Audit Readiness and Internal Controls
Audit Readiness and Internal Controls tests how managers assess, test, and remediate controls so financial statements withstand audit, and how deficiencies are classified and reported.
The standards
OMB Circular A-123 requires annual management assessment and reporting on internal control over financial reporting; Appendix A covers that assessment, the other appendices address improper payments and FISMA compliance. GAO's Green Book (GAO-14-704G) sets five components, control environment, risk assessment, control activities, information and communication, and monitoring, plus 17 principles used as evaluation criteria. DoD Instruction 5010.40 runs the Managers' Internal Control Program and the annual statement of assurance. The Yellow Book sets government audit standards, and the Payment Integrity Information Act governs improper payments.
Audit readiness lifecycle
- Assess the process and identify gaps against audit criteria.
- Build a corrective action plan with owners and milestones.
- Test control design.
- Test operating effectiveness with samples and documentary evidence.
- Validate before the auditor arrives, then sustain.
FIAR work sequences existence and completeness of assets and liabilities first, then valuation, then financial reporting controls. Evidence must be documentary and reproducible on request.
Classifying findings
A deficiency is a control gap. Whether it is a significant deficiency or a material weakness is judged on likelihood and magnitude, meaning whether a misstatement could occur and be material to the statements, not on the dollar value of the single transaction. Material weaknesses are reported in the Agency Financial Report with a corrective action plan and milestones.
Worked example
A payment office lets one certifying officer both approve and release payments in the accounting system with no independent review. Analysis: this is a segregation-of-duties failure against Green Book control activities. Because one person could create and conceal an unauthorized obligation, and payment volume is large relative to materiality, the likelihood and magnitude test supports a material weakness rather than a simple deficiency. The corrective action plan should separate the roles in the system, add supervisory review, and test operating effectiveness over at least two quarters.
Traps that cost marks
- Confusing the Green Book (internal control criteria) with the Yellow Book (audit standards).
- Treating a completed corrective action as validated without testing operating effectiveness.
- Judging deficiencies by the dollar value of the individual transaction rather than likelihood and magnitude.
- Assuming a clean component-level opinion supports the DoD-wide opinion.