Managers’ Internal Control Program ICONO and ICOFR

Navy Medicine Audit Readiness Training Symposium

5 and 6 June 2012 Ms. Meg Sherwood, Program Manager—ICONO Ms. Freda King, Program Manager—ICOFR

C

ontext

P

urpose

O

utcome

Context

To understand the MIC Program’s two parallel components:

I

nternal

C

ontrols

o

ver

N

onfinancial

O

perations (ICONO) and

I

nternal

C

ontrols

o

ver

F

inancial

R

eporting (ICOFR).

Purpose

To better define the MIC Program’s structure and objective.

Outcome

Commands are able to utilize the tools available in the MIC Program to support audit readiness efforts.

FOR OFFICIAL USE ONLY 2

Agenda

1. MIC Program Overview 2. Internal Controls over Nonfinancial Operations (ICONO) 3. Internal Controls over Financial Reporting (ICOFR) 4. Exercise: Classifying and Reporting Deficiencies 5. Questions FOR OFFICIAL USE ONLY 3

Part 1:

MIC PROGRAM OVERVIEW

FOR OFFICIAL USE ONLY 4

Legal/Regulatory Framework

Federal Managers’ Financial Integrity Act of 1982 (FMFIA) From FMFIA:

“…internal

accounting

and

administrative controls

Comptroller General…”

~ Head of each agency must prepare an accounting and administrative control

comply

of each executive agency shall be established IAW standards prescribed by the

annual statement

certifying whether the agency’s systems of internal with FMFIA OMB Circular A-123 “Management’s Responsibility for Internal Control” From OMB Circular A-123: ~

Implementing guidance

for federal agencies ~ Establishes

3 objectives

of internal controls ~ Outlines

5 standards

of internal control activities ICONO ICOFR ICOFS ICONO: Internal Controls Over Non-financial Operations ICOFR: Internal Controls Over Financial Reporting ICOFS: Internal Controls Over Financial Systems Annual Statement of Assurance 3 Levels of Assurance: ~

Unqualified

: no material weaknesses (MWs) ~

Qualified

: MWs identified with corrective action plan developed ~

No Assurance

: no assessment done or MWs are pervasive

Goal: Effective Internal Controls

FOR OFFICIAL USE ONLY 5

• • • • •

What are Internal Controls?

Organization

,

policies

and

procedures

financial managers

achieve results

and to help program and

safeguard

the integrity of their programs.

• Ensure what

should

occur in daily activities

does

occur.

3 objectives: • • • Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations

Safeguarding of assets is a subset

Support performance-based management Incorporate into every business process Further, not hinder, mission accomplishment • Cost/benefit analysis when implementing controls

Goal: provide

reasonable assurance

3 objectives are met

FOR OFFICIAL USE ONLY 6

5 Standards of Internal Control Activities

Monitoring MICP, CLT, MEDIG, CE, JC, PPMAP Control Activities Policies/procedures, SOPs

Risk Assessment

DSG’s Areas for Leadership Engagement; Internal Controls Program Management Office (ICPMO)

Control Environment

“Tone from the top,” SG’s Memo on Internal Controls, Code of Ethics

FOR OFFICIAL USE ONLY 7

MICP Program Guidance BUMEDINST 5200.13A

Annual Program Guidance

FOR OFFICIAL USE ONLY 8

ICONO and ICOFR Assessable Units (AUs)

FY 12 Managers' Internal Control Program ICONO Assessable Units

12-21 12-22 12-23 12-24 12-25 12-26 12-E2 12-27 12-28 12-29 12-30 12-31 12-32 12-33

#

12-01 12-02 12-03 12-04 12-05 12-06 12-07 12-08 12-09 12-10 12-11 12-12 12-13 12-14 12-15 12-16 12-17 12-18 12-E1 12-19 12-20

ASSESSABLE UNIT

Command Evaluation Program Government Travel Charge Card Government Purchase Card I Information Assurance - Personally Identifiable Information Sustainment, Restoration, Modernization Process Records Management DOD-VA Health Care Resource Sharing Rates Personal Property Accountability - Maintenance Management Contract Management - Contracting Officer's Representative (COR) Responsibilities Aged Due-Ins Reprocessing of Single Use Devices Risk Management Custody and Control of Outpatient Medical Records Verification of Eligibility for Medical Care Reporting/Recording of OCO and WW Obligations Contract Management - Licensing & Credentialing for Medical Service Contracts Defense Travel System Timekeeping and Attendance Elective #1 (Region- or Activity-developed) UBO--TPC--MSA--MAC Government Purchase Card II Anti Fraud Medical Coding Personal Property Accountability - Equipment Management Pharmacy/Expired Drug Turn-In Information Assurance - Non-US Citizen Personnel Security Information Assurance - Protected Health Information (PHI) Elective #2 (Region- or Activity-developed) Reimbursable Support Agreements Patient Safety Command Manpower Data Management Command Special Pays Information Assurance - Appropriate Use of IT Resources Information Assurance - IA Workforce Improvement Financial Management Training

