OSAE sets the PACE ~ Premier Auditing Consulting and Evaluations!

1. Department of Finance2009FinancialIntegrity andState Managers AccountabilityAct (FISMA) OSAE sets the PACE ~ Premier Auditing Consulting and Evaluations!

2. Review Phases • Phase I – Department Wide Risk Assessment • Phase II – Identification of Controls and Control Testing • Phase III – Corrective Action Plan • Phase IV – Subsequent evaluations

3. Phase I Department Wide Risk Assessment

4. Initial Meeting • Executive Management • Principle Functions • Questions related to the Principle Functions • What units are involved to accomplish this function? • How do we do it? • Who’s impacted by the results? • What could go wrong? • Results of the initial meeting – Risk Statements

5. Second Meeting • Word-smithed the Risk Statements • Option Finder • Likelihood • Impact • Heat Map

6. Option Finder Example

7. Phase II Identification of Controls and Control Testing

8. Control Discussion • Executive Management • Go over the Risk Statements • Identify Controls that are in place • Identify Controls that might be implemented • Complete the Risk and Control Matrix Risk and Control Matrix1.xls

9. Testing of Controls • Tested a sample controls to ensure they were working as intended. • Revisited the heat map. • Complete the Risk and Control Matrix Risk and Control Matrix2.xls

10. Phase IIICorrective Action • Executive Management’s responsibility • 30 day deadline • 6 month deadline

11. Phase IVSubsequent Evaluations • Continuous Process • Interim Evaluations • Re-evaluation of Risks and Controls • Lower Level Risk Assessments