Department of the Navy Sustaining the Success! Mike Moreau ASN(FM&C) FMO 27 May 2009

1. Department of the Navy Sustaining the Success! Mike Moreau ASN(FM&C) FMO 27 May 2009

2. Agenda • Guidance • Approach to Internal Control Testing (Goals and Considerations) • Current MIC Process for Certifications • Proposed MIC / ICOFR Process for Certifications • Approach to Internal Control Testing (Roles and Responsibilities) • Command Level Testing Example - BUMED • Summary

3. Guidance… • Federal Managers’ Financial Integrity Act (FMFIA) of 1982 • Requires the establishment of internal accounting and administrative controls • Requires agencies to annually report on the effectiveness of internal controls • OMB Circular No. A-123 (revised 2004) • Provides guidance to managers on establishing and reporting on internal controls • Revised to include “Appendix A”, outlining the responsibility for internal controls over financial reporting (ICOFR) • DoDI 5010.40 Managers’ Internal Control Program Procedures • Outlines two separate processes for annual reporting of control deficiencies: • Over Non-Financial Operations • Over Financial Reporting • SECNAVINST 5200.35E • Provides MIC policy, roles and responsibilities to the DON components • Establishes the DON Senior Assessment Team (SAT)

4. Approach to Internal Control Testing… • Goals • Maintain management’s reasonable assurance for departmental internal controls over financial reporting • Support the preparation of the Annual Statement of Assurance and Quarterly Financial Statement Certifications • Foster accountability for internal controls over financial reporting at the command level • Considerations • Current level of standardized department-level process and controls documentation • Availability of resources at the command and department levels • Value derived at commands from active documentation of financial processes and testing of internal controls

5. DON Statement of Assurance Certification Statements Assertion Packages Three Distinct, but Related, Processes… Senior Assessment Team Certification Over Financial Reporting Certification Over Non-Financial Ops ASN(FM&C) FMO 2 1 3 ASN(FM&C) FMO & NAVAUDSVC DON Financial Improvement Program (FIP) Data / Assertions MAUs Third Party Audit or Inspection Findings

6. MAU Certification Statements MAU Subordinates’ Certification Statements 1. MIC Bottom-Up Self-Reporting… • DON Major Assessable Units (MAUs) report directly to the SECNAV or Under Secretary • Certification statements attest a senior leader’s reasonable assurance that key business process controls are in place and operating effectively • Controls ensure the organization is capable of meeting its mission objectives and providing accurate financial information • Material Weaknesses are those control deficiencies impacting mission capability or accuracy of financial information DON SOA 18 MAUs

7. DON SOA DON FIP Data / Assertions Assertion Packages 3. Internal Controls Over Financial Reporting… • Approach • Commands that are Budget Submitting Organizations • Develop or use existing test plans to assess effectiveness of internal controls • FMO compiles Navy test results and findings, for review by OUSD(C) • USMC provides separate inputs, but results are included in the DON SOA • Identified ICOFR Material Weaknesses are included in the DON SOA • Material Weakness = more than a remote likelihood that a material financial misstatement will prevent audit readiness

8. DON Statement of Assurance MIC Certification Statements ICOFR Certification Statements New MIC / ICOFR Reporting (After the FIP is gone…) Senior Assessment Team Certification Over Financial Reporting Certification Over Non-Financial Ops ASN(FM&C) FMO 1 MAUs 2 ASN(FM&C) FMO & NAVAUDSVC Third Party Audit or Inspection Findings

9. Certification Statements… AAUSN ONR ASN(RD&A) NAVIG SECRETARY OF THE NAVY OLA OPPA ASN(M&RA) JAG UNDER SECRETARY OF THE NAVY ASN(I&E) NCIS OSBP DON CIO AUDGEN ASN(FM&C) OGC CHINFO CMC CNO ONI NAVSEA NAVSUP SPAWAR NAVFAC BUMED BUPERS CFFC NAVAIR PACFLT CNIC FSA RESFOR SSP COMSC SPECWAR

10. Certification Statements… AAUSN ONR SECRETARY OF THE NAVY UNDER SECRETARY OF THE NAVY CMC CNO ONI NAVSEA NAVSUP SPAWAR NAVFAC BUMED BUPERS CFFC NAVAIR PACFLT CNIC FSA RESFOR SSP COMSC SPECWAR

11. Certification Statements… SECRETARY OF THE NAVY UNDER SECRETARY OF THE NAVY MIC Certification ICOFR Certification ICOFR Certification CNO ICOFR Certification BUMED BUPERS CNIC

