This report presents the results of our audit of the FDIC’s controls over contractor invoice approval, payment, and posting to the General Ledger (G/L). The G/L is the central component of the New Financial Environment (NFE)—the FDIC’s financial management system. The G/L provides accounting, reporting, and decision-making information for the FDIC. The FDIC’s Division of Finance (DOF) is responsible for maintaining the G/L, receiving contractor invoices, verifying payment approvals, issuing disbursements and posting transactions to the G/L. In addition, the Division of Administration’s (DOA) Acquisition Services Branch (ASB) is responsible for developing all contracting policies and procedures and communicating and implementing those policies and procedures throughout the FDIC.

The audit objective was to assess the FDIC’s controls over contractor invoice approval, payment, and posting to the G/L. The audit focused on the FDIC’s control activities intended to provide reasonable assurance that the FDIC (1) meets management directives, such as budget execution; (2) accomplishes control objectives, such as efficient use of FDIC resources; and (3) mitigates risk. Control activities for invoice processing include the segregation of the receiving, invoicing, and purchasing functions; goods and services receipt verification; managerial authorizations; independent review before payment; and pre-payment procedures for Prompt Payment Act (PPA)1 compliance and duplicate payment detection to ensure that only valid transactions are authorized and approved.

¹ The PPA and its implementing regulations from the U.S. Office of Management and Budget, (5 Code of Federal Regulations (C.F.R.) Part 1315) require that agencies, among other things, pay interest to contractors if contractor invoices are not paid in a timely manner, for example, within the period established by the contract. The FDIC, in its corporate capacity, is an agency for purposes of the PPA. Additional information is contained in Appendix 1 under the Compliance with Laws and Regulations section.

We conducted this performance audit in accordance with generally accepted government auditing standards. Appendix 1 of this report discusses our audit objective, scope, and methodology in detail.

BACKGROUND

Of the FDIC’s $992 million in calendar-year 2007 operating expenses, over $250 million represents amounts paid for contracted goods and services. For the 6 months ended June 2008, $121 million of $495 million in operating expenses was for contractor payments. Part of the $121 million was paid based on contractor invoices. Our review included a sample of 30 of 1,148 FDIC invoices, representing $5.7 million of the total $37.5 million in contractor payments from October 2007 through March 2008. The FDIC had assigned 15 Oversight Managers (OM) the responsibility for the review and approval of the 30 sampled invoices (see Appendix 2), representing 18 contractors.

Guidance and Controls Related to Contractor Payments

The FDIC has a number of policies and procedures related to controls over the contractor invoice payment process as described below.

FDIC Circular 4010.3. FDIC Circular 4010.3, FDIC Enterprise Risk Management Program, adopted internal control standards prescribed in the Government Accountability Office (GAO) publication, Standards for Internal Control in the Federal Government. These standards apply to all operations (programmatic, financial, and compliance) and are intended to ensure the effectiveness and efficiency of operation, reliability of financial reporting, and compliance with applicable laws and regulations. Circular 4010.3 requires management to develop and implement controls to ensure that management directives are carried out and to provide reasonable assurance that controls are sufficient to minimize exposure to waste, fraud, and mismanagement.

Key control activities related to contractor payments described in Circular 4010.3 include:

• Segregation of Duties. Key duties and responsibilities shall be divided among different individuals such that no one individual should control all key aspects of a transaction to reduce the risk of error or fraud.
• Proper Execution of Transactions and Events. Transactions and other significant events shall be authorized and executed only by persons acting within the scope of their authority.
• Appropriate Documentation of Transactions and Internal Controls. Internal controls, all transactions, and other significant events shall be clearly documented. This helps to ensure that payment transactions are complete, accurate, and recorded in a timely manner. Documentation shall be readily available for examination.

