Board Report: 2013-AE-B-013 September 5, 2013
We found that the Board's divisions have processes for establishing administrative internal control that are tailored to their specific responsibilities. These controls generally utilize best practices and are designed to increase efficiency and react to changing environments. A few of the divisions' functional areas formally maintain and monitor their controls. However, the Board's processes for maintaining and monitoring these internal controls can be enhanced. Specifically, we found that the Board does not have an agency-wide process for maintaining, monitoring, and reporting on its administrative internal control. Although the Board is not subject to FMFIA, the Board decided to voluntarily comply with the spirit and intent of FMFIA. The Board's approach to addressing the provisions of FMFIA does not require management to assess and monitor administrative internal control. GAO has emphasized the benefits of internal control, and during our audit we performed benchmarking against other independent agencies that voluntarily follow FMFIA as a best practice. We believe that an agency-wide process that maintains, monitors, and reports on administrative internal control can assist the Board in effectively and efficiently achieving its mission, goals, and objectives, as well as address organizational challenges outlined in the Board's 2012–2015 strategic framework.
During our audit, we found that the Board's functional areas have processes for establishing internal control. The types of internal controls implemented differ by functional area because they are tailored to their specific responsibilities. For example, we found that some functional areas have implemented automated processes to increase efficiency while others have documented their procedures to ensure consistency as environments may change. In general, we found that functional areas developed their internal controls as they recognized the need to mitigate risks.
Although the Board's divisions have processes for establishing internal controls, we found that the Board does not have an agency-wide process for maintaining, monitoring, and reporting on administrative internal control. A few of the divisions' functional areas do formally maintain and monitor their controls through regular updates to policies and procedures, continuous evaluation of a process, or internal business reviews. For example, functional areas in multiple divisions that are responsible for providing economic analyses to support monetary policy decisionmaking have created a committee to periodically review their process and ensure that it is up-to-date. Other functional areas have set schedules for reviewing their procedures to ensure they are up-to-date. Some of these functional areas maintain and monitor their controls because they are reviewed periodically by outside agencies. Two of these functional areas perform and submit self-assessments to those outside agencies. However, we found that the majority of the functional areas do not formally maintain and monitor their administrative internal controls. The functional areas that do not maintain and monitor their administrative internal controls update them on an as-needed basis, such as when a process changes or new guidance is issued, rather than as a result of monitoring.
In a series of correspondence from 1983 to 1988, the Board stated its intent to comply with the spirit and intent of FMFIA. Since that time, the Board's approach to addressing the provisions of FMFIA has relied on work already being conducted, such as the examination of the Board's financial statements by independent auditors as well as independent reviews by the OIG and GAO. In addition, the Board stated that its approach to meeting the reporting provisions of FMFIA is through reports the Board provides to Congress, such as the Board's annual report and the OIG's semiannual reports. However, this approach does not require any action by the Board's divisions and does not include maintaining, monitoring, and reporting on administrative internal control.
FMFIA guidance states that management has primary responsibility for assessing and monitoring controls associated within their programs and should use other sources as a supplement to, not a replacement for, its own judgment when assessing and reporting on internal control. The guidance also states that continuous monitoring and other periodic assessments should provide the basis for the agency's assessment of its internal control. Therefore, although the OIG and GAO perform independent reviews of the Board's programs and operations, their reports should not replace Board management's own judgment for assessing and reporting on administrative internal control.
GAO has emphasized the benefits of internal control. GAO monitored and reported on initial FMFIA implementation efforts across the government in a series of reports as well as in numerous reports targeting specific agencies and programs. Specifically, GAO reported that agencies noted moderate or better senior management support for a strong internal control review process and for reporting weaknesses identified and making the needed improvements as a result of implementing FMFIA. GAO also reported that federal managers generally perceived that positive impacts, such as improved internal control and program efficiency and effectiveness, have resulted from FMFIA. In February 2005, GAO testified before Congress that controls at agencies had improved and that agencies had implemented logical, cohesive, and coordinated agency-wide approaches to identifying and correcting internal control problems.
During our benchmarking, we met with management at one executive agency that is required to comply with FMFIA (Agency 1) and two independent agencies that voluntarily follow FMFIA as a best practice (Agency 2 and Agency 3).5 Management from Agencies 2 and 3 stated to us that they recognize the importance of internal control and therefore decided to follow FMFIA. Both of the agencies stated that accountability was recognized as one of the benefits of following FMFIA. Agency 2 also stated that its FMFIA process allows business units to proactively focus on their areas of highest risk.
