Taking a Fresh Look at Circular A-123 Appendix A—Three Years Later

By: Robert Maitner Jr., MGA, CGFM

Robert Maitner Jr., MGA, CGFM, an at-large AGA member, is a senior managing consulting with IBM’s public sector financial management practice.

In December 2004, early into fiscal year 2005, the U.S. Office of Management and Budget (OMB) issued an update to one of its better known and widely regarded circulars, A-123, Management’s Responsibility for Internal Control. This was the first revision to the circular since June of 1995, and included for the first time the now infamous Appendix A, Internal Control over Financial Reporting, effective with fiscal year 2006. The original A-123, which was a natural outgrowth of the Federal Managers’ Financial Integrity Act (FMFIA), came into being in 1982 and was known as OMB “Internal Controls Guidelines.” The early version of the document included guidelines for organizational and management internal controls, and was tied to the requirements of FMFIA, such as the annual FMFIA statement of assurance over internal controls.

More than 25 years later, federal agencies are still preparing the annual statement of assurance (SOA), but since 2006, with a twist. The new Appendix A required for the first time a separate statement regarding internal control over financial reporting as a subset of the overall FMFIA statement. Essentially, a second statement was added as part of the original.

The establishment of Appendix A was a direct response to the passing of the Sarbanes-Oxley Act of 2002. Following a series of high profile corporate scandals and accounting improprieties during the late 1990s and early 2000s, the federal government decided to crack down on publicly held companies. President Bush signed the Sarbanes-Oxley Act in July of 2002, putting into place a series of new stringent requirements surrounding internal control over financial reporting and including annual attestations by external auditors.

In particular, Appendix A requires:

• Strengthened process for conducting and documenting management’s assessment methodology • Documentation of the assessment method and key processes such that the reader can acquire an understanding of the process flow and controls • Direct testing of key controls to determine operating effectiveness • New assurance statement for internal control over financial reporting (as a subset of the overall FMFIA assurance statement)

All in all, this translated into more work to be done on the part of the agency chief financial officer (CFO) staff, as well as subordinate organizational levels.

Now three years into the new requirements, federal agencies continue to wrestle through process flows diagrams, narratives, risk analyses and controls documentation. Entire organizations have come into existence for the sole purpose of providing services related to compliance with both Sarbanes-Oxley and Appendix A, and naturally all of the big firms have gotten into the game. Some of the larger and better-funded agencies have been able to keep up with the requirements, either through additional staffing or outsourcing, while the smaller ones may struggle with the added burden.

This all leads to the question, “how effective has A-123 been in achieving its original goals?” And “has the impact to the agencies been worth the additional effort?” It would also be in line to take a look at the progress that some agencies are making in its efforts to achieve an unqualified audit opinion on its annual CFO Act financial statements, and how they are integrating those efforts with the Appendix A activities. And is there a relationship between the level of assurance provided by an agency and the status of its audit opinion? What do you think?

TOMORROW: Joseph Kull, CGFM, Director, Washington Federal Practice, PricewaterhouseCoopers LLC, on "Can We Contract Out the Human Capital Issue?"

Questions on posting comments or wish to subscribe to the feed that sends blogs right to your e-mail? Find instructions here. Want to be our guest on the Blog? Contact Marie Force, AGA communications director, at mforce@cox.net.

Comments

[Robert Maitner]

Thanks to everyone for reading my blog today and thanks for the comments!

[Robert Maitner]

Thanks for your questions and comments. A strong internal controls program provides a solid foundation for the purposes of financial reporting - as we have seen in past instances, weak internal controls have had dramatic effects on organizations and even resulted in the demise of some corporations. While solid internal controls will not eliminate the existence of material weaknesses across the board, they will contribute to ongoing improvements to financial reporting. And yes, in many cases I do believe that a cost benefit analysis would make sense, particularly to organizations that do not have huge budgets or extra staff. Overall, the process of reviewing the processes and subprocesses leads to discovering new and better ways of doing business.

[Alexandra Moses]

Hi Robert. I am interested in your opinion as to whether you think improving internal controls is going to significantly increase material misstatements on the financial statements. Is a strong internal controls program the answer to the financial statement audit opinion woes?

Also, do you think a cost-benefit analysis should be conducted on A-123?

[Robert Maitner]

We also should consider what the impact of Appendix A has been on Federal agencies over the last couple of years. Clearly there has been an added work burden to perform the tasks required of the revised circular, and additional cost. But what about the outcomes? Stronger internal controls? Improved financial reporting?

[Robert Maitner]

Thanks for your thoughts and insight. This is exactly the type of information that I think is helpful to understanding the relationship betweeen audit opinion and the annual SOA for appendix A. Your data does seem to suggest that the relationship is currently not strong, at least in looking at the last two years. It will be interesting to see if the 2008 results provide any further insight. We may also be looking at a situation where some agencies are finding that they are able to achieve unqualified audit opinions while still reporting deficiencies or material weaknesses for appendix A.

[Jodie Sandel]

Hi Robert. I’d like to discuss your question “And is there a relationship between the level of assurance provided by an agency and the status of its audit opinion?” I believe the relationship as of yet is weak, although it is improving. In FY 2006 and FY 2007, I reviewed the audit opinions and the Statement of Assurance Internal Control A-123 opinions of 46 Federal government departments and agencies. In FY 2006, there were 24 departments/agencies that had matching audit and SOA opinions. In FY 2007, there were 31 matches. Although data on two years certainly can not indicate a trend, perhaps as agencies are spending more resources on internal controls, the link between internal controls and the audit process will continue to strengthen.

[Robert Maitner]

Good morning, this is Robert. My essay was posted as the topic of discussion for today's AGA blog. Let me know what you think. Has the updated version of A-123, which includes Appendix A (internal control over financial reporting)had an impact? What have been some of the impacts of this since becoming effective during fiscal year 2006?