Tougher Audits

Two years after Sarbanes-Oxley rocked the private sector financial world, it's coming to government.

When Andrew Maner, chief financial officer of the Homeland Security Department, heard that his agency would be the first to be required to audit its internal controls, he wasn't happy.

"I don't need another audit to tell me I have problems with internal controls," Maner says. DHS' fiscal 2004 audit uncovered 10 weaknesses in internal controls, one of the worst records for a federal agency. That audit did not, however, include a separate opinion on internal controls, as the new law will require. The straight-talking executive has called the mandate unnecessary and duplicative of existing requirements.

Maner is fighting a rising tide of pressure from power- ful sources-including Congress, the Government Accountability Office and the Office of Management and Budget-that are eager to fortify financial regulations. The landmark 2002 Sarbanes-Oxley Act, which strengthened financial controls in publicly traded companies, has inspired federal leaders to ask whether government should be held to the same standards. So far, most of their attention has been focused on the part of Sarbanes-Oxley that most easily translates into the federal world: audits on internal controls, in which a third-party documents how well an agency guards itself against waste, fraud and abuse. Current audits list weaknesses in that area, but do not require the more detailed assessments of internal controls that Sarbanes-Oxley popularized.

The new Sarbanes-Oxley mind-set already is trickling down to the federal level: Last October, President George W. Bush signed into law the Homeland Security Financial Accountability Act, which requires DHS to issue a separate opinion on its internal controls after fiscal 2005. In January, OMB ordered federal managers to review internal controls and enhance them if necessary. OMB granted itself authority to require a separate audit if an agency doesn't appear to be correcting its problems. Rep. Todd Platts, R-Pa., who wrote the DHS legislation, called a hearing in February to determine whether more agencies should be required to issue separate internal controls audits, and some federal executives are so sure Sarbanes-Oxley requirements will hit their desks that they've already taken steps toward compliance.

Jack Martin, the chief financial officer of the Education Department, held all-day training sessions for senior managers on internal controls in 2002, and recently established a working group to discuss OMB's new requirement. Christopher Burnham, chief financial officer of the State Department, also anticipated tougher rules early and since 2002, has included extra information about internal controls in annual reports.

At the same time, no one wants to be accused of being an overeager regulator. Platts says he's not yet sure whether a DHS-style audit requirement should be applied to other agencies. "When we get through this year, the first year under the new regulations, it will give us a better database and help us make a more informed decision." Platts emphasizes that the money recovered by the new audits could more than pay back the cost of doing them, but upfront expenditures could be significant. Maner says the initial cost of an internal control audit for DHS will be about $4 million, 40 percent more than its current audit costs.

Still, Jeffrey Steinhoff, managing director of the GAO's financial management and assurance team, would like to see every agency get an internal control opinion as soon as possible, but says those with weak controls aren't ready yet. He compares the regulatory process to disciplining children: If you give too many directives too quickly, they won't be able to follow any of them.

Whether agencies are ready or not, the new audit requirements seem poised to spread throughout government. Even the once-reluctant Maner appears to be swept up in the momentum. "People say I don't love this law. That's irrelevant," he says. "We're moving out on this, and I plan to be the leader."