SLIDE 4 12/14/2018 4
A-123, Appendix A Update Background
7
- Agencies need to provide reasonable assurances that correct information is reported, both
internally to drive informed, risk-based decisions, and externally, for accurate, transparent reporting to the public.
- In 2016, OMB issued A-123 Management’s Responsibility for Enterprise Risk Management and
Internal Controls. The updated guidance requires agencies to adopt a risk-based approach towards achieving their strategic, operations, compliance and reporting objectives.
- Agencies are already doing some form of internal control and risk management over reporting.
One of the goals is to update Appendix A of A-123 to integrate those efforts with A-123 enterprise risk management efforts, including the development and improvement of agency risk profiles, and integration with the FMFIA assurance statement processes for internal control.
- Another goal is to update Appendix A to capitalize on ERM as a management tool to provide
solutions that go beyond just internal controls when developing performance, budgetary, and strategic responses to risk.
Back to Management Controls
8
A-123 from the 1980’s and 1990’s described internal controls as including controls over programs and required agencies to provide reasonable assurance over the safeguarding of “government resources” and “assets”, not just limited to “funds.” A-123 from 1995 described internal controls as “Management Controls” The 2016 update to A-123 seeks to bring back the focus to internal controls beyond just financial controls. The 2018 update to Appendix A seeks to bring the focus from Internal Control over Financial Reporting (ICOFR) back to Internal Control over Reporting (ICOR).
7 8
