[House Hearing, 109 Congress]
[From the U.S. Government Publishing Office]





 IMPROVING INTERNAL CONTROLS: A REVIEW OF CHANGES TO OMB CIRCULAR A-123

=======================================================================

                                HEARING

                               before the

                 SUBCOMMITTEE ON GOVERNMENT MANAGEMENT,
                      FINANCE, AND ACCOUNTABILITY

                                 of the

                              COMMITTEE ON
                           GOVERNMENT REFORM

                        HOUSE OF REPRESENTATIVES

                       ONE HUNDRED NINTH CONGRESS

                             FIRST SESSION

                               __________

                           FEBRUARY 16, 2005

                               __________

                           Serial No. 109-16

                               __________

       Printed for the use of the Committee on Government Reform


  Available via the World Wide Web: http://www.gpo.gov/congress/house
                      http://www.house.gov/reform


                                 ______

                    U.S. GOVERNMENT PRINTING OFFICE
20-879                      WASHINGTON : 2005
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512ï¿½091800  
Fax: (202) 512ï¿½092250 Mail: Stop SSOP, Washington, DC 20402ï¿½090001

                     COMMITTEE ON GOVERNMENT REFORM

                     TOM DAVIS, Virginia, Chairman
CHRISTOPHER SHAYS, Connecticut       HENRY A. WAXMAN, California
DAN BURTON, Indiana                  TOM LANTOS, California
ILEANA ROS-LEHTINEN, Florida         MAJOR R. OWENS, New York
JOHN M. McHUGH, New York             EDOLPHUS TOWNS, New York
JOHN L. MICA, Florida                PAUL E. KANJORSKI, Pennsylvania
GIL GUTKNECHT, Minnesota             CAROLYN B. MALONEY, New York
MARK E. SOUDER, Indiana              ELIJAH E. CUMMINGS, Maryland
STEVEN C. LaTOURETTE, Ohio           DENNIS J. KUCINICH, Ohio
TODD RUSSELL PLATTS, Pennsylvania    DANNY K. DAVIS, Illinois
CHRIS CANNON, Utah                   WM. LACY CLAY, Missouri
JOHN J. DUNCAN, Jr., Tennessee       DIANE E. WATSON, California
CANDICE S. MILLER, Michigan          STEPHEN F. LYNCH, Massachusetts
MICHAEL R. TURNER, Ohio              CHRIS VAN HOLLEN, Maryland
DARRELL E. ISSA, California          LINDA T. SANCHEZ, California
GINNY BROWN-WAITE, Florida           C.A. DUTCH RUPPERSBERGER, Maryland
JON C. PORTER, Nevada                BRIAN HIGGINS, New York
KENNY MARCHANT, Texas                ELEANOR HOLMES NORTON, District of 
LYNN A. WESTMORELAND, Georgia            Columbia
PATRICK T. McHENRY, North Carolina               ------
CHARLES W. DENT, Pennsylvania        BERNARD SANDERS, Vermont 
VIRGINIA FOXX, North Carolina            (Independent)
------ ------

                    Melissa Wojciak, Staff Director
                   David Marin, Deputy Staff Director
                      Rob Borden, Parliamentarian
                       Teresa Austin, Chief Clerk
          Phil Barnett, Minority Chief of Staff/Chief Counsel

   Subcommittee on Government Management, Finance, and Accountability

              TODD RUSSELL PLATTS, Pennsylvania, Chairman
VIRGINIA FOXX, North Carolina        EDOLPHUS TOWNS, New York
TOM DAVIS, Virginia                  MAJOR R. OWENS, New York
GIL GUTKNECHT, Minnesota             PAUL E. KANJORSKI, Pennsylvania
MARK E. SOUDER, Indiana              CAROLYN B. MALONEY, New York
JOHN J. DUNCAN, Jr., Tennessee

                               Ex Officio
                      HENRY A. WAXMAN, California

                     Mike Hettinger, Staff Director
               Tabetha Mueller, Professional Staff Member
                         Nathaniel Berry, Clerk
            Adam Bordes, Minority Professional Staff Member


                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on February 16, 2005................................     1
Statement of:
    Higgins, John P., Jr., Inspector General of the Department of 
      Education..................................................    29
    Steinhoff, Jeffrey C., Managing Director, Financial 
      Management and Assurance, U.S. Government Accountability 
      Office.....................................................    38
    Wolff, Otto J., Chief Financial Officer and Assistant 
      Secretary for Administration, U.S. Department of Commerce; 
      Christopher B. Burnham, Acting Under Secretary for 
      Management, Assistant Secretary for Resource Management and 
      Chief Financial Officer, U.S. Department of State; John P. 
      Higgins, Jr., Inspector General, U.S. Department of 
      Education; and Jeffrey C. Steinhoff, Managing Director of 
      Financial Management and Assurance, U.S. Government 
      Accountability Office......................................     4
        Burnham, Christopher B...................................    12
        Wolff, Otto J............................................     4
Letters, statements, etc., submitted for the record by:
    Burnham, Christopher B., Acting Under Secretary for 
      Management, Assistant Secretary for Resource Management and 
      Chief Financial Officer, U.S. Department of State, prepared 
      statement of...............................................    14
    Higgins, John P., Jr., Inspector General of the Department of 
      Education, prepared statement of...........................    32
    Steinhoff, Jeffrey C., Managing Director, Financial 
      Management and Assurance, U.S. Government Accountability 
      Office, prepared statement of..............................    41
    Wolff, Otto J., Chief Financial Officer and Assistant 
      Secretary for Administration, U.S. Department of Commerce, 
      prepared statement of......................................     7