The circular also requires management to perform monitoring activities to assess the quality of performance over time and the effectiveness of controls. Monitoring activities include routine management and supervisory actions; transaction comparisons and reconciliations; other actions taken in the course of normal operations; as well as separate and discrete control evaluations, including internal self-assessments and external reviews.

The Acquisition Policy Manual. The FDIC’s Acquisition Policy Manual (APM) provides that contract OMs are, among other things, responsible for reviewing and approving invoices promptly for payment to avoid interest on late payments and ensuring that the goods or services contracted for are received and within the scope of the contract. The APM requires that the Contracting Officer provide the program-appointed OM with a Letter of Oversight Manager Confirmation, describing the OM’s authority and responsibilities. Prior to receiving the letter of confirmation, OMs are required to complete training that includes, among other things, the OM role in contract administration.

Interim Acquisition Policy No. 2004-5, CEFile, dated August 10, 2004. The policy states that the Contract Electronic File (CEFile) is the official contract file of record for the ASB. The CEFile is a Web-based template on the FDICnet used to create official contract files and electronically organize and store all pertinent contract file documentation such as the requirements package, contract, contract modifications, and OM’s contract-related records. The policy memorandum states that the Contracting Officers and OMs are responsible to ensure that the CEFile is current, accurate, and complete. The documentation in the file shall be sufficient to (a) provide a complete background as a basis for informed decisions at each step in the acquisition process; (b) support actions taken; (c) provide information for reviews and investigations; and (d) furnish essential facts in the event of litigation or congressional inquiries.

Interim Acquisition Policy No. 2007-02, Establishment of the FDIC Contract Oversight Management Program, dated April 12, 2007. The policy memorandum formally establishes the FDIC Contract Oversight Management Program and states that supervisors must ensure that individuals considered for appointment as OMs obtain certain competencies needed to effectively and efficiently perform delegated contract management duties. On May 11, 2007, ASB notified OMs regarding mandatory classroom training.

Operating Expense Process Memorandum. DOF’s Disbursement Operations Unit (DOU) processes approved invoices for goods and services procured by the FDIC. The FDIC’s Operating Expense Process Memorandum, for calendar year 2007, defines the G/L procedures related to operating expenses, which are included in the Operating Expense line item on the FDIC’s financial statements.

The process memorandum identifies key events and describes the controls provided at each stage as summarized below:

• DOU is responsible for the initial receipt and date stamping of invoices and input of information into the NFE Accounts Payable Module. DOU is also responsible for evaluating invoices to ensure compliance with the PPA late payment provisions.
• DOU reviews invoice information to verify that it complies with the FDIC-designed vendor invoice format that is acceptable for NFE billing. The standardized invoice form requires vendors to provide mandatory elements, such as the contract/purchase order number, labor categories, hourly rates, period being invoiced, and applicable backup documentation, to determine, among other things, the appropriate fund and expense accounts in the G/L for authorizing the payment transaction. Once approved by DOU, the invoice is routed in NFE to the OM for final approval.
• The OM is responsible for reviewing the invoice in accordance with ASB requirements, including the APM. The review is intended to ensure that the invoice is correct and complies with the terms and conditions of the contract and the payments in process do not exceed the specified contract purchase order or task order contract limits and expenditure authority. The Invoice Review Checklist in the APM provides the OM guidelines for reviewing contractor invoices. If the invoice and purchase order are correct, the OM approves the invoice in NFE.
• Once the OM approves the invoice in NFE, payments are generally made through an Electronic Funds Transfer (EFT).2 DOU approves the daily electronic payment transactions on-line. EFT payment files are sent to the disbursing bank upon e-mail notification from DOU to DOF’s NFE Servicing and Control Unit (NSCU). The NFE Accounts Payable Module then records the journal entries for the payment transactions and through its system interface with the G/L, automatically posts these transactions to the appropriate fund and expense accounts in the G/L. The Accounts Payable Module has built-in edits to prevent duplicate payments. In addition, daily reports are run and reviewed by DOU to detect suspect invoices that could result in duplicate payments.

