Managers’ Internal Control Program ICONO and ICOFR Navy Medicine Audit Readiness Training Symposium 5 and 6 June 2012 Ms. Meg Sherwood, Program Manager—ICONO

Managers’ Internal Control Program

ICONO and ICOFRNavy Medicine Audit Readiness Training Symposium

5 and 6 June 2012

Ms. Meg Sherwood, Program Manager—ICONO

Ms. Freda King, Program Manager—ICOFR

Context Purpose Outcome

ContextTo understand the MIC Program’s two parallel

components: Internal Controls over Nonfinancial Operations (ICONO) and Internal Controls over Financial Reporting (ICOFR).

PurposeTo better define the MIC Program’s structure and

objective.

OutcomeCommands are able to utilize the tools available in the

MIC Program to support audit readiness efforts.FOR OFFICIAL USE ONLY2

Agenda

1. MIC Program Overview

2. Internal Controls over Nonfinancial Operations (ICONO)

3. Internal Controls over Financial Reporting (ICOFR)

4. Exercise: Classifying and Reporting Deficiencies

5. Questions

FOR OFFICIAL USE ONLY3

MIC PROGRAM OVERVIEW

Part 1:


FOR OFFICIAL USE ONLY

5

Legal/Regulatory Framework

Federal Managers’ Financial Integrity Act

of 1982 (FMFIA)

OMB Circular A-123 “Management’s

Responsibility for Internal Control”

ICONO

ICOFR

ICOFS

Annual Statement of Assurance

ICONO: Internal Controls Over Non-financial OperationsICOFR: Internal Controls Over Financial ReportingICOFS: Internal Controls Over Financial Systems

From FMFIA:“…internal accounting and administrative controls of each executive agency shall be

established IAW standards prescribed by the Comptroller General…”

~ Head of each agency must prepare an annual statement certifying whether the

agency’s systems of internal accounting and administrative control comply with FMFIA

Goal: Effective Internal Controls

From OMB Circular A-123:~ Implementing guidance for federal

agencies~ Establishes 3 objectives of internal

controls~ Outlines 5 standards of internal control

activities3 Levels of Assurance:

~ Unqualified: no material weaknesses (MWs)

~ Qualified: MWs identified with corrective action plan developed

~ No Assurance: no assessment done or MWs are pervasive

What are Internal Controls?


• Organization, policies and procedures to help program and financial managers achieve results and safeguard the integrity of their programs.• Ensure what should occur in daily activities does occur.

• 3 objectives:• Effectiveness and efficiency of operations• Reliability of financial reporting• Compliance with applicable laws and regulations

• Support performance-based management• Incorporate into every business process• Further, not hinder, mission accomplishment

• Cost/benefit analysis when implementing controls

Goal: provide reasonable assurance 3 objectives are met

Safeguarding of

assets is a subset

5 Standards of Internal Control Activities


Info

rmat

ion

& C

omm

unic

atio

nInform

ation & C

omm

unication

MICP Program Guidance


BUMEDINST 5200.13A

Annual Program Guidance

ICONO and ICOFR Assessable Units (AUs)