 
 IMPROVING INTERNAL CONTROLS: A REVIEW OF CHANGES TO OMB CIRCULAR A-123

                              ----------                              


                      WEDNESDAY, FEBRUARY 16, 2005

                  House of Representatives,
Subcommittee on Government Management, Finance, and 
                                    Accountability,
                            Committee on Government Reform,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 2 p.m., in 
room 2247, Rayburn House Office Building, Hon. Todd Russell 
Platts (chairman of the committee) presiding.
    Present: Representatives Platts, Foxx, Towns, and Maloney.
    Staff present: Mike Hettinger, staff director; Dan Daly, 
counsel; Tabetha Mueller, professional staff member; Jessica 
Friedman, legislative assistant; Nathaniel Berry, clerk; Adam 
Bordes, minority professional staff member; and Jean Gosa, 
minority assistant clerk.
    Mr. Platts. A quorum being present, this hearing of the 
Government Reform Subcommittee on Government Management, 
Finance and Accountability will come to order.
    When accounting scandals shook the U.S. economy earlier 
this decade, Congress responded by placing stringent new 
accounting requirements on publicly traded companies. The 
legislation known as Sarbanes-Oxley put responsibility for 
financial information squarely in the hands of managers. To 
ensure that investors could rely on financial reports, 
Sarbanes-Oxley required companies to document the safeguards 
they have in place to prevent errors or fraud, commonly known 
as internal controls.
    Internal controls are the checks and balances that help 
managers detect and prevent problems. They can be as simple as 
computer passwords or having a manager sign off on a time sheet 
or as complex as installing software to track spending and 
detect spikes that signal trouble. Internal controls provide a 
foundation for accountability, and while they are important in 
the private sector, sound internal controls are imperative in 
Government. Public trust depends on nothing less.
    Glaring internal control problems in the Federal Government 
have made headlines recently from the Office of Management and 
Budget's reporting of $45 billion in mistaken payments 
throughout Government to soldiers being paid incorrectly while 
serving in harm's way. When audits revealed egregious internal 
control problems at the Department of Homeland Security, this 
subcommittee proposed and enacted legislation to require the 
Department to take responsibility for improving internal 
controls and to have an auditor attest to those improvements.
    In light of this legislation and the standards for the 
private sector under Sarbanes-Oxley, OMB reexamined controls 
for Federal agencies. I want to applaud this administration for 
this forward looking action and for employing a collaborative 
approach using information gleaned from a committee of agency 
chief financial officers and inspector generals and working 
with the Government Accountability Office.
    As a result of this collaboration, the new guidance was 
issued in December of last year. Like Sarbanes-Oxley and the 
requirements at DHS, the revised guidance puts responsibility 
on agency management and clearly defines the steps that need to 
be taken and documented to ensure that internal controls are 
sound. This hearing will look at what prompted these changes 
and how they will impact agency management.
    We are pleased to have a distinguished panel of witnesses 
with us here today who have played an instrumental role in 
developing these new guidelines. We have the Honorable Otto 
Wolff, CFO and Assistant Secretary for Administration at the 
Department of Commerce and a member of the CFO Council; the 
Honorable Chris Burnham, Acting Under Secretary for Management, 
Assistant Secretary for Resource Management and CFO at the U.S. 
Department of State and a member of the CFO Council; and the 
Honorable Jack Higgins, Inspector General at the U.S. 
Department of Education and a member of the President's Council 
on Integrity and Efficiency.
    Mr. Jeff Steinhoff, Managing Director of Financial 
Management and Assurance at the U.S. Government Accountability 
Office, also joins these administration witnesses. We are 
grateful for your appearance here today and know you've done a 
lot of legwork leading up to this hearing and look forward to 
hearing your testimonies as well.
    I would now like to recognize our ranking member, the 
gentleman from New York, Mr. Towns, for the purpose of an 
opening statement.
    Mr. Towns. Thank you very much, Mr. Chairman. Let me thank 
you for holding this hearing on OMB's recent amendments to its 
guidance on agency internal controls.
    Following last week's insightful hearing on the state of 
our Government's financial position, I believe it is timely for 
our subcommittee to address the issue of internal controls as 
they relate to improving efficiency and accountability 
throughout the Federal Government. The need for adequate 
internal controls in governing the financial and operational 
components of our agencies has never been greater as the burden 
of both Federal budget deficits and improper payments diminish 
the success of many programs. Such concepts are not foreign to 
us, as recent private sector accounting scandals have forced 
Congress to reexamine issues of accountability and transparency 
in the name of protecting consumers and investors.
    From this perspective, it is only logical to pursue 
policies that make the Federal Government more accountable to 
Congress and taxpayers, just as the private sector must be more 
accountable to its shareholders and consumers. Today we are 
reviewing what appears to be the first step in the process as 
we hear from our panel about recent amendments made to Circular 
A-123. In conformity with the Federal Managers Financial 
Integrity Act, the new guidelines bring clarity to areas of 
confusion in defining what are effective management practices 
for assessing internal controls for all agencies. This will 
ensure uniformity throughout agencies as they seek to establish 
an internal control structure that adequately meets appropriate 
levels of risk and program complexity.
    In addition, the changes spell out requirements for 
agencies to report on and address deficiencies in their 
internal control structure. This is an improvement over 
previous practices, and will allow OMB to require an external 
opinion on agency internal controls when warranted. Our 
committee is well familiar with this practice, thanks to 
legislation enacted last session that was authored by the 
chairman of the subcommittee, my good friend, Congressman 
Platts from Pennsylvania, which required an independent review 
for internal control practices at the Department of Homeland 
Security.
    With many agencies now in the process of implementing new 
financial management systems, I believe these requirements are 
timely and necessary. As I have said before, our failure to 
adequately implement appropriate business practices will have 
an adverse impact on operations for programs that so many of my 
constituents depend on for their well-being. Hopefully, the 
aforementioned changes will ensure that all of our agency 
programs will be efficient and effective.
    Thanks again, Mr. Chairman, for holding this hearing, and 
on that note, I yield back.
    Mr. Platts. Thank you, Mr. Towns.
    We will proceed to our testimonies. If we could ask all of 
our witnesses to stand and take the oath. Any individuals who 
will be advising you as part of your testimony today should 
also stand and raise their right hand as well.
    [Witnesses sworn.]
    Mr. Platts. Thank you. Please be seated. The clerk will 
note that all witnesses affirmed the oath. Again, we appreciate 
the written testimony you have submitted. As I say to my kids, 
it is my homework that I bring home with me in my daily 
commute, and it allows me to be better prepared for our good 
dialog here today.
    With your oral testimonies here today, if we can try to 
stay roughly in that 8 minute range in summarizing your written 
statements as best you see fit to do, then we will get into 
questions. Secretary Wolff, we are going to begin with you, 
please.

