Time Runs Out for Financial Failures

Mandate for accurate accounting could put agencies on the path to automation.

These days, push-button auditing might sound like a far-off dream. For federal number-crunchers scrambling to certify their internal controls on financial reporting by June 30, a future of fully automated accounting software is, no doubt, enticing.

Such software would be a huge boon to the 24 agencies rounding the home stretch on a new Office of Management and Budget requirement to verify their financial reporting safeguards. In 2004, OMB tightened rules in Circular A-123 after corporate accounting scandals swept the country, following the lead of tougher commercial controls under the 2002 Sarbanes-Oxley Act.

Changes include stricter guidelines on how agencies evaluate their controls and a requirement that agency heads personally provide their "reasonable assurance" that annual financial reports are accurate for inclusion with their fiscal year Performance and Accountability Report.

Bill McCabe, acting chief financial officer at the Education Department and formerly a senior manager with global accounting giant KPMG, is heading the agency's compliance efforts. Speaking more like the CFO of a large company than a federal agency, he is well aware of the need for automation. "We have millions of transactions flying through the company daily with only 4,000 people to [stand] watch," he says.

But despite its promise, Education has held off on investing in new technology, opting to first lay the groundwork and straighten out any wrinkles by hand. "This year is very manually intensive," McCabe says of his agency's work to document and test internal processes.

OMB Controller Linda Combs says the experience is common among agencies hustling to comply. "Reviewing and updating existing documentation of the key business processes and related internal controls, or documenting new controls, has probably been the most challenging and labor-intensive for agencies over the past year," she says.

Compliance also means agencies must assess the risk associated with their processes, evaluating the likelihood of error, oversight or fraud. If potential problems are factored in-even if the error itself is minor-the process might require more attention.

In what officials hope is a final step, they must test the controls. Testing can be simple or elaborate, ranging from ensuring that documents follow the correct chain of approval to surveying employees who handle a process to observing or even rerunning a process, according to OMB guidance. Where tests indicate a problem, agencies must retool their procedures and repeat the steps, or be prepared to report a deficiency.

Some agencies have well-known shortcomings. In each of the nine years that agencies have been required to obtain financial audits, the Defense Department has flunked its review. Each time, it obtained a qualified opinion indicating that reviewers could not adequately assess its finances. Given Defense's large share of the federal budget, that amounts to an audit failure for the entire government. But there is little the administration or Congress can do, as neither has found a big enough carrot or stick to get the Pentagon to wrangle its myriad legacy financial systems into a cohesive, accountable whole.

OMB has said agencies with "pervasive material weaknesses . . . should focus on the remediation of those weaknesses rather than testing internal controls that are known to be ineffective." Agencies too large or complex to complete testing on all their systems in one year can continue to make incremental progress through 2008 without being considered out of line, as long as OMB is satisfied there is a plan and progress. "Internal control is a management issue," Combs stresses. Automation is crucial and reduces human error, she says, but it comes down to understanding how the bureaucracy works. As Danny Werfel, deputy controller of OMB's Office of Federal Financial Management, noted at a May breakfast for officials working toward the deadline, "Think of A-123 as a commitment that management knows their agency better than anyone else."

Officials stress that the "reasonable assurance" in A-123 is less demanding than the accounting standard applied in other aspects of agencies' financial obligations, which should make it easier to meet the deadline. "It will be the secretary who decides this, not our auditor, and not the inspector general," Education's McCabe says. Everyone agrees that inspectors general need to be involved in the compliance process early on, but some say managers should push back if they feel pressure from auditors, who are accustomed to stricter standards, to go beyond what OMB requires. Molly Dawson, an Education Department audit manager who was detailed to OMB, warns that the same applies to consultants peddling unneeded audit services.

McCabe thinks by next year, agencies could be a big step closer to that fantasy of one-click A-123 compliance. "I just think people are being cautious," he says. "The first thing you want to do is not rush out the door and spend a lot of money on technology." He does not know of any agencies making major IT purchases this year to meet the deadline. By this time next year, he expects technology to be a much bigger player in Education's reporting strategy.

In the meantime, McCabe hopes the review process won't just beef up controls, but also will slim down procedural layers, such as manual and automated checks and balances that duplicate each other and multiple signoffs when one would suffice. "We may find more instances where we may be overcontrolled than undercontrolled," he says.

A sleeker reporting bureaucracy? Now that sounds like a fantasy.