the aggregate level and types of risk that the agency',
219:'and its management are willing to assume to achieve its strategic objectives. the risk profile differs from a risk register',
220:'in that it is a prioritized inventory of the most significant risks identified and assessed through the risk assessment process',
221:'versus a complete inventory of risks. the risk profile must consider risks from a portfolio perspective and be approved by',
222:'an agency’s rmc or equivalent. additionally, the profile must identify sources of uncertainty, both positive opportunities and negative threats. the',
223:'development of an agency risk profile: encourages open and candid conversations about risks facing an organization at all levels; facilitates',
224:'the ranking of risk priorities in particular to identify and escalate the most significant risks of which senior management should',
225:'be aware; captures the reasons for decisions made about risk tolerances; facilitates recording of the way in which it is',
226:'decided to address risk; allows leadership at all levels to understand the overall risk profile and how their areas of',
227:'particular responsibility fit into it; and facilitates the review and regular monitoring of risks. agencies have discretion in terms of',
228:'the appropriate content and format for their risk profiles; however, in general risk profiles should include the following seven components:',
229:'1. identification of objectives 2. identification of risk 3. inherent risk assessment 4. current risk response 5. residual risk assessment',
230:'6. proposed risk response 7. proposed action category each of these seven components is illustrated in the table below, and',
231:'further descriptions of each component, including guidance for each, follows the table. in completing their risk profiles, agencies may consider',
232:'reviewing and incorporating results from existing documentation such as gao and oig audit findings, oig’s annual report on top performance',
233:'and management challenges, ffmia/fmfia documentation, employee viewpoint survey results, external media, etc. agencies should adhere to the general guidance provided',
234:'for these components when making modifications to the content and format of their risk profiles. see sections c1 though c7',
235:'following the table below. table 1 illustrative example of a risk profile strategic objective – improve program outcomes inherent assessment',
236:'current risk response residual assessment proposed risk response owner proposed risk response risk impact likelihood impact likelihood category agency x',
237:'may fail to achieve program targets due to lack of capacity at program partners. high high reduction: agency x has',
238:'developed a program to provide program partners technical assistance high medium agency x will monitor capacity of program partners through',
239:'quarterly reporting from partners primary – program office primary – strategic review operations objective – manage this risk of fraud',
240:'in federal operations contract and grant fraud. high medium reduction: agency x has developed procedures to ensure contract performance is',
241:'monitored and that proper checks and balances are in place. high medium agency x will provide training on fraud awareness,',
242:'identification, prevention, and reporting. primary – contracting or grants officer primary – internal control assessment reporting objective – provide reliable',
243:'external financial reporting inherent assessment risk response residual assessment proposed action owner proposed action risk impact likelihood impact likelihood category',
244:'agency x identified material weaknesses in internal control. high high reduction: agency x has developed corrective actions to provide program',
245:'partners technical assistance. high medium agency x will monitor corrective actions in consultation with omb to maintain audit opinion. primary',
246:'– chief financial officer primary – internal control assessment compliance objective – comply with the improper payments legislation program x',
247:'is highly susceptible to significant improper payments. high high reduction: agency x has developed corrective actions to ensure improper payment',
248:'rates are monitored and reduced. high medium agency x will develop budget proposals to strengthen program integrity. primary – program',
249:'office primary – internal control assessment and strategic review b1. identification of objectives risk must be analyzed in relation to',
250:'achievement of the strategic objectives established in the agency strategic plan see omb circular no. a11, section 230, as well',
251:'as risk in relation to appropriate operational objectives. specific objectives must be identified and documented to facilitate identification of risks',
252:'to strategic, operations, reporting, and compliance. this process assists in the identification of formal internal controls and compliance with the',
253:'fmfia, as discussed in section iii. in summary, the risk profile must include the following objectives: strategic objectives: relating to',
254:'the strategic goals and objectives aligned with and supporting the agency’s mission see omb circular no. a 11, section 230.',
255:'operations objectives: relating to the effective and efficient use of the agency’s resources related to administrative and major program operations,',
256:'including financial and fraud objectives refer to section iii, establishing and operating an effective system of internal control. reporting objectives:',
257:'relating to the reliability of the agency’s reporting. compliance objectives: relating to the agency’s compliance with applicable laws and regulations.',
258:'in some cases there will be overlap across these categories, and agencies have discretion in terms of how to address',
259:'this overlap. in addition, agencies may find it useful to include additional subcategories of one or more objectives categories to',
260:'facilitate communication on a narrower topic. one of the most common subcategories includes reputational risk. reputational risk damages the reputation',
261:'of an agency or component of an agency to the point of having a detrimental effect capable of affecting the',
262:'agency’s ability to carry out mission objectives. examples of reputational risk include the loss of confidence and trust, which stakeholders',
263:'have in an organization to deliver operational services, or the loss of an agency’s financial statement opinion. agencies may use',
264:'their discretion in determining how to incorporate additional subcategories into their risk profile. b2. identification of risk identifying risks is',
265:'a critical step in building the agency’s risk profile. the identification of risk can be separated into two distinct phases:',
266:'1. initial risk identification for an agency which has not previously identified its risks in a structured way, or for',
267:'a new component of an agency, or perhaps for a new project or activity within an agency; and 2. continuous',
268:'risk identification which is necessary to identify new or emerging risks, and/or changes in existing risks. the identification of risk',
269:'is a continuous and ongoing process. once initial risks are identified, it is important to reexamine risks on a regular',
270:'basis to identify new risks or changes to existing risks. assessing risk is the next critical step in building the',
271:'agency’s risk profile, which includes three important principles: 1. ensure that there is a clearly structured process in which both',
272:'likelihood and impact are considered for each risk; 2. record the assessment of risk in a way which facilitates monitoring',
273:'and the identification of risk priorities; and 3. be clear about the difference between inherent and residual risk. some risk',
274:'is unavoidable and beyond an organization’s ability to reduce to a tolerable level. nevertheless, the organization should make contingency plans',
275:'and manage risks against those plans. for example, many organizations have to accept that risk arises due to natural disaster',
276:'situations that they cannot control. b3. inherent risk assessment inherent risk is the exposure arising from a specific risk before',
277:'any action has been taken to manage it beyond normal operations. the impact on the agency’s ability to achieve its',
278:'objectives if the risk occurred can be ranked by appropriate categories, as can the likelihood that each significant risk might',
279:'occur. while agencies can design their own appropriate categories, for the purposes of this guidance the following illustrative definitions can',
280:'be used: impact high: the impact could preclude or highly impair the entity’s ability to achieve one or more of',
281:'its objectives or performance goals; medium: the impact could significantly affect the entity’s ability to achieve one or more of',
282:'its objectives or performance goals; and low: the impact will not significantly affect the entity’s ability to achieve one or',
283:'more of its objectives or performance goals. likelihood high: the risk is very likely or reasonably expected to occur; medium:',
284:'the risk is more likely to occur than unlikely; and low: the risk is unlikely to occur. b4. current risk',
285:'response the action taken to manage the risk. it could involve one or more of the following: acceptance: no action',
286:'is taken to respond to the risk based on the insignificance of the risk; or the risk is knowingly assumed',
287:'to seize an opportunity. avoidance: action is taken to stop the operational process, or the part of the operational process,',
288:'causing the risk. reduction: action is taken to reduce the likelihood or impact of the risk. sharing: action is taken',
289:'to transfer or share risks across the entity or with external parties, such as insuring against losses.5 5 based on',
290:'definitions outlined by gao in the green book. risk responses take many forms, including: avoidance of risk by development of',
291:'a legislative proposal; reduction of risk by proposing to increase funding for the activity; acceptance of the risk of adopting',
292:'a new technology in order to provide better services to customers. formulation of risk responses should consider the organization’s risk',
293:'appetite and tolerance levels. the development of risk responses should be used to inform decisionmaking through existing management processes including',
294:'the strategic reviews, development of the legislative and policy agenda, operational planning, and budget formulation. as part of developing the',
295:'risk profile, management must determine those risks for which the appropriate response includes implementation of formal internal control activities as',
296:'described in section iii of this guidance and which conform to the standards published by gao in the green book.',
297:'these include those risks that meet each of the following criteria: the agency is working to reduce exposure to the',
298:'risk. the objective is related to reporting, compliance, or operations, including both administrative operations and the major operational components of',
299:'programs. the risk is identified in the agency risk profile as at least medium impact and medium likelihood i.e., the',
300:'risk is greater than low. public reporting on the risk will not negatively impact services provided to the public, national',