The GAO, as part of the annual audit of the FDIC’s financial statements, assesses the controls for contractor invoice payment processing and G/L posting activities. GAO’s audit work includes testing and tracing of contractor invoice payments from approval through disbursements and G/L postings.

² EFT is the electronic movement of funds from one bank account to another, by means of electronically communicated payment instructions.

The DOF Accounts Payable Operating Procedures Manual, November 2006. DOF maintains this manual to document activities and procedures related to the FDIC’s Accounts Payable function. The topics addressed in the Manual include:

• Reviewing an Accounts Payable invoice before processing
• Accounts Payable pay-cycle review and approval
• Auditing large dollar Accounts Payable payments
• Reviewing and monitoring for compliance with the PPA
• Reviewing and monitoring for duplicate payments
• Accounts Payable voucher routing error
• Accounts Payable voucher override/matching procedure
• Scanning and attaching an invoice voucher
• Accounts Payable Electronic Invoice Processing
• Processing Accounts Payable Expense Adjustment Voucher

RESULTS OF AUDIT

The FDIC has established and implemented generally adequate controls over contractor invoice approval, payment, and posting to the G/L. The NFE provides an audit trail from the authorized invoice approval through posting of the payment transactions to the G/L. Payment transactions for the 30 sampled invoices were accurately posted to the correct fund and expense accounts in the G/L. Additionally, the FDIC has enhanced its Contract Oversight Management Program to ensure that OMs receive and complete training regarding their roles in reviewing and approving contractor invoices for payment.

However, based on our review of the 30 sampled contractor invoices, representing total FDIC expenditures of $5.7 million, we found that enhanced control activities could improve the OM’s review and approval procedures as described below.

• Segregation of duties was lacking for five invoices, representing $239,300 in contractor payments. The same OM prepared and approved two invoices. Another OM submitted the three other invoices directly to DOF for the contractors and then approved those invoices for payment. Properly designed control activities help ensure that no one individual can initiate and approve a transaction. Maintaining the segregation of duties in the invoice payment process would help to reduce the risk of errors or unauthorized transactions.
• Three of 15 OMs, who approved 3 invoices, with a total value of $213,150, did not have confirmation letters from Contracting Officers, authorizing the OMs to perform contractor oversight responsibilities, including reviewing and approving invoices for payments. Also, two OMs, who had not completed the required training, approved three invoices totaling $130,600. Confirmation letters and training help to ensure that OMs correctly review and approve invoice payments in accordance with FDIC policies.

• The CEFile did not contain 26 out of the 30 invoices sampled, which represented about $1.7 million out of the $5.7 million in contractor payments. OMs did not consistently follow the FDIC’s acquisition policy regarding documenting these contract activities in the CEFile. Timely inclusion of invoices in the CEFile ensures current, accurate, and complete records of contract activities.

Strengthening controls in the areas of the segregation of duties, OM training, and contract file maintenance will help in ensuring the effectiveness and efficiency of operations, reliability of financial reporting, and compliance with FDIC policies and procedures.

PAYMENT PROCESSING AND GENERAL LEDGER POSTING

We found that the FDIC has established and implemented adequate controls over the contractor invoice payment function and corresponding posting to the G/L. The NFE provides an audit trail from the authorized invoice approval through posting the payment transactions. We obtained documentation from DOF and traced the payment transactions of the 30 sampled invoices from NFE approval to disbursement and recording in the G/L. DOU approved the electronic payment transactions for the sampled invoices. After approval, DOU notified NSCU via email that the payment transactions were ready for processing. NSCU sent these payment transactions to the appropriate disbursement banks, and the automated interface in the Accounts Payable Module posted the payment transactions to the correct funds and expense accounts in the G/L.