9

MICP analyzes

operational and

financial internal controls

across all functional

areas

Reporting Responsibilities # ASSESSABLE UNIT TMA BUMED

12-01 Command Evaluation Program ALL X12-02 Government Travel Charge Card ALL X12-03 Government Purchase Card I ALL X X12-04 Information Assurance - Personally Identifiable Information ALL X12-05 Sustainment, Restoration, Modernization Process NME, NMW, WRNMMC X12-06 Records Management ALL X12-07 DOD-VA Health Care Resource Sharing Rates NME, NMW, WRNMMC X12-08 Personal Property Accountability - Maintenance Management NME, NMW, WRNMMC X12-09 Contract Management - Contracting Offi cer's Representative (COR) Responsibilities ALL X12-10 Aged Due-Ins ALL X12-11 Reprocessing of Single Use Devices NMW X12-12 Risk Management NME, WRNMMC X12-13 Custody and Control of Outpatient Medical Records NME, NMW, WRNMMC X12-14 Verification of Eligibility for Medical Care NME, NMW, WRNMMC X12-15 Reporting/Recording of OCO and WW Obligations ALL X X12-16 Contract Management - Licensing & Credentialing for Medical Service Contracts NME, NMW, WRNMMC X X12-17 Defense Travel System ALL X12-18 Timekeeping and Attendance ALL X12-E1 Elective #1 (Region- or Activity-developed) ALL X12-19 UBO--TPC--MSA--MAC NME, NMW, WRNMMC X X12-20 Government Purchase Card II ALL X12-21 Anti Fraud ALL X X12-22 Medical Coding ALL X12-23 Personal Property Accountability - Equipment Management ALL X X12-24 Pharmacy/Expired Drug Turn-In NME, NMW, WRNMMC X12-25 Information Assurance - Non-US Citizen Personnel Security ALL X12-26 Information Assurance - Protected Health Information (PHI) ALL X X12-E2 Elective #2 (Region- or Activity-developed) ALL X12-27 Reimbursable Support Agreements ALL X12-28 Patient Safety NME, NMW, WRNMMC X12-29 Command Manpower Data Management ALL X12-30 Command Special Pays ALL X12-31 Information Assurance - Appropriate Use of IT Resources ALL X12-32 Information Assurance - IA Workforce Improvement ALL X12-33 Financial Management Training ALL X

Quarter ASSESSABLE UNIT Reporting Responsibilities TMA BUMED1 Consumables ALL X X2 Federal Receivables ALL X X3 Real Property ALL X X4 Civilian Payroll ALL X X

Qu

art

er

4

FY 12 Managers' Internal Control Program ICOFR CLT Process Areas

Required by

FY 12 Managers' Internal Control Program ICONO Assessable Units

Required by

Qu

art

er

1Q

ua

rte

r 2

Qu

art

er

3

Quarterly & Annual Reporting Requirements

• Quarterly Certifications• Annual Statement of Assurance (SOA)

• Provide two levels of assurance, one for ICONO and one for ICOFR, that internal controls are in place and operating effectively

• Provide sources that were assessed to determine the level of assurance and identify control deficiencies

• Report deficiencies• Attest to implementation of Standard Operating

Procedures (SOPs)FOR OFFICIAL USE ONLY

10

Sources of Internal Control Assessment

• MICP Sources:• ICONO: Assessable Unit results• ICOFR: Command Level Testing (CLT) results

• Other Sources:


Level of Assurance

• Unqualified: Reasonable assurance with no material weaknesses (MWs) reported. Certification must be accompanied by a firm basis for this position.

• Qualified: Reasonable assurance with the exception of one or more MW(s) reported. Certification must cite MW(s) that precluded an unqualified statement.

• No Assurance: No reasonable assurance either because no assessments were conducted or MWs are pervasive.


INTERNAL CONTROLS OVER NONFINANCIAL OPERATIONS (ICONO)

Part 2:


ICONO Assessable Units

• Organized functionally• Inventory developed based on TMA- and BUMED-

identified risks

• Reviewed and updated annually with input from program managers/subject matter experts

• Supplemented by Region/Activity identified electives

• Support audit readiness initiatives• Increased effort to introduce data driven elements and

transactional reviews into the assessments


Goal: Identify control deficiencies and implement corrective actions

Identifying Deficiencies

• Must be control related• Identified through the Assessable Units, as well as,

the internal and external assessment sources• Classify the deficiency according to its severity• Establish corrective action plans to address

deficiencies• Activities are responsible for implementing the corrective

actions within their control and updating their plans• Regions/BUMED provide oversight to ensure corrective

actions are being implemented and provide implementation assistance when needed

• Report through quarterly Certification Statements and Annual Statement of Assurance (SOA)


Classifying Deficiencies• How severe is the deficiency?• Is there a significant threat to mission, resources, and/or

image?• Deficiency Categories:

• Material Weakness (MW): A reportable condition of combination of reportable conditions, which is significant enough to report to the next higher level. The determination is a management judgment as to whether a weakness is material.

• Reportable Condition (RC): A control deficiency, or combination of control deficiencies, that adversely affects the ability to meet mission objectives but are not deemed by the Head of the Component as serious enough to report as material weaknesses.

