Internal control represents an organization’s plans, methods, and procedures used to meet its missions, goals, and objectives and serves as the first line of defense in safeguarding assets and preventing and detecting errors, fraud, waste, abuse, and mismanagement. Internal control is to provide reasonable assurance that an organization’s objectives are achieved through (1) effective and efficient operations, (2) reliable financial reporting, and (3) compliance with laws and regulations. Safeguarding of assets is a subset of all these objectives. The term “reasonable assurance” is important because no matter how well-designed and operated, internal control cannot provide absolute assurance that agency objectives will be met. Cost-benefit is an important concept to internal control considerations. Internal control is very broad and encompasses all controls within an organization, covering the entire mission and operations, not just financial operations. One need only to look at GAO’s January 2005 High-Risk Series: An Update, in which we identify 25 areas of high risk for fraud, waste, abuse, and mismanagement, to see the breadth of internal control. While these areas are very diverse in nature, ranging from weapon systems acquisition to contract management to the enforcement of tax laws to the Medicare and Medicaid programs, all share the common denominator of having serious internal control weaknesses. In addition, as the Comptroller General testified before the House Committee on Government Reform last week, certain material weaknesses in internal control have contributed to our inability to provide an opinion on whether the consolidated financial statements of the U.S. government are fairly stated in conformity with U.S. generally accepted accounting principles. Internal control weaknesses are also at the heart of the over $45 billion in improper payments reported by the federal government in fiscal year 2004 across a range of programs. Further, internal control includes things such as screening of air passengers and baggage to help address the risks associated with terrorism, network firewalls to keep out computer hackers, and credit checks to determine the creditworthiness of potential borrowers. The Congress has long recognized the importance of internal control, beginning with the Budget and Accounting Procedures Act of 1950, over 50 years ago. The 1950 act placed primary responsibility for establishing and maintaining internal control squarely on the shoulders of agency management. As I will discuss later, the auditor can serve an important role by independently determining whether management’s internal control is adequately designed and operating effectively and making recommendations to management to improve internal control where needed. However, the fundamental responsibility for establishing and maintaining effective internal control belongs to management. In 1982, when faced with a number of highly publicized internal control breakdowns, the Congress passed FMFIA with a goal of strengthening internal control and accounting systems. This two-page law, a copy of which is in appendix I, defined internal control broadly to include program, operational, and administrative controls as well as accounting and financial management, and reaffirmed that the primary responsibility for adequate systems of internal control rests with management. Under FMFIA, agency heads are required to establish a continuous process for assessment and improvement of their agency’s internal control and to publicly report on the status of their efforts by signing annual statements of assurance as to whether internal control is designed adequately and operating effectively. Where there are material weaknesses, the agency heads are to disclose the nature of the problems and the status of corrective actions in an annual assurance statement. Today, agencies are generally meeting their FMFIA reporting requirement by including this information in their Performance and Accountability reports, which also include their audited financial statements. The act also required that the Comptroller General establish internal control standards and that OMB issue guidelines for agencies to follow in assessing their internal control against the Comptroller General’s standards. OMB first issued Circular A-123, then entitled Internal Control Systems, in October 1981, in anticipation of FMFIA becoming law. In December 1982, following FMFIA enactment, OMB issued the assessment guidelines required by the act. OMB’s Guidelines for the Evaluation and Improvement of and Reporting on Internal Control Systems in the Federal Government detailed a seven-step internal control assessment process targeted to an agency’s mission and organizational structure. The Comptroller General issued Standards for Internal Control in the Federal Government in 1983. These standards apply equally to financial and nonfinancial controls. In August 1984, OMB issued a question and answer supplement to its assessment guidelines, intended to clarify the applicability of the Comptroller General’s internal control standards and to assist agencies in assessing risk and correcting weaknesses. The 1990s brought additional legislation that reinforced the significance of effective internal control. The Chief Financial Officers (CFO) Act, which among other things provided for major transformation of financial management, including the establishment of CFOs, called for financial management systems to comply with the Comptroller General’s internal control standards. The Government Performance and Results Act of 1993 required agencies to clarify missions, set strategic and performance goals, and measure performance toward those goals. Internal control plays a significant role in helping managers achieve their goals. The Government Management Reform Act of 1994 expanded the CFO Act by establishing requirements for the preparation and audit of agencywide financial statements and consolidated financial statements for the federal government as a whole. The 1996 Federal Financial Management Improvement Act identified internal control as an integral part of improving financial management systems. These are just a few of the legislative initiatives over the years aimed at improving government effectiveness and accountability. The Congress has been