12. Testing - Department Level • FMO: • Administer the testing program • Work with Naval Audit Service to determine which segments / controls to test • Review command-level test plans / results • Prepare OUSD(C) ICOFR Deliverables • Naval Audit Service: • Review command-level testing to determine if it has been done properly • Perform control testing in coordination with FMO using samples representing the DON universe of transactions

13. Testing - Command Level • DON Commands: • Implement a testing program for ICOFR, based on process documentation and initial test results for all asserted segments • Maintain and provide source documentation to assist department-level testing efforts

14. Navy Medicine Command Level TestingImplementing Navy’s Vision of “Test for Success” May 27, 2009

15. Purpose and Objectives • Provide overview of Medicines’ Validation and Command Level Testing (CLT) efforts. • Demonstrate how Navy Medicine integrates reporting validation and testing results with Managers Internal Control Program (MICP)

16. The Path to Financial Audit Readiness…

17. What is Command Level Testing? • Internal Controls Testing by Hospital/Activity personnel (Deck Plate) • Testing platform built from ongoing OMB A-123 Appendix A Discovery & Validation efforts • Provide fact-based assurances on each Command’s internal control efforts • Reviewing assigned processes • Pulling and Testing documentation for selected sample transactions • Documenting Results • Report up the chain Annual SoA Region Quarterly FS BUMED

18. Why Command Testing of Internal Controls? • Determines if processes are functioningeffectively • Validates that controls are in place to safeguard resources • Provides reasonable assurance of compliance with applicable laws and regulations • Enhances reliability of financial reporting

19. Immediate Questions on Testing • Every Transaction at my Hospital, BMC, etc? • Answer: OMB requires that we demonstrate internal controls over all processes that tie to Finances. Many Transactions will be included – but not all. • How far back in time will we go for Testing? • Answer: No more than 12 months.

20. Immediate Questions on Testing • What systems are included? • Answer: STARS-FL, DTS, FASTDATA, etc. • What documentation? • Answer: System screen shot(s), Active Document List, transaction listings, and policies and procedures • Who decides the scope, i. e. How Much? • Answer: The BUMED SAT, working in conjunction with guidelines established by DON and OUSD ( C ).

21. What Kinds of Things are We Looking For? • Test specific controls in designated processes related to “Assertion Standards” • Approvals(e.g. Appropriate signature/authorization of funds) • Separation of Duties(e.g. person/activity ordering property different from those receiving) • Reviews/Checks/Reconciliations(e.g. Obligation Balances within official accounting system) • Adherence to Policy and Guidance(e.g. FMR, JTR, SOP’s etc.) • Maintenance of Documentation(e.g. Required retention, either hard or soft copy)

22. Command Level Testing – Process Flow

23. Command Level Testing – Process Flow (cont) Q2 Cert. Statement Statement of Assurance Q4 Cert. Statement Q3 Cert. Statement Quarterly Efforts • Accomplish Testing • Report and Review Results • Support Process Improvements • Plan testing for the next Quarter

24. Command Fact Based Quarterly Certification • Command Level Results Compilation • Compile results at the Command level and provide to the Region • Command Certification • Provides fact-based assurance of internal controls within the Command • Signed by CO and Comptroller • Completed checklist is attached to Command Certification

25. Regional Quarterly Certification Integrated with BUMED MIC Program Reporting • Regional Certification • Signed by Regional Commander and Comptroller • Completed checklists are attached to Regional Quarterly Certification • Combined with MIC reporting requirements

26. FY09 Command Level Testing Areas Q2 FY09 • Consumables – Request • Consumables – Acquisition • Consumables – Receiving Q3 FY09 • Budget Formulation – Unliquidated Obligations/Pipeline • Budget Formulation – Continuing Resolution Q4 FY09 • Personal Property – Receiving and Invoicing • Personal Property – Inventory • Personal Property – Disposal (DRMS) Business Areas from the Key Process Map

27. Command Level Testing Format (cont) • Key Points • Comptroller is the Lead • Structured Responses • Results can be compiled and compared

28. Command Level Testing Checklist (cont)

29. Command Level Testing Format (cont) • Compiles results • Gathers comments • Signed by Commanding Officer

30. Summary • FMO administers department-level testing, while command-level testing programs maintain process documentation, test controls • BSO commands will provide a separate certification statement for ICOFR via the Managers’ Internal Control Program

31. Questions?

32. Contact Information… • Nancy McDermott – DON MIC Program Manager • nancy.l.mcdermott@navy.mil • (202) 685-6719 • Mike Moreau – DON MIC Program Coordinator • michael.moreau@navy.mil • (202) 685-6737 • Richard Raimondo – DON MIC Program Team Lead • richard.raimondo.ctr@navy.mil • (202) 685-6414 • Mike Lipke – BUMED FIP Manager • michael.lipke@med.navy.mil • (202) 762-0101