301:'security, or agency operations. control objectives can be clearly specified. b5. residual risk assessment residual risk is the exposure remaining',
302:'from an inherent risk after action has been taken to manage it, using the same assessment standards as the inherent',
303:'assessment. b6. proposed action additional action proposed to further reduce the exposure remaining after the risk mitigation actions have been',
304:'taken, for consideration by senior management, proposed risk responses should use the same standards applied to the current risk response,',
305:'as described above, including the identification of risks for which implementation of formal internal control activities is appropriate. b7. proposed',
306:'risk response category identification of the existing management process that will be used to implement and monitor proposed actions. those',
307:'proposed actions that will be discussed with omb as part of the annual strategic review must be identified see omb',
308:'circular no. a11, section 270, as well as proposed actions to be considered during formulation of the president’s budget. in',
309:'particular, the rmc or other equivalent governance body, must categorize actions for the adoption of formal internal control activities as',
310:'described in section iii of this guidance and which conform to the standards published by gao in the green book,',
311:'when the criteria identified above under current risk responses have been met. risk profile disclosure. as explained above, the development',
312:'of agency risk profiles requires candor, subjective evaluations, and frank discussions in identifying the likelihood and severity of internal vulnerabilities.',
313:'in addition, risk profiles serve to inform the development of agency strategic plans as well as the president’s budget. as',
314:'such, agency risk profiles will often contain predecisional, deliberative, confidential, or sensitive information. agencies are encouraged to consult with their',
315:'office of general counsel if there are questions regarding the disclosure of such information. c. implementation the management of risk',
316:'must be regularly reviewed to monitor whether or not the risk profile has changed and to gain assurance that risk',
317:'management is effective or if further action is necessary. in addition, processes must be put in place to review whether',
318:'risks still exist, whether new risks have arisen, whether the likelihood and impact of risks have changed, to report significant',
319:'changes that adjust risk priorities, and deliver assurance on the effectiveness of control. in addition, the overall risk management process',
320:'must be subjected to regular review to deliver assurance that it remains appropriate and effective.at a minimum, management’sriskmanagement review processes',
321:'must6: ensure that all aspects ofthe risk management process are reviewedat least once a year; ensure that risks themselves are',
322:'subjected to review with appropriatefrequency; and make provisionsfor alerting the appropriate levelof management to new or emergingrisks,as well as changesin',
323:'already identifiedrisks,so that the change can be appropriately addressed. federal agencies have diverse missions, and are at different levels of',
324:'maturity in terms of theircapacity to fully implement erm.theagency’s approach for developing risk profiles and implementing ermshouldbe refinedand improved each',
325:'year.this guidancerecognizesthat not all components ofan ermprocessarefully operationalized in theinitial years, andagencyleadershipmustset priorities in terms of implementation.unless otherwiseapproved by omb,',
326:'agenciesmustmeet thefollowing deadlines: figure3erm developmentand implementation deadlines deliverabledue dateno laterthan:descriptionermimplementationapproachas soon aspracticable, prior to june initial riskprofiledeliverableagencies are encouraged not',
327:'required to develop anapproach to implement enterprise risk management erm which may include: plannedrisk managementgovernance structure, process for considering risk',
328:'appetite and risktolerance levels, methodology fordevelopinga risk profile, general implementation timeline, andplan formaturing the comprehensivenessand quality of therisk profiles over',
329:'time. initialrisk profilejune 2, 2017 agenciesmust complete theirinitial risk profiles incoordination with the agency strategicreviews. keyfindings should be made available',
330:'for discussionwithomb by june 2,2017 as part of the agency strategic reviewmeetings and/or fedstat.the finaldetermination on informationto be sharedwith ombwill',
331:'be provided in early 2017.this initial risk profilewill inform the development of each agency’snewstrategic planand the president’sfy 2019 budget. integration',
332:'with managementevaluation of internalcontrolseptember15,2017for those risks forwhichformal internal controls havebeen identified as part of the initial risk profile in fy2017,',
333:'all agenciesmust present assurances on internalcontrol processes in the fy 2017 agencyfinancialreport afr or the performance andaccountabilityreport par, alongwith a',
334:'report on identifiedmaterial 6basedin part on the orangebook, management of risk –principles and concepts, october 2004, hm treasury. 20 weaknesses',
335:'and corrective actions. until an agency has fully implemented an erm approach to risk management, it may continue to provide',
336:'the existing risk assurance statements to their oig and/or private accounting firms, as appropriate. updated risk profile annually by june',
337:'3 no less than annually, all agencies must prepare a complete risk profile and include required risk components and elements',
338:'required by this guidance. cfo act agencies, at a minimum, must complete their risk profiles in coordination with the agency',
339:'strategic review. for these agencies, key findings should be made available for discussion with omb by june 3rd as part',
340:'of the agency strategic review meetings and/or fedstat. the final determination on information to be shared with omb will be',
341:'provided in advance of these discussions. the risk profile will help to inform changes to strategy, policy, operations, and the',
342:'president’s budget. omb circular no. a11, part 6, is the authoritative policy guidance on deadlines for the summary of findings',
343:'from the agency strategic reviews, including the timing of submissions to omb. agencies should consult omb circular no. a11 as',
344:'each prepares materials. after initial implementation, the agency’s risk profile must be discussed each year with omb as a component',
345:'of the summary of findings from the agency strategic review and fedstat see omb circular no. a11, section 270. for',
346:'those objectives for which formal internal control activities have been identified as part of the risk profile, assurances on internal',
347:'control processes must be presented in the agency financial report afr or performance and accountability report par, along with a',
348:'report on identified material weaknesses and corrective actions. d. role of auditors in enterprise risk management management is responsible for',
349:'enterprise risk management systems. internal or external auditors conduct independent and objective audits, evaluations, and investigations of an agency’s programs',
350:'and operations, which includes aspects of the internal control and risk management systems. management uses the results of such evaluations,',
351:'including accompanying findings and recommendations, to monitor the design or operating effectiveness of these systems at a specific time or',
352:'of a specific function or process. auditors are also responsible for keeping management informed about risks that it detects, including',
353:'fraud risks, and thereby provides information to management for use in the identification and assessment of risks. management and external',
354:'auditors might have different interpretations of risks based on their respective roles and responsibilities. the agency risk function should seek',
355:'to coordinate their roles so that the independence and scope of the external auditor’s role is preserved while ensuring the',
356:'continuing flow of risk information to the risk management function. iii. establishing and operating an effective system of internal control',
357:'the fmfia requires the gao to prescribe standards of internal control in the federal government, more commonly known as the',
358:'green book. these standards provide the internal control framework and criteria federal managers must use in designing, implementing, and operating',
359:'an effective system of internal control. the green book defines internal control as a process effected by an entity’s oversight',
360:'body, management, and other personnel that provides reasonable assurance that the objectives of an entity are achieved. these objectives and',
361:'related risks can be broadly classified into one or more of the following categories: operations: effectiveness and efficiency of operations;',
362:'reporting: reliability of reporting for internal and external use; and compliance: compliance with applicable laws and regulations. a subset of',
363:'the categories of objectives are the safeguarding of all assets. management designs an internal control system to provide reasonable assurance',
364:'regarding the prevention or prompt detection and correction of unauthorized acquisition, use, or disposition of an entity’s assets. fmfia also',
365:'requires omb, in consultation with gao, to establish guidelines for agencies to evaluate their systems of internal control to determine',
366:'fmfia compliance. instead of considering internal control as an isolated management tool, agencies must integrate their efforts to meet the',
367:'requirements of the fmfia with the enterprise risk management erm requirements discussed in section ii. thus, internal control is an',
368:'integral part of the entire cycle of strategic planning, goal and objective setting, budgeting, program management, accounting, and auditing. it',
369:'must support the effectiveness and the integrity of every step of the process and provide continual feedback to management. federal',
370:'managers must carefully consider the appropriate balance between risk, controls, costs, and benefits in their missionsupport operations. too many controls',
371:'can result in inefficiencies, while too few controls might increase risk to an unacceptable level. management’s responsibility is to develop',
372:'and maintain effective internal control that is consistent with its established risk appetite and risk tolerance levels. in addition, management',
373:'is responsible for establishing and integrating internal control into its operations in a riskbased and cost beneficial manner, in order',
374:'to provide reasonable assurance that the entity’s internal control over operations, reporting, and compliance is operating effectively. achieving the objectives',
375:'of external reporting and compliance, which are based largely on laws, rules, regulations, and standards established by congress, gao, and',
376:'omb, depends on how activities within the agency’s control are performed. generally, management and oversight bodies have greater discretion in',
377:'setting internal reporting objectives that are not driven by external parties. however, agency’s may choose to align its internal and',
378:'external reporting objectives to allow internal reporting to better support the agency’s external reporting. achievement of some operations objectives –',