• Item to be Revisited (IR): An internal control issue brought to management’s attention with insufficient information to determine whether the control deficiency is material or not. These issues will be revisited throughout the following quarters to determine the materiality of the control deficiency.


16

Corrective Action Plans

• Develop for all deficiencies—whether or not you report them

• Elements to include:• Identify the deficiency• Set a target correction date• Identify the corrective actions that will be taken to

remediate the deficiency• Call attention to higher level assistance, if needed

• Monitor and update progress on a regular basis


Determining What Deficiencies to Report

• Report from your organization’s perspective• MTFs/activities should report deficiencies as they

impact the MTF/activity• Regions should report deficiencies as they impact the

Region

• Questions to ask:• Does higher echelon need to know about this issue?• Can we resolve this issue within our own means at the

MTF/activity or Regional level?• Does this issue permeate the entire Region or is it an

isolated issue?


Determining Level of Assurance

• A management decision

• Based on the types of deficiencies identified and whether or not the items need to be reported to the next higher level

• 3 levels of assurance: qualified, unqualified, no assurance


Level of Assurance Types of Deficiencies

Unqualified No MWsSome RCs and/or IRs identified

Qualified 1 or more MWs

No Assurance MWs are pervasiveNo assessments were conducted

How ICONO Efforts Support Audit Readiness

• Examine and/or test internal controls to ensure compliance with laws, regulations, policies, etc.

• Evaluate processes to determine if Standard Operating Procedures (SOPs) are fully implemented and correct processes where they are not

• Practice pulling documents which support transactions

• Identify internal control deficiencies and correct them before audit


INTERNAL CONTROLS OVER FINANCIAL REPORTING (ICOFR)

Part 3:


OMB Circular A-123, Appendix A

Internal Controls Over

Financial Reporting (ICOFR)

Objective

• OMB Circular A-123, Appendix A - Internal Controls over Financial Reporting (ICOFR)

Requires Management to Assess, Test, Document, and Report on Financial Controls

• Financial Improvement and Audit Readiness(FIAR) Plan

Provide Guidelines, Goals, Priorities, and Strategies to become Audit Ready

• Achieving Audit ReadinessDoD’s Goals and Roles to Achieve Audit Readiness


Appendix A - Governing Statutes

• Federal Managers’ Financial Integrity Act of 1982

Requires all DoD managers to assess the effectiveness of management controls applicable to their responsibilitiesAn Act to amend the Accounting and Auditing Act of 1950 to require ongoing evaluations and reports of the adequacy of the systems of internal accounting and administrative control

• Sarbanes-Oxley Act of 2002Public Company Accounting Reform and Investor Protection Act FOR OFFICIAL USE ONLY

24

Appendix A - Requirements

• Reporting on Financial Internal Controls

Internal Controls are specific policies procedures and activities that are established to manage or mitigate risks

• Assessing and Validating Controls and Processes

Internal Controls are part of every process and activity being performed throughout the organization

• Providing ICOFR Annual Assurance Statement

Internal controls provided reasonable assurance that what should happen does happen


Internal Control

• Internal Control Objectives:

• Effectiveness and Efficiency of Operations,

• Reliability of Financial Reporting, and

• Compliance with Applicable Laws and Regulations


Standards of Internal Control Activities

• Control Environment - the organizational structure to sustain organizational support for effective internal control

• Risk Assessment - identify internal and external risks that may prevent the organization from meeting its objectives

• Control Activities - include policies, procedures and mechanisms in place to help ensure that agency objectives are met

• Information and Communications - should be relevant, reliable, and timely

• Monitoring - periodic reviews, reconciliations or comparisons of data should be included as part of the regular assigned duties of personnel


Financial Improvement and Audit Readiness (FIAR)

• FIAR Plan (OMB Circular A-123, Appendix A)•Goals•Priorities•Strategies

•FIAR Phases•Discovery•Corrective Action•Evaluation•Assertion•Validation•Audit


FIAR Goals

• Improve the Department’s Financial Management Operations

• Provide our Service men and women with the resources they need to carry out the mission

• Improving our stewardship of the resources entrusted to us by the taxpayers.


