NAF Internal Controls MG Robert M Joyce School

NAF Internal Controls MG Robert M. Joyce School for Family and MWR

Meet your School for Family and MWR Training Team! James Moore Matt Jobe

Introductions Name What do you do for Family and MWR? How many years have you worked with Family and MWR?

Policies and Procedures Attendance ◦ ◦ Class time is 0800 -1700 You must attend every session to receive credit for the course (AM & PM) Failure to meet this requirement will result in an incomplete Cannot miss more than 5% of class to earn credit Breaks ◦ Lunch- 1 hour ◦ Breaks- 2 per day (AM & PM) Classroom Expectations ◦ ◦ ◦ Be on time for class and returning from breaks Actively participate in group discussions and exercises Complete all assignments Respect your fellow participants Place cell phones on silent or vibrate

Syllabus and Information Syllabus • Agenda • Graded Assignments • Course Credit • 0. 7 CEUs • 1 college semester hour in financial internal control and auditing Participant Guide • Helpful for taking notes • Assignment Instructions Mobile Training Documents (electronic) • https: //www. imcomacademy. com/ima/? page_id=11999 Corrective Action Plan

Expectations

Course Objective Given the General Accountability Office (GAO) framework for Internal Controls, learners should be able to analyze the five standards and apply the standards to daily operations to ensure reasonable control over their area of responsibility.

Five Standards of Internal Controls Ø Information & Communication Ø Control Environment Ø Risk Assessment Ø Control Activities Ø Monitoring

IC Brainstorm At your groups, please identify one (1) or more reasons we have internal controls.

Module 1 NAF Internal Controls in the Operational Environment

Module 1 Objectives q Explore the roles and responsibilities associated with Internal Controls and established monitoring plan. q Identify breakdowns in internal controls, impacts and possible mitigating responses. q Relate each standard of internal controls to the operational environment. q Given the 5 step Risk Assessment process, apply to determine level of risk.

Five Standards of Internal Controls Ø Information & Communication Ø Control Environment Ø Risk Assessment Ø Control Activities Ø Monitoring

Roles & Responsibilities • Senior Responsible Official (SRO) • The SRO is the Director of the Directorate that the Internal Control function falls under. • Assessable Unit Managers (AUM) • The AUM is the military or civilian head of an assessable unit. • Internal Control Administrator (ICA) • The ICA is the individual designated by the SRO to administer the MICP for a reporting organization.

Roles & Responsibilities POSITION HQ IMCOM ROLE SRO ID Director Senior Commander Garrison Commander AUM DFMWR Division Chief Program Manager ICA

Roles & Responsibilities Where does the Management Internal Control Program (MICP) fit in with my roles/responsibilities as a Family and MWR Program Manager? • Follow guidance provided by your local ICA • Complete training for your level within the MICP AUM (usually Director and Garrison Commander), ICA/Alt ICA (appointed by Director/Garrison Commander), Evaluators (usually division chiefs), and Managers • What else?

Conducting An Analysis - Scenario

Group Instructions Ø Using the scenario, answer the questions. § What is your impression of the Bowling Center program in this scenario? § Is there anything you would change within the Bowling Center program? § Who should Bob have contacted? § Identify possible areas for fraud, waste, and abuse. Ø Choose someone to scribe on the chart paper. Ø Choose someone to brief the large group.

What Are Internal Controls? Ø A process effected by an organization’s people, designed to provide Reasonable Assurance in reliability of financial reporting, compliance with laws and regulations, and effective and efficient operations. Ø A control is any technique, tool, device, check or balance in our every day work - designed to ensure what should happen does happen; what shouldn’t happen, doesn’t happen. We have controls throughout our daily lives. We just don’t think about them. Sometimes we institute them from hard lessons learned.

Why Are Internal Controls Important? Ø Internal Controls are part of effective management. Ø Internal Controls ensure: - Accurate and Reliable Information - Compliance with Laws & Policies - Safeguarding of Resources - Economical & Efficient Use of Resources - Safety of Operations

Internal Control Objectives Ø Reliability of financial reporting - Accountability Ø Compliance with Laws and Regulations - Compliance Ø Effectiveness/Efficiency of Operations - Effective/Efficient

Reasonable Assurance Ø An acceptable degree of confidence in the general reliability of internal controls to deter or detect material failures in complying with the Federal Manager’s Financial Integrity Act (FMFIA) objectives.