Reporting Responsibilities

ALL ALL ALL ALL NME, NMW, WRNMMC ALL NME, NMW, WRNMMC NME, NMW, WRNMMC ALL ALL NMW NME, WRNMMC NME, NMW, WRNMMC NME, NMW, WRNMMC ALL NME, NMW, WRNMMC ALL ALL ALL NME, NMW, WRNMMC ALL ALL ALL ALL NME, NMW, WRNMMC ALL ALL ALL ALL NME, NMW, WRNMMC ALL ALL ALL ALL ALL

FY 12 Managers' Internal Control Program ICOFR CLT Process Areas

Quarter

1 2 3 4 Consumables Federal Receivables Real Property Civilian Payroll

ASSESSABLE UNIT Reporting Responsibilities

ALL ALL ALL ALL FOR OFFICIAL USE ONLY X X X X X X X X

Required by TMA BUMED

X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X X

Required by TMA

X X X X

BUMED

X X X X

MICP analyzes operational and financial internal controls across all functional areas

9

Quarterly & Annual Reporting Requirements

• • Quarterly Certifications Annual Statement of Assurance (SOA) • • • • Provide two levels of assurance, one for ICONO and one for ICOFR, that internal controls are in place and operating effectively Provide sources that were assessed to determine the level of assurance and identify control deficiencies Report deficiencies Attest to implementation of Standard Operating Procedures (SOPs) FOR OFFICIAL USE ONLY 10

• •

Sources of Internal Control Assessment

MICP Sources: • ICONO: Assessable Unit results • ICOFR: Command Level Testing (CLT) results Other Sources: Internal to Navy Medicine External to Navy Medicine • MEDIG findings • Command Evaluation Program • Logistics Assist Visits • UBO Quarterly Audits • Unauthorized Commitments • Management Observation • Program Reviews • Government Accountability Office (GAO) • DoD IG findings • Navy IG findings • Navy Audit Service (NAS) • Joint Commission Inspections • PPMAP Inspections FOR OFFICIAL USE ONLY 11

Level of Assurance

•

Unqualified

: Reasonable assurance with no material weaknesses (MWs) reported. Certification must be accompanied by a firm basis for this position.

•

Qualified

: Reasonable assurance with the exception of one or more MW(s) reported. Certification must cite MW(s) that precluded an unqualified statement.

•

No Assurance

: No reasonable assurance either because no assessments were conducted or MWs are pervasive.

12 FOR OFFICIAL USE ONLY

Part 2:

INTERNAL CONTROLS OVER NONFINANCIAL OPERATIONS (ICONO)

13 FOR OFFICIAL USE ONLY

ICONO Assessable Units

• • • Organized

functionally

• Inventory developed based on TMA- and BUMED-identified risks Reviewed and updated annually with input from program managers/subject matter experts Supplemented by Region/Activity identified electives •

Support audit readiness initiatives

• Increased effort to introduce data driven elements and transactional reviews into the assessments

Goal: Identify control deficiencies and implement corrective actions

FOR OFFICIAL USE ONLY 14

Identifying Deficiencies

• • • • • Must be

control related

Identified through the

Assessable Units

, as well as, the

internal and external assessment sources

Classify the deficiency according to its severity Establish

corrective action plans

• • to address deficiencies Activities are responsible for implementing the corrective actions within their control and updating their plans Regions/BUMED provide oversight to ensure corrective actions are being implemented and provide implementation assistance when needed Report through quarterly Certification Statements and Annual Statement of Assurance (SOA) 15 FOR OFFICIAL USE ONLY

• • •

Classifying Deficiencies

How severe is the deficiency?

Is there a significant threat to mission, resources, and/or image?

Deficiency Categories: • •

Material Weakness (MW)

: A reportable condition of combination of reportable conditions, which is significant enough to report to the next higher level. The determination is a management judgment as to whether a weakness is material.

Reportable Condition (RC)

: A control deficiency, or combination of control deficiencies, that adversely affects the ability to meet mission objectives but are not deemed by the Head of the Component as serious enough to report as material weaknesses.

•

Item to be Revisited (IR)

the control deficiency.

