Mr. Chairman and Members of the Subcommittee: We are pleased to be here today to discuss the subject of internal control. Its importance cannot be understated, especially in the large, complex operating environment of the federal government. Internal control is the first line of defense against fraud, waste, and abuse and helps to ensure that an entity’s mission is achieved in the most effective and efficient manner. Although the subject of internal control usually surfaces for discussion after improprieties or inefficiencies are found, good managers are always aware of and seek ways to help improve operations through effective internal control. As you requested, my testimony today will discuss the following questions: (1) What is internal control? (2) Why is it important? and (3) What happens when it breaks down? “The plan of organization and methods and procedures adopted by management to ensure that resource use is consistent with laws, regulations, and policies; that resources are safeguarded against waste, loss, and misuse; and that reliable data are obtained, maintained, and fairly disclosed in reports.” Internal control should not be looked upon as separate, specialized systems within an agency. Rather, internal control should be recognized as an integral part of each system that management uses to regulate and guide its operations. Internal control is synonymous with management control in that the broad objectives of internal control cover all aspects of agency operations. Although ultimate responsibility for good internal control rests with management, all employees have a role in the effective operation of internal control that has been set by management. to name a few) that achieve the goal. All internal controls have objectives and techniques. In practice, internal control starts with defining entitywide objectives and then more specific objectives throughout the various levels in the entity. Techniques are then implemented to achieve the objectives. In its simplest form, internal control is practiced by citizens in the daily routine of everyday life. For example, when you leave your home and lock the door or when you lock your car at the mall or on a street, you are practicing a form of internal control. The objective is to protect your assets against undesired access, and your technique is to physically secure your assets by locks. In another routine, when you write a check, you record the check in the ledger or on your personal computer. The objective is to control the money in your checking account by knowing the balance. The technique is to document the check amount and the balance. Periodically, you compare the checking account transactions and balances you have recorded with the bank statement. Your objective is to ensure the accuracy of your records to avoid costly mistakes. Your technique is to perform the reconciliation. These same types of concepts form the basis for internal control in business operations and the operation of government. The nature of their operations is, of course, significantly larger and more complex, as is the inherent risk of ensuring that assets are safeguarded, laws and regulations are complied with, and data used for decision-making and reporting are reliable. Focusing a discussion on objectives and techniques, the acquisition, receipt, use, and disposal of property, such as computer equipment, can illustrate the practice of internal control in the operation of government activities. Internal control at the activity level such as procuring equipment should be preceded, at a higher organizational level, by policy and planning control objectives and control techniques that govern overall agency operations in achieving mission objectives. Examples of high-level control objectives that logically follow a pattern include the following: The mission of the agency should be set in accordance with laws, regulations, and administration and management policy. Agency components should be defined in accordance with the overall mission of the agency. Missions of the agency and components should be documented and communicated to agency personnel. Plans and budgets should be developed in accordance with the missions of the agency and its components. Policies and procedures should be defined and communicated to achieve the objectives defined in plans and budgets. Authorizations should be in accordance with policies and procedures. Systems of monitoring and reporting the results of agency activities should be defined. Transactions should be classified or coded to permit the preparation of reports to meet management’s needs and other reporting requirements. Access to assets should be permitted only in accordance with laws, regulations, and management’s policy. Examples of control techniques to help achieve the objectives include the following: agency and component mission statements approved by management and its legal counsel; training of personnel in mission and objectives; long and short-range plans developed related to budgets; monitoring of results against plans and budgets; policies and procedures defined and communicated to all levels of the organization and periodically reviewed and revised based on internal reviews; authorizations defined, controls set to ensure authorizations are made, and classifications of accounts set to permit the capture and reporting of data to prepare required reports; and physical restrictions on access to assets and records, and training in security provided to employees. The policy and planning control objectives and techniques provide a framework to conduct agency operations and to account for resources and results. Without that framework, administration and legislative goals may not be achieved; laws and regulations may be