	The Key Concepts Underlying Internal Control

Internal control represents an organization’s plans, methods, and  procedures used to meet its missions, goals, and objectives and serves as  the first line of defense in safeguarding assets and preventing and detecting  errors, fraud, waste, abuse, and mismanagement. Internal control is to  provide reasonable assurance that an organization’s objectives are  achieved through (1) effective and efficient operations, (2) reliable  financial reporting, and (3) compliance with laws and regulations. The Congress Has Long Recognized the Importance of Internal Control

The Congress has long recognized the importance of internal control,  beginning with the Budget and Accounting Procedures Act of 1950, over 50  years ago. The 1950 act placed primary responsibility for establishing and  maintaining internal control squarely on the shoulders of agency  management. In 1982, when faced with a number of highly publicized internal control  breakdowns, the Congress passed FMFIA with a goal of strengthening  internal control and accounting systems. Under  FMFIA, agency heads are required to establish a continuous process for  assessment and improvement of their agency’s internal control and to  publicly report on the status of their efforts by signing annual statements of  assurance as to whether internal control is designed adequately and  operating effectively. The act also required that the  Comptroller General establish internal control standards and that OMB  issue guidelines for agencies to follow in assessing their internal control  against the Comptroller General’s standards. Early Experiences and Lessons Learned from Agency FMFIA Implementation

From the outset, agencies faced major challenges in implementing FMFIA. Starting in  1983, GAO monitored and reported on FMFIA implementation efforts  across the government in a series of four reports from 1984 through 1989 as  well as in numerous reports targeting specific agencies and programs. Our fourth governmentwide report, issued in 1989 for which the title,  Ineffective Internal Controls Result in Ineffective Federal Programs and  Billion in Losses, is still appropriate in today’s environment, concluded  that while internal control was improving, the efforts were clearly not  producing the results intended. It  seemed that the assessment and reporting processes had, at least to some,  become the endgame. Too much process and paper continued to be a problem, and in 1995 OMB  made a major revision to Circular A-123 that relaxed the assessment and  reporting requirements. In  addition, it gave agencies the discretion to determine which tools to use in  arriving at the annual assurance statement to the President and the  Congress, with the stated aim of achieving a streamlined management  control program that incorporated the then administration’s reinvention  principles. The changes are intended to strengthen the requirements for conducting  management’s assessment of internal control over financial reporting. The  December 2004 revision to the Circular also emphasizes the need for  agencies to integrate and coordinate internal control assessments with  other internal control-related activities. In particular, we support the principles-based approach in the revised  Circular for establishing and reporting on internal control that should  increase accountability. Third, managers throughout an agency and at all levels will need to provide  strong support for internal control. FMFIA does not call for  an auditor opinion on management’s assessment of internal control over  financial reporting nor does it call for an auditor opinion on the  effectiveness of internal control. What is the maturity level of internal control over financial reporting? Of the 25 areas on GAO’s high-risk list, 14 relate to  DOD, including DOD financial management.
Why GAO Did This Study

Internal control is at the heart of accountability for our nation's resources and how effectively government uses them. This testimony outlines the importance of internal control, summarizes the Congress's long-standing interest in internal control and the related statutory framework, discusses GAO's experiences and lessons learned from agency assessments since the early 1980s, and provides GAO's views on the Office of Management and Budget's (OMB) recent revisions to its Circular A- 123. GAO highlights six issues important to successful implementation of the revised Circular, specifically, the need for supplemental guidance and implementation tools; vigilance over the broader range of controls covering program objectives; strong support from managers throughout the agency, and at all levels; risk-based assessments and an appropriate balance between the costs and benefits of controls; management testing of controls in operation to assess if they are designed adequately and operating effectively; and management accountability for control breakdowns. Finally, GAO discusses its views on the importance of auditor opinions on internal control over financial reporting.

What GAO Found

Internal control represents an organization's plans, methods, and procedures used to meet its missions, goals, and objectives and serves as the first line of defense in safeguarding assets and preventing and detecting errors, fraud, waste, abuse, and mismanagement. Internal control provides reasonable assurance that an organizations' objectives are achieved through (1) effective and efficient operations, (2) reliable financial reporting, and (3) compliance with laws and regulations. The Congress has long recognized the importance of internal control, beginning with the Budget and Accounting Procedures Act of 1950, which placed primary responsibility for establishing and maintaining internal control squarely on the shoulders of management. In 1982, when faced with a number of highly publicized internal control breakdowns, the Congress passed the Federal Managers' Financial Integrity Act (FMFIA). FMFIA required agency heads to establish a continuous process for assessment and improvement of their agency's internal control and to annually report on the status of their efforts. In addition the act required the Comptroller General to issue internal control standards and OMB to issue guidelines for agencies to follow in assessing their internal controls. GAO monitored and reported on FMFIA implementation efforts across the government in a series of four reports from 1984 through 1989 as well as in numerous reports targeting specific agencies and programs. With each report, GAO noted the efforts under way, but also that more needed to be done. In 1989, GAO concluded that while internal control was improving, the efforts were clearly not producing the results intended. The assessment and reporting process itself appeared to have become the endgame, and many serious internal control and accounting systems weaknesses remain unresolved as evidenced by GAO's high risk report which highlights serious long-standing internal control problems. In 1995, OMB made a major revision to its guidance that provided a framework for integrating internal control assessments with other work performed and relaxed the assessment and reporting requirements, giving the agencies discretion to determine the tools to use in arriving at their annual FMFIA assurance statements. OMB's recent 2004 revisions to the internal control guidance are intended to strengthen the requirements for conducting management's assessment of control over financial reporting. GAO supports OMB's recent changes to Circular A-123 and in particular the principles-based approach for establishing and reporting on internal control. GAO also noted six specific issues that are important to successful implementation of OMB's revised guidance and discusses its views on the importance of auditor opinions on internal control over financial reporting.