1. Integration of Financial Operations and IT Cybersecurity Controls Integration of Financial Operations and IT Cybersecurity Controls March 18, 2016 Mr. Edward S. Romesburg Chief, RS1, DISA 1

2. Agenda 2 New Government Internal Control Standards DoD Material Weaknesses in Financial Reporting and IT Integration/Collaboration of Financial Operations and IT Interdependence of Financial Reporting Controls and IT Cybersecurity Controls IT Control Considerations for Operations

3. New Gov’t Internal Control Standards 3

4. Internal Control Framework 4 Agency Directorate Division Process

5. Internal Control Framework 5 Agencies must achieve the following internal control objectives:  Operations Effective and efficient operations  Reporting Reliable internal and external reports  Compliance Comply with applicable laws and regulations Safeguarding Assets

6. Five (5) Components of Internal Control 6 1.Control Environment  Commitment to establishing and maintaining effective internal controls within the Agency 2.Risk Assessment  Identifies areas where risk may prevent the organization from meeting its objective 3.Control Activities  Activities that ensure the Agency’s objectives are met 4. Information and Communication  Relevant, reliable and timely information is communicated to the right people at all levels of the organization 5. Monitoring Activities  Assessing the quality of performance over time  Continuously monitor and test internal controls to identify poorly designed or ineffective controls and correct them