OMB orders agencies to strengthen internal controls

The Office of Management and Budget has released new auditing rules that require agencies to review their internal controls over financial management, fix potential shortcomings and submit an annual report on their activities.

In the wake of the 2002 Sarbanes-Oxley Act, which calls for publicly held companies to obtain audits of their internal controls, government auditors and financial managers have debated whether they should follow suit. The Government Accountability Office is in the midst of rewriting its auditing guidelines, and held a meeting in late 2004 in which some auditors expressed concern that tightening federal auditing practices was unnecessary and resource-consuming. But senior GAO officials supported strengthening internal control audit requirements.

OMB sided with the faction supporting stricter rules. OMB Controller Linda Springer said effective internal controls were "the foundation of reliable financial reporting" in a press release accompanying the revised circular. GAO offers guidelines on auditing standards, while OMB's rules are binding.

OMB, however, stopped short of adopting the full force of Sarbanes-Oxley provisions, which would have included requiring a separate audit opinion on internal controls. The new rules do, however, allow OMB to require agencies to obtain a separate opinion on their internal controls if they fail to fix identified internal control problems.

The revised circular was largely met with approval from the federal financial management community. Samuel Mok, chief financial officer for the Labor Department, said his agency supports the revisions, and strengthening internal controls "will result in enhanced performance and accountability."

Labor, he said, anticipated the requirement and tightened the agency's internal controls over financial management about a year ago.

Rep. Todd Platts, R-Pa., chairman of the House Government Reform Subcommittee on Efficiency and Financial Management, said, "I'm pleased to see that the White House responded in such an aggressive manner to strengthen agency internal controls requirements."

Platts sponsored the 2004 Homeland Security Financial Accountability Act, which requires an independent auditor to review DHS' internal controls.

Internal controls include measures ranging from computer security to segregation of duties, all of which are designed to reduce the possibilities of error and fraud. In testimony at a hearing before Platts' subcommittee, McCoy Williams, director of GAO's financial management and assurance team, said agencies reported $35.7 billion worth of improper payments in fiscal 2003, including $11.6 billion in erroneous Medicare payments.

"OMB's guidance is very appropriate because it realizes [internal control audits] are not needed for every agency," said Tabetha Mueller, spokeswoman for the House Government Reform Subcommittee on Government Efficiency and Financial Management.

Homeland Security, she said, "has a lot of internal control weaknesses, so you would hope that an audit would go over it with a fine-toothed comb and fix them." Labor and Commerce, on the other hand, have not been found to have material weaknesses so would not need an additional audit.

Mueller added that despite their cost, additional audits could actually save agencies money by helping them close accounting holes.

OMB said it will release guidance on how to implement the new rules in March. Agencies must abide by the revised circular by fiscal 2006.