Internal Control Efforts at USDA

1
Internal Control Efforts at USDA

• Presented byMichael A. Fiene

2
Agenda/Efforts

• OCFOs Internal Control Division
• IT Executive Steering Committee
• Internal Control Boot Camp
• Risk Assessment Methodology
• CSAM
• Other Internal Control Efforts

3
Internal Control Efforts at the Fiene House
4
(No Transcript)
5
Keys to a Self-Sustaining IC Program

• Education/Training
• Communication
• Automated Compliance Tools
• Streamline Consolidate Reviews
• Offices of Control Compliance (OCCO)

6
OCFOs Internal Control Division (ICD)
7
OCFO-ICD Mission Statement

• To promote and support the USDAs internal
  control program in order to provide reasonable
  assurance that
• USDA operations are effective efficient
• USDA complies with applicable laws and
  regulations
• USDA financial reports are reliable

8
What Does OCFO-ICD Do?

• Review and monitor USDA operations systems
• Assist/coach USDA and its agencies in their
  internal control efforts
• Promote effective internal control practices in
  order to support audits
• Provide training and facilitate communication

9
OCFO-ICD Staff

• Michael A. Fiene, Director
• Ronda F. Price, Deputy Director, Financial
  Control Specialist
• Patricia Price, Administrative Control Specialist
• Fiscal Control Specialist (IS) (Vacant)
• 3 positions (vacant)

10
IT Executive Steering Committee (IT-ESC)
11
IT-ESC

• Established by Chuck Christopherson, November,
  2006
• Joint OCFO and OCIO effort to address the ongoing
  IT material weakness and provide leadership and
  direction
• Co-Chaired by Jon Holladay, Deputy CFO and Chris
  Smith, Deputy CIO
• Meet every Thursday

12
IT-ESC

• 16 agencies brief the IT-ESC
• Seek common solutions to common problems
• Results
• Joint CIO/CFO meetings (Monthly)
• Communication
• I/C Bootcamp
• CSAM
• Risk Assessment Methodology

13
USDA Internal Control Boot Camp
14
Internal Control Boot Camp
In the first three years of Sarbanes-Oxley,
companies have under-invested in staff training
and technology (e.g. automated compliance tools)
to support cost-effective compliance and theyve
over-invested in outside consultants. Source
Journal of Accountancy, July, 2006
15
Internal Control Boot Camp
Question What are the key qualities to look for
in a high-performing internal auditor? Does a
CPA help? Answer A key quality is having
invested the time and resources to be fully
conversant with all internal control guidance.
This allows him or her to have fact-based
debates with their external auditor over how to
meet internal control requirements
cost-effectively. Source Journal of
Accountancy, July, 2006
16
Internal Control Boot Camp

• Topics Covered
• Internal Control Laws Regs
• CSAM
• Internal Controls IT Track
• Internal Controls Financial Track
• Evaluating the Severity of Control Deficiencies
• Corrective Action Plans (Root Cause)

17
Internal Control Boot Camp

• Objective
• Provide a better understanding of audit and
  internal control concepts to USDA professionals
  who have not had any recent audit experience or
  who have never been auditors in their
  professional careers.
• First Boot Camp
• Kansas City, Missouri, February 11 15, 2008
• 70 Participants (40 IT, 30 Financial)
• 20 USDA Agencies Represented
• Future Boot Camps
• Washington, DC
• St. Louis, MO
• New Orleans, LA

18
Risk Assessment Methodology
19
Risk Assessment Methodology/Framework
20
Risk Assessment Workshops (August, 2008)

• Washington, DC
• Kansas City, MO
• St. Louis, MO
• New Orleans, LA
• Albuquerque, NM

21
Cyber Security Assessment and Management System
(CSAM)
22
CSAM
23
CSAM

• Allows for transparency of systems and controls
• Upload supporting documents/artifacts
• Customizable
• Flexible reporting
• Use for A-123, Appendix A assessment of
  financial/process controls.

24
Other Internal Control Efforts at USDA
25
Other Internal Control Efforts

• A-123, Appendix A assessment over FFATA data
• Combine required internal control
  reviews/assessments (FMFIA, FFMIA, FISMA, etc.)
• Streamline required internal control
  reviews/assessments (ongoing monitoring)
• Establish Office of Control and Compliance at
  each agency

26
Internal Control Compliance
27
(No Transcript)