Department of Commerce Approach to Implementing A-123 Presentation

Department of Commerce Approach to Implementing A-123 Presentation May 23, 2006 Lisa Casias Deputy CFO and Director for Financial Management

Agenda Background and Challenges A-123 Implementation Approach DOC Timeline Benefits

Background • DOC is comprised of 13 diverse bureaus (all but 3 bureaus are on one financial system). • We have approximately 34, 000 employees. • In 2005, total assets were approximately $12. 7 billion. • In 2005, DOC received an unqualified opinion for the 7 th consecutive year. • Since 1 st quarter, FY 2005, DOC has maintained a green status rating on the Financial Management Scorecard under the President’s Management Agenda.

Background (continued) • Two reportable conditions, Construction in Progress (new) and IT Security. • Corrective action plans are required on all findings – including management letter. • CFOs are required to certify to financial statements and compilation procedures. • Monthly CFO and Finance Officer meetings are held to discuss financial management issues. • Review of business processes to standardize recording of transactions among bureaus on DOC system. • Frequent consultation with the OIG.

Challenges Resources • Leveraging existing bureau and Department resources – no contract assistance to date (with the exception of PTO) • Working with the CIO on IT Controls. Testing of IT internal controls is being integrated with internal control testing required by FISMA. However, this testing doesn’t reach the application controls. Buy-in/Understanding • Materiality • Communication/Training Storage and Maintenance of Documentation Timeframe to Meet Requirements

Agenda Background and Challenges A-123 Implementation Approach DOC Timeline Benefits

A-123 Implementation Approach Requirement DOC Approach Organizational Structure • June 2005 - CFO appointed Senior Management Council (SMC) – Provides oversight for A-123 process – Composed of all bureau CFOs, CIO, and heads of Human Resources, Acquisition Management, Budget and Administrative Services. – Co-chaired by Deputy CFO and Director, Office of Management and Organization – Meets monthly • October 2005 – SMC appointed Senior Assessment Team (SAT) – Conducts day-to-day A-123 activities, including review, documentation, and testing of internal controls. – Composed of representative of bureaus and offices that have a material impact on DOC’s financial reporting.

A-123 Implementation Approach Requirement DOC Approach Scope of financial reporting • • • Materiality • Planning Materiality – 3% total assets • Design Materiality – 1/3 planning materiality • Assessment Materiality – 75% of design materiality Balance Sheet Statement of Net Cost Statement of Changes in Net Position Statement of Budgetary Resources Accompanying Financial Statement Notes Budgetary Execution Reports have a material effect on significant spending, budgetary, or other financial decisions, and in some instances, are used to monitor specific activities • Major programs, e. g. Decennial Census These programs significantly impact budget, have a high degree of risk, or are of particular interest to management. Used GAO/PCIE Financial Audit Manual as a guide.

A-123 Implementation Approach Requirement Identification of Key Processes DOC Approach • • • Budget Execution Inventory Purchasing Revenues Payroll and Employee Benefits PP&E Spending and Maintenance Financial Reporting (including period-end reporting) Treasury Management Risk Management Information Systems Grants Management Loans Processes significantly impact the Department’s financial management and reporting, and support the material balances on the financial reports. Processes defined by financial statements, auditor-provided cycle memoranda and significant control summaries, and other pertinent information.

A-123 Implementation Approach Requirement DOC Approach Identification of Key Controls • SAT divided into sub-teams according to process area. • Sub-teams documented control objectives, risks, key controls and risk assessments for key processes and sub-processes on standardized template. • OFM coordinated SAT review of all draft templates and sub-teams coordinated resolution of issues. • Outstanding issues were resolved by OFM, in consultation with sub-teams. Documentation • Processes and controls in place – Bureaus responsible for documenting processes – DOC did not prescribe a documentation standard this year • Assessment process and methodology management – OFM developing and maintaining documentation.

A-123 Implementation Approach Requirement Testing Approach and Plan DOC Approach • Planning: – Testing Team, a sub-team of the SAT, includes representatives from several small and large Department bureaus and the Office of Financial Management – During the 2 nd quarter of FY 2006, Team met on a regular basis to develop testing approach and plan. • Test Approach – Decentralized testing at the bureau level – Bureaus who cross-service provide testing services for customer bureaus – Planning, monitoring, reviewing and evaluation of test work coordinated at the Departmental level through the SAT and SMC.

