OMB Circular A-123, Appendix A Adam Goldberg Office of Federal Financial Management Office of Management and Budget

“Corporation: An ingenious device for obtaining profit without individual responsibility.” Ambrose Bierce Unfortunately, this is the perception of corporate America today. The scandals in corporate America have prompted everyone to re-evaluate what controls are in place to detect and prevent fraud, waste, and abuse.

John Greenleaf Whittier “As a small businessperson, you have no greater leverage than the truth.” John Greenleaf Whittier I particularly like this quote because of its simple, but powerful message. Whether we focus on large corporations, Federal departments and agencies, or small businesses, this quote is applicable to all of them. This is also the intent and message of the requirements in OMB Circular No A-123 - requiring management to assess its internal control environment and to report truthfully on its effectiveness and then work to improve deficiencies identified.

Legislative History 1933-1935 SEC Act ’33 / ’34, Public Utilities Act ’35 1977 Foreign Corrupt Practices Act 1982 FMFIA (Circular A-123) 1990 CFO Act 2002 Sarbanes Oxley 2004 Circular A-123, Appendix A

Circular A-123 A-123 was revised in December 2004 to incorporate Sarbanes-Oxley Section 404 principles into federal financial management. Revision deals primarily with internal controls over financial reporting. Revised A-123 effective FY2006. FMFIA and original A-123 guidance required establishing internal controls and administrative accounting. A-123 was revised in December of 2004 to incorporate Sarbanes-Oxley principles into federal financial management. The revision deals with internal controls over financial reporting and audit requirements. Revised A-123 guidance added Appendix A which requires management to separately assess, test, document, and report internal control over financial reporting. Revised A-123 requirements are effective starting this fiscal year, 2006.

OMB Circular No. A-123 Original Guidance Management Assurance Self Assessment Documentation Annual Reporting Revised Guidance Management Assurance Self Assessment Enhanced Documentation Annual Reporting New Appendix A Testing for Reasonable Assurance Additional Assurance for Internal Control over Financial Reporting New Requirements Appendix A, Internal Control over Financial Reporting Documentation of assessment methodology, key processes and controls, testing results Direct testing by management New assurance statement; subset of FMFIA assurance statement As of June 30; updated through PAR submission

A-123, Appendix A vs. Sarbanes-Oxley Management Responsibility A-123, App A Enhanced Financial Disclosures SOX 404 Who Agency Management Corporate Management What Estab & Maintain ICOFR Provide Reasonable Assurance Statement of ICOFR Provide Assurance Statement of Management’s Responsibility for ICOFR Statement of Effectiveness of IC Structure Auditor Attestation Report on Management’s Assessment When Fiscal Year 2006 Year-ending on or after Nov. 15, 2004 How Often Annual Sarbanes-Oxley has been in effect longer than the A-123 revisions. To compare, both require an assurance statement of Internal Controls Over Financial Reporting (ICOFR). Notice, however, that there are differences: A-123 requires a reasonable assurance statement while Sarbanes-Oxley requires an Assurance Statement of Responsibility. A-123 does not require a Statement of Effectiveness of the Internal Control (IC) Structure. Finally, A-123 also does not require and an Auditor Attestation which is a Report on Management’s Assessment.

Similarities (Sarbanes-Oxley/A-123) Focus is on internal controls Purpose is for reliable financial reporting and effective, efficient operations Responsibility falls primarily on management The major principles of Sarbanes-Oxley are reflected in A-123. The focus is on internal controls The purpose is for reliable financial reporting and effective, efficient operations. Finally, the responsibility for reliable financial reporting and effective operations is placed on management.

Differences (Sarbanes Oxley/A-123) Criminal penalties Separate audit of internal controls over financial reporting However, there are distinct differences between A-123 and Sarbanes-Oxley: A-123 does not carry criminal liability for managers A-123 does not require a separate audit for control structures with the exception of the Department of Homeland Security (DHS). Instead of a separate internal control audit, A-123 requires a “management assurance” statement. This statement is considered sufficient in place of the separate audit unless an agency repeatedly fails to correct known deficiencies.

Differences in Implementation: Federal vs. Private All transactions in the federal government must have legal authority (prescribed by law). Goals and motivations of federal agencies differ from their private sector counterparts. Federal Agencies already subject to a web of laws to promote prudence and accountability (before Sarbanes-Oxley or A-123 revision) You may wonder why A-123 differs from Sarbanes-Oxley at all. Well, the differences stem from the differences of the sectors: Public (federal) versus Private. First, private companies are PROSCRIBED by law. Meaning, they have the authority to make purchases, etc. unless expressly ILLEGAL. In the Public sector, on the other hand, purchases are PRESCRIBED meaning there are more regulations, policies and procedures all intended to ensure that all fiscal and budgetary actions are legal. Federal agency leaders are held responsible performance and accountability while private sector leaders are held accountable for the bottom line. Because the public sector managers are more concerned with performance than the bottom line, there is less risk of financial data manipulation in the public sector. Finally, Federal Agencies were already subject to a web of laws that promote principles similar to those of Sarbanes-Oxley. (See Next Slide “Puzzle Pieces”)

Puzzle Pieces of Federal Internal Control Framework FMFIA GPRA CFO Act IG Act FFMIA FISMA IPIA Single Audit Act Clinger-Cohen Act A-123 GAO Green Book As you can see, there are a number of laws and regulations that govern federal financial management. Collaboratively, these laws and regulations can work together to solve the “puzzle” of an internal control framework that enable agencies to provide reliable financial reporting and effective, efficient operations. Notes: FMFIA- Federal Management Financial Integrity and Analysis CFO Act, As amended. FFMIA-Federal Financial Management Improvement Act of 1996. IPIA-Improper Payments Information Act of 2002 GPRA-Government Performance and Results Act IG Act of 1978, As Amended FISMA-Federal Information Security Management Act of 2002. Single Audit Act, As Amended Clinger-Cohen Act of 1996 COSO- Committee of Sponsoring Organizations (control framework) A-123- Appendix A, As Amended.