consistent over the years in demanding that agencies have effective internal control and accounting systems. From the outset, agencies faced major challenges in implementing FMFIA. The first annual assessment reports were due by December 31, 1983. This time frame gave agencies a little over a year to develop and implement an agencywide internal control assessment and reporting process to provide the information needed to support the first agency head assurance statement to the President and the Congress. OMB assembled an interagency task force called the Financial Integrity Task Force and visited all federal departments and the 10 largest agencies to foster implementation of its internal control assessment guidelines. Starting in 1983, GAO monitored and reported on FMFIA implementation efforts across the government in a series of four reports from 1984 through 1989 as well as in numerous reports targeting specific agencies and programs. In our first governmentwide report, issued in 1984, we noted that although early efforts were primarily learning experiences, agencies had demonstrated a commitment to implementing FMFIA with a good start at assessing their internal control and accounting systems. We found agencies had established systematic processes to assess, improve, and report on their internal control and accounting systems, and we observed that federal managers had become more aware of the need for good internal control and improved accounting systems. OMB played an active role, providing guidance and central direction to the program. Though the nature and extent of participation varied, most inspectors general also played a major role in the first year. Our 1984 report outlined key steps to improve implementation, including adequate training and guidance, the importance of a positive attitude and a mind-set to hold managers accountable for results, and the need for more internal control testing. Our second governmentwide report in 1985 noted that FMFIA had provided a significant impetus to the government’s attempts to improve internal control and accounting systems by focusing attention on the problems. Agencies continued to identify material internal control and accounting system weaknesses with a number of major improvement initiatives under way. We identified needed improvements to FMFIA implementation similar to those in our 1984 report, but also identified the need to reduce the paperwork associated with agency assessment efforts. In particular, vulnerability assessments aimed at identifying the areas of highest risk in order to prioritize more detailed internal control reviews were widely criticized by agencies as paperwork exercises. It was widely thought that while agencies had devoted considerable resources assessing the vulnerability of thousands of operations and functions, these efforts did not provide management with a whole lot of reliable and useful information. Our third governmentwide report was issued in 1987. We noted that an important step in strengthening internal control is verifying that planned corrective actions have been implemented as envisioned and that the completed corrective actions have been effective. We found instances where (1) corrective measures taken had not completely corrected the identified weaknesses and (2) actions to resolve weaknesses had been delayed, in some cases for years. Our fourth governmentwide report, issued in 1989 for which the title, Ineffective Internal Controls Result in Ineffective Federal Programs and Billion in Losses, is still appropriate in today’s environment, concluded that while internal control was improving, the efforts were clearly not producing the results intended. We noted continuing widespread internal control and accounting system problems and the need for greater top-level leadership. We reported that what started off as a well-intended program to foster the continual assessment and improvement of internal control unfortunately had become mired in extensive process and paperwork. Significant attention was focused on creating a paper trail to prove that agencies had adhered to the OMB assessment process and on crafting voluminous annual reports that could exceed several hundred pages. It seemed that the assessment and reporting processes had, at least to some, become the endgame. At the same time, there were some important accomplishments coming from FMFIA. Thousands of problems were identified and fixed along the way, especially at the lower levels where internal control assessments were performed and managers could take focused actions to fix relatively simple problems. Unfortunately, many of the more serious and complex internal control and accounting system weaknesses remained largely unchanged and agencies were drowning in paper. In March 1989, GAO, along with representatives of seven agencies, OMB, and the President’s Council on Integrity and Efficiency (PCIE), reviewed aspects of FMFIA implementation as part of a subcommittee of the Internal Control Interagency Coordination Council. The subcommittee’s report highlighted the following seven issues as requiring action: Link the internal control assessment and reporting process with the budget to assist the Congress and OMB in analyzing the impact of corrective actions on agency resources. Emphasize the early warning capabilities of the internal control process to ensure timely actions to correct weaknesses identified. Consolidate the review processes of various OMB circulars to eliminate overlapping assessment requirements, improve staff utilization, and reduce the paper being generated. Provide for and promote senior management involvement in the internal control process to ensure more effective and lasting oversight and accountability for FMFIA activities. Highlight the most critical internal control weaknesses in the FMFIA assurance statements to increase the usefulness of the report to the President and the Congress. Report on agency processes to validate actions taken to correct material weaknesses, ascertain that desired results were achieved, and reduce the likelihood of repeated occurrences of the same weaknesses. Improve management awareness and understanding of FMFIA to provide for more consistent program manager interpretation and acceptance of the act. Too much process and paper continued to be a problem, and in 1995 