A-123 Implementation Approach Requirement Testing Approach and Plan (continued) DOC Approach • Test Approach (continued) – Segregation of Duties • Bureau staff performing test work independent of bureau staff performing operational functions AND bureau staff reviewing quality and accuracy of test work. • SAT and SMC member review test work of bureaus other than their own bureau. – Documentation • Test team developed standard work paper templates and instructions for use by all testers. • Testers will document test procedures followed, rational for departures from Department-wide standardized test plan, evidence obtained through the testing process and conclusions reached.

A-123 Implementation Approach Requirement Testing Approach and Plan (continued) DOC Approach • Test Approach (continued) – Controlling and Monitoring: • Formalized communication protocol between testers, SAT reviewers and SMC in place. • Test plan controlled and monitored at the Department level. • Sampling approach developed at Department level. Each bureau will use uniform sample sizes and sampling techniques. • SAT reviewers will examine the processes across bureaus to ensure consistency in application of judgment to and quality of testing.

A-123 Implementation Approach Requirement Testing Approach and Plan (continued) DOC Approach • Test Plan – DOC testing key controls on all 12 processes. Testing procedures, including control type, test method, sampling, and audit test have been developed for all key controls. – The processes associated with each material line item being tested at material bureaus. The SAT documented the crosswalk between the key processes, each material financial reporting line item they support, and the bureaus that are material to each line item. – Testing started during the 3 rd quarter; will be completed by the middle of the 4 th quarter.

A-123 Implementation Approach Requirement Concluding, Reporting, and Correcting Deficiencies and Weaknesses DOC Approach • Test results will be reviewed by the SAT and SMC for deficiencies and weaknesses • Determinations made regarding extent of any deficiencies found, i. e. , internal control deficiency, reportable condition, material weakness • Corrective Actions Plans developed and implemented. • Reporting and identification of deficiencies and weaknesses completed during 4 th quarter. SMC will recommend level of assurance the Secretary should provide on internal control over financial reporting.

A-123 Implementation Approach Requirement Consultation with IG DOC Approach • Meet with OIG staff periodically to discuss DOC approach and provide updates on progress. • Provide Implementation Plan, Process Templates, and Testing documentation that describe approach. Integrate and Coordinate • Testing of internal controls will be integrated with internal control testing required by FISMA. with Other Control • Department to provide additional guidance to bureaus Related Activities for an integrated FMFIA review process. • Leverage completed and ongoing IG and GAO audit activities at the Department.

A-123 Implementation Approach Requirement Communication DOC Approach • SES Career Development Program team is developing a Department-wide A-123 communication strategy and plan. • Department senior managers communicate A-123 requirements at quarterly management updates, briefings and presentations. • Bureaus routinely discuss A-123 activities among managers and staff. • PMA initiatives included in SES Performance Plans. One bureau includes a specific element that states: "Completes all actions necessary to eliminate material weaknesses and support achievement of a unqualified bureau audit. "

Agenda Background and Challenges A-123 Implementation Approach DOC Timeline Benefits

DOC Timeline FY 2005 Assessment Phases Project Initiation Appoint SMC (6/05) Identify FS Prepare Materiality Analysis Appoint SAT Planning Phase Finalize Materiality Finalize Processes/Sub-Processes Document Key Controls Document Processes Integrate Control Activities Develop Communications Plan Develop Test Plan Testing Phase Testing Key Controls Identify Deficiencies & Weaknesses Evaluation Phase SMC and SAT review test results Develop CAPs Reporting Phase Assurance Statement in PAR (as of June 30 – PAR issued 11/15/06) Qtr. 4 FY 2006 Qtr. 1 Qtr. 2 Qtr. 3 Qtr. 4

Agenda Background and Challenges A-123 Implementation Approach DOC Timeline Benefits

Benefits • Formalized the process and reporting on assurance of internal controls. • Assists in enforcing compliance by increasing visibility. • Provides positive opportunity to work with bureaus – working together to get the job done. • Transfer of knowledge among bureaus. • A-123 Inter-agency workgroup.