1. 1  AGA-DC and GWSPCA 6 th ANNUAL CONFERENCE OMB Circular A-123, Appendix A Internal Control Over Financial Reporting Innovative Approaches Jerome A. Vaiana Deputy Assistant Chief Financial Officer for Financial Management U.S. Department of Housing and Urban Development May 8, 2007

2. 2 HUD’S FRAMEWORK FHA Ginnie Mae HUD General Programs Public & Indian Housing Community Planning & Development Housing

3. 3 Approach A-123, Appendix A provides a methodology for agency management to assess, document, test, and report on its internal control over financial reporting. Management Utilize a "Top Down" approach supported by the organizational structure already in place to direct the Department’s financial management systems integration and modernization project. Contract Assistance Each service bureau has its own contract assistance to perform Appendix A requirements Contract tasks are slightly different –One bureau tasks contractor with assisting in corrective actions –General Programs: Make recommendations for improvements/corrections and our employees will perform the corrective actions –Other bureau: Concentrate more on the General Ledger. Last year, they implemented a new General Ledger while the review was underway

4. 4 Coordination –Members of the bureaus’ (HUD General Programs, FHA, and Ginnie Mae) assessment teams attend each other’s A-123 status meetings in order to coordinate and stay current on all assessment activities. –Each bureau has its own support contractor To assist in the assessment of the control environment and the identification, documentation, and testing of primary controls over financial reporting. To recommend improvements to strengthen internal controls identified as deficient. –OCFO closely coordinates the overall A-123 assessment process in support of the Secretary’s annual assurance statement for the Department. –Contractors communicated well and kept us and the fellow contractors informed of the progress made in completing reviews Delineation of areas of responsibility General Programs contractor was responsible for reviewing HUD’s financial statement consolidation process One area raised by a service bureau contractor that became a tasking for the General Programs contractor Approach (cont’d)

5. 5 Key Decisions Scope The scope of the assessment covered all financial statement line items that fall within the materiality thresholds and all key business processes, with a focus on major program activity. Materiality Materiality level calculated using qualitative factors after reviewing OIG’s approach to performing their audit materiality calculation. HUD General Program Materiality – Based on Total Expenses Most active major financial statement line items and accounts primarily for grant, subsidies and contract expenses FHA and Ginnie Mae Materiality - Based on Total Assets Asset based government corporations

6. 6 The results of our FY06 review are as follows: 70 simple deficiencies for HUD General Programs, FHA and Ginnie Mae; 1 reportable condition in the area of Information Technology Lack of documented policies and procedures IT deficiencies resulting from the financial statement audit and review by an independent contractor –Corrective Action Plans (CAPs) have been developed; progress is continually monitored Recommended Assurance Statement “HUD conducted its assessment of the effectiveness of internal control over financial reporting, in accordance with OMB Circular A-123, Management’s Responsibility for Internal Control. Based on the results of this evaluation, HUD can provide reasonable assurance that internal control over financial reporting as of June 30, 2006 was operating effectively and no material weaknesses were found in the design or operation of the internal controls over financial reporting.” FY06 Results

7. 7 FY07 Planning FY07 Areas of Focus HUD General Programs IT Testing in general support systems and seven major financial systems Rotate the assessment of business processes utilizing a 3-year cycle –Identify any significant process changes and their control procedures as well as test them –Risk-based approach to selection of business processes Develop strategies to better coordinate with other internal control activities Special emphasis on Gulf Coast Disaster Recovery CDBG program ($16.7 Billion) Incorporate internal controls into the HUD business culture

8. 8 FHA Focus on high risk areas, such as Liability for Loan Guarantees and HECM (Reverse Mortgages) Continue to produce and update written procedures for cycle memorandums –and financial controls based on legal, statutory, regulatory, organizational and –mission changes, etc. where required Special emphasis includes collecting samples to test materiality and –items of special emphasis by Congress, FHA, and prior audits, reviews, or inspections FY07 Planning FY07 Areas of Focus (cont’d)

9. 9 Ginnie Mae Follow-up on documentation of written desk procedures Validate that internal controls are in-place for the HECM product Review reports and controls on master subservicer FY07 Planning FY07 Areas of Focus (cont’d)

10. 10 Value Added Benefits of A-123A Expand Management Focus on Financial Reporting  Beyond the purview of CFO and auditors  Better integration of business and accounting processes Draw Attention to Areas for Improvement  Improved documentation of policies and procedures for processing financial transactions, accounting adjustments and reports  Increased focus on controls over data quality Produces Better Requirements Documentation for Systems Improvement Efforts

11. 11 Three Bureaus Supported by Different Contractors Each contractor performs assessments a little differently –Enables best practices sharing –Draws attention to areas needing more focus; i.e. Ginnie Mae support contractor requested that HUD General Programs perform more IT general support systems testing –Allows service bureaus to customize the scope/tasking in the contract to their individual needs Innovative Approaches

12. 12 Integration and Coordination with Other Control Related Activities Improper Payment Information Act (IPIA) risk assessments; A-127 systems compliance reviews; A-130 security compliance reviews; and funds control documentation, etc. –Eliminates redundancies –Stresses the importance of non-audit type reviews by following up on “ignored” recommendations from these reviews Programmatic internal control activities such as subsidy compliance reviews of contract administrators –Leverages extensive review programs already in place Innovative Approaches (cont’d)

13. 13 A-123A Cycle Memos Utilized for other processes, i.e., share with auditors, staff, and IT development efforts Require sign-off from business process owners; reinforces “ownership” of the process Innovative Approaches (cont’d)

14. 14 Combine Assessment Activities and Use Risk Based Approach Combine the updating and refining of business processes documentation with risk assessment Assess the risk of each key control within a process then use results to determine the overall process risk Innovative Approaches (cont’d)

15. 15 Automate the assessment Utilize software and databases to automate the process where possible Innovative Approaches (cont’d)

16. 16 Report “Good News” Remember to cite good news when reporting your final test results, i.e., agency and/or individual awards pertaining to internal controls, elimination of major audit conditions or risk ratings, etc. Innovative Approaches (cont’d)

17. 17 Questions?