OMB made a major revision to Circular A-123 that relaxed the assessment and reporting requirements. The 1995 revision integrated many policy issuances on internal control into a single document and provided a framework for integrating internal control assessments with other reviews being performed by agency managers, auditors, and evaluators. In addition, it gave agencies the discretion to determine which tools to use in arriving at the annual assurance statement to the President and the Congress, with the stated aim of achieving a streamlined management control program that incorporated the then administration’s reinvention principles. And this brings us to the present. The recent December 2004 update to Circular A-123 reflects policy recommendations developed by a joint committee of representatives from the CFO Council (CFOC) and PCIE. The changes are intended to strengthen the requirements for conducting management’s assessment of internal control over financial reporting. The December 2004 revision to the Circular also emphasizes the need for agencies to integrate and coordinate internal control assessments with other internal control-related activities. We support OMB’s efforts to revitalize FMFIA through the December 2004 revisions to Circular A-123. These revisions recognize that effective internal control is critical to improving federal agencies’ effectiveness and accountability and to achieving the goals that the Congress established in 1950 and reaffirmed in 1982. The Circular correctly recognizes that instead of considering internal control an isolated management tool, agencies should integrate their efforts to meet the requirements of FMFIA with other efforts to improve effectiveness and accountability. Internal control should be an integral part of the entire cycle of planning, budgeting, management, accounting, and auditing. It should support the effectiveness and the integrity of every step of the process and provide continual feedback to management. In particular, we support the principles-based approach in the revised Circular for establishing and reporting on internal control that should increase accountability. This type of approach provides a floor for expected behavior, rather than a ceiling, and by its nature, greater judgment on the part of those applying these principles will be necessary. Accordingly, clear articulation of objectives, the criteria for measuring whether the objectives have been successfully achieved, and the rigor with which these criteria are applied will be critical. Providing agencies with supplemental guidance and implementation tools is particularly important, in light of the varying levels of internal control maturity that exist across government as well as the expected divergence in implementation that is typically found when a range of entities with varying capabilities apply a principles-based approach. I would now like to highlight what I think will be the six issues critical to effectively implementing the changes to Circular A-123 based on the lessons learned over the past 20 years under FMFIA. First, OMB indicated that it plans to work with the CFOC and PCIE to provide further implementation guidance. For the reasons I just highlighted, we support the development of supplemental guidance and implementation tools, which will be particularly important to help ensure that agency efforts are properly focused and meaningful. These materials should demand an appropriate rigor to whatever assessment and reporting process management adopts as well as set the bar at a level to ensure that the objectives of FMFIA are being met in substance, with a caution to guard against excessive focus on process and paperwork. Supplemental guidance and implementation tools should be aimed at helping agency management achieve the bottom-line goal of getting results from effective internal control. Second, while the revised Circular A-123 emphasizes internal control over financial reporting, it will be important that proper attention also be paid to the other two internal control objectives covered by FMFIA and discussed in the Circular, which are (1) achieving effective and efficient operations and (2) complying with laws and regulations. Also, as I mentioned earlier, safeguarding assets is a subset of all three objectives. Third, managers throughout an agency and at all levels will need to provide strong support for internal control. As I discussed earlier, the responsibility for internal control does not reside solely with the CFO. A case in point is internal control over improper payments, which is the responsibility of a range of agency officials outside of the CFO operation. Also, with respect to financial reporting, which the revised OMB Circular A- 123 specifically refers to as a priority area, the CFO generally does not control all of the needed information and often depends on other business systems for much of the financial data. For example, at the Department of Defense (DOD), about 80 percent of the information needed to prepare annual financial statements comes from other business systems, such as logistics, procurement, and personnel information systems, that are not under the CFO. Fourth, agencies must strike an appropriate balance between costs and benefits, while at the same time achieving an appropriate level of internal control. Internal controls need to be designed and implemented only after properly identifying and analyzing the risks associated with achieving control objectives. Agencies need to have the right controls, in the right place, at the right time, with an appropriate balance between related costs and benefits. In this regard, the revisions to Circular A-123 outline the concept of risk assessment for internal control over financial reporting by laying out an assessment approach at the process, transaction, and application levels. A similar approach needs to be applied as well to the other business areas and the range of programs and operations as envisioned in FMFIA. Fifth, management testing of controls in operation to determine their soundness and whether they are being adhered to and to assist in the formulation of corrective actions where problems arise will be essential. This is another area covered by the revised Circular A-123. Testing can show whether internal controls are in place and