: An internal control issue brought to management’s attention with insufficient information to determine whether the control deficiency is material or not. These issues will be revisited throughout the following quarters to determine the materiality of FOR OFFICIAL USE ONLY 16

Corrective Action Plans

• Develop for

all

deficiencies—whether or not you report them • Elements to include: • • Identify the deficiency Set a target correction date • • Identify the corrective actions that will be taken to remediate the deficiency Call attention to higher level assistance, if needed • Monitor and update progress on a regular basis FOR OFFICIAL USE ONLY 17

Determining What Deficiencies to Report

• Report from your

organization’s perspective

• • MTFs/activities should report deficiencies as they impact the MTF/activity Regions should report deficiencies as they impact the Region • Questions to ask: • • • Does higher echelon need to know about this issue?

Can we resolve this issue within our own means at the MTF/activity or Regional level?

Does this issue permeate the entire Region or is it an isolated issue?

18 FOR OFFICIAL USE ONLY

Determining Level of Assurance

• A

management decision

• Based on the types of deficiencies identified and whether or not the items need to be reported to the next higher level • 3 levels of assurance: qualified, unqualified, no assurance

Level of Assurance

Unqualified Qualified No Assurance

Types of Deficiencies

No MWs Some RCs and/or IRs identified 1 or more MWs MWs are pervasive No assessments were conducted FOR OFFICIAL USE ONLY 19

How ICONO Efforts Support Audit Readiness

• Examine and/or test internal controls to ensure compliance with laws, regulations, policies, etc.

• Evaluate processes to determine if Standard Operating Procedures (SOPs) are fully implemented and correct processes where they are not • Practice pulling documents which support transactions • Identify internal control deficiencies and correct them before audit 20 FOR OFFICIAL USE ONLY

Part 3:

INTERNAL CONTROLS OVER FINANCIAL REPORTING (ICOFR)

FOR OFFICIAL USE ONLY 21

OMB Circular A-123, Appendix A Internal Controls Over Financial Reporting (ICOFR)

Objective

•

OMB Circular A-123, Appendix A - Internal Controls over Financial Reporting (ICOFR)

 Requires Management to Assess, Test, Document, and Report on Financial Controls •

Financial Improvement and Audit Readiness(FIAR) Plan

 Provide Guidelines, Goals, Priorities, and Strategies to become Audit Ready •

Achieving Audit Readiness

 DoD’s Goals and Roles to Achieve Audit Readiness 23 FOR OFFICIAL USE ONLY

Appendix A - Governing Statutes

• •

Federal Managers’ Financial Integrity Act of 1982

 Requires all DoD managers to assess the effectiveness of management controls applicable to their responsibilities  An Act to amend the Accounting and Auditing Act of 1950 to require ongoing evaluations and reports of the adequacy of the systems of internal accounting and administrative control

Sarbanes-Oxley Act of 2002

 Public Company Accounting Reform and Investor Protection Act 24 FOR OFFICIAL USE ONLY

Appendix A - Requirements

•

Reporting on Financial Internal Controls

 Internal Controls are specific policies procedures and activities that are established to manage or mitigate risks •

Assessing and Validating Controls and Processes

 Internal Controls are part of every process and activity being performed throughout the organization •

Providing ICOFR Annual Assurance Statement

 Internal controls provided reasonable assurance that what should happen does happen 25 FOR OFFICIAL USE ONLY

Internal Control

• Internal Control Objectives: • Effectiveness and Efficiency of Operations, • Reliability of Financial Reporting, and • Compliance with Applicable Laws and Regulations FOR OFFICIAL USE ONLY 26

Standards of Internal Control Activities

• Control Environment - the organizational structure to sustain organizational support for effective internal control • Risk Assessment - identify internal and external risks that may prevent the organization from meeting its objectives • Control Activities - include policies, procedures and mechanisms in place to help ensure that agency objectives are met • Information and Communications - should be relevant, reliable, and timely • Monitoring - periodic reviews, reconciliations or comparisons of data should be included as part of the regular assigned duties of personnel 27 FOR OFFICIAL USE ONLY

Financial Improvement and Audit Readiness (FIAR)

• FIAR Plan (OMB Circular A-123, Appendix A) • Goals • Priorities • Strategies • FIAR Phases • Discovery • Corrective Action • Evaluation • Assertion • Validation • Audit FOR OFFICIAL USE ONLY 28

FIAR Goals

• Improve the Department’s Financial Management Operations • Provide our Service men and women with the resources they need to carry out the mission • Improving our stewardship of the resources entrusted to us by the taxpayers.

