Audit Readiness and Internal Controls
Domain 5 tests whether you can defend a financial statement line to an auditor: the control framework, the evidence chain behind each balance, and the sampling logic used in DoD audit readiness work.
The framework
The CFO Act of 1990 requires audited financial statements; FMFIA (31 U.S.C. 3512) requires annual management assurance that internal control is effective; OMB Circular A-123 implements both, with Appendix A covering internal control over financial reporting. DoD Instruction 7600.07 sets audit readiness policy, and the FIAR program manages the path to an audit opinion.
The GAO Green Book (GAO-14-704G) supplies the framework: five components - control environment, risk assessment, control activities, information and communication, and monitoring - and seventeen principles management must demonstrate, not merely document.
Evidence and assertions
For each material line, the entity documents the process (narrative and flowchart), identifies key controls, assesses risk, and tests. Support must trace to key supporting documentation (KSD): the obligation document, receiving report, invoice, acceptance, and payment record. Auditors test management's assertions - existence/occurrence, completeness, rights and obligations, valuation, and presentation - by sampling. Sample errors are projected to the population; if projected error exceeds tolerable misstatement, the line is not assertion-ready and a corrective action plan (CAP) with owners and dates is required.
Segregation of duties, system access reviews, and reconciliation controls are common key controls. A control that is designed but not performed consistently is a deficiency, not a strength.
Worked example
A sample of 80 obligations contains 4 with no evidence of receipt. The error rate is 4/80 = 5 percent. If tolerable error is 5 percent, the result is borderline, not passing: the exceptions still require root-cause analysis and a CAP, and the auditor may expand the sample. Projecting 5 percent across a $40,000,000 population yields $2,000,000 of potential misstatement - likely above materiality for that line.
Traps that cost marks
Treating last year's clean test as current evidence, calling a process narrative a control, relying on undocumented verbal confirmations, and closing a finding by writing a CAP without retesting the control.