ASMC Faculty Update Symposium

1
DoD Managers Internal Control Program Check It
Campaign
Peggy P. Johnson DoD Managers Internal Control
Program Check It Campaign Manager Office of the
Under Secretary of Defense (Comptroller)
2
Agenda

• Fundamentals of the Managers Internal Control
  Program
• What Are Internal Management Controls (IMC)
• What Can Happen If Ineffective
• Check It Campaign Used to Help Communicate
  Importance of IMC
• What Requires DoD Have Programmatic Approach to
  IMC
• How DoD Conducts the Managers Internal Control
  Program (MICP)
• Component Heads Required to Report Statement of
  Assurance to Secretary of Defense
• Breaking Down Components Into Assessable Units
• Identifying Which IMC to Assess
• Non-Financial Process Activities for Success
• Component Heads Required to Provide Separate
  Assurance on Financial Reporting in addition to
  Non-Financial
• FY 2008 DoD Statement of Assurance Results
• FY 2008 Statement of Assurance Scorecard Results
• What to Expect in FY 2009 and Beyond

3
What Are Internal Management Controls?

• Mechanisms, techniques, or processes that help
  ensure mission objectives met or help mitigate
  the risk that a material adverse affect could
  occur
• Three objectives of internal controls
• Effective and efficient operations
• Reliable financial reporting
• Compliance with applicable laws and regulations

4
What Are Internal Management Controls? (cont)

• Effective internal management controls
• Do not guarantee success of
• program, or ensure against waste,
• fraud, or mismanagement, but
• mitigate RISK

Remember that the costs of controls must be
relative to the importance and risk associated
with a given program!
5
What Can Happen If Internal Management Controls
Are Ineffective?
Pilots checklists for takeoff, flight, before
landing, and after landing became standard
procedure after the 1935 crash of the Boeing
Model 299 (predecessor to the famous Flying
Fortress, B-17). Pilots got together after the
accident and decided that the new aircraft Model
299 was not too much airplane for one man to
fly, but more than one man could remember
without help. Checklists help compensate for the
weaknesses of human memory to help ensure
consistency and completeness in accomplishing a
mission.
6
Check It Campaign Used to CommunicateImportance
of Internal Management Controls
Winner of the FY 2008 Silver Anvil Award
3 billion in reported savings

• Campaign purpose -- Raise awareness on the
  importance of effective internal
  management controls
• Targeted all DoD Personnel
• Campaign overall message WE COUNT ON YOU TO DO
  THE JOB RIGHT!
• Core Messages
• The Departments mission cannot be accomplished
  by warfighters alone
• Everyone has a job to do, and every job is
  important
• Internal Management Controls ensure that what
  should happen, does happen every day, but they
  must be in place, effective, and used
• Slogan CHECK IT. WHAT GETS CHECKED, GETS DONE!
• Phase One year-long awareness campaign completed
  Aug 2007
• Phase Two recognition for best process
  improvement ends Dec 2008

7
Check It Campaign Used to CommunicateImportance
of Internal Management Controls (cont)
8
What Requires DoD Have Programmatic Approach to
Internal Management Controls
Federal Financial Managers Integrity Act
Office of Management and Budget Require

• Managers of Federal Agencies will
• Establish an effective system of internal
  controls (all functions)
• Assess the effectiveness of internal controls
• Annually report assurance
• Identifying material weaknesses
• Describing plan and schedule for correcting
• Types of assurance

• (Unqualified) I am able to provide an
  unqualified statement of assurance that the
  internal controls meet the objectives of FMFIA
  overall programs, administrative, and
  operations.
• (Qualified) I am able to provide a qualified
  statement of assurance that the internal controls
  meet the objectives of FMFIA with the exception
  of (number) material weakness(es) described .
• (No Assurance) I am able to provide no
  assurance . (pervasive material weaknesses)

9
How DoD Conducts the Managers Internal Control
ProgramComponents Heads Required to Report
Statements of Assurance to Secretary of Defense

• Secretaries of the Military Departments
• Army, Navy / Marine Corps, and Air Force
• Office of Secretary of Defense (OSD)
• Consolidated OSD Statement of Assurance prepared
  and reported by Director, Administration and
  Management - includes OSD Principal Staff
  Assistants and DoD Field Activities, but not DoD
  Agencies, which report through not to Principal
  Staff Assistants
• Chair Senior Assessment Team, DoD Financial
  Reporting Appendix A
• Director of the Joint Chiefs of Staff
• Commanders of the Combatant Commands
• USAFRICOM, USEUCOM, USTRANSCOM, USNORAD/NORTHCOM,
  USPACOM,
• USSOUTHCOM, USJFCOM, USSOCOM,
  USSTRATCOM, and USCENTCOM
• Commander, Multi-National Forces - Iraq
• Inspector General, Department of Defense
• Directors of DoD Agencies Reporting through
• Under Secretary of Defense (Acquisition,
  Logistics and Technology)
• Defense Advanced Research Projects Agency,
  Defense Contract Management Agency, Defense
  Logistics Agency, Defense Threat Reduction
  Agency, Missile Defense Agency
• Under Secretary of Defense (Policy) Defense
  Security Cooperation Agency
• Under Secretary of Defense (Comptroller)
• Defense Finance and Accounting Service and
  Defense Contract Audit Agency
• Under Secretary of Defense (Personnel and
  Readiness) Defense Commissary Agency
• Under Secretary of Defense (Intelligence)