379:'such as certain aspects of program outcomes or maintaining safe operations – are not always within the agency’s control. an',
380:'effective internal control system increases the likelihood that an entity achieves its objectives. however, no matter how well designed, implemented,',
381:'or operated, an internal control system cannot provide absolute assurance that all of an organization’s objectives are met. factors outside',
382:'the control or influence of management can affect the entity’s ability to achieve all of its objectives. for example, a',
383:'natural disaster can affect an organization’s ability to achieve its objectives. therefore, once in place, effective internal control provides reasonable,',
384:'not absolute, assurance that an organization achieves its objectives. the green book is organized by five components of internal control',
385:'as shown in the exhibit below. in addition, the five components of internal control contain 17 required principles and each',
386:'principle has important attributes which explain the principles in greater detail. table 2 summary of green book components and principles',
387:'of internal control components of internal control principles control environment 1. demonstrate commitment to integrity and ethical values 2. exercise',
388:'oversight responsibility 3. establish structure, responsibility and authority 4. demonstrate commitment to competence 5. enforce accountability risk assessment 6. define',
389:'objectives and risk tolerances 7. identify, analyze, and respond to risk 8. assess fraud risk 9. analyze and respond to',
390:'change control activities 10. design control activities 11. design activities for information systems 12. implement control activities information and communication',
391:'13. use quality information 14. communicate internally 15. communicate externally monitoring 16. perform monitoring activities 17. remediate deficiency federal managers',
392:'must carefully consider the appropriate balance between controls and risk in their programs and operations. to emphasize, too many controls',
393:'can result in inefficient and ineffective government; agency managers must ensure an appropriate balance between the strength of controls and',
394:'the relative risk associated with particular programs and operations. the benefits of controls should outweigh the cost. agencies should consider',
395:'both qualitative and quantitative factors when analyzing costs against benefits. a. governance. agencies must have a senior management council smc',
396:'to assess and monitor deficiencies in internal control. this smc may be a subset of the risk management council, however,',
397:'agencies have discretion in determining the appropriate structure. a senior management council may include the chief financial officer, chief human',
398:'capital officer, chief information officer, chief information security officer, chief acquisition officer, senior agency official for privacy, designated agency ethics',
399:'official, and performance improvement officer and the managers of other program offices, must be involved in identifying and ensuring correction',
400:'of systemic material weaknesses relating to their respective programs. such councils generally recommend to the agency head which significant deficiencies',
401:'are deemed to be material weaknesses to the agency as a whole, and must therefore be included in the annual',
402:'fmfia assurance statement and reported in the agency’s annual financial report afr or performance accountability report par. this council should',
403:'be responsible for overseeing the timely implementation of corrective actions related to material weaknesses. such a council is also useful',
404:'in determining when sufficient action has been taken to declare that a significant deficiency or material weakness has been corrected',
405:'though the final official determination likely resides with the agency head and the oig. the smc should also include senior',
406:'assessment teams to lead assessments related to the objective of internal control over reporting see appendix a to omb circular',
407:'no. a123, internal control over reporting. b. establish entity level control establishing entity level control elc is another primary step',
408:'in operating an effective system of internal control. the green book defines elcs as controls that have a pervasive effect',
409:'on an entity’s internal control system and pertain to multiple components. elcs are mostly within the control environment, risk assessment,',
410:'information and communication, and monitoring components of the green book. control activities are also considered a component of elc and',
411:'provide a link to an agency’s processes as described in section c below. entitylevel controls also include controls related to',
412:'the entity’s use of service organizations or management override of internal control and fraud. b1. service organizations the green book',
413:'provides internal control considerations for service organizations shared service providers ssp are one example. service organization internal control considerations include',
414:'management’s responsibility for the performance of third party provided processes, establishing “user controls” at the agency receiving services, and service',
415:'organization oversight. management’s responsibility for the processes performed by third party service organizations. third party service providers perform activities for',
416:'many agencies. examples include, but are not limited to: accounting and payroll processing, employee benefit plan servicing, information technology services,',
417:'protections for sensitive agency data, acquisition or procurement services, security services, asset management, health care claims processing, and loan servicing.',
418:'agencies are ultimately responsible for the services and processes provided by third party service organizations as they relate to the',
419:'agency’s ability to maintain internal control over operations, reporting, and compliance with laws and regulations. management’s responsibility for establishing user',
420:'controls. if the processes provided by the third party service organization is significant to an agency’s internal control objectives, then',
421:'the agency is responsible for establishing user agency controls that complement the service organization’s controls. management still retains overall responsibility',
422:'and accountability for all controls related to the processes provided by the third party, and must monitor the process as',
423:'a whole to make sure it is effective. examples of user agency controls include: o input/ output controls: in most',
424:'third party provider situations, the agency must have access to the information processed by a service organization. in some cases,',
425:'this information enables the agency to compare the service organization’s results with the results of an independent source. for example,',
426:'an agency using a payroll service organization compares the data submitted to the service organization with reports or information received',
427:'from the service organization after the data has been processed. o performance monitoring: agencies must have a process for monitoring',
428:'the service organization’s performance in relation to various metrics, as typically defined in a servicelevel agreement. most of these metrics',
429:'must be tailored to specific operations. for example, agencies regularly review the security, availability, and processing integrity of servicelevel agreements.',
430:'o process controls: in some third party provider situations, the agency’s user controls are closely tied to the service organization’s',
431:'processes and provide direct assurance over their operation. for example, an agency that has its it development provided by a',
432:'third party service organization chooses to document, track, approve, and test all application changes internally, thus retaining significant control over',
433:'the it development process. management’s responsibility for oversight of service organizations. the extent of an agency’s oversight of a service',
434:'organization depends on the nature of the contract or agreement terms and conditions. the use of a third party provider',
435:'needs to be considered for management’s oversight and assessment of internal control based on risk and when the activity is',
436:'significant to the agency’s achievement of internal control objectives of operations, reporting, or compliance. examples of services provided by the',
437:'service organization that warrant oversight include: maintenance of a user agency’s financial reporting and accounting records; safeguarding of a user',
438:'agency’s assets; services that involve personally identifiable information pii; investments for employee benefit plans; mortgage services from servicers that service',
439:'mortgages for others; or application services for technology environments that support operations. service organization responsibility. service organizations are responsible for',
440:'providing assurances to their customers and assisting customers in understanding the relationship between the service provider’s controls and the customer’s',
441:'user controls. together, service organizations and customers manage the risks of third party provider activities typically through a service organization',
442:'control soc 1 type 2 report more technically referred to as a statement on standards for attestation engagement no. 16',
443:'report7. soc 1 report considerations include: o ensuring the soc report adequately addresses the relevant internal control objectives. o determining',
444:'the extent and adequacy of internal control testing performed on the operating effectiveness of internal controls throughout a specified period.',
445:'o ensuring the soc reports cover a substantial portion of the fiscal year and bridge or roll forward letters are',
446:'considered. o reviewing the soc report opinion e.g., unmodified and determining what impact any internal control deficiencies included in the',
447:'soc report have on the related control objectives. o evaluating complementary user entity controls included in the soc 1 report',
448:'to determine that the appropriate controls are in place to support the activities of the service provider. o considering any',
449:'complementary subservice organization controls included in the soc 1 report and the effectiveness of controls at subservice organizations. 7 effective',
450:'for service auditors’ reports dated on or after may 1, 2017, service organization reports will be prepared under a new',
451:'clarified attestation standard –au320. 8 gao standards for internal control in the federal government, gao14704g, section 8.03. http://www.gao.gov/assets/670/665712.pdf. b2. managing',
452:'fraud risks in federal programs the green book defines fraud as obtaining something of value through willful misrepresentation. whether an',
453:'act is fraud is a determination to be made through the judicial or other adjudicative system and is beyond management’s',
454:'professional responsibility for assessing risk. waste is the act of using or expending resources carelessly, extravagantly, or to no purpose.',
455:'abuse involves behavior that is deficient or improper when compared with behavior that a prudent person considers reasonable and necessary',