29 FOR OFFICIAL USE ONLY

FIAR Priorities

• • The First Priority is the Budgetary Resources. The benefits of focusing on budgetary information are to:  Improve the visibility of budgetary transactions  Provide for operational efficiencies through more readily available financial information;  Improve fiscal stewardship (ensures that funds appropriated, expended and recorded are reported accurately, reliably and timely); and  Improve budget processes and controls The Second Priority is the Mission Critical Assets. Mission critical assets are:  Military Equipment  Real Property  Inventory  Operating Materials and Supplies  General Equipment FOR OFFICIAL USE ONLY 30

FIAR Strategies

•

Wave 1 Wave 2 Wave 3 Wave 4 Appropriations Received Statement of Budgetary Resources Mission Critical Assets Existence & Completeness Full Audit (except for valuation)

31 FOR OFFICIAL USE ONLY

WAVE 1 Appropriations Received

• • Accurate and timely recording of the budget authority needed to commit, obligate, and expend funds Processes and controls include activities performed to control and record transactions related to:    Receipt of the budget (Appropriations Received) Distribution of the Budget to the Major Commands Fund Balance with Treasury (FBWT) 32 FOR OFFICIAL USE ONLY

WAVE 2 Statement of Budgetary Resources

• The SBR presents:  all budgetary resources a reporting entity has available    the status of those resources at period end a reconciliation of changes in obligated balances from the beginning to the end of the period and cash collections and disbursements for the period reported.

• Includes all processes, internal controls, systems and supporting documentation that must be audit ready before the SBR can be audited.

33 FOR OFFICIAL USE ONLY

Sample Statement of Budgetary Resources (SBR)

BUDGETARY FINANCING ACCOUNTS BUDGETARY RESOURCES Unobligated balance, brought forward, Oct 1 Recoveries of prior year unpaid obligations Budget authority Appropriation Spending authority from offsetting collections Earned Collected Change in receivables from Federal sources Change in unfilled customer orders Advance received Without advance from Federal sources Subtotal Nonexpenditure transfer, net, anticipated and actual Permanently not available Total Budgetary Resources Status of Budgetary Resources Obligations incurred: Direct Reimbursable Unobligated balance: Apportioned Sub Total Unobligated balance not available Total status of budgetary resources Changes in Obligated Balances Obligated balance, net Unpaid obligations, brought forward, Oct 1 Less: Uncollected customer payments for Federal sources, brought forward, Oct 1 Total unpaid obligated balance Obligations incurred net (+/-) Less: Gross outlays Less: Recoveries of prior year unpaid obligations, actual Change in uncollected customer payments from federal sources (+/-) Obligated balance, net, end of period Unpaid obligations Less: Uncollected customer payments from Federal sources (-) Total, unpaid obligated balance, net, end of period Net Outlays: Gross Outlays Less: Offsetting Collections Less: Distributed offsetting receipts Net Outlays FOR OFFICIAL USE ONLY 2009 Combined 28,026,796 24,029,026 165,257,644 7,806,105 (144,220) 323,916 76,479 173,322,124 1,711,873 (3,170,061) 223,921,758 186,801,435 10,215,890 197,017,325 23,899,972 23,899,972 3,004,461 223,921,758 93,776,544 (3,864,218) 89,912,326 197,017,325 (165,217,414) (24,029,026) 65,742 101,547,429 (3,798,476) 97,746,953 165,217,414 (8,130,022) (321,451) 156,765,941 34

WAVE 3 Mission Critical Assets (E&C)

• Focuses on the “existence and completeness” financial statement assertions and includes the “rights” assertion and portions of the “presentation and disclosure” assertion.

• Reporting entities must ensure that:     all assets recorded in the property books exist all of the reporting entities’ assets are recorded in their system reporting entities have the right to report all assets (Rights) assets are consistently categorized, summarized, and reported period to period (Presentation and Disclosure). 35 FOR OFFICIAL USE ONLY

WAVE 4 Full Audit

• Include the proprietary side of financial transactions covered in Wave 2, and:      accounts receivable earned revenue accounts payable gross costs other liabilities • Adds the “valuation” assertion for assets 36 FOR OFFICIAL USE ONLY

Assertions

Existence: Only valid or authorized transactions are processed during the correct period, and the underlying asset exists during the period reported in the accounting system

Completeness

: All transactions are processed that should be and the entire population of assets is accounted for and established.

Rights & Obligations

: Assets represent the rights of the organization as of a given date (Ownership/Custody)

Valuation:

Assets, liability, equity, revenue, and expense components have been included in the financial statements at appropriate amounts.

Presentation and Disclosure: C salvageable) omponents of the financial statements are properly classified, described and disclosed (properly recorded as acquisitions, disposals, reparable, expendable, 37 FOR OFFICIAL USE ONLY

Asserting

• We will be asserting : 

that our financial controls are in place and operating effectively



that our financial reports are accurately prepared



that transactions can be supported with documentation and that



that we have fully complied with our laws and regulations.

