Service Organization Reports – What Agencies Need to Know

Service Organization Reports Panel  Moderator  Howard Campbell, Senior Manager, IBC  Panelist  Mike Wetklow, Branch Chief, Office of Federal Financial Management, Office of Management and Budget  Matt Miller, Assistant Commissioner, Bureau of the Fiscal Service, U.S. Department of the Treasury  Kerrey Olden, Federal Audit Senior Manager, KPMG 2

GAO Updated the ‘Green Book’ On September 10, 2014 GAO updated internal control standards for the federal government as required by the Federal Managers’ Financial Integrity Act (FMFIA), based on COSO changes relevant to the federal government. FMFIA also requires OMB to develop implementation requirements and that is done through OMB Circular A-123. These standards are effective beginning in FY 2016 The Green Book is available at New Internal Control Standards 3

Additional Considerations – Service Organizations Management use of service originations and responsibility for processes assigned to service organizations Management may consider the following when determining the extent of oversight for the operational processes assigned to the service organization: The nature of services outsourced The service organization’s standards of conduct The quality and frequency of the service organization’s enforcement of adherence to standards of conduct by its personnel The magnitude and level of complexity of the entity’s operations and organizational structure The extent to which the entity’s internal controls are sufficient so that the entity achieves its objectives and addresses risks related to the assigned operational process New Internal Control Standards 4

OMB Memorandum 04-11, Service Organization Audits OMB, A-123 Appendix D, Compliance with the Federal Financial Management Improvement Act Examples of how to meet management responsibilities for internal control related to Service Organizations: Determining use of a service organization? Significance to an agencies internal control? Does a Service Organization Report Exist and is it sufficient in scope? If a Service Organization Report doesn’t exist, what else can be done? Management Responsibilities for Internal Control 5

Service Provider Perspective  Background & History  Benefits to Providers  Benefits to Clients/Users 6

Financial Statement Auditor Perspective  Relevant guidance  Auditors’ responsibility  Common pitfalls  Examples of success 7