Internal Controls Program as a Management Tool

Streamline the Internal Controls Program to Make it an Efficient and
Effective Management Tool

Background

"Internal controls" are an integral part of any organization's basic
management processes. Internal controls ensure that organizational
missions are being met through effective and efficient means. They are
intended to protect an organization's resources and assets from fraud,
waste, abuse, and mismanagement. The formal internal controls program of
the federal government consists of two parts: (1) the design and
implementation of internal controls, and (2) the review of the adequacy
of those internal controls.

The traditional view of internal controls is rooted in financial
management and accounting. This view is being integrated into the
broader context of "management controls." This broader view has been
growing in acceptance in government circles since the late 1980s.
Internal management control techniques include policies, procedures, and
organizational plans, and physical arrangements.(1) These include time
clocks or sign-in sheets, computer password protections, and required
signatures to approve travel documents. Controls also include the
separation of duties--a form of checks and balances.  Effective internal
management controls keep dishonest employees from paying secretarial
staff the amount due an executive; and they keep Head Start grant money
from being awarded to drug dealers.

Financial Integrity Act.

Concern over inadequate management controls led Congress to enact the
Federal Managers' Financial Integrity Act (FMFIA) in 1982. The act
establishes a review process of internal accounting, administrative
controls, and accounting systems. Each agency must report annually to
the President and Congress on the condition of its management controls
and accounting systems, self-report "material control weaknesses," and
describe the actions that will be taken to correct the material
weaknesses.(2) FMFIA requires the Office of Management and Budget (OMB)
to issue guidelines and the General Accounting Office (GAO) to issue
internal control standards.(3)

OMB Circular A-123, "Internal Control Systems," implements FMFIA. It
requires agencies to segment their organizations and functions into
assessable units or components. Reviews of these components' management
controls are carried out through Risk Assessments, Management Control
Reviews, and Alternative Management Control Reviews as prescribed by
OMB. OMB's guidelines are intended to place the responsibility with the
line manager to assess the adequacy of the management controls of his or
her organizational component.

Typically, however, small staffs in each agency have been dedicated to
monitoring the requirements of FMFIA and OMB Circular A-123. In
addition, GAO and Inspector General (IG) staffs selectively review
agencies' management controls. Therefore, the annual reports are a
combination of material control weaknesses that have been uncovered by
managers, management control staffs, GAO, and/or the IG.

Action on Weaknesses.

According to OMB, since 1982, agencies have reported approximately 4,500
material weaknesses and corrected 3,855 of them. Currently, 645 material
control weaknesses are pending.(4) Overall, the reports indicated that
the majority of the weaknesses had been disclosed by IG or GAO staffs.
Some agencies, such as the Department of Veteran's Affairs, rely on IG
staffs to disclose problems with management controls. Others, such as
the Department of Health and Human Services (HHS), rely more heavily on
management staff to disclose the weaknesses. In 1992, the majority of
HHS' material weaknesses had been disclosed by line managers.(5)

Some agencies have high-level management councils that assist the agency
head in determining which identified weaknesses should be included in
the annual report and in tracking the progress of corrective actions. In
addition, the interagency Management Control Coordinating Council exists
to share information across agencies regarding the implementation of
FMFIA.

Need for Change

The Management Control Coordinating Council believes FMFIA has the
potential for being an early warning tool.(6) "Are there other HUDs
today?" the Assistant Comptroller General for Accounting and Financial
Management asked rhetorically in his 1990 testimony to Congress.
"Unfortunately, I believe there are," he continued.(7) For this reason,
the government needs a tool such as FMFIA to provide an early warning of
problems. However, FMFIA and OMB Circular A-123 have not ensured that
effective management controls were in place. As a result, scandals
occurred, wasting the taxpayers' dollars and eroding their confidence.
If proper management controls had been in place, or if their
ineffectiveness had been brought to the attention of high- level
executives sooner, these debacles might not have occurred.(8)

Agency heads must ensure internal management controls are in place and
must be sure that they are appropriate and effective. Too few or
inadequate management controls may exist in some instances.  Conversely,
there can be too many management controls that are counterproductive and
not cost-effective because they are process- oriented, not
results-oriented.(9) For example, to ensure that employees are working
the appropriate number of hours, management sometimes asks employees to
punch a time clock each day or sign in and out on a time sheet. Would it
not be more significant to show that they have completed the required
work at the required level of quality?

Current Approach is Hollow.

