Governmental Financial Management and Control
Internal control
The GAO Green Book (Standards for Internal Control in the Federal Government) sets five components - control environment, risk assessment, control activities, information and communication, monitoring - supported by 17 principles; COSO is the private-sector analogue. Control activities include segregation of duties, authorization, reconciliation, physical safeguards, and system access. Distinguish preventive from detective controls, and know the deficiency hierarchy: deficiency, significant deficiency, material weakness.
Audit and oversight
The Yellow Book (GAGAS) governs government audits - financial, attestation, and performance audits - with independence, continuing education, and quality-control requirements. A Single Audit is required when an entity expends a threshold amount of federal awards in a year (raised to $1 million for fiscal years beginning on or after October 1, 2024; confirm the current threshold). It adds a schedule of expenditures of federal awards, a report on internal control over compliance, and a compliance opinion on each major program.
Managing risk and results
The GAO Fraud Risk Management Framework follows a cycle: commit, assess, design and implement, evaluate and adapt. Core statutes include the CFO Act (financial management leadership and audited statements), the GPRA Modernization Act (strategic plans, annual performance plans and reports), the Payment Integrity Information Act (improper payments), and the Cash Management Improvement Act (federal fund transfers).
Traps
- Calling a deficiency a material weakness without evidence of a reasonable possibility of material misstatement.
- Assuming every grant recipient needs a Single Audit - only entities meeting the federal expenditure threshold do.
- Treating internal control as accounting-only; it covers operations, compliance, and reporting objectives.
- Confusing the Green Book (management) with the Yellow Book (auditors).
Worked example
A clerk who both approves vendors and releases payments creates a segregation-of-duties gap. It is a preventive control failure in control activities, ordinarily at least a significant deficiency in design, and it threatens compliance objectives as well as reporting.