Short answer: OMB Circular A-123 sets out federal agency management’s responsibility for internal control. An A-123 review tests whether an agency’s controls over operations, reporting and compliance are designed well and working as intended, documents any deficiencies, and supports the annual assurance statement the agency head signs.
Where A-123 comes from
The Federal Managers’ Financial Integrity Act (FMFIA) requires agency heads to evaluate their internal control every year and report on it. OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, is the guidance that tells agencies how to do it. Its 2016 revision tied internal control to enterprise risk management, so controls are judged against the risks that matter most to the mission.
The benchmark for what “good” looks like is the Government Accountability Office’s Standards for Internal Control in the Federal Government, known as the Green Book. It organizes internal control into five components: control environment, risk assessment, control activities, information and communication, and monitoring.
What the appendices cover
- Appendix A focuses on internal control over reporting, including financial reporting.
- Appendix B covers charge card programs.
- Appendix C addresses payment integrity. Its current guidance is issued as OMB memorandum M-21-19.
- Appendix D relates to compliance with the Federal Financial Management Improvement Act (FFMIA).
How a review usually runs
- Scoping. Identify the processes, systems and locations that are material to the agency’s reporting and mission.
- Risk assessment. Rate what could go wrong in each process and how likely and serious it would be.
- Documentation. Map each process and the key controls that address its risks, often as narratives, flowcharts and a risk and control matrix.
- Testing. Test whether each key control is designed effectively and whether it actually operated during the period, using samples and evidence.
- Evaluation. Classify any deficiencies by severity, from control deficiency through significant deficiency to material weakness.
- Corrective action. Agree corrective action plans with owners and dates, and follow up until they’re closed.
What the agency gets
A clear picture of which controls work, which don’t and why, and evidence to support the FMFIA assurance statement. Done well, an A-123 program also makes the financial statement audit smoother, because auditors can rely on controls that management has already documented and tested.
Common pitfalls
- Treating A-123 as a once-a-year paperwork exercise instead of ongoing monitoring.
- Documenting controls that exist on paper but aren’t performed consistently.
- Leaving IT general controls out of scope when key reports come from systems.
- Corrective action plans without owners, dates or follow-up.
This article is a general overview for information only. It isn't legal, tax or accounting advice for your situation — talk to us about yours.