FIAR Priorities

• The First Priority is the Budgetary Resources. The benefits of focusing on budgetary information are to:

Improve the visibility of budgetary transactionsProvide for operational efficiencies through more readily available financial information;Improve fiscal stewardship (ensures that funds appropriated, expended and recorded are reported accurately, reliably and timely); andImprove budget processes and controls

• The Second Priority is the Mission Critical Assets. Mission critical assets are:

Military Equipment Real Property Inventory Operating Materials and Supplies General Equipment



• Wave 1Wave 1• Wave 1Wave 1 Wave 2Wave 2Wave 2Wave 2 Wave 3Wave 3Wave 3Wave 3 Wave 4Wave 4Wave 4Wave 4

AppropriationsAppropriations ReceivedReceived

Statement Statement of of

Budgetary Budgetary Resources Resources

Mission Critical Mission Critical Assets Assets

Existence & Existence & Completeness Completeness

Full Audit Full Audit (except for (except for valuation) valuation)

FIAR Strategies

WAVE 1Appropriations Received

• Accurate and timely recording of the budget authority needed to commit, obligate, and expend funds

• Processes and controls include activities performed to control and record transactions related to:

Receipt of the budget (Appropriations Received) Distribution of the Budget to the Major Commands Fund Balance with Treasury (FBWT)


WAVE 2Statement of Budgetary

Resources

• The SBR presents: all budgetary resources a reporting entity has available the status of those resources at period end a reconciliation of changes in obligated balances from

the beginning to the end of the period and cash collections and disbursements for the period

reported.

• Includes all processes, internal controls, systems and supporting documentation that must be audit ready before the SBR can be audited.


Sample Statement of Budgetary Resources (SBR)


BUDGETARY FINANCING ACCOUNTS 2009 Combined BUDGETARY RESOURCES Unobligated balance, brought forward, Oct 1 28,026,796 Recoveries of prior year unpaid obligations 24,029,026 Budget authority Appropriation 165,257,644 Spending authority from offsetting collections Earned Collected 7,806,105 Change in receivables from Federal sources (144,220) Change in unfilled customer orders Advance received 323,916 Without advance from Federal sources 76,479 Subtotal 173,322,124 Nonexpenditure transfer, net, anticipated and actual 1,711,873 Permanently not available (3,170,061) Total Budgetary Resources 223,921,758 Status of Budgetary Resources Obligations incurred: Direct 186,801,435 Reimbursable 10,215,890 Unobligated balance: 197,017,325 Apportioned 23,899,972 Sub Total 23,899,972 Unobligated balance not available 3,004,461 Total status of budgetary resources 223,921,758 Changes in Obligated Balances Obligated balance, net Unpaid obligations, brought forward, Oct 1 93,776,544 Less: Uncollected customer payments for Federal sources, brought forward, Oct 1

(3,864,218)

Total unpaid obligated balance 89,912,326 Obligations incurred net (+/-) 197,017,325 Less: Gross outlays (165,217,414) Less: Recoveries of prior year unpaid obligations, actual (24,029,026) Change in uncollected customer payments from federal sources (+/-)

65,742

Obligated balance, net, end of period Unpaid obligations 101,547,429 Less: Uncollected customer payments from Federal sources (-) (3,798,476) Total, unpaid obligated balance, net, end of period 97,746,953 Net Outlays: Gross Outlays 165,217,414 Less: Offsetting Collections (8,130,022) Less: Distributed offsetting receipts (321,451) Net Outlays 156,765,941

WAVE 3Mission Critical Assets

(E&C)

• Focuses on the “existence and completeness” financial statement assertions and includes the “rights” assertion and portions of the “presentation and disclosure” assertion.

• Reporting entities must ensure that: all assets recorded in the property books exist all of the reporting entities’ assets are recorded in their

system reporting entities have the right to report all assets

(Rights) assets are consistently categorized, summarized, and

reported period to period (Presentation and Disclosure). FOR OFFICIAL USE ONLY

35

WAVE 4Full Audit

• Include the proprietary side of financial transactions covered in Wave 2, and:

accounts receivable earned revenue accounts payable gross costs other liabilities

• Adds the “valuation” assertion for assets


Assertions


Asserting


• We will be asserting :

that our financial controls are in place and operating effectively

that our financial reports are accurately prepared

that transactions can be supported with documentation and that

that we have fully complied with our laws and regulations.


