Transcript Slide 1

Service Organization Reports –
What Agencies Need to Know
Service Organization Reports Panel
 Moderator
 Howard Campbell, Senior Manager, IBC
 Panelist
 Mike Wetklow, Branch Chief, Office of Federal Financial
Management, Office of Management and Budget
 Matt Miller, Assistant Commissioner, Bureau of the Fiscal
Service, U.S. Department of the Treasury
 Kerrey Olden, Federal Audit Senior Manager, KPMG
2
New Internal Control Standards
GAO Updated the ‘Green Book’
• On September 10, 2014 GAO updated internal control
standards for the federal government as required by the
Federal Managers’ Financial Integrity Act (FMFIA), based on
COSO changes relevant to the federal government.
• FMFIA also requires OMB to develop implementation
requirements and that is done through OMB Circular A-123.
• These standards are effective beginning in FY 2016
• The Green Book is available at
http://www.gao.gov/greenbook/overview
3
New Internal Control Standards
Additional Considerations – Service Organizations
• Management use of service originations and responsibility for
processes assigned to service organizations
• Management may consider the following when determining the extent
of oversight for the operational processes assigned to the service
organization:
• The nature of services outsourced
• The service organization’s standards of conduct
• The quality and frequency of the service organization’s
enforcement of adherence to standards of conduct by its
personnel
• The magnitude and level of complexity of the entity’s operations
and organizational structure
• The extent to which the entity’s internal controls are sufficient so
that the entity achieves its objectives and addresses risks related
to the assigned operational process
4
Management Responsibilities for
Internal Control
• OMB Memorandum 04-11, Service Organization Audits
• OMB, A-123 Appendix D, Compliance with the Federal Financial
Management Improvement Act
• Examples of how to meet management responsibilities for
internal control related to Service Organizations:
• Determining use of a service organization?
• Significance to an agencies internal control?
• Does a Service Organization Report Exist and is it sufficient
in scope?
• If a Service Organization Report doesn’t exist, what else
can be done?
5
Service Provider Perspective
 Background & History
 Benefits to Providers
 Benefits to Clients/Users
6
Financial Statement Auditor Perspective
 Relevant guidance
 Auditors’ responsibility
 Common pitfalls
 Examples of success
7