456:'in operational practice given the facts and circumstances. this includes the misuse of authority or position for personal gain or',
457:'for the benefit of another. waste and abuse do not necessarily involve fraud or illegal acts. green book requires management',
458:'to consider the potential for fraud when identifying, analyzing, and responding to risks. 8 principle 8 of the omb circular',
459:'no. a123 fraud risk profile requirements. fraud jeopardizes agency missions by diverting scarce resources from their intended purpose. a single',
460:'case of fraud can undermine programmatic mission, disrupt services, and force management to expend valuable time, resources, and staffhours to',
461:'resolve and recover property lost due to fraud. reputational risks of fraud can damage the perception of an agency, impact',
462:'employee morale, and create distrust by the public, further hindering their efforts to provide services to the public. to the',
463:'extent that federal managers can effectively mitigate and prevent fraud from occurring, it can save time and resources spent in',
464:'investigating and prosecuting fraud, and recovering lost money and property, thus avoiding the “pay and chase model.” management has overall',
465:'responsibility for establishing internal controls to manage the risk of fraud. this includes reporting to the agency’s governance structure what',
466:'actions have been taken to manage fraud risks and on the status of the agency’s risk profile. the agency’s risk',
467:'profile as required by section ii of omb circular no. a123 must include an evaluation of fraud risks and use',
468:'a riskbased approach to design and implement financial and administrative control activities to mitigate identified material fraud risks. refer to',
469:'appendix a of omb circular no. a123, internal control over reporting, for requirements related to reporting internal control objectives. the',
470:'financial and administrative controls established through the agency’s risk profile must also include: controls to address identified fraud risks related',
471:'to payroll, beneficiary payments, grants, large contracts, information technology and security, asset safeguards, and purchase, travel and fleet cards; collecting',
472:'and analyzing data from reporting mechanisms on detected fraud to monitor fraud trends and using that data and information to',
473:'continuously improve fraud prevention controls; and using the results of monitoring, evaluation, and investigations to improve fraud prevention, detection, and',
474:'response. gao framework for managing fraud risks in federal programs. to help managers to combat fraud and preserve integrity in',
475:'government agencies and programs, gao identified leading practices for managing fraud risks and organized them into a conceptual framework called',
476:'the fraud risk management framework the framework, gao15593sp. managers should adhere to these leading practices as part of their efforts',
477:'to effectively design, implement, and operate an internal control system that addresses fraud risks. managers are responsible for determining the',
478:'extent to which the leading practices in the framework are relevant to their program and for tailoring the practices, as',
479:'appropriate, to align with the program’s operations. the framework encompasses control activities to prevent, detect, and respond to fraud, with',
480:'an emphasis on prevention, as well as structures and environmental factors that influence or help managers achieve their objective to',
481:'mitigate fraud risks. in addition, the framework highlights the importance of monitoring and incorporating feedback, which are ongoing practices that',
482:'apply to the following four components described below. commit to combating fraud by creating an organizational culture and structure conducive',
483:'to fraud risk management. plan regular fraud risk assessments and assess risks to determine a fraud risk profile. evaluate outcomes',
484:'using a riskbased approach and adapt activities to improve fraud risk management. design and implement a strategy with specific control',
485:'activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation. establishing risk tolerances in disaster situations. managers',
486:'must balance their priorities to fulfill the program’s mission, such as effectively disbursing funds or providing services to beneficiaries, and',
487:'taking actions to safeguard taxpayer dollars from improper use. for example, in disaster situations, fraud risks are higher than under',
488:'normal circumstances because the need to provide services quickly can hinder the effectiveness of existing controls and creates additional opportunities',
489:'for individuals to engage in fraud. as a result, managers face additional challenges balancing their mission to provide assistance quickly',
490:'with implementing controls to address the increased risk of fraud. gao’s fraud framework calls for managers to determine risk tolerances',
491:'when assessing fraud risks and to use that determination as part of the basis for developing responses to identified fraud',
492:'risks, including specific controls to address the risks. risk tolerance reflects managers’ willingness to accept a higher level of fraud',
493:'risks and vary depending on the circumstances of the program. when determining risk tolerance in disaster situations, managers weigh the',
494:'program’s operational objective of expeditiously providing assistance against the objective of lowering the likelihood of fraud, because activities to lower',
495:'fraud risks—such as the risk that ineligible individuals submit fraudulent applications for benefits—causing delays in service. as a result, managers',
496:'are willing to accept a somewhat higher risk of fraud than under normal circumstances in order to provide emergency assistance',
497:'in a timely manner. gao’s fraud framework provides a basis for managers to make decisions about how to respond to',
498:'fraud risks, including determining the specific controls to design and implement, given managers’ defined risk tolerances. managers can find additional',
499:'guidance provided in the association of government accountants aga fraud prevention tool kit useful when managing specific types of fraud',
500:'risks in federal programs. aga’s fraud prevention tool kit provides current, stateoftheart tools for federal, state, local, and tribal government',
501:'financial managers to use in preventing and detecting fraud. iv. assessing internal control agency managers must continuously monitor, assess, and',
502:'improve the effectiveness of internal control associated with those internal control objectives identified as part of their risk profile. this',
503:'continuous monitoring, and other periodic evaluations, provide the basis for the agency head’s annual assessment and report on internal control',
504:'as required by the fmfia. a. documentation requirements agency management must determine the appropriate level of documentation needed to support',
505:'this assessment. the green book provides documentation requirements that are a necessary part of an effective internal control system. the',
506:'level and nature of documentation vary based on the size of the entity and the complexity of the operational processes',
507:'the entity performs. management uses judgment in determining the extent of documentation that is needed. documentation is required to demonstrate',
508:'the design, implementation, and operating effectiveness of an entity’s internal control system. the green book includes minimum documentation requirements as',
509:'follows: if management’s assessment determines that a principle is not relevant, management supports that determination with documentation that includes the',
510:'rationale of how, in the absence of that principle, the associated component may be designed, implemented, and operated effectively. management',
511:'develops and maintains documentation of its internal control system. management documents in policies the internal control responsibilities of the organization.',
512:'management evaluates and documents the results of ongoing monitoring and separate evaluations to identify internal control issues. management evaluates and',
513:'documents internal control issues and determines appropriate corrective actions for internal control deficiencies on a timely basis. management completes and',
514:'documents corrective actions to remediate internal control deficiencies on a timely basis. b. sources of information the agency’s assessment of',
515:'internal control may be documented using a variety of information sources to include: management documentation of its internal control system,',
516:'policies, procedures, and knowledge gained from the daily operation of agency programs and systems. management reviews conducted i expressly for',
517:'the purpose of assessing internal control, or ii for other purposes with an assessment of internal control as a byproduct',
518:'of the review. annual performance plans, reports, strategic reviews and program evaluations relevant to internal control pursuant to the gpra',
519:'modernization act and omb circular no. a11, section 200, federal performance framework. acquisition assessments pursuant to omb memorandum: conducting acquisition',
520:'assessments under omb circular no. a123, may 21, 2008. management reviews and annual evaluations and reports related to information technology,',
521:'information security, and information resources pursuant to the federal information security modernization act of 2014 and omb circular no. a130,',
522:'responsibilities for protecting federal information resources. outputs of governance mechanisms for information technology resources published by the agency, pursuant to',
523:'the “cio authorities” described in the federal information technology acquisition reform act fitara. office of government ethics program reviews and',
524:'other internal agency ethics program reviews. annual reviews and reports pursuant to the improper payments information act of 2002, as',
525:'amended by the improper payments elimination and recovery act of 2010 and the improper payments elimination and recovery improvement act',
526:'of 2012. program reviews conducted pursuant to omb circular no. a129, policies for federal credit programs and nontax receivables. single',
527:'audit act reports and program reviews conducted pursuant to the uniform administrative requirements, cost principles, and audit requirements for federal',
528:'awards for grantmaking agencies. antideficiency act reviews and investigations. independent audit reports including office of inspectors general management challenges and',
529:'gao high risk reports. internal audit reports. reports and other information provided by the congressional committees of jurisdiction. other reviews',
530:'or reports relating to agency operations or management controls. assessments of internal control over financial reporting and reviews of financial',
531:'management systems pursuant to appendix a of omb circular no. a123, internal control over reporting, appendix b to omb circular',
532:'no. a123, improving the management of government charge card program, appendix c to omb circular no. a123, requirements for effective',
533:'estimation and remediation of improper payments, or appendix d to omb circular no. a123, compliance with the federal financial management',