We were able to verify that the 30 contractor invoices in our sample were paid in the correct amount invoiced and processed in a timely manner within the limits of the PPA late payment provisions. In addition, the edit checks in the Accounts Payable Module for duplicate payments and the DOU procedures for daily monitoring of invoices worked as intended for the sampled invoices. There were no duplicate payments for any of the 30 sampled invoices.

Based on the results of our audit work, we are not making recommendations in these areas. However, we found that management attention is warranted in the areas of the segregation of duties, OM training, and contract file maintenance as discussed below.

SEGREGATION OF DUTIES FOR INVOICE APPROVAL

We found that 5 of the 30 invoices, representing $239,300 in payments, were approved without an adequate segregation of duties. One OM prepared,3 submitted, and approved two invoices, while another OM submitted three invoices directly to DOF for the contractors and then approved them for payment processing.

³ Invoice preparation involved transferring billing data received from the contractor, Benefits Allocation Specialists (BAS), and submitting a supplemental cover page with contract information and cost allocation information into the invoice format required by DOF. The FDIC contracted with BAS to administer certain FDIC employee benefits programs and maintain FDIC employees’ benefits enrollment information.

Having one individual initiate and approve a transaction increases the risk of errors and unauthorized payment transactions. This control weakness occurred because management did not ensure compliance with the segregation of duties requirement for invoice preparation, submission, and approval in accordance with FDIC Circular 4010.3.

The two invoices prepared and approved by the same OM were for certain contracted insurance providers for the FDIC’s employee health benefits programs. The contractors did not have access to certain information needed for billing purposes;⁴ therefore, the OM transferred the billing data from BAS and added the required contract and cost allocation information on the invoices submitted to DOU for payment processing. After receiving notification, through the NFE, that the invoices needed approval, the same OM approved the invoices for payment. Having one individual with the capability to prepare, submit, and approve an invoice increases the risk of errors and could result in unauthorized payment transactions.

The three remaining invoices, which were for expert consulting services, were also submitted and approved without an adequate segregation of duties. The OM for the consulting services contracts received the invoices from the contractor, submitted them to DOF, and approved the invoices for payment.⁵ The Operating Expense Process Memorandum states that the contractor, not the OM, should submit invoices to DOU. The lack of segregation of duties increases the risk of errors or unauthorized payment transactions.

FDIC Circular 4010.3 states that key duties and responsibilities shall be divided among different individuals to reduce the risk of error or fraud. Maintaining appropriate segregation of duties in the invoice payment process is key to safeguarding FDIC resources.

Recommendation Related to Segregation of Duties for Invoice Approval

We recommend that the Director, DOA, work with the Director, DOF, to:

⁴ The BAS database contains sensitive personnel enrollment information such as Social Security numbers, addresses, family members, and their Social Security numbers. The contracted insurance providers do not have direct access to the BAS database.
⁵ The contract for one invoice and a similar contract for two invoices did not specify where to send the invoices. This may result in the need for the contractors to contact the OM for further invoice submission instruction.

OM CONFIRMATION LETTERS AND TRAINING

Three of 15 OMs, who approved 3 of the 30 sampled invoices did not have confirmation letters from Contracting Officers, authorizing them to perform OM responsibilities, including reviewing and approving invoices for payments. The three invoices totaled $213,150. In addition, two OMs approved three invoices totaling $130,600 without first completing the required OM training. Both of these OMs also lacked a confirmation letter from the Contracting Officer. The lack of OM confirmation letters and training occurred because DOA has not been monitoring and periodically assessing compliance with OM authorization requirements. Confirmation letters and training help to (1) ensure that the OMs are fully aware of their authorities and responsibilities and (2) reduce the risk of OMs approving erroneous and/or unauthorized transactions.

The APM requires that a Letter of Oversight Manager Confirmation be issued by the Contracting Officer to the OM, authorizing the OM to perform a number of tasks, including verifying satisfactory delivery of contract terms and/or performance, and reviewing and approving invoices promptly to avoid late payments and incurred interest charges. In addition, Interim Acquisition Policy No. 2007-02, dated April 12, 2007, defines required competencies for OMs, and ASB has established mandatory instructor-led classroom training for OMs regarding FDIC contract oversight management. An important part of the training focuses on the OM role in contract administration, which includes responsibilities for reviewing and approving invoices for contractor payments.