We found only minor differences in the approach of the agency required to comply with FMFIA as compared with the agencies that voluntarily follow FMFIA. Specifically, we found that all three agencies have developed an agency-wide process for evaluating and reporting on internal control. For example, all three agencies have designated officials responsible for FMFIA compliance at the agency level. Within these agencies, each business unit performs internal control reviews and provides an assurance statement to the head of the agency concerning the adequacy of their internal control, including deficiencies identified during their assessments. In addition, using the assurance statements provided by the business units, the heads of each of the three agencies publicly issue a consolidated assurance statement on the adequacy of the agency's internal control. One of the agencies that voluntarily follows FMFIA has also implemented a policy for FMFIA compliance and has established a senior oversight council. The other agency stated that it is planning to implement a policy for FMFIA compliance and establish a senior oversight council in the near future. Both agencies placed great emphasis on the importance of educating their staffs regarding internal control.
A comparison of the FMFIA implementation approaches of the benchmarked agencies is in table 1.
Table 1: Benchmarking Summary, FMFIA Section 2a
| FMFIA Implementation | Agency 1 | Agency 2 | Agency 3 |
|---|---|---|---|
| Required to comply with FMFIA | Yes | No | No |
| Designated officials responsible for FMFIA compliance | Yes | Yes | Yes |
| Developed an agency-wide policy regarding FMFIA compliance | Yes | Yes | Nob |
| Established an oversight council | Yes | Yes | Noc |
| Conduct internal control reviews and program evaluations of the business lines | Yes | Yes | Yes |
| Provide an assurance statement concerning the adequacy of business units' internal control to the agency head | Yes | Yes | Yes |
| Include all the deficiencies identified throughout the unit in the assurance letter, which is forwarded to the agency head | Yes | Yes | Yes |
| Publicly issues an annual assurance statement | Yes | Yes | Yes |
Source: OIG compilation of benchmarking results.
aSection 2 of FMFIA deals with accounting and administrative internal controls.
bDuring our interview, agency officials stated that they were planning to develop an agency policy for FMFIA compliance.
cDuring our interview, agency officials stated that they were planning to create an oversight council in the future.
Maintaining and monitoring administrative internal control can help the Board respond to shifting environments and evolving demands and priorities by ensuring that the control activities being used are effective and updated when necessary. While the Board's broad mission of fostering stability, integrity, and efficiency in the nation's monetary, financial, and payment system remains essentially unchanged, the 2007–2009 financial crisis fundamentally changed how the Board operates within its functional disciplines. To address these changes, the Board developed a strategic framework for 2012–2015 that addresses the most critical organizational challenges, such as retaining the right mix of skills and expertise, data governance, and facilities upgrades. As the Board's programs change to meet the strategic framework goals, established control activities can become less effective due to changing conditions. Maintaining and monitoring established control activities to address organizational challenges can help the Board ensure that the internal controls implemented are adequately designed and continue to work over time and that control failures and risks are identified, corrected, and mitigated on a timely basis.
We believe that an agency-wide process for maintaining, monitoring, and reporting on internal control can assist the Board in achieving its mission, goals, and objectives; lead to organizational efficiencies; and help avoid and address potential and actual problems that might prevent the Board from carrying out its mission effectively and efficiently or complying with laws and regulations. Prior OIG work products have identified internal control weaknesses at the Board, including noncompliance with policies and procedures, inadequate access control, and the premature release of confidential information. Although these internal control weaknesses did not prevent the Board from carrying out its mission or achieving its strategic objectives, they introduced operational and reputational risks. An agency-wide process for maintaining and monitoring administrative internal control can allow the Board to (1) identify and prevent or correct internal control weaknesses in a timely manner; (2) reduce costs because problems are identified and addressed in a proactive, rather than reactive, manner; (3) produce more accurate and reliable information for use in decisionmaking; and (4) provide periodic assertions on the effectiveness of internal control.
Recognizing the importance of FMFIA, the Board decided to voluntarily comply with the spirit and intent of the legislation. However, the Board's approach to FMFIA compliance does not include an agency-wide process for evaluating and reporting on administrative internal control. During our benchmarking, we found that other agencies that are not required to follow FMFIA have developed an agency-wide process for evaluating and reporting on administrative internal control. Maintaining and monitoring administrative internal control can provide management with reasonable assurance that the Board is effectively and efficiently achieving its mission, goals, and objectives and complying with laws and regulations. We believe an agency-wide approach that more closely follows and addresses the spirit and intent of FMFIA would allow the Board to maximize the benefit from its internal control and could contribute to the Board's ongoing commitment to accountability and effective and efficient operations.