534:'improvement act. use of information should take into consideration the completeness of the assessment and whether the process included an',
535:'evaluation of internal control. agency management should avoid duplicating reviews that assess internal controls, and should coordinate their efforts with',
536:'other evaluations to the extent practical. c. identification of deficiencies agency managers and employees should identify deficiencies in internal control',
537:'from the sources of information described above and the results of their assessment process. the assessment process must include an',
538:'assessment of compliance with each of the green book components and principles. in addition, the identification of deficiencies must include',
539:'all management and operational functions and processes that support mission delivery. agency employees and managers report control deficiencies, at a',
540:'minimum to the next supervisory level, which allows the chain of command structure to determine the relative importance of each',
541:'deficiency. reporting of deficiencies should also include reporting deficiencies to the agency’s inspector general. definitions of control deficiencies, significant deficiencies,',
542:'and material weaknesses are provided in section vi. agency managers and staff are encouraged to identify control deficiencies, as this',
543:'reflects positively on the agencys commitment to recognizing and addressing management problems. failing to report a known material weakness or',
544:'significant deficiency reflects adversely on the agency and continue to place the agency’s mission support operations at risk. agencies must',
545:'carefully consider whether systemic weaknesses exist that adversely affect internal control across organizational or program lines. d. internal control evaluation',
546:'approach management is responsible for evaluating whether a system of internal control reduces the risk of not achieving the entity’s',
547:'objectives related to operations, reporting, or compliance to an acceptable level. in evaluating internal control, management should follow a riskbased',
548:'assessment approach:9 9 section based on coso, internal control – integrated framework, illustrative tools for assessing effectiveness of a system',
549:'of internal control new york: american institute of certified public accountants, 2013. 1. conduct an assessment of internal control. management',
550:'must conduct an evaluation of internal controls for each of the green book’s principles for each of the entity objectives.',
551:'2. prepare a summary of internal control deficiencies. management should leverage an aggregated or summary log of all identified internal',
552:'control deficiencies from the sources of information listed in section b above and the results of their assessment process. the',
553:'log may support the evaluation of the green book’s internal control components and principles. 3. conclude on internal control principle',
554:'evaluation. management must summarize its determination of whether each principle is designed, implemented, and operating effectively. that determination is a',
555:'function of management judgment based on: a. the applicability of the principle to the agency’s circumstances, b. whether the agency',
556:'has actually been able to implement, perform, and apply the principle, c. any internal control deficiency that may result, d.',
557:'the extent of compensating internal controls within the principle, and e. the extent to which the remaining risk impacts on',
558:'the agency’s ability to achieve its objectives and meet its mission and goals. evaluation of whether each principle is designed,',
559:'implemented, and operating effectively must be of the “yes/no” type. 4. conclude on internal control component evaluation. management must also',
560:'summarize its determination of whether each component is designed, implemented, and operating effectively. similar to item three above, evaluation of',
561:'internal control components is a function of management judgment and qualitative determinations. if an internal control principle is not designed,',
562:'implemented, and operating effectively, management is unable to conclude that the internal control component is operating effectively. 5. conclude on',
563:'overall assessment of a system of internal control. management must summarize its determination of whether each of the green book’s',
564:'components and principles are designed, implemented, and operating effectively and components are operating together in an integrated manner. in addition,',
565:'management must determine the severity of internal control deficiencies or combination of deficiencies when aggregated across the components. if one',
566:'or more internal control components are not operating effectively, a material weakness must be reported. the following table illustrates how',
567:'internal control principles within the control environment component roll up into the determination of whether the component is designed, implemented,',
568:'and operating effectively, in addition to the overall assessment of a system of internal control. examples below include illustrative summaries',
569:'of control deficiencies. table3illustrative internal control evaluation–control environment illustrative internalcontrol evaluationcontrol environmentprinciplecontrol deficiency summaryprinciple 1: demonstratecommitment tointegrity andethical valuesthe agency’s',
570:'ethics training program is not sufficientto make all employees aware of the importance ofadhering to the executive branch employee standards',
571:'ofconduct. the agency doesnot have processes in place to detectandmitigate potential employee conflicts of interest. management concludes the principle isnotdesigned,',
572:'implemented, and operating effectively. principle 2: exercise oversight responsibilityinternal control deficiency noted because the seniormanagement council’s review of risk assessments',
573:'andremediation plans are not documented. management concludes that the principle is designed, implemented, and operating effectively despite internalcontrol deficiencies based',
574:'on an evaluation of the severity of deficiencies and that compensating controlsare in place. principle 3: establish structure, responsibility andauthorityinternal',
575:'control deficiency noted because oversight andcontrol structures havenot evolved to keep upwith changes in operations. management concludes that the principle',
576:'is designed, implemented, and operating effectively as the deficiencynoted only affect a small portion of the agency. principle 4: demonstratecommitment',
577:'to competenceno internal control deficiencies noted. management concludes that the principle is designed, implemented, and operating effectively. principle 5: enforce',
578:'accountabilityinternal control deficiencies noted because management,with oversight from the seniormanagement council, does not take necessarycorrective actions. management concludes that the',
579:'principle is notdesigned, implemented, and operating effectively. the following table is anillustrativeexample of the results of management’s assessment of the',
580:'control environment component: table4principleand component evaluation principle evaluationprincipledesigned & implementedyes/no operating effectively1 demonstrate commitment to integrity and ethical valuesnoineffective2 exercise',
581:'oversightresponsibilityyeseffectivewith internal controldeficiencies and compensatingcontrolsnoted3 establish structure, responsibility andauthorityyeseffectivewith internal controldeficiencies and compensatingcontrolsnoted 4 demonstrate commitment to competence yes effective',
582:'5 enforce accountability no ineffective component evaluation component designed & implemented yes/no operating effectively control environment no ineffective in the',
583:'table above, management concludes the control environment component is not designed, implemented, and operating effectively since two principles are not',
584:'designed, implemented, and operating effectively due to the identified deficiencies from the summary log. each principle supports the design, implementation,',
585:'operational effectiveness of the associated component. if one principle is ineffective, management is unable to conclude that the component is',
586:'effective.10 in the table below, since management concluded that the control environment is not operating effectively, it must conclude that',
587:'the overall system of internal control was not operating effectively and an entitylevel control material weakness must be reported. 10',
588:'see green book ov3.03, factors of effective internal control table 5 overall assessment of a system of internal control overall',
589:'assessment of a system of internal control system evaluation designed & implemented yes/no operating effectively control environment no ineffective risk',
590:'assessment yes effective control activities yes effective information and communication yes effective monitoring yes effective are all components operating together',
591:'in an integrated manner? no ineffective overall evaluation of a system of internal control overall evaluation operating effectively is the',
592:'overall system of internal control effective? no v. correcting internal control deficiencies a. importance of correcting internal control deficiencies correcting',
593:'control deficiencies is an integral part of management accountability and must be considered a priority by the agency. an agency’s',
594:'ability to correct control deficiencies is an indicator of the strength of its internal control environment. effective remediation of control',
595:'deficiencies is essential to achieving the objectives of the fmfia, and uncorrected or longstanding control deficiencies must be considered in',
596:'determining the overall effectiveness of internal control. the corrective action process provides the mechanism for management to present a comprehensive',
597:'plan for addressing the risk associated with a control deficiency. b. corrective action plan requirements agencies should perform a rootcause',
598:'analysis of the deficiency to ensure that subsequent strategies and plans address the root of the problem and not just',
599:'the symptoms. identifying and developing an understanding of the root cause of control deficiencies is management’s responsibility. management should incorporate',
600:'ig and gao audit findings as part of its identification process; however, auditors are not responsible for identifying root causes',
601:'of control deficiencies. as a result, reliance on audit findings or recommendations alone may lead to incomplete corrective actions. management',
602:'should also consider alternative risk mitigation strategies and perform costbenefit analysis to determine the best or most costeffective solution. a',
603:'summary of the corrective action plans for material weaknesses that have not been fully mitigated at the time of reporting',
604:'must be included in the agency’s afr, par, or other management report. also see section vi for reporting on material',
605:'weaknesses. the summary discussion must include a description of the material weakness, status of corrective actions, and timeline for resolution.',
606:'management must maintain more thoroughly detailed corrective action plans internally, which must be made available for omb and audit review.',