Recommendation Related to OM Confirmation Letters and Training

We recommend that the Director, DOA:

(2) Monitor and periodically assess compliance with the FDIC’s acquisition policy to ensure that designated OMs have received confirmation letters from Contracting Officers and completed required training.

CONTRACT DOCUMENTATION

We found that for the 30 invoices sampled, the CEFile did not contain 26 invoices representing about $1.7 million out of $5.7 million in contractor payments. This occurred because DOA has not been monitoring OM compliance with the requirements to ensure that the CEFile is current, accurate, and complete. As a result, the CEFile documents for 16 of the18 contracts in our sample were not up to date and cannot be relied upon as a record of contract activities.

Interim Acquisition Policy No. 2004-05 indicates that the CEFile is the official contract file of record. Further, DOA issued a memorandum, dated October 18, 2006, to FDIC Contracting Officers and OMs, stating that maintaining the CEFile is an ongoing and continuous process, and it is the responsibility of both the Contract Specialist and the OM to ensure that the CEFile is current, accurate, and complete.

In particular, OMs are required to maintain their contract-related records such as approved invoices in the CEFile. OM contract administration responsibilities are performed corporate-wide. Accordingly, DOA needs to monitor OM compliance with acquisition policy to ensure the CEFile is current, accurate, and complete.

Recommendation Related to Contract Documentation

We recommend that the Director, DOA:

(3) Monitor and periodically assess whether OMs record contract activities, including invoices, in a timely manner to ensure the CEFile is current, accurate, and complete.

CORPORATION COMMENTS AND OIG EVALUATION

On September 12, 2008, DOA and DOF provided a joint written response to the draft of this report. The response is provided in its entirety as Appendix 3 of this report. DOA and DOF concurred with our recommendations and provided planned corrective actions for each recommendation as discussed below.

Regarding recommendation 1 on segregation of duties for invoice preparation, submission, and approval, DOA indicated that the OM’s review and approval procedures could be improved for invoices of the employee health benefits program. Currently, the FDIC’s contractor for administering the employee benefits program, BAS, provides the employee premiums to the FDIC. The DOA Benefits Center staff then creates a separate spreadsheet for the DOU showing the contract name, number, allocation codes, and amounts and sends the entire package as an invoice to DOU for input into the NFE. To improve segregation of duties, DOA’s Benefits Center staff will instruct BAS to include on its invoice the name and number of the contract, dollar amount allocation per budget line, and total dollar amount and send the invoice directly to DOU. This new procedure will be implemented by December 31, 2008.

DOF also agreed to take actions to strengthen segregation of duties controls for invoice preparation, submission, and approval. DOU will implement a process by September 30, 2008, to follow up with OMs who receive an invoice directly from a contractor and subsequently forward the invoice to the DOU for processing. DOU will reinforce to the OM that contractors should submit invoices directly to DOU. Where there is a valid business reason that supports a vendor invoice being first received by the program office, DOF will document this exception and stress to the program office the importance of maintaining appropriate segregation of duties regarding the preparation, submission, and approval of invoices.

With respect to recommendation 2 on OM Confirmation Letters and Training, DOA will monitor and periodically assess compliance with acquisition policy through contract post-award reviews to be conducted by DOA’s Acquisition Services Branch.

DOA indicated that by December 31, 2008, a contract post-award review checklist will be developed to include a review of OM training and appointments.

Regarding recommendation 3 on contract documentation, DOA will include on the contract post-award review checklist being developed (by December 31, 2008) a review of the CEFile to ensure that all applicable documentation is included in that file.