Assessable Units Assertion Dates

Travel SEP 2012

Consumables DEC 2012

Reimbursable Work Orders – Grantor

DEC 2012

Reimbursable Work Orders – Performer

APR 2013

Military Payroll APR 2013

Contract Administration JUL 2013

Non-Federal Receivables JUL 2013

Federal Receivables SEP 2013

Civilian Payroll DEC 2013

Financial Reporting DEC 2013

Fund Balance with Treasury DEC 2013

BUMED Assertion Dates to TMA


FIAR Phases

• Command Level Testing/Validation Testing

• Standard Operating Procedures (SOPs)

• FMO Samples and Workbooks

• NAS Sample Testing


BUMED’s FIP Tool Box

Audit Preparation


Managers’ Internal Control Program (MICP)

• It’s not just a Job; it’s the path to audit success…


Audit Readiness

• What are the Priorities of the FIAR Plan?

• What are Two Internal Control Objectives?

• What are the Five Financial Assertions?

• What is the date for Audit of the SBR?

• What is the date for Full Audit?


Audit Readiness Trivia

EXERCISE: CLASSIFYING AND REPORTING DEFICIENCIES

Part 4:


Scenario


• At Naval Hospital Atlantis, during a 6 month timeframe, questionable transactions were found on the GTCCs for 60 members. During this timeframe, the total number of members who used their card was 70.

• The types of questionable transactions included:• Expenses not related to official government travel such

as video games purchased at Target• Cash advances taken within a member’s permanent

duty station and the member is not on official government travel orders

• Airline tickets purchased for a member’s spouse and children

• Lodging charges for a member’s personal travel following a period of official government travel

• These questionable expenses were not identified during travel card or DTS voucher review processes

Analysis• Is the deficiency a threat to mission, resources, and/or

image?

• How would you classify the deficiency and why?• Material Weakness, Reportable Condition, Item to be

Revisited

• What is your corrective action plan?

• Would you report the deficiency? Why or why not?

• Is the deficiency related to ICONO, ICOFR, or both?

• If you do report the deficiency, what level of assurance do you report?• Unqualified, Qualified, or No assurance


Higher Level Resources• Federal Managers’ Financial Integrity Act of 1982 (P.L. 97-255)

• OMB Circular A-123: Management’s Responsibility for Internal Control

• DoD Financial Improvement and Audit Readiness (FIAR) Guidance of December 2011

• DoDI 5010.40 of 29 July 2010: Managers’ Internal Control Program (MICP) Procedures

• SECNAVINST 5200.35E of 8 November 2006: Department of the Navy (DON) Managers’ Internal Control (MIC) Program

• SECNAV M-5200.35 of June 2008: Department of the Navy Managers’ Internal Control Manual

• OPNAVINST 5200.25D of 03 October 2011: Managers’ Internal Control Program

• GAO Products: “Standards for Internal Control in the Federal Government” and “Internal Control Management and Evaluation Tool”

49FOR OFFICIAL USE ONLY

http://www.whitehouse.gov/omb/financial_fmfia1982

http://comptroller.defense.gov/fiar/documents/FIAR_Guidance_2011.pdf

http://comptroller.defense.gov/fiar/documents/FIAR_Guidance_2011.pdf

BUMED Resources


• SG’s Memo on Internal Controls in Navy Medicine of 5 January 2012; Reference: 5200 Ser M82/11UM82757

• DSG’s Memo on Annual Areas for Leadership Engagement of 30 August 2010; Reference: 5200 Ser M82/10UM82749

• BUMEDINST 5200.13A of 29 October 2008: Managers’ Internal Control Program

• Managers’ Internal Control Program (MICP) Guidance for Fiscal Year (FY) 2012 dated 6 October 2011; Reference: 5200 Ser M82/11UM82758

Questions?

Contact Information

• Meg SherwoodPhone: 703-681-9487Email: [email protected]

• Freda KingPhone: 703-681-9471Email: [email protected]


Documents

Managers’ Internal Control Program ICONO and ICOFR Navy Medicine Audit Readiness Training Symposium 5 and 6 June 2012 Ms. Meg Sherwood, Program Manager—ICONO