Reasonable Assurance ØThe determination of reasonable assurance is a subjective management judgment based on “confidence that internal controls are adequate and operating as intended. ” ü Strive for “reasonable” assurance, not absolute assurance. ü Adjust over time from lessons learned and in response to a changing environment. Ø Recognizes acceptable levels of risk exists that cannot be avoided because the cost of absolute control exceeds the benefits derived.

The “Goldilocks” Principle ◦ OVERKILL: Armed escort for all employees during movement through IMCOM installations. ◦ REASONABLE ACTION: Fulltime guard at entrances; screening IDs and visitor badges. ◦ INSUFFICIENT ACTION: No guards at entrances; no screening process.

Control Environment What do I do to ensure a “controlled environment” is in place?

Risk Management Ø WHAT IS IT? Risk Management is the process of evaluating the risks in a functional area based on the key internal controls that are in place. - Specifically, risk assessment is measuring two quantities of the risk, the magnitude of the potential loss, and the probability that the loss will occur. In addition, the key internal controls employed to reduce risk should not exceed the benefits derived. Ø THE MYTH: Risk Assessment must ALWAYS be long and complex. Ø THE REALITY: On its own, paperwork never saved anyone. It is a means to an end, not an end in itself - Action is what protects people. Risk assessments should be fit for purpose and acted upon.

Risk Assessment (1) IDENTIFY (5) MONITOR (2) ANALYZE ASSESS (4) IMPLEMENT (3) DEVELOP DECIDE

Risk Assessment (1) IDENTIFY Ø Identify Risks - Identify Objectives - Internal Factors - External Factors - Factors that contribute to increase the risk to agency is exposed Ø Analyze - Day to Day management of activities - Potential for Loss - Risk during change (5) MONITOR (2) ANALYZE ASSESS (4) IMPLEMENT (3) DEVELOP DECIDE Ø Assess - Rank using any qualitative or quantitative method - Analysis of estimating risks impact - Analysis of risk’s likelihood Ø Develop/Decide - What controls should be in place to mitigate the risk identified.

Risk Assessment - Exercise Risk Assessment Matrix Probability Severity Frequent A Likely B Occasional C Seldom D Unlikely E Catastrophic I E E H H M Critical II E H H M L Marginal III H M M L L Negligible IV M L L E – Extremely High Risk H – High Risk M – Moderate Risk L – Low Risk

Deliberate Risk Assessment Worksheet (DD Form 2977)

Assignment: DD Form 2977 Exercise Conduct a Risk Assessment of your cash management process (if you don’t have a cash management process, please use the scenario) ◦ Complete the form individually Brief your DD Form 2977 to your group ◦ Provide feedback to each individual ◦ Update form accordingly Turn in your completed/updated form to the instructors

Module 2 Managing Internal Controls through “Reasonable Control”

Objectives Ø Identify and categorize the operational elements that require internal controls. Ø Identify drivers that determine need for an internal control. Ø Select the best type of control to meet program objectives. Ø Evaluate implementation of internal control to determine if controls are being used as intended. Ø Evaluate the controls to determine if controls are effective in achieving objectives.

Five Standards of Internal Controls Ø Information & Communication Ø Control Environment Ø Risk Assessment Ø Control Activities Ø Monitoring

CATEGORIES IDENTIFIED RISK FOR LOSS MISSING MONEY CATEGORIES PEOPLE INVENTORY PROPERTY UNSECURED BUILDING FINANCIAL MANAGEMENT EMPLOYEE ABSENCES PROGRAM COMPLIANCE OUTDATED SOPs

TRIGGERS & DRIVERS IDENTIFIED RISK 1. Missing Money IDENTIFIED TRIGGERS • Missing $157. 00 • Two people/One register • Building left unsecured 2. Inventory • Improper inventory tracking • Beginning and End of Month inventory discrepancy • Inventory left unsecured DRIVERS CATEGORY • Financial Management • Laws Regulations Budget • Laws Regulations Local Policies • Program Compliance • Property • Program Compliance • Financial Management • Property

Key Internal Controls Think about the bowling scenario and provide one example of a ‘key internal control’ that should have been in place. What deficiency would this control have prevented?

Control Activities Reviews by Management at the Activity Level Management of Human Capital Information Processing Segregation of Duties

Selecting the Best Control(s) – Group Exercise Instructions Ø Internal Control Process to discuss: Snack Bar Food Inventory Ø Select a control for the food inventory. Ø Answer the following questions § Why did you select this control? § How will you implement this control? § What could be the consequences if you did not have the control(s) in place? Ø Select a scribe to capture your responses on the Chart Paper. Ø Select Spokesperson to out-brief to the large group.