38 FOR OFFICIAL USE ONLY

BUMED Assertion Dates to TMA

Assessable Units Travel Consumables Reimbursable Work Orders – Grantor Reimbursable Work Orders – Performer Military Payroll Contract Administration Non-Federal Receivables Federal Receivables Civilian Payroll Financial Reporting Fund Balance with Treasury

FOR OFFICIAL USE ONLY

Assertion Dates SEP 2012 DEC 2012 DEC 2012 APR 2013 APR 2013 JUL 2013 JUL 2013 SEP 2013 DEC 2013 DEC 2013 DEC 2013

39

Audit

FIAR Phases

Discovery Validation Assertion FOR OFFICIAL USE ONLY Evaluation Corrective Action 40

BUMED’s FIP Tool Box

• Command Level Testing/Validation Testing • Standard Operating Procedures (SOPs) • FMO Samples and Workbooks • NAS Sample Testing FOR OFFICIAL USE ONLY 41

Verify Beginning Balances

Audit Preparation

Supporting Documents

Reconciliations

Population IT Controls Control Testing Service Providers

Managers’ Internal Control Program (MICP)

ICONO ICOFR MICP

FOR OFFICIAL USE ONLY 43

Audit Readiness

•

It’s not just a Job; it’s the path to audit success…

FOR OFFICIAL USE ONLY 44

Audit Readiness Trivia

• What are the Priorities of the FIAR Plan?

• What are Two Internal Control Objectives?

• What are the Five Financial Assertions?

• What is the date for Audit of the SBR?

• What is the date for Full Audit?

FOR OFFICIAL USE ONLY 45

Part 4:

EXERCISE: CLASSIFYING AND REPORTING DEFICIENCIES

FOR OFFICIAL USE ONLY 46

• • •

Scenario

At Naval Hospital Atlantis, during a 6 month timeframe, questionable transactions were found on the GTCCs for 60 members. During this timeframe, the total number of members who used their card was 70.

The types of questionable transactions included: • Expenses not related to official government travel such as video games purchased at Target • Cash advances taken within a member’s permanent duty station and the member is not on official government travel orders • Airline tickets purchased for a member’s spouse and children • Lodging charges for a member’s personal travel following a period of official government travel These questionable expenses were not identified during travel card or DTS voucher review processes 47 FOR OFFICIAL USE ONLY

•

Analysis

Is the deficiency a threat to mission, resources, and/or image?

• How would you classify the deficiency and why?

• Material Weakness, Reportable Condition, Item to be Revisited • What is your corrective action plan?

• Would you report the deficiency? Why or why not?

• Is the deficiency related to ICONO, ICOFR, or both?

• If you do report the deficiency, what level of assurance do you report?

• Unqualified, Qualified, or No assurance FOR OFFICIAL USE ONLY 48

• • • • • • • •

Higher Level Resources

Federal Managers’ Financial Integrity Act of 1982 (P.L. 97-255) OMB Circular A-123: Management’s Responsibility for Internal Control DoD Financial Improvement and Audit Readiness (FIAR) Guidance of December 2011 DoDI 5010.40 of 29 July 2010: Managers’ Internal Control Program (MICP) Procedures SECNAVINST 5200.35E of 8 November 2006: Department of the Navy (DON) Managers’ Internal Control (MIC) Program SECNAV M-5200.35 of June 2008: Department of the Navy Managers’ Internal Control Manual OPNAVINST 5200.25D of 03 October 2011: Managers’ Internal Control Program GAO Products: “Standards for Internal Control in the Federal Government” “Internal Control Management and Evaluation Tool” and FOR OFFICIAL USE ONLY 49

BUMED Resources

• • • • SG’s Memo on Internal Controls in Navy Medicine of 5 January 2012; Reference: 5200 Ser M82/11UM82757 DSG’s Memo on Annual Areas for Leadership Engagement of 30 August 2010; Reference: 5200 Ser M82/10UM82749 BUMEDINST 5200.13A of 29 October 2008: Managers’ Internal Control Program Managers’ Internal Control Program (MICP) Guidance for Fiscal Year (FY) 2012 dated 6 October 2011; Reference: 5200 Ser M82/11UM82758 50 FOR OFFICIAL USE ONLY

Questions?

Contact Information

• Meg Sherwood Phone: 703-681-9487 Email: [email protected]

• Freda King Phone: 703-681-9471 Email: [email protected]

FOR OFFICIAL USE ONLY 51