607:'management’s process for resolution and corrective action of identified internal control deficiencies must: communicate corrective actions to the appropriate level',
608:'of the agency and delegate authority for completing corrective actions to appropriate personnel. determine the resources required to correct a',
609:'control deficiency. the corrective action plan must indicate the types of resources needed e.g., additional personnel, contract support, training, etc.,',
610:'including nonfinancial resources, such as senior leadership support for correcting the control deficiency. include critical path milestones that affect the',
611:'overall schedule and performance of the corrective actions needed to resolve the control deficiency. critical path milestones must lead to',
612:'a date certain of the correction of the control deficiency. require prompt resolution and internal control testing to validate the',
613:'correction of the control deficiency. ensure that accurate records of the status of the identified control deficiency are maintained and',
614:'updated throughout the entire process. ensure that the corrective action plans are consistent with laws, regulations, and agency policy. ensure',
615:'that performance appraisals of appropriate officials reflect effectiveness in resolving or implementing corrective action for identified material weaknesses. fully disclose',
616:'uncorrected internal control weaknesses and highlight those that are material. a determination that a control deficiency has been corrected should',
617:'be made by the senior accountable official only when sufficient corrective actions have been taken and validated. this determination must',
618:'be in writing, supported by appropriate documentation, and made available for review by appropriate officials, e.g., the agency’s senior management',
619:'council or equivalent. c. audit follow up and cooperative audit resolution and oversight initiatives as managers consider office of inspectors',
620:'general oig, gao, and other investigative audit reports in identifying and correcting internal control deficiencies, they must be mindful of',
621:'the statutory requirements included in the inspector general act, as amended, and omb circular no. a50, audit followup. management has',
622:'a responsibility to complete action, in a timely manner, on audit recommendations on which agreement with the oig has been',
623:'reached. management must make a decision regarding oig audit recommendations within a sixmonth period after issuance of the audit report',
624:'and implement managements decision within one year to the extent practicable. some agencies use cooperative audit resolution and oversight initiatives',
625:'caroi11 to complement oversight of corrective actions and internal control efforts. in addition, the uniform grant guidance encourages agencies to',
626:'use cooperative audit resolution mechanisms as part of audit followup techniques that promote prompt corrective actions by improving communication, fostering',
627:'collaboration, promoting trust, and developing a common understanding of audit findings to improve federal program outcomes. the aga has conducted',
628:'research and has developed a framework to implement caroi at federal agencies. the aga provides, “the caroi is a tool',
629:'for achieving: 1 alternative and creative approaches to resolving audit findings and their underlying causes, and 2 greater success in',
630:'attaining program goals at all levels of government through the constructive use of monitoring and technical assistance i.e., oversight activities.”',
631:'while the establishment of a caroi is not a requirement of this document, a caroi or similar construct is encouraged.',
632:'11 https://www.agacgfm.org/aga/toolsresources/documents/caroi.pdf. vi. reporting on internal controls a. annual assurance statement. the assurance statement and summary information related to section',
633:'2 and section 4 of the fmfia must be provided in a single report section of the annual afr, par,',
634:'or other management report labeled “analysis of entity’s systems, controls and legal compliance. the section must include the annual assurance',
635:'statement, a summary of the agency’s process for assessing internal control effectiveness and resulting material weaknesses and corrective action plans',
636:'as of september 30 of a given fiscal year.12 the assurance statement is an accountability statement so only essential information',
637:'must be included. table 5 provides a summary of internal control reporting requirements, and exhibits 1, 2, and 3 provide',
638:'illustrative examples of assurance statements. 12 agencies may use roll forward procedures for timing differences in different types of internal',
639:'control assessments e.g., timing differences between june 30 and september 30. b. reporting pursuant to integration of enterprise risk management',
640:'and internal control management has discretion in determining the scope of operations, reporting, and compliance objectives based on the agency’s',
641:'risk profile as described in section ii of this document. agencies are required to provide assurances on their process to',
642:'identify risks and establish controls or integrate existing controls to the identified risk. some of these internal control systems may',
643:'have been operating effectively prior to integration of these risks. these assurances should be built out over time following a',
644:'maturity model approach and reported in the afr along with a report on identified material weaknesses and corrective actions. until',
645:'an agency has fully implemented an erm approach to risk management they may continue to provide the existing risk assurance',
646:'statements to their oig and/or private accounting firms. c. reporting pursuant to omb circular no. a123, appendix a appendix a',
647:'of omb circular no. a123 provides a methodology for agency management to assess, document and report on internal controls over',
648:'reporting. this document also encourages an integrated approach to assess the internal controls over reporting considering the current legislative and',
649:'regulatory environment in which federal entities operate. management’s assessment of internal control over external financial reporting must follow the assessment',
650:'methodology provided in appendix a to circular no. a123, internal control over reporting. d. reporting pursuant to omb circular no.',
651:'a130, appendix i appendix i of omb circular no. a130, responsibilities for protecting and managing federal information resources, establishes minimum',
652:'requirements for federal information security programs, assigns federal agency responsibilities for the security of information and information systems, and links',
653:'agency information security programs and agency management control systems established in accordance with omb circular no. a123. the appendix also',
654:'establishes requirements for federal privacy programs, assigns responsibilities for privacy program management, and describes how agencies must take a coordinated',
655:'approach to implementing information security and privacy controls. e. reporting pursuant to section 2—31 u.s.c. 3512d 2 section 231 u.s.c',
656:'3512d 2, commonly referred to as section 2 of the fmfia requires that the head of each executive agency annually',
657:'submit to the president and the congress i a statement on whether there is reasonable assurance that the agencys controls',
658:'are achieving their intended objectives; and ii a report on material weaknesses in the agencys controls. statement of assurance. the',
659:'statement of assurance represents the agency heads informed judgment as to the overall adequacy and effectiveness of internal control within',
660:'the agency related to operations, reporting, and compliance. the statement must take one of the following forms: o unmodified statement',
661:'of assurance no material weaknesses or lack of compliance reported; o modified statement of assurance, considering the exceptions explicitly noted',
662:'one or more material weaknesses or lack of compliance reported; or o statement of no assurance no processes in place',
663:'or pervasive material weaknesses. in deciding on the type of assurance to provide, the agency head should consider information from',
664:'the assessment process described in section iv of this circular, with input from senior program and administrative officials. management is',
665:'precluded from concluding that the agency’s internal control is effective unmodified statement of assurance if there are one or more',
666:'material weaknesses. in support of a single assurance statement, a detailed summary of management assurances must also be provided in',
667:'the “other information” section of the annual afr, par, or other management report. the detailed assurances should mirror the single',
668:'assurance statement and provide assurance over the effectiveness of internal controls in each supporting area of operations, reporting including external',
669:'financial reporting, and compliance. the agency head must sign the statement of assurance. f. reporting pursuant to section 4—31 u.s.c.',
670:'3512d 2 b section 431 u.s.c. 3512d 2 b commonly referred to as section 4 of the fmfia, requires cfo',
671:'act agencies, a separate report on whether the agencys financial management systems comply with governmentwide requirements. these financial management systems',
672:'requirements are mandated by section 803 a of the federal financial management improvement act and appendix d to omb circular',
673:'no. a123, compliance with the federal financial management improvement act of 1996. ffmia section 803a requirements include compliance with federal',
674:'financial management system requirements, applicable federal accounting standards, and the united states standard general ledger ussgl at the transaction level.',
675:'if the agency’s systems do not comply with financial systems requirements, the statement must list the lack of compliance noted',
676:'and discuss the agencys plans for bringing its systems into compliance. financial management systems include both financial and financiallyrelated or',
677:'mixed systems. g. government corporations for government corporations, section 306 of the chief financial officers act established a reporting requirement',
678:'related to the internal controls for corporations covered by the government corporation control act. these corporations must submit an annual',
679:'management report to the congress. this report must include, among other items, a statement on control systems by the head',
680:'of the management of the corporation consistent with the requirements of the fmfia. the corporation is required to provide the',
681:'president, the director of omb, and the comptroller general a copy of the management report when it is submitted to',
682:'the congress. h. classified matters the statement of assurance is made available to the public. however, relevant information that is',
683:'specifically prohibited from disclosure by any provision of law, or specifically required by executive order to protect the interest of',
684:'national defense or the conduct of foreign affairs, must not be included in the statement made available to the public.',
685:'descriptions of major vulnerabilities must be framed in such a way as to preclude an adverse party from exploiting the',
686:'information. table 6 summary of omb circular no. a123 reporting requirements category definition reporting control deficiency a control deficiency exists',
