GAO to OMB: Go slow on stricter audit requirements

The Government Accountability Office recently urged the Office of Management and Budget to step up federal audit requirements slowly, to allow agencies time to first reach stricter standards that went into effect in June.

In a Tuesday letter to leaders of the Senate Homeland Security and Governmental Affairs and the House Government Reform committees, McCoy Williams, GAO's director of financial management and assurance, presented the agency's analysis of a recent cost-benefit study conducted by the Chief Financial Officers Council and the President's Council on Integrity and Efficiency, an association of presidentially appointed inspectors general.

The study and GAO's analysis, which were called for under the 2004 Department of Homeland Security Financial Accountability Act, address how and when agencies should be required to obtain an audit opinion on their internal controls over financial reporting. Under the rules of OMB's Circular A-123, the teeth of which were first felt by agencies in June, managers at the 24 CFO Act agencies must provide annual assurances on the accuracy and effectiveness of their internal controls for financial reporting.

Although most agencies are not required to obtain formal internal control audits, DHS must do so starting this year under the 2004 financial accountability law.

In their assessment of the value in advancing to a formal audit for other agencies, the CFO Council and PCIE concluded that agencies should first be allowed to reach full compliance with Circular A-123. GAO agreed that not all agencies were ready for an audit.

"We recognize that not all agencies have the same maturity level of internal control over financial reporting," Williams wrote.

In their cost-benefit analysis, the CFO Council and PCIE presented ballpark estimates for the costs of the 24 CFO Act agencies obtaining an audit. The total bill, which they cautioned was not a hard number, would come to about $140 million with about $56 million, or 40 percent, for auditing the 23 civilian agencies and $84 million to audit the Defense Department.

In analyzing the cost-benefit equation, Williams wrote that an audit's cost-effectiveness would depend on already having an unqualified management assurance. Defense does not have an unqualified statement, nor is it clear when the department's books will be in order, so it is unlikely it would meet this threshold in the near future.

GAO recommended that OMB take two actions to clarify the timing of future audit requirements. OMB should develop criteria for when agencies would first be required to obtain an audit opinion on internal controls and when they could move to a multiyear audit schedule.

Obtaining an audit once every three years, with annual management assurances in the off years under A-123 rules, could be a good schedule, the analysts concluded.