operating effectively to minimize the risk of fraud, waste, abuse, and mismanagement and whether accounting systems are producing accurate, timely, and useful information. Through adequate testing, agency managers should know what is working well and what is not. Management will then be able to focus on corrective actions as needed and on streamlining controls if testing shows that existing controls are not cost-effective. Sixth, personal accountability for results will be essential, starting with top agency management and cascading down through the organization. Regular oversight hearings, such as this one, will be critical to keeping agencies accountable and expressing the continual interest and expectations of the Congress. Independent verification and validation through the audit process, which I will talk about next, is another means of providing additional accountability. There should be clear rewards (incentives) for doing the right things and consequences (disincentives) for doing the wrong things. If a serious problem occurs because of a breakdown in internal control and it is found that management did not do its part to establish a proper internal control environment, or did not act expeditiously to fix a known problem, those responsible need to be held accountable and face the consequences of inaction. The revised Circular A-123 encourages the involvement of senior management councils in internal control assessment and monitoring, which can be an excellent means of establishing accountability and ownership for the program. In initiating the revisions to Circular A-123, OMB cited the new internal control requirements for publicly traded companies that are contained in the Sarbanes-Oxley Act of 2002. Sarbanes-Oxley was born out of the corporate accountability failures of the past several years. Sarbanes-Oxley is similar in concept to the long-standing requirements for federal agencies in FMFIA and Circular A-123. Under Sarbanes-Oxley, management of a publicly-traded company is required to (1) annually assess the internal control over financial reporting at the company and (2) issue an annual statement on the effectiveness of internal control over financial reporting. The company’s auditors are then required to attest to and report on management’s assessment as to the effectiveness of its internal control. This is where Sarbanes-Oxley differs from FMFIA. FMFIA does not call for an auditor opinion on management’s assessment of internal control over financial reporting nor does it call for an auditor opinion on the effectiveness of internal control. Likewise, Circular A-123 does not adopt these requirements, although the Circular does recognize that some agencies are voluntarily getting an audit opinion on internal control over financial reporting. Our position is that an auditor’s opinion on internal control over financial reporting is similarly important in the government environment. We view auditor opinions on internal control over financial reporting as an important component of monitoring the effectiveness of an entity’s risk management and accountability systems. In practicing what we preach, we not only issue an opinion on internal control over financial reporting at the federal entities where we perform the financial statement audit, including the consolidated financial statements of the U.S. government, but we also obtain an auditor’s opinion on internal control on our own annual financial statements. On their own initiative, the Social Security Administration (SSA) and Nuclear Regulatory Commission also received opinions on internal control over financial reporting for fiscal year 2004 from their respective independent auditors. In considering when to require an auditor opinion on internal control, the following four questions can be used to frame the issue. 1. Is this a major federal entity, such as the 24 departments and agencies covered by the CFO Act? There would be different consideration for small simple entities versus large complex entities. 2. What is the maturity level of internal control over financial reporting? 3. Is the agency currently in a position to attest to the effectiveness of internal control over financial reporting and subject that conclusion to independent audit? 4. What are the benefits and costs of obtaining an opinion? What underlies these questions is whether management has done its job of assessing its internal control and has a firm basis for its assertion statement before the auditor is tasked with performing work to support an opinion on internal control over financial reporting. As I have stressed throughout my testimony today, internal control is a fundamental responsibility of management, including ongoing oversight. The auditor’s role, similar to its opinion on the financial statements issued by management, would be to state whether the auditor agrees with management’s assertion that its internal control is adequate so that the reader has an independent view. As an example, consider DOD which has many known material internal control weaknesses. Of the 25 areas on GAO’s high-risk list, 14 relate to DOD, including DOD financial management. Given that DOD management is clearly not in a position to state that the department has effective internal control over financial reporting, there would be no need for the auditor to do additional audit work to render an opinion that internal control was not effective. On the other hand, as I just mentioned for fiscal year 2004, SSA management reported that it does not have any material internal control weaknesses over financial reporting. The auditor’s unqualified opinion over financial reporting at SSA provided an independent assessment of management’s assertion about internal control, which we believe by its nature adds value and creditability similar to the auditor’s opinion on the financial statements. As you know, Mr. Chairman, recent legislation making the Department of Homeland Security (DHS) subject to the provisions of the CFO Act, which this Subcommittee spearheaded, requires DHS management to provide an assertion on the effectiveness of internal control over financial reporting for fiscal year 2005 and to obtain an auditor’s opinion on its internal control over financial reporting for fiscal year 2006. In addition, the CFO Council and PCIE are required by the DHS