687:'when the design, implementation, or operation of a control does not allow management or personnel, in the normal course of',
688:'performing their assigned functions, to achieve control objectives and address related risks.13 a deficiency in design exists when 1 a',
689:'control necessary to meet a control objective is missing or 2 an existing control is not properly designed so that',
690:'even if the control operates as designed, the control objective would not be met.14 a deficiency in implementation exists when',
691:'a properly designed control is not implemented correctly in the internal control system. 15 a deficiency in operation exists when',
692:'a properly designed control does not operate as designed, or when the person performing the control does not possess the',
693:'necessary authority or competence to perform the control effectively.16 internal to the organization and not reported externally. progress against corrective',
694:'action plans must be periodically assessed and reported to agency management. significant deficiency a significant deficiency is a deficiency, or',
695:'a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit',
696:'attention by those charged with governance.17 internal to the organization and not reported externally. progress against corrective action plans must',
697:'be periodically assessed and reported to agency management. 13 green book ov3.08 14 green book ov3.05 15 green book ov3.05',
698:'16 green book ov3.06 17 consistent with auc 260, the auditor’s communication with those charged with governance, the 2011 revision',
699:'of government auditing standards defines those charged with governance as the persons or organizations with responsibility for overseeing the strategic',
700:'direction of the entity and the obligations related to the accountability of the entity. this includes overseeing the financial reporting',
701:'process, subject matter, or program under audit, including related internal controls. category definition reporting material weakness a significant deficiency that',
702:'the agency head determines to be significant enough to report outside of the agency as a material weakness. in the',
703:'context of the green book, nonachievement of a relevant principle and related component results in a material weakness.18 a material',
704:'weakness in internal control over operations might include, but is not limited to, conditions that: impacts the operating effectiveness of',
705:'entity level controls; impairs fulfillment of essential operations or mission; deprives the public of needed services; or significantly weakens established',
706:'safeguards against fraud, waste, loss, unauthorized use, or misappropriation of funds, property, other assets, or conflicts of interest. a material',
707:'weakness in internal control over reporting is a significant deficiency, in which the agency head determines significant enough to impact',
708:'internal or external decisionmaking and reports outside of the agency as a material weakness. a material weakness in internal control',
709:'over external financial reporting is a deficiency, or a combination of deficiencies, in internal control, such that there is a',
710:'reasonable possibility19 that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on',
711:'a timely basis. a material weakness in internal control over compliance is a condition where management lacks a process that',
712:'reasonably ensures preventing a violation of law or regulation that has a direct and material effect on financial reporting or',
713:'significant effect on other reporting or achieving agency objectives. material weaknesses and a summary of corrective actions must be reported',
714:'to omb and congress through the afr, par, or other management reports. progress against corrective action plans must be periodically',
715:'assessed and reported to agency management. 18 the federal information security modernization act of 2014 no longer requires that a',
716:'significant deficiency identified be reported as a material weakness for fmfia. 19 in this definition, a reasonable possibility exists when',
717:'the likelihood of the event is reasonably possible or probable as those terms are used in auc 265, communicating internal',
718:'control related matters identified in an audit. exhibit 1 illustrative unmodified assurance statement the [agency] management is responsible for managing',
719:'risks and maintaining effective internal control to meet the objectives of sections 2 and 4 of the federal managers’ financial',
720:'integrity act. the [agency] conducted its assessment of risk and internal control in accordance with omb circular no. a123, management’s',
721:'responsibility for enterprise risk management and internal control. based on the results of the assessment, the agency can provide reasonable',
722:'assurance that internal control over operations, reporting, and compliance were operating effectively as of september 30, 20xx. head of the',
723:'agency signature exhibit 2 illustrative modified assurance statement the [agency] management is responsible for managing risks and maintaining effective internal',
724:'control to meet the objectives of sections 2 and 4 of the federal managers’ financial integrity act. the [agency] conducted',
725:'its assessment of risk and internal control in accordance with omb circular no. a123, management’s responsibility for enterprise risk management',
726:'and internal control. based on the results of the assessment, the agency can provide reasonable assurance that internal control over',
727:'operations, reporting, and compliance were operating effectively as of september 30, 20xx, except for the following material weaknesses reported: [insert',
728:'brief description of each internal control material weakness;] head of the agency signature exhibit 3 illustrative statement of no assurance',
729:'the [agency] management is responsible for managing risks and maintaining effective internal control to meet the objectives of sections 2',
730:'and 4 of the federal managers’ financial integrity act. the [agency] conducted its assessment of risk and internal control in',
731:'accordance with omb circular no. a123, management’s responsibility for enterprise risk management and internal control. based on the results of',
732:'the assessment, the agency is unable to provide assurance that internal control over operations, reporting, and compliance was operating effectively',
733:'due to the following material weaknesses: [insert brief description of each internal control material weakness;] head of the agency signature',
734:'i. agencies obtaining audit opinions on internal control agencies may be required or may at their choice elect to receive',
735:'an audit opinion on internal control over external financial reporting. these agencies must provide a separate assurance statement for internal',
736:'control over external financial reporting. the green book and omb circular no. a123 provide adequate criteria for management’s assessment of',
737:'internal control and related management assurances. public company accounting oversight board requirements for the private sector are not requirements of',
738:'the federal government. vii. additional considerations a. managing privacy risks in federal programs the federal government necessarily creates, collects, uses,',
739:'processes, stores, maintains, disseminates, discloses, and disposes of personally identifiable information pii to carry out the missions mandated by federal',
740:'statute. the term pii, as defined by omb, refers to information that can be used to distinguish or trace an',
741:'individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. because',
742:'there are many different types of information that can be used to distinguish or trace an individual’s identity, the term',
743:'pii is necessarily broad. to determine whether information is pii, the agency must perform an assessment of the specific risk',
744:'that an individual can be identified using the information with other information that is linked or linkable to the individual.',
745:'in performing this assessment, it is important to recognize that information that is not pii can become pii whenever additional',
746:'information becomes available – in any medium and from any source – that would make it possible to identify an',
747:'individual. once the agency determines that an information system contains pii, the agency must then consider the privacy risks and',
748:'the associated risk to agency operations, agency assets, individuals, other organizations, and the nation. when considering privacy risks, the agency',
749:'must consider the risks to an individual or individuals associated with the agency’s creation, collection, use, processing, storage, maintenance, dissemination,',
750:'disclosure, and disposal of their pii. in particular, the agency must evaluate the sensitivity of each individual data element that',
751:'is pii, as well as all of the data elements together. the sensitivity level of the pii will depend on',
752:'the context, including the purpose for which the pii is created, collected, used, processed, stored, maintained, disseminated, disclosed, or disposed.',
753:'for example, the sensitivity level of a list of individuals’ names may depend on the source of the information, the',
754:'other information associated with the list, the intended use of the information, how the information will be processed and shared,',
755:'and the ability to access the information. in addition, when determining the privacy and associated risks, the agency must also',
756:'consider the volume of pii. a higher volume of pii about a single individual or multiple individuals may pose increased',
757:'privacy or associated risks. agency privacy programs. in order to manage federal information resources that involve pii, agencies must develop,',
758:'implement, document, maintain, and oversee agencywide privacy programs that include people, processes, and technologies. agencies’ privacy programs are led by',
759:'the senior agency official for privacy saop and are responsible for ensuring compliance with applicable privacy requirements, developing and evaluating',
760:'privacy policy, and managing privacy risks. privacy programs’ review of privacy risks should begin at the earliest planning and development',
761:'stages of agency actions and policies that involve pii, and should continue throughout the life cycle of the information. privacy',
762:'impact assessments. as a general matter, an agency must conduct a privacy impact assessment pia under section 208b of the',
763:'egovernment act of 2002, absent an applicable exception under that section, when the agency develops, procures, or uses information technology',
764:'to create, collect, use, process, store, maintain, disseminate, disclose, or dispose of pii.20 a pia is an analysis of how',
765:'pii is handled to ensure that handling conforms to applicable privacy requirements, determine the privacy risks associated with an information',
766:'system or activity, and evaluate ways to mitigate privacy risks. a pia is both an analysis and a formal document',
767:'detailing the process and the outcome of the analysis. 20 see 44 u.s.c. § 3501 note. section 208b of the',
768:'egovernment act requires agencies, absent an applicable exception under this section, to conduct a pia before: i developing or procuring',
