Corporate controllers exhausted from the Sarbanes-Oxley Act can take one bit of grim solace this summer: Their public sector colleagues will soon join them.
"Circular A-123," the federal government’s version of SOX to manage its own operations, will mandate drastic new internal control assessments from all government agencies when fiscal 2006 begins on Oct. 1. The provisions require annual reports on internal controls, and assurances that all of an agency’s controls have been documented and tested.
Sound familiar?
DeLoach
“Since Sarbanes has been released, there’s been lots of debate on whether federal agencies should have the same discipline,” says James DeLoach, managing director at compliance and risk consulting firm Protiviti. “Clearly, this is an effort to do so.”
However, most federal accounting experts aren't surprised about the contents of A-123. “Sarbanes wasn’t going anywhere, and eventually it would find a way to trickle down to us,” says Felicia Farrar, an auditor with the city of Houston who oversees federal funds for a local HIV-assistance program. “This is going to be the same challenge that it’s been with public companies and Section 404.”
Exactly how much turbulence A-123’s new provisions will create remains unclear. However, the circular has generated considereable speculation among executives in the private sector. Those executives not only have an interest in providing help to strapped agencies, but they have concerns that the government might extend A-123 standards to contractors.
"A Totally Different Environment"
A-123’s new provisions are listed in a new “Appendix A,” which spells out the assessment process and clearly aligns itself with Section 404. The only significant departure is that agencies will not be required to obtain independent attestations of their controls, although the Office of Management and Budget might tell an agency with especially poor controls to get one.
Taylor
Jim Taylor, deputy CFO of the Commerce Department, expects less chaos than other skeptics. He notes that Sarbanes-Oxley was the first law to address internal controls for all public companies, which caught many businesses unprepared. The public sector, however, has had regulatory processes and inspectors general poring over government ledgers for decades. “We’ve had a whole history of internal controls oversight that the private sector has never experienced,” said Taylor. “It’s a totally different environment.”
Still, Taylor and his cohorts face a tough 2006. Foremost, A-123 documentation will cost money that most agencies do not have. Farrar, for example, expects to spend 2 percent to 3 percent of her total funding on compliance. That amount is in step with private-sector costs, but will also come from cash otherwise slotted to help AIDS victims.
Another crucial issue will be manpower. Everyone expects government agencies to tap outside auditors for help as Corporate America did in 2004. But many businesses, especially non-accelerated filers, still need outside help today, and there are only so many consultants to go around. DeLoach bluntly predicts that finding skilled auditors will be “a horrendous resource point.”
CIRCULAR A-123
The following excerpt is from OMB Circular NO. A-123, Management’s Responsibility for Internal Control:
Policy. Management is responsible for establishing and maintaining internal control to achieve the objectives of effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. Management shall consistently apply the internal control standards to meet each of the internal control objectives and to assess internal control effectiveness ... Annually, management must provide assurances on internal control in its Performance and Accountability Report, including a separate assurance on internal control over financial reporting, along with a report on identified material weaknesses and corrective actions.
Actions Required. Agencies and individual Federal managers must take systematic and proactive measures to (i) develop and implement appropriate, cost-effective internal control for results-oriented management; (ii) assess the adequacy of internal control in Federal programs and operations; (iii) separately assess and document internal control over financial reporting ... (iv) identify needed improvements; (v) take corresponding corrective action; and (vi) report annually on internal control through management assurance statements.
Effective Date. Circular is effective beginning with Fiscal Year 2006.
Applicability. Circular is applicable to each executive agency, with some exceptions (refer to the Circular, below).
Inquiries. Information concerning this Circular may be obtained from the Financial Standards and Grants Branch, Office of Federal Financial Management, Office of Management and Budget, Washington, DC 20503, (202) 395-3993.
Download The OMB's Circular A-123 (Very Large File)
HTML Version Of The OMB's Circular A-123
Taylor admits that the project “is going to require prioritization, and in the current environment”—that is, he says, the Bush Administration’s desire to suppress domestic spending in the face of high budget deficits—“it’s very unlikely there will be new funding for this sort of thing.”
A Building Block
Rabun
Outside observers expect a rush of requests-for-proposals sometime in September, as bureaucrats return from summer vacations and realize the new A-123 provisions go into effect in October. “They’re just beginning to realize they need help,” says Denise Rabun, an associate partner with IBM Business Consulting Services. Her division and Deloitte & Touche recently signed a deal to help the National Science Foundation with its $5.6 billion budget, and is in talks with several other agencies.
Rabun sees many agencies with documentation in Excel or, worse, filing cabinets. “It’s all over the place,” she says. “The hard part is getting your arms around what should be tested.”
The OMB has, however, made some progress on that front. Since it released the new A-123 standards last December, the Office has worked with the U.S. CFO Council—representing more than two dozen government departments and agencies—to provide better guidance about what controls must be documented, and to avoid the improvisation that marked so much of Section 404 last year.
According to Taylor, who is a a member of the Council, the group "already had something in place to build on”; specifically, the Financial Integrity Act that introduced A-123 in 1982. Though Taylor acknowledges that the Act was 20 years old and "wasn’t meeting the requirements of today’s environment," he states that "it was a building block.”
The Public Company Accounting Oversight Board and the Securities and Exchange Commission also both gave guidance this year about what documentation is necessary. “That’s going to go a long way, especially with the government and non-accelerated filers,” says Walter Gelnovatch, a former government auditor and now an accountant with Berenfeld, Spritzer, Shechter & Sheer in Miami.
Still, despite all the headaches government agencies are poised to experience, in-the-trenches auditors like Farrar believe the ultimate goal is worthwhile. Too many government programs, she says, secure funding based on political popularity. Shifting money to programs with strong controls ultimately benefits the public.
“We’re talking about the accountability of funds when there really had not been good accountability,” she says. “Even though Sarbanes has been a headache for a lot of companies, I think it’s one of the greatest things that ever happened.”
No comments yet