Meeting DOE’s OMB Circular A-123 Requirements at Fermilab & Financial Management Assurance

1. Meeting DOE’s OMB Circular A-123 Requirements at Fermilab&Financial Management Assurance Circular A-123: Management's Responsibility for Internal Control Appendix A (Internal Control over Financial Reporting)

2. BACKGROUND A-123: • Defines management’s responsibility for internal control in federal agencies. • Provides guidance to help management improve accountability and effectiveness of operations by maintaining effective internal controls, and assessing, correcting, and reporting on internal controls. • Applies to Fermilab through DOE. The Lab’s financial information and internal controls affect DOE. • First implemented in FY06.

3. BACKGROUND (cont.) Appendix A: • Ensures the Federal Government is committed to safeguarding its assets and providing reliable financial information. • Strengthens the requirements for methods management must use to assess, document, and report on internal control over financial reporting. • Emphasizes the need for agencies to integrate and coordinate internal control assessments with other internal control related activities. • Supports DOE’s requirement of quarterly reporting through DOE’s AART (A-123 Assessment & Reporting Tool).

4. A-123 Requirements • Document risks & controls over financial reporting for processes affecting “material accounts”. • Assess the design effectiveness of the controls, and document the assessment process. • Test the controls as DOE A-123 schedule dictates (A-123 year is July 1 – June 30). • Submit quarterly reports via the AART (A-123 Assessment & Reporting Tool). • Submit a Corrective Action Plan when deficiencies are identified by assessments and testing, and take corrective action.

5. Fermilab A-123 Assessment Statusas of January 2009:

6. 2009 A-123 Activities • Document, assess, and test the Travel Process and Pro-Card Sub-Process. • Cyclical testing of other Sub-Processes (approximately 35 controls) • Testing cycle is 3 years (maximum) • Internal Audit conducts test work • Migrate to new Financial Management Assurance (FMA) Tool – when???

7. 2009 Milestones • January 2009 – 1st Qtr AART due DOE-CH -done • April 2009 – 2nd Qtr AART due DOE-CH - done • June 2009 – Complete 2009 testing • July 2009 – 3rd Qtr AART due DOE-CH • New FMA tool due?? When?? What is FMA – “Financial Management Assurance?

8. Build on A-123,Evolve to a Common Approach Local …. SCIC FFMIA A-123 Leverage Capture Once

9. Certifications • Key Corporate Certifications • A-123, Appendix A (Controls over Financial Reporting) • FMFIA, Section II (Financial Management Controls) • FMFIA Section IV (Financial Management System Controls) • FISMA (Information System Controls) • FMS 2108, Year-end Closing Statement (Ending Balances) • Statement of Costs Incurred and Claimed Certification (Contractor Cost) • Other Certifications / Activities that can be supported • Mgmt. Representation Letter Assurances (Financial Statements) • Subsequent Events Calls (Financial statements) • Support Cost Data Certification • Financial Management System Certifications • Biennnial Pricing Reviews • Letter of Credit Certifications • Erroneous Payment/Recovery Audit Activities • Trial Balance Reconciliations • …….

10. Evolution from A-123 to FMA A-123 only Material Accounts focus Standard Process Cycle / Process Local Sub-processes Local Risks Inherent Risk (Impact / Likelihood) Control Sets …… PERCV Remediation / CAP Detail data capture (Test info, Rationales, Documentation location....) All Key Certifications incl A-123 Compliance and Risk based focus Standard Process Cycle / Process Standard Sub-processes StandardRisks / Local Risks Exposure Risk / Control Effectiveness / Risk Occurrence Controls / Standard Compliance Controls Name of System for Automated Controls No PERCV CAP References / No CAP Tracking in Release 1 Higher level data capture (delegated responsibility to Field / Detail data capture optional) A-123 FMA Targeted to year round use and certifications support

11. FMA Tool as Evolution from AART Controls Process Hierarchy Risks Risk Factors Evaluation Dates (Last, Next) Risk Assessment

12. Implementation Strategy & Timelines What we were told in December • Strategy • Migration timeline from AART to FMA is at the Site’s discretion during FY 2009 • Until a Site has migrated to FMA they continue with the AART and current certification approaches • Sites need to populate the FMA Tool with required data to support certifications • Everyone will be operational on FMA by October 1, 2009

13. FMA – What we know now • Latest Info: • Full rollout of FMA tool in May (previously October 1st) • Office of Internal Review will send out tool, guidance, and timeline “soon” (next week), to be followed by training webinars. • Will have to fill out both tools this year; no due date yet • No automated way to migrate risks & controls from AART to new tool • 192 standard risks identified with ability to add local risks • Risk definitions have changed in FMA; more robust risk analysis in new tool and testing cycles not as rigid • To be continued . . .