769:'it that collects, maintains, or disseminates information that is in an identifiable form; or ii initiating a new collection of',
770:'information that – i will be collected, maintained, or disseminated using it; and ii includes any information in an identifiable',
771:'form permitting the physical or online contacting of a specific individual, if identical questions have been posed to, or identical',
772:'reporting requirements imposed on, 10 or more persons, other than agencies, instrumentalities, or employees of the federal government. a pia',
773:'is one of the most valuable tools federal agencies use to ensure compliance with applicable privacy requirements and manage privacy',
774:'risks. agencies must conduct and draft a pia with sufficient clarity and specificity to demonstrate that the agency fully considered',
775:'privacy and incorporated appropriate privacy protections from the earliest stages of the agency activity and throughout the information life cycle.',
776:'in order to conduct a meaningful pia, the agency’s saop must work closely with the program managers, information system owners,',
777:'information technology experts, security officials, counsel, and other relevant agency officials. moreover, a pia is not a timerestricted activity that',
778:'is limited to a particular milestone or stage of the information system or pii life cycles. rather, the privacy analysis',
779:'must continue throughout the information system and pii life cycles. accordingly, a pia must be considered a living document that',
780:'agencies are required to update whenever changes to the information technology, changes to the agency’s practices, or other factors alter',
781:'the privacy risks associated with the use of such information technology. in addition to serving as an important analytical tool',
782:'for agencies, a pia also serves as notice to the public regarding the agency’s practices with respect to privacy and',
783:'information technology. all pias must be drafted in plain language and must be posted on the agency’s website, unless doing',
784:'so would raise security concerns or reveal classified or sensitive information. although pias are generally required by law, such as',
785:'by the egovernment act of 2002, agencies may also develop policies to require pias in circumstances where a pia would',
786:'not be required by law. risk management framework. agencies’ privacy programs have responsibilities under the risk management framework.21 the risk',
787:'management framework provides a disciplined and structured process that integrates information security, privacy, and risk management activities into the information',
788:'system development life cycle. agencies should refer to omb circular no. a130 for more detailed guidance regarding the role of',
789:'agencies’ privacy programs under the risk management framework. 21 traditionally, the risk management framework was a framework to help agencies',
790:'address information security and related risks in the authorization process for federal information systems. nist has published a suite of',
791:'standards and guidelines that describe how to implement an agencywide risk management framework. as of the date of this publication,',
792:'many of the existing nist standards and guidelines that detail how to implement an agency wide risk management framework do',
793:'not fully address the role of privacy and agencies’ privacy programs. in the future, nist may revise or develop standards',
794:'and guidelines to further clarify how privacy and agencies’ privacy programs are integrated into the risk management framework. b. conducting',
795:'acquisition assessments under omb circular no. a123 in may 2008, omb’s office of federal procurement policy ofpp issued guidelines, including',
796:'an assessment template, to 1 establish a standard approach for assessing acquisition activities and programs; and 2 integrate these efforts',
797:'into existing agency internal control processes and practices required by omb circular no. a123. the template was adopted from the',
798:'government accountability office gao framework for assessing the acquisition function at federal agencies framework gao05218g and consists of four interrelated',
799:'areas, i.e. cornerstones, that are essential to an efficient, effective and accountable acquisition process: 1 organizational alignment and leadership; 2',
800:'policies and processes; 3 human capital; and 4 information management and stewardship. assessments conducted using this acquisition framework can continue',
801:'to be leveraged in meeting the requirements of the current update to omb circular no. a123. these guidelines are based',
802:'on gao’s framework for assessing the acquisition function at federal agencies gao05218g and can continue to be leveraged in meeting',
803:'the requirements of the current update to omb circular no. a123. each of the elements of omb’s acquisition framework is',
804:'reviewed below in relation to the green book. the critical factors contained in each element of the acquisition framework are',
805:'used where possible to depict these similarities and differences. the following illustrative table is included in setting out concepts that',
806:'are common to both omb’s acquisition framework and the green book and required by the green book, but not part',
807:'of the acquisition framework. table 7 comparison of omb acquisition framework and gao green book common to both differences required',
808:'by the green book aligning acquisition with agency mission and needs commitment from leadership none planning strategically effectively managing the',
809:'acquisition process promoting successful outcomes of major projects management responsibility for considering fraud risks valuing and investing in the acquisition',
810:'workforce strategic human capital planning acquiring, developing, and retaining talent creating resultsoriented organizational cultures management responsibility for considering fraud risks',
811:'identify data and technology that support acquisition management decisions safeguarding the integrity of operations and data none agencies should continue',
812:'their prior assessment activities under the acquisition framework to comply with the 2014 revision of the green book. for example,',
813:'the framework describes the commitment from leadership element to include management providing clear, strong and ethical executive leadership, and effective',
814:'communication, and continuous improvement. these activities align with the green book principles that require an entity to demonstrate commitment to',
815:'integrity and ethical values, while ensuring that management should communicate the necessary quality information both internally and externally. one required',
816:'green book principle that is absent from the current acquisition framework is management’s consideration for potential fraud when identifying, analyzing',
817:'and responding to risks. agencies must consider fraud risks in their strategic plans, and ensure agency professionals involved in planning',
818:'for, reviewing, awarding, and managing deliverables under contract and throughout the acquisition lifecycle receive training on fraud indicators and risks.',
819:'additional guidance covering administrative actions and procedures for preventing fraud in emergency responses and contingency operations can be found in',
820:'omb’s emergency acquisitions guide22 and in the federal acquisition regulation far. 22 memorandum for chief acquisition officers senior procurement executives.',
821:'emergency acquisitions guide 1/14/2011. http://www.whitehouse.gov/omb/procurement c. managing grants risks in federal programs on december 26, 2013, omb published the final',
822:'guidance, uniform administrative requirements, cost principles, and audit requirements for federal awards “uniform guidance” 2 cfr 200. these new requirements',
823:'set forth standards for obtaining consistency and uniformity among federal agencies for the audit of nonfederal entities expending federal awards.',
824:'the requirements seek to effectively focus federal resources, improve federal grant award performance, and create a governmentwide framework for ensuring',
825:'effective fiscal management of federal grants. in addition, the requirements in 2 cfr 200.501, audit requirements, reduce the administrative burden',
826:'on recipients by increasing the single audit threshold to $750,000 in federal award expenditures per year. the guidance in 2',
827:'cfr 200.205 requires federal awarding agency review of risks posed by applicants, risk evaluations whenever making new awards, and authorized',
828:'use of a risk based approach. within each federal agency, there is a shared interest for management and oversight of',
829:'federal grant dollars from both a financial management and grants management perspective. leveraging the riskbased perspective, the internal controls framework',
830:'should serve as a mechanism to ensure effective and efficient allocation and use of federal grant dollars. agencies must consider',
831:'fraud risks in their strategic plans and ensure federal officials involved in planning for, awarding, and managing grants and other',
832:'forms of financial assistance receive training of fraud indicators and risk. in addition, the federal government has a number of',
833:'complex interdependencies with state and local governments, and other recipients of federal funding. from an erm perspective, these interdependencies are',
834:'called the “extended enterprise” impacts the agency’s risk management, and give rise to certain additional risks, which need to be',
835:'considered in the agency’s risk profile. finally, erm and use of data analytics is an emerging best practice; examples include:',
836:'preaward decision support: appropriate tools and data analytics made available to federal awarding agencies to properly conduct risk analysis. pre/post',
837:'award monitoring plans and activities: federal awarding agencies use of relevant data to determine risks and take appropriate action prior',
838:'to making awards. award grantee risk mitigation: federal awarding agencies plan for and execute monitoring and mitigation activities meeting their',
839:'specific needs. grant policy monitoring standards: federal awarding agencies manage grant portfolios using a common set of riskbased standards. d.',
840:'managing antideficiency act risks the antideficiency act ada imposes restrictions on the amounts of obligations or expenditures that agencies may',
841:'make. ada violations are ultimately reported to the president, congress, and the government accountability office. an ada violation may be',
842:'a symptom of an underlying control deficiency. omb circular no. a11, section 150, administrative control of funds outlines requirements for',
843:'the administrative control of funds under the ada. section 150.3 explains the relationship between an agency’s internal controls and its',
844:'fund controls. in addition, omb circular no. a11, section 145, requirements for reporting antideficiency act violations, provides more information about',
845:'the ada, and also provides agencies with guidelines for reporting violations. the agency’s risk profile as described in section ii',
846:'must include a review of the agency’s budget authority, from sources such as appropriations legislation, and identify any areas in',
847:'which there is a risk of violating the ada.',