legislation to jointly study the potential costs and benefits of requiring CFO Act agencies to obtain audit opinions on their internal control over financial reporting, and GAO is to perform an analysis of the information provided in the report and provide any findings to the House Committee on Government Reform and the Senate Committee on Homeland Security and Governmental Affairs. We believe that the study and related analysis are important steps in resolving the issues associated with the current reporting on the adequacy of internal control. In addition, this issue is being discussed by the Principals of the Joint Financial Management Improvement Program—the Comptroller General, the Director of OMB, the Secretary of the Treasury, and the Director of the Office of Personnel Management. In closing, as the Congress and the American public have increased demands for accountability, the federal government must respond by having a high standard of accountability for its programs and activities. Areas vulnerable to fraud, waste, abuse, and mismanagement must be continually evaluated to ensure that scarce resources reach their intended beneficiaries; are used properly; and are not diverted for inappropriate, illegal, inefficient, or ineffective purposes. I want to emphasize our commitment to continuing our work with the Congress, the administration, the federal agencies, and the audit community to continually improve the quality of internal control governmentwide, and to help ensure that action is taken to address the internal control vulnerabilities that exist today. To that end, as I said earlier, the leadership of this Subcommittee will continue to be an important catalyst for change, and I again thank you for the opportunity to participate in this hearing. Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions you or other Members of the Subcommittee may have at this time. For information about this statement, please contact Jeffrey C. Steinhoff at (202) 512-2600 or McCoy Williams, Director, Financial Management and Assurance, at (202) 512-6906 or at williamsm1@gao.gov. Individuals who made key contributions to this testimony include Mary Arnold Mohiyuddin, Abe Dymond, and Paul Caban. Numerous other individuals made contributions to the GAO reports cited in this testimony. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Internal control is at the heart of accountability for our nation's resources and how effectively government uses them. This testimony outlines the importance of internal control, summarizes the Congress's long-standing interest in internal control and the related statutory framework, discusses GAO's experiences and lessons learned from agency assessments since the early 1980s, and provides GAO's views on the Office of Management and Budget's (OMB) recent revisions to its Circular A- 123. GAO highlights six issues important to successful implementation of the revised Circular, specifically, the need for supplemental guidance and implementation tools; vigilance over the broader range of controls covering program objectives; strong support from managers throughout the agency, and at all levels; risk-based assessments and an appropriate balance between the costs and benefits of controls; management testing of controls in operation to assess if they are designed adequately and operating effectively; and management accountability for control breakdowns. Finally, GAO discusses its views on the importance of auditor opinions on internal control over financial reporting. Internal control represents an organization's plans, methods, and procedures used to meet its missions, goals, and objectives and serves as the first line of defense in safeguarding assets and preventing and detecting errors, fraud, waste, abuse, and mismanagement. Internal control provides reasonable assurance that an organizations' objectives are achieved through (1) effective and efficient operations, (2) reliable financial reporting, and (3) compliance with laws and regulations. The Congress has long recognized the importance of internal control, beginning with the Budget and Accounting Procedures Act of 1950, which placed primary responsibility for establishing and maintaining internal control squarely on the shoulders of management. In 1982, when faced with a number of highly publicized internal control breakdowns, the Congress passed the Federal Managers' Financial Integrity Act (FMFIA). FMFIA required agency heads to establish a continuous process for assessment and improvement of their agency's internal control and to annually report on the status of their efforts. In addition the act required the Comptroller General to issue internal control standards and OMB to issue guidelines for agencies to follow in assessing their internal controls. GAO monitored and reported on FMFIA implementation efforts across the government in a series of four reports from 1984 through 1989 as well as in numerous reports targeting specific agencies and programs. With each report, GAO noted the efforts under way, but also that more needed to be done. In 1989, GAO concluded that while internal control was improving, the efforts were clearly not producing the results intended. The assessment and reporting process itself appeared to have become the endgame, and many serious internal control and accounting systems weaknesses remain unresolved as evidenced by GAO's high risk report which highlights serious long-standing internal control problems. In 1995, OMB made a major revision to its guidance that provided a framework for integrating internal control assessments with other work performed and relaxed the assessment and reporting requirements, giving the agencies discretion to determine the tools to use in arriving at their annual FMFIA assurance statements. OMB's recent 2004 revisions to the internal control guidance are intended to strengthen the requirements for conducting management's assessment of control over financial reporting. GAO supports OMB's recent changes to Circular A-123 and in particular the principles-based approach for establishing and reporting on internal control. GAO also noted six specific issues that are important to successful implementation of OMB's revised guidance and discusses its views on the importance of auditor opinions on internal control over financial reporting.