violated; operations may not be effective and efficient and may be misdirected; unauthorized activities may occur; inaccurate reports to management and others may occur; fraud, waste, and abuse is more likely to occur and be concealed; assets may be stolen or lost; and ultimately the agency is in danger of not achieving its mission. intended results. The procurement and management of computer equipment is an example of such a specific activity. Objectives and techniques should be established for each activity’s specific control. As examples of control objectives, vendors should be approved in accordance with laws, regulations, and management’s policy, as should the types, quantities, and approved purchase prices of computer equipment. As examples of related control techniques, criteria for approving vendors should be established and approved vendor master files should be controlled, and the purchase governed by criteria, such as obtaining competitive bids and setting specifications of the equipment to be procured. Likewise, control objectives should be set for the receiving process. For example, only equipment that meets contract or purchase order terms should be accepted, and equipment accepted should be accurately and promptly reported. Related control techniques include (1) detailed comparison of equipment received to a copy of the purchase order, (2) prenumbered controlled receiving documents that are accounted for, and (3) maintenance of receiving logs. Throughout the purchasing and receiving of equipment there needs to be appropriate separation of duties and interface with the accounting function to achieve funds control, timely payments, and inventorying and control of equipment received. Equipment received should be safeguarded to prevent unauthorized access and use. For example, in addition to physical security, equipment should be tagged with identification numbers and placed into inventory records. Equipment placed into service should only be issued to authorized users and records of the issuances should be maintained to achieve accountability. Further, physical inventories should be taken periodically and compared with inventory records. Differences in counts and records should be resolved in a timely manner and appropriate corrective actions taken. Also, equipment retired from use should be in accordance with management’s policies, including establishing appropriate safeguards to prevent unauthorized information that may be stored in the equipment from being disclosed. carelessness. Also, procedures whose effectiveness depends on segregation of duties can be circumvented by collusion. Similarly, management authorizations may be ineffective against errors or fraud perpetrated by management. In addition, the standard of reasonable assurance recognizes that the cost of internal control should not exceed the benefit derived. Reasonable assurance equates to a satisfactory level of confidence under given considerations of costs, benefits, and risks. The cost of fraud, waste, and abuse cannot always be measured in dollars and cents. Such improper activities erode public confidence in the government’s ability to efficiently and effectively manage its programs. Management at a number of federal government agencies are faced with tight budgets and fewer personnel. In such an environment, related operating factors, such as executive and middle management turnover and the diversity and complexity of government operations, can provide a fertile environment for internal control weakness and the resulting undesired consequences. It has been almost 50 years since the Congress formally recognized the importance of internal control. The Accounting and Auditing Act of 1950 required, among other things, that agency heads establish and maintain effective internal controls over all funds, property, and other assets for which an agency is responsible. However, the ensuing years up through the 1970s saw the government experience a crisis of poor controls. To help restore confidence in government and to improve operations, the Congress passed the Federal Managers’ Financial Integrity Act of 1982. The Integrity Act required, among other items, that we establish internal control standards that agencies are required to adhere to, the Office of Management and Budget (OMB) issue guidelines for agencies to follow in annually assessing their internal controls, agencies annually evaluate their internal controls and prepare a statement to the President and the Congress on whether their internal controls comply with the standards issued by GAO, and agency reports include material internal control weaknesses identified and plans for correcting the weaknesses. OMB has issued agency guidance that sets forth the requirements for establishing, periodically assessing, correcting, and reporting on controls required by the Integrity Act. Regarding the identification and reporting of deficiencies, OMB’s guidance states that “a deficiency should be reported if it is or should be of interest to the next level of management. Agency employees and managers generally report deficiencies to the next supervisory level, which allows the chain of command structure to determine the relative importance of each deficiency.” The guidance further states that “a deficiency that the agency head determines to be significant enough to be reported outside the agency (i.e., included in the annual Integrity Act report to the President and the Congress) shall be considered a ’material weakness.’” The guidance encourages reporting of deficiencies by recognizing that such reporting reflects positively on the agency’s commitment to recognizing and addressing management problems and, conversely, failing to report a known deficiency reflects adversely on the agency.