Internal controls are not just for CFOs anymore, OMB says
Connecting state and local government leaders
The Office of Management and Budget later this month will issue a list of best practices to help agencies implement internal controls for financial reporting.
The Office of Management and Budget later this month will issue a list of best practices to help agencies implement internal controls for financial reporting information. OMB also will start providing feedback to agencies on the plans they submitted in August to put internal controls in place as part of revised Circular A-123.
Financial reporting is not just for chief financial officers anymore. Management needs to get its arms around internal controls, said Linda Combs, OMB controller. Circular A-123 is similar to management compliance requirements for private corporations under the Sarbanes-Oxley Act, passed in the wake of corporate fraud at Enron and WorldCom.
'My dream is for every program manager to be a financial manager, or act like one,' she said yesterday at an industry event sponsored by Input of Reston, Va. Internal controls enable managers to make good financial decisions on a daily basis, and that starts at the program level. 'We need to show them how to mine and use data better,' she said.
Internal controls are designed to help agencies produce their data more quickly and accurately.
Agencies must implement effective internal controls by next October. OMB will make documentation, testing and correction of internal controls a part of the financial management category of the President's Management Agenda scorecard this year.
'It will be a stronger and more rigorous process with documentation and an assurance statement by management,' said David Zavada, chief of the federal financial systems branch at OMB's Office of Federal Financial Management. The first assessment of an agency's internal controls is due in June. A management assurance statement, which will report any major weaknesses, will accompany an agency's PAR reports in November.
The Commerce Department has begun developing a senior management council, made up of the CIO, CFO, bureau CFOs, and procurement, budget and system managers, to address internal controls, said James Taylor, Commerce's deputy CFO and director for financial management.
It's relatively new for IT divisions to address internal controls for quarterly financial reporting, just as it was for financial divisions to consider IT issues in developing financial management systems, said Jerry Williams, deputy CIO for the Agriculture Department.
'We have to figure out how to tie together statutory requirements,' he said.
OMB has said that some documentation for internal controls can be accomplished through documentation for other reporting requirements, such as certification and accreditation for security under the Federal Information Security Management Act. However, the timing for A-123 and FISMA reporting is not synchronized. A-123 reporting is due in June, FISMA in September, Williams said.
Also, definitions and standards may vary under different reporting requirements. For example, deficiencies reported under the Federal Financial Management Improvement Act did not correspond with what were considered deficiencies related to financial management systems, Taylor said. So OMB rated Commerce a green on the PMA's financial management section.
'Eventually, we'll have the same vocabulary across different reporting,' he said.