Evaluation of Control Give an example of how to evaluate a control.

Internal Control Evaluation Plan (ICEP) Ø The ICEP documents the required schedule of internal control evaluations. Ø The Internal Control Evaluation should identify the following: § Areas to be evaluated § Year for the evaluation § Official responsible for ensuring the evaluation is conducted

Internal Control Evaluation The evaluation must indicate: Ø Who conducted the evaluation Ø The date the evaluation was conducted Ø The methods used to test key internal controls Ø What weaknesses were detected Ø A deficiency may be a material weakness Ø Corrective actions taken ØWhat form exists to certify this evaluation process?

DA Form 11 -2

How are our Internal Controls evaluated from the Headquarters/IDs or your Garrison Command? Ø DA Form 11 -2 is submitted through the ID to the G 8 at the Headquarters. Signed by your AUM. Ø Site Assistance Visits Ø Audits Ø Organizational Inspection Program (OIP) visits. Ø How else?

Module 3 Evaluating and Monitoring Controls

Objectives Ø Construct a corrective action plan for a material weakness. Ø Given a material weakness, develop a monitoring plan to review internal controls over time. Ø Formulate a Corrective Action & Monitoring Plan to monitor material risks.

Five Standards of Internal Controls Ø Information & Communication Ø Control Environment Ø Risk Assessment Ø Control Activities Ø Monitoring

What is a material weakness? § The absence or ineffectiveness of internal controls that constitutes a deficiency/weakness that must be corrected.

Material Weakness • Criteria: – It must involve a weakness in internal controls (i. e. , not in place, not being used or adequate) – It must warrant the attention of the next level of command (i. e. , the higher level must resolve the problem or be aware of it) • Other factors (must be significant and systemic with one or more risk factors): – Actual or potential loss of resources – Sensitivity of resources involved – Magnitude of funds/property/resources. – Unreliable info that could cause bad decisions – Diminished credibility of Army and/or IMCOM – Impaired mission, injury, death

Corrective Action Plan – Group Exercise Instructions Ø Your table has been assigned one (1) deficiency. MISSING MONEY INVENTORY UNSECURED BUILDING EMPLOYEE ABSENCES OUTDATED SOPs Ø Develop a Corrective Action Plan (CAP) to correct the material weakness/deficiency. § Define the achievable milestones § Prove your control will work (what does success look like) Ø Select a scribe to capture your responses on the chart paper. Ø Select a spokesperson to brief the large group.

Monitoring What is a monitoring? § Observing and checking the progress or quality of (something) over a period of time; keep under systematic review.

Monitoring Plan – Group Exercise Instructions Ø Based on your group’s identified deficiency & corrective action plan develop a Monitoring Plan. Ø The Monitoring Plan should include: § What is being monitored. § How it will be monitored. § When it will be monitored. § Who will be responsible for monitoring. Ø Select a spokesperson to brief the large group.

Corrective Action Plan

Corrective Action Plan- Financial Impact Ø What are some financial impacts of having controls in place? Ø Is there a cost savings? Ø Is it negative or positive? Why? Ø Provide a dollar amount for one month: $_______

Module 4 Corrective Action Plan

Five Standards of Internal Controls Ø Information & Communication Ø Control Environment Ø Risk Assessment Ø Control Activities Ø Monitoring

Individual Assignment: Corrective Action Plan Exercise Ø Identify one (1) deficiency. § Choose one from your program. Ø Develop a Corrective Action Plan (CAP) to correct the material weakness/deficiency. § Complete all sections (1 -9) § Complete the form individually Ø Brief your CAP to your group. § Provide feedback to each individual § Update form accordingly § Each table will choose 1 person to brief their CAP to the large group Ø Turn in your completed/updated form to the instructors.

Corrective Action & Monitoring Plan

Risk Assessment • Identify Breakdowns • Relate Standards to Operational Environment • Determine Level of Risk Evaluation • Identify, Categorize Operational Elements • Identify Drivers • Select Best Control • Evaluate Controls Monitoring • Corrective Action Plan • Monitoring Plan • Roles & Responsibilities Corrective Action Plan • Corrective Action Plan Feedback

Expectations

Survey!

NAF Internal Controls MG Robert M. Joyce School for Family and MWR