A summary of management’s response to the recommendations is in Appendix 4. We consider the planned actions to be responsive to the recommendations. The recommendations are resolved but will remain open until we have determined that agreed-to corrective actions have been completed and are responsive.

Objective and Scope

The audit objective was to assess the FDIC’s controls over contractor invoice approval, payment, and posting to the G/L. We conducted this performance audit from April through July 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

The scope of the audit was the contractor invoices processed in the NFE Accounts Payable Module for the 6-month period of October 1, 2007 through March 31, 2008. The scope was limited to EFT and check payments for FDIC contractor invoices. We obtained information regarding these contractor payment transactions from a query of the NFE Accounts Payable Module.

Methodology

To accomplish our objective, we:

• Judgmentally selected 30 invoices out of the 1,148 total invoices processed through the NFE Accounts Payable Module during the period of October 1, 2007 through March 31, 2008.⁶ Our sample included invoices from six FDIC divisions, the Division of Resolutions and Receiverships (DRR), Division of Insurance and Research (DIR), DOA, Division of Information Technology (DIT), Legal Division, and the FDIC’s Corporate University. These invoices were for contracts managed by both FDIC Headquarters and the Dallas Regional Office. The selected invoices ranged from over $1 million to less than $2,000.
• Interviewed the OMs for each of the 18 contracts associated with the 30 invoices in our sample. Examined OM files and reviewed the OM procedures for reviewing and approving FDIC invoices. Obtained documentation on OM confirmation letters and training requirements. We reviewed electronic documents stored in the CEFile, as well as working documents stored separately by the OMs to assist with their review and approval of invoices.
• Examined each invoice to determine whether the OMs had carried out their responsibilities related to invoice review as described in their letters of confirmation. Key responsibilities include receiving and accepting deliverables, verifying satisfactory contract performance before approving invoices for payment, reviewing and approving invoices promptly to avoid late payment interest charges, and ensuring that the dollar values of invoices do not exceed the expenditure authority.

⁶ The results of a non-statistical sample cannot be projected to the intended population by standard statistical methods.

• Queried the CEFile to verify whether the following contract documentation related to the sampled invoices was included in the files: OM confirmation letters, OM-approved invoices, the contracts, contract modifications, and correspondence related to the contract events and transactions.
• Reviewed the documentation stored in NFE to support the posting of the 30 sampled invoice transactions to the G/L and to verify that the amounts had been paid and cleared the disbursement bank.
• Queried the NFE Accounts Payable Module to trace invoices through the entire process--from approval to the bank clearance. The key steps in this process are OM invoice approval, DOF invoice input into NFE, preparation of contractor payments within NFE, the posting of each transaction to the G/L, and the funding of payments through payment vouchers.
• Verified that the 30 invoices in our sample had been paid within the required timeframes of the PPA provisions regarding late payments.
• Considered relevant provisions of the FDIC’s policies pertaining to the following:
  • The FDIC’s APM, which provides FDIC policy on contracting for products and services.
  • The FDIC’s Circular 4010.3, FDIC Enterprise Risk Management Program, which adopts the internal control standards prescribed in the GAO publication, Standards for Internal Control in the Federal Government. These standards apply to all operations (programmatic, financial, and compliance) and are intended to ensure the effectiveness and efficiency of operation, reliability of financial reporting, and compliance with applicable laws and regulations. Circular 4010.3 requires management to develop and implement controls to ensure that management directives are carried out and to provide reasonable assurance that controls are sufficient to minimize exposure to waste, fraud, and mismanagement.
  • GAO’s publication, Standards for Internal Control in the Federal Government, as largely adopted in FDIC Circular 4010.3.
  • DOF’s Accounts Payable Operating Procedures Manual, which documents the activities and procedures related to the FDIC’s Accounts Payable function.

We performed our audit work at the FDIC’s Headquarters offices in Arlington, Virginia, and Washington, D.C., and the Dallas Regional Office.

