Are you Ready for an Audit?Are you Ready for an Audit?

Acquisition Internal Control Acquisition Internal Control ConsiderationsConsiderations

Department of Commerce, Office of Inspector General

1

ContentsContentsAudit Guidance and CriteriaOIG Evaluations of Internal

ControlAcquisition Separation of Duties

2

Internal Control Audit Internal Control Audit GuidanceGuidanceAICPA Codification of Auditing StandardsGAO Yellow BookGAO Red BookGAO Financial Audit ManualGAO…

3

Acquisition Internal Control Acquisition Internal Control CriteriaCriteriaInternal control activities can be tested against

many federal requirements, including:

Federal Accounting Standards Advisory Board Statements

Federal Acquisition RegulationDepartment Administrative OrdersAnti-deficiency ActPrompt Payment Act Final RuleFederal Financial Management Improvement ActFederal Managers’ Financial Integrity Act of

1982OMB Bulletins and Circulars (especially A-123 &

A-11)

4

Evaluating Significant Evaluating Significant ControlsControls1. Identify control objectives2. Identify key control activities3. Determine nature, timing, and

extent of control tests4. Conduct tests and evaluate

results5. Assess control risk

5

Evaluating Significant Controls – Evaluating Significant Controls – Sample Procurement TestsSample Procurement Tests

  Criteria Yes No

1Does the obligation contain a proper requisition, order and description?

2Has an authorized individual certified the availability of funds?

3Is the obligation approved by an authorized individual prior to purchase?

4Are adequate separation of duties in place for this transaction?

5Is the period of performance correct?

6Are the appropriate fiscal year funds being used?

7Was the initial obligation or modification entered promptly?

8Is the correct object class identified?

9Are accounts payable estimates adequately supported?

10Are payments adequately supported?

11Have payments been processed timely in accordance with the Prompt Payment Act Final Rule?

12Does the recorded data match the supporting documentation?

6

Evaluating Significant Acquisition Evaluating Significant Acquisition ControlsControlsSample obligation control findings• Identify at least two approvals on all obligations (fund

certification and approving official) before the contract’s period of performance begins.

• Identify three approvals on all contractual obligations - fund certification, approving officer (for bona fide needs), and contracting officer (for delegated procurement authority).

• Providing fund certifications and authorizations verbally or by email can be accepted, but should not be the primary organizational control.

• Obtain all required authorizations before the obligation is entered into the financial system.

• Fiscal year appropriations can only be used for needs of that fiscal year, regardless of when performance occurs.

7

Separation of Duties and Key Separation of Duties and Key Acquisition Control ActivitiesAcquisition Control ActivitiesOverallApprovals must be from authorized

individuals (electronic or manual)Approvers should not record obligations or

paymentsObligations cannot occur before approval

(e.g. contracting officer cannot bind the government before an approving official agrees)

Obligations cannot be recorded if not finalized (e.g. obligations cannot be recorded prior to contracting officer approval)

One person cannot control multiple key roles

8

Separation of Duties Separation of Duties ConsiderationsConsiderationsWhat opportunities exist when

controls are not in place?

9

Separation of Duties for Acquisitions Separation of Duties for Acquisitions (Ex.1)(Ex.1)

10

Sample Process Flow Design

ROLE Requester/ Requisition Fund Certifier Obligation

ApproverContracting

Officer

Obligation Keyer/

RecorderCOTR Payment

Approver

Payment Keyer/

Recorder

Payment Releaser

1. Requester/Requisition N/A No No No No No No No No

2. Fund Certifier No N/A No No No No No No No

3. Obligation Approver No No N/A No No No Yes No No

4. Contracting Officer No No No N/A No No No No No

5. Obligation Keyer/Recorder No No No No N/A No No Yes No

6. COTR (Review bill for validity) No No No No No N/A No No No

7. Payment Approver No No Yes No No No N/A No No

8. Payment Keyer/Recorder No No No No Yes No No N/A No

9. Payment Releaser No No No No No No No No N/A

Separation of Duties for Acquisitions Separation of Duties for Acquisitions (Ex.2)(Ex.2)

11

Sample Process Flow Design

ROLE Requester/ Requisition Fund Certifier Obligation

ApproverContracting

Officer

Obligation Keyer/

RecorderCOTR Payment

Approver

Payment Keyer/

Recorder

Payment Releaser

1. Requester/Requisition N/A No No No No No No No No

2. Fund Certifier No N/A No No No No No No Yes

3. Obligation Approver No No N/A No No No Yes No No

4. Contracting Officer No No No N/A No No No No No

5. Obligation Keyer/Recorder No No No No N/A No No Yes No

6. COTR (Review bill for validity) No No No No No N/A No No No

7. Payment Approver No No Yes No No No N/A No No

8. Payment Keyer/Recorder No No No No Yes No No N/A No

9. Payment Releaser No Yes No No No No No No N/A

Separation of Duties for Acquisitions (Ex. Separation of Duties for Acquisitions (Ex. 3)3)

12

Sample Process Flow Design

ROLE Requester/ Requisition Fund Certifier Obligation

ApproverContracting

Officer

Obligation Keyer/

RecorderCOTR Payment

Approver

Payment Keyer/

Recorder

Payment Releaser

1. Requester/Requisition N/A No No No No No No No No

2. Fund Certifier No N/A No No Yes No No Yes No

3. Obligation Approver No No N/A No No No No No No

4. Contracting Officer No No No N/A No No No No No

5. Obligation Keyer/Recorder No Yes No No N/A No No Yes No

6. COTR (Review bill for validity) No No No No No N/A No No No

7. Payment Approver No No No No No No N/A No Yes

8. Payment Keyer/Recorder No Yes No No Yes No No N/A No

9. Payment Releaser No No No No No No Yes No N/A