We recommend that the Chief Operating Officer
Regarding our recommendation, the Board's Chief Operating Officer (COO) stated the following:
Concur with the recommendation's intent. We agree that effectively establishing, maintaining, and monitoring administrative internal controls can assist the Board in achieving its goals and objectives and in complying with laws and regulations. We also agree that there are opportunities to enhance our current practices related to administrative internal controls. To that end, we have already implemented, or are in the process of implementing, several enhanced administrative processes. For example, we are establishing within the Division of Financial Management a central tracking point for all audit, inspection, evaluation, or other similar reports pertaining to any Board functional area. This will allow us to better monitor findings across the organization and identify trends and opportunities to more broadly strengthen administrative internal controls. We have also established a comprehensive process for regularly reviewing and updating all of our management policies to ensure that the policies and the underlying practices and associated controls remain up-to-date; I receive regular reports on the status of this activity.
The audit report notes that shortly after FMFIA was enacted, as well as in later correspondence in 1984 and 1988, staff recommended that the Board comply with the spirit and intent of FMFIA. It is unclear, however, from this correspondence whether the Board officially adopted this recommendation or exactly what staff intended in establishing a FMFIA-compliant program. Given the priorities and budgetary constraints underlying the Board's new strategic framework, we believe that creating additional infrastructure to develop and implement policies and processes, to include developing a training program, must be carefully balanced with other competing resource priorities. We will evaluate whether, and in what form, an agency-wide framework makes sense and coordinate with the Executive Committee of the Board to implement any additional requirements.
The COO acknowledged that there are opportunities to enhance the Board's current practices related to administrative internal controls and provided two examples of enhancements that have been implemented or are in the process of being implemented. The COO stated that the Board has established a comprehensive process for regularly reviewing and updating all management policies. We agree that this is a method of maintaining and monitoring internal control over those management policies; however, this process addresses only one of the Board's functions. We believe that this is a good example of a method by which other functional areas in other divisions can keep their policies and procedures up to date. In addition, the COO stated that the Division of Financial Management is establishing a central tracking point for all audit, inspection, evaluation, and other similar reports. While a tracking system will assist the Board in monitoring the areas that have been reviewed by others, FMFIA and COSO guidance state that management should continually assess and evaluate internal control and should use other sources as a supplement to, not as a replacement for, its own judgment when assessing and reporting on internal control.
The COO also stated in his response that it is unclear whether the Board officially adopted a staff recommendation included in the correspondence from the 1980s to comply with the spirit and intent of FMFIA. Further, the COO stated in his response that it is unclear what the staff recommendation intended regarding the establishment of a FMFIA-compliant program. While we did not find evidence that the Board officially adopted a staff recommendation to comply with the spirit and intent of FMFIA, correspondence from the 1980s from the Vice Chairman of the Board and others indicate support for complying with the spirit and intent of FMFIA.
Concerning our audit recommendation, the COO stated that implementing policies and processes, to include developing a training program, must be balanced with other competing resource priorities as detailed in the Board's new strategic framework. He plans to evaluate whether, and in what form, an agency-wide framework makes sense and coordinate with the Executive Committee of the Board to implement any additional requirements. We recognize that the Board has priorities and resource constraints, but we believe that an agency-wide process for maintaining and monitoring administrative internal control can help the Board manage changes that may result from implementing the strategic framework and further the Board's goal of increasing the efficiencies of its operations. As we stated in our report, change can decrease the effectiveness of the Board's control activities. Therefore, maintaining and monitoring established control activities to address organizational challenges can help the Board ensure that the internal controls implemented are adequately designed and continue to work over time and that control failures and risks are identified, corrected, and mitigated in a timely manner. Based on our benchmarking and the emphasis on the benefits of internal control throughout the federal government, we strongly believe it is in the Board's best interest to more closely follow the spirit and intent of FMFIA.
The Inspector General Act, as amended, requires that we report in our Semiannual Report to Congress on recommendations for which no management decision has been made. The act defines a management decision as the issuance of a final decision by management concerning its response to audit findings and recommendations, including actions concluded to be necessary. Since the COO's response indicated that he had not yet determined the final actions he would take to address our report's findings, we are requesting that he provide us within 90 calendar days a final management decision describing the actions taken or planned to address our recommendation.