Internal Controls

We identified the key control points in the FDIC’s invoice payment processes. Our tests addressed these key control activities:

• The separation of duties between receiving, billing, and purchasing functions.
• The required verification of receipt of goods and services before payments can be authorized.
• The required authorization (OM confirmation letters and FDIC contract oversight management training) for OMs to carry out their responsibilities.
• DOF’s independent review of invoices for compliance with the FDIC’s billing policies.
• DOF’s review for suspect invoices prior to payment processing.
• DOF managerial review and approval of funding payments.

Reliance on Computer-processed Information

In performing this audit, we relied on data from the NFE and CEFile. We confirmed the accuracy of the data through tracing to source documents and considered the reasonableness of data such as electronic timesheets of hours charged on invoices.

Performance Measurement

We reviewed the FDIC’s 2008 Annual Performance Plan and found that it did not contain specific goals, objectives, or performance measures that were relevant to our audit. We did note that DOF maintains a Balanced Scorecard to track initiatives, targets, and accomplishments. The Balanced Scorecard for 2007 indicates a number of accomplishments that enhance the controls over contractor invoice approval, payment, and posting processes:

• Under Internal Operational Excellence, DOF had an objective of continuous improvement. In 2007, the target of having all hard copies of contractor invoices scanned into NFE and electronically routed to the OM had been accomplished. Procedures have been written, and new contracts are being written to encourage vendors to submit invoices electronically.
• Under Promoting Financial Stewardship, DOF has completed a formal program of post-payment controls, reviews, and monitoring and incurred only $1,982 in interest related to the PPA for 2007.

Compliance with Laws and Regulations

The following laws and regulations are relevant to the FDIC’s controls over contractor invoice approval, payment and posting to the G/L:

• The Federal Managers’ Financial Integrity Act (FMFIA) (31 United States Code 3512, subsection (b)) states the head of each executive agency shall establish and maintain systems of accounting and internal controls that provide complete disclosure of the financial results of the activities of the agency and adequate financial information the agency needs for management purposes. In addition, FMFIA requires the head of each executive agency to establish internal accounting and administrative controls that reasonably ensure that (1) obligations and costs comply with applicable law; (2) all assets are safeguarded against waste, loss, unauthorized use, and misappropriation; and (3) revenues and expenditures applicable to agency operations are recorded properly so that accounts and reliable financial and statistical reports may be prepared and accountability of assets may be maintained. While the FDIC is not an executive agency for purposes of the FMFIA, provisions of the FMFIA became applicable to the FDIC via the Chief Financial Officers Act of 1990, described below.
• The Chief Financial Officers Act of 1990 (CFOA) requires that government corporations such as the FDIC submit an annual management report to the Congress that includes a statement on internal accounting and administrative control systems by the head of the management of the corporation, consistent with the requirements for agency statements on internal accounting and administrative control systems under the amendments made by the FMFIA. CFOA also requires the Inspectors General to audit their agencies’ financial statements unless the GAO conducts the audit instead.
• The Federal Deposit Insurance Act (FDI Act), section 17(e), requires that the financial transactions of the FDIC be audited by the GAO in accordance with the principles and procedures applicable to commercial corporate transactions and under such rules and regulations as may be prescribed by the Comptroller General of the United States.
• Two Office of Management and Budget (OMB) Circulars related to internal controls and financial management systems were issued to guide agency compliance with FMFIA.
  • Circular No. A-123, Management’s Responsibility for Internal Control, notes the provisions of FMFIA regarding internal controls, then specifies requirements for assessing internal control, correcting internal control deficiencies, and reporting on internal control. The circular’s high-level discussion does not prescribe specific control or assessments for a particular type of account, but the circular's principles are applicable to all types of agency internal control.

APPENDIX 3

CORPORATION COMMENTS

---

APPENDIX 3

APPENDIX 3

APPENDIX 4

ACRONYMS USED IN THE REPORT

---