35 Components in FY 2009
10
How DoD Conducts the Managers Internal Control
Program (cont)Breaking Down Components Into
Assessable Units
LEADERSHIP
PROGRAM EXECUTION
Partnership Pyramid
DoD Managers Internal Control (MIC) Program
Manager
Secretary of Defense
35 DoD Component Heads
DoD Component MIC Program Manager
Assessable Unit Managers MIC Program Manager
Assessable Unit Managers
Sub-Assessable Unit Managers MIC Program Manager
Sub-Assessable Unit Managers
Sub-Assessable Unit Managers MIC Program Manager
Sub-Assessable Unit Managers
Assessable Units Organizational reporting
units Each DoD Component must report 100 of
assessable units Assessable Unit Manager must
assign adequately trained MICP Program Manager
11
How DoD Conducts the Managers Internal Control
Program (cont) Identifying Which IMC to Assess
MICP Assessments Must Consider All Mission
Essential Functions
OMB A-123


Supply
Mfg, Maint, Repair
Property Mgmt
Force Readiness
Commo, Intel Secur
Contract Admin
Info Tech
Procurement
Personnel Org
Major System Acq
Comptroller RM
RDTE
Security Assist
DoD Senior Assessment Team
Support Svcs
FMFIA Over Financial Reporting
Which function? It Depends!
Appendix A
12
Non-Financial Process Activities for Success

• 1) Determine core business.
• What Does Your Organization Primarily Do?
• Example Dental Clinic
• 2) Make a list of mission essential functions /
  products or outputs
• Whats Your Organizations Products?
• Example Exams, Fillings, Cleaning Teething,
  Preparing Dental Crowns
• 3) Decide which process to assess for internal
  management controls and draw a flowchart.
• What mission essential function / product /
  process to flowchart?
• Example Preparing Dental Crowns

Dentist Sends Mold / X-ray to Lab
Lab Receives Mold X-rays from Dentist
Lab builds crown
BEGIN
Dentist X-rays Patients Tooth
Dentist Crowns Tooth
Lab Sends Crown / Mold X-ray Back to Dentist
Dentist Preps Tooth
Dentist Makes Dental Mold
End
Dental Clinic
Dental Laboratory
13
Non-Financial Process Activities for Success
Dentist Sends Mold / X-ray to Lab
Lab Receives Mold X-rays from Dentist
Lab builds crown
BEGIN
Dentist X-rays Patients Tooth
Dentist Crowns Tooth
Lab Sends Crown / Mold X-ray Back to Dentist
Dentist Makes Mold
Dentist Preps Tooth
End
Dental Clinic
Dental Laboratory
RISK

• 4) Determine where the RISK exists in the
  process.
• Does your process involve transferring functions
  to other organizations for work?
• Example Work sent to laboratory for
  crown preparation
• 5) Identify internal management controls that
  currently exist to mitigate any risk
• What is in place to ensure the right crown is
  sent back for the right patient with correct fit?
• Example Patients x-rays and dental mold
  transferred to laboratory

14
Non-Financial Process Activities for Success

• 6) Determine if existing inspection or audit
  will test key controls. If so, use those results
  and DOCUMENT.
• 7) If not, test and DOCUMENT.
• What test is being used?
• Example File review of remake log which
  captures all relevant data of crown(s) remade
• due to improper fit
• 8) Determine tolerance that is acceptable.
• What percentage of error is acceptable?
• Example 3 percent error rate is acceptable
• 9) When errors found that exceed tolerance
  level, determine if problem is a deficiency,
  significant
• deficiency or material weakness.
• Was the error found frequent or of great
  magnitude, and to what degree?
• Example 10 percent error rate found for FY 2008

• If problem considered deficiency or significant
  deficiency, track in house and do not report in
  the
• Statement of Assurance (SOA).