While management controls must be cost-effective, so should the review
of these controls. FMFIA and A-123 have been criticized because they are
seen as hollow, inflexible procedures. One agency refers to FMFIA as
"flim-flam." While many people interviewed consider management controls
as important tools to safeguard the government's assets and resources,
FMFIA generally is perceived as a labor-intensive, paperwork-focused
reporting requirement with little positive results. It treats management
controls as a separate, staff- run program, not an integral part of line
management.

Many agencies have developed their own techniques for fulfilling the
FMFIA requirement. Therefore, it is critical that OMB, through its
circular and guidelines, give agencies sufficient flexibility to tailor
their programs to their missions. However, the Internal Control
Guidelines, issued by OMB in 1982, have not been revised to reflect the
fact that many agencies' needs for management control differ. They
prefer to have the flexibility to develop their own FMFIA programs,
guided only by general policy, not detailed prescriptive guidelines.

Current Approach Does Not Make Line Managers Responsible.  A key to
establishing a practice of reporting problems early is to have those
that sight the problems first--usually front-line employees or line
managers--reporting them. However, in general, there is a lack of
incentives for managers to report problems. Some managers are concerned
that sanctions will result from reporting weaknesses.(10) In addition,
some managers find that high-level management is sometimes uninterested
in correcting management control problems(11) and that adequate
resources are not available for corrective actions. And yet, management
controls are an integral function of effective management.
Accountability for and the review of management controls should be in
the hands of the line managers.(12) They need to explicitly be held
responsible for reporting these problems and resolving them promptly.

Cross References to Other NPR Accompanying Reports

Executive Office of the President, EOP05: Reinvent OMB's Management
Mission.

Improving Financial Management, FM08: Reduce Financial Regulations and
Requirements.

Reengineering Through Information Technology, IT01: Provide Clear,
Strong Leadership to Integrate Information Technology into the Business
of Government.

Creating Quality Leadership and Management, QUAL02: Improve Government
Performance Through Strategic and Quality Management.

Endnotes

1. U.S. General Accounting Office, Standards For Internal Controls In
The Federal Government (Washington, D.C., U.S. General Accounting
Office, 1983), p. 7.

2. According to A-123 and OMB guidance, a "material control weakness "
is one that: significantly impairs the mission of an agency or
component; deprives the public of needed services; violates statutory or
regulatory requirements; significantly weakens safeguards against waste,
loss, unauthorized use, or misappropriation of funds, property, or other
assets; or results in a conflict of interest. A material control
weakness should also: merit the attention of the agency head/senior
management, the Executive Office of the President, and Congress; and/or
exist in a majority of agency components or in a major agency program or
activity; and/or risk or result in the actual loss of either $10 million
or 5 percent of the resources of a budget line item; and/or reflect
adversely on the credibility of the agency when reported to the public.

3. The implementation of FMFIA is guided by OMB Circular A-123 "Internal
Control Systems" (revised in 1986), OMB's "Internal Control Guidelines"
(issued in 1982), OMB's annual guidance, and GAO's "Standards For
Internal Controls In The Federal Government" (issued in 1983). Many
agencies have also developed handbooks.

4. Data provided by the Management Integrity Branch, Office of
Management and Budget.

5. Interview with Edwin Sullivan, Director, Division of Integrity and
Organizational Review, Department of Health and Human Services, August
1993.

6. President's Council on Management Improvement, Internal Control
Interagency Coordination Council, "Improving the Management Control
Process," July 1989, p. 7. The Internal Control Interagency Coordination
Council is now called the Management Control Coordinating Council.

7. U.S. General Accounting Office, Federal Internal Control and
Financial Management Systems: Major Reform Efforts Are Needed, GAO/T-
AFMD-90-14, (Washington, D.C.: GAO, April 18, 1990), p.15.

8. Grosshans, Werner, "Internal Control Assessments--Are They Needed on
Performance Audits?" Government Accountants Journal (Winter 1992), p.
44.

9. Camillus, John C., Strategic Planning and Management Control (Canada:
D.C. Heath, 1986), p. 13.

10. Ibid., p. 19.

11. President's Council on Management Improvement, Internal Control
Interagency Coordination Council, p. 9.

12. Kendig, William L., and Wayne D. Howard, "The Maturing of the
Management Control Process," Government Accountants Journal (Spring
1992), p. 48.

13. This is the same council described in Creating Quality Leadership
and Management, QUAL02: Improve Government Performance Through Strategic
and Quality Management, action item 3. OMB's May 1990 memo on FMFIA
encouraged agencies to form a similar council. This council, as
proposed, would have broader responsibilities.

14. President's Council on Management Improvement, Internal Control
Interagency Coordination Council, p. 7.