15
Non-Financial Process Activities for Success

• 11) If considered material weakness, use TAB B
  format in the FY 2009 Guidance for the
  Preparation of the Statement of Assurance (SOA)
  for corrective actions, and report in the SOA.
• 12) Prepare corrective actions and project
  realistic corrective target date. Promptly
  resolve.
• What should be done to correct the problem?
• Example 1st Qtr, FY 2009
  -- Conduct a trend analysis to determine
  root cause of errors.
• 2nd Qtr, FY 2009 -- Prepare plan
  of action and obtain approval.
• 4th Qtr,
  FY 2009 -- Implement plan.
• 2nd Qtr, FY 2010 -- Verify
  that the weakness is corrected.
• Determine level of assurance for non-financial
  operations (Unqualified, Qualified, or No
  Assurance)
• 14) Complete SOA, brief leadership, and obtain
  HEAD or PRINCIPAL DEPUTYs signature.

Continuous Monitoring, supplemented by periodic
assessments must be documented and maintained in
enough detail to support managements assertion
as to the effectiveness of internal controls.
16
How DoD Conducts the Managers Internal Control
ProgramComponent Heads Required to Provide
Separate Assurance on Financial Reporting in
addition to Non-Financial

• Secretaries of the Military Departments
• Army (General Fund, Working Capital Fund,
  and Corps of Engineers)
• Navy (General Fund and Working Capital
  Fund) Marine Corps (General Fund)
• Air Force (General Fund and Working
  Capital Fund)
• Office of Secretary of Defense (OSD)
• Under Secretary of Defense (Comptroller)
  DoD-wide Compilation
• Military Retirement Trust Fund
• Medicare Eligible Retirement Health Care
  Fund
• Defense Health Program (Service Medical
  Activity Tricare Management Activity)
• Chemical Biological and Defense Program
  
• Commanders of the Combatant Commands US Special
  Operations Command (General Fund)
• Inspector General, Department of Defense
  (General Fund)
• Directors of the DoD Agencies
• Defense Advanced Research Projects Agency
  (General Fund), Defense Commissary Agency
• (General Fund and Working Capital Fund),
  Defense Contract Audit Agency (General Fund),
• Defense Finance and Accounting Service
  (General Fund and Working Capital Fund), Defense
• Information Systems Agency (General Fund
  and Working Capital Fund), Defense Intelligence
• Agency (General Fund), Defense Logistics
  Agency (General Fund and Working Capital Fund),
• Defense Security Service (General Fund),
  Defense Threat Reduction Agency (General Fund),

17
FY 2008 DoD Statement of Assurance Results
Safeguarding the Taxpayer Dollar
Internal Control Weaknesses
Strong internal controls prevent waste, fraud and
abuse
18
Statement of AssuranceFY 2008 Winners Circle

• First Place
• United States Transportation Command
• Second Place
• Defense Finance and Accounting Service
• Defense Information Systems Agency
• Department of the Air Force
• Department of the Army
• Office of the Secretary of Defense
• (OSD Principal Staff and DoD Field
  Activities)
• Third Place
• Defense Commissary Agency
• Fourth Place
• Defense Contract Management Agency
• Defense Logistics Agency
• Department of Defense Financial Reporting
• Joint Staff
• Missile Defense Agency
• Multi-National Forces Iraq

19
FY 2008 Statement of Assurance Scorecard
Examples of Scoring
20
What to Expect in FY 2009 and Beyond

• Revision of the DoD Instruction 5010.40,
  Managers Internal Control Program (MICP)
  Procedures in FY 2009 requiring
• Assessable Unit Managers to assign adequately
  training MICP program managers
• Only the DoD Components currently required to
  provide separate level of assurance on internal
  controls over financial reporting.to report an
  additional level of assurance on financial system
  conformance with Federally mandated requirements
  of the Federal Financial Management Improvement
  Act of 1996

21
Summary

• Establishing effective controls helps prevent
• Fraud, waste or abuse
• Accidents
• Unauthorized access to information or systems
• Mission failure
• Negative publicity
• Pilferage
• Effective internal controls help leaders become
  more confident (assured) that things are
  happening as they should

22
Internal Control References

• DoD Managers Internal Control Program and Check
  It Campaign References
• DoD Comptroller Website http//www.defenselink.mi
  l/comptroller/micp.html
• Federal Managers Financial Integrity Act of 1982
  (PL 97-255)
• GAO Standards for Internal Control in the Federal
  Government,
• Nov 1999
• OMB Circular A-123, Managements Responsibility
  for Internal Control,
• Dec 21, 2004
• DoD Instruction 5010.40, Managers Internal
  Control Program Procedures,
• Jan 4, 2006
• FY 2009 Guidance for Preparation of the Statement
  of Assurance,
• Nov 13, 2008
• Guidance for Internal Controls over Financial
  Reporting as Required by the
• OMB A-123, Appendix A, Aug 22, 2008