   STATEMENTS OF OTTO J. WOLFF, CHIEF FINANCIAL OFFICER AND 
  ASSISTANT SECRETARY FOR ADMINISTRATION, U.S. DEPARTMENT OF 
 COMMERCE; CHRISTOPHER B. BURNHAM, ACTING UNDER SECRETARY FOR 
  MANAGEMENT, ASSISTANT SECRETARY FOR RESOURCE MANAGEMENT AND 
  CHIEF FINANCIAL OFFICER, U.S. DEPARTMENT OF STATE; JOHN P. 
HIGGINS, JR., INSPECTOR GENERAL, U.S. DEPARTMENT OF EDUCATION; 
   AND JEFFREY C. STEINHOFF, MANAGING DIRECTOR OF FINANCIAL 
MANAGEMENT AND ASSURANCE, U.S. GOVERNMENT ACCOUNTABILITY OFFICE

                   STATEMENT OF OTTO J. WOLFF

    Mr. Wolff. Mr. Chairman, Mr. Towns, thank you for the 
opportunity to appear before you today to discuss how my 
colleagues in the Federal financial management and audit 
communities have come together in concert with the Office of 
Management and Budget to strengthen the internal control 
requirements over financial reporting within the Federal 
Government.
    As a result of our efforts, we have substantially improved 
the accountability and oversight of internal controls in all 
the Federal departments and agencies. These changes were the 
result of the administration taking a proactive and 
collaborative approach to improving financial management in the 
Federal Government and a direct result of President Bush's 
insistence on accountability at all levels of this 
administration. They are embodied in the revised OMB Circular 
A-123, Management's Responsibility for Internal Controls, which 
was signed in December by OMB Director Bolten. The revised 
circular will help managers assure proper controls are in 
place, documented and tested.
    These changes will also strengthen the existing internal 
control assessment process in a cost effective manner. 
Additionally, these improvements will further support the goals 
of the President's management agenda by promoting a foundation 
of good controls from which timely and reliable financial 
information can be developed.
    We are all too aware of highly publicized corporate 
failures and accounting scandals in recent years which reveal 
the lack of accountability and proper controls over financial 
reporting in publicly held companies, prompting the passage of 
the Sarbanes-Oxley Act of 2002. This legislation included for 
the first time ever the requirement that publicly held firms 
undertake significant efforts to provide assurance on the 
effectiveness of their financial reporting processes and to 
obtain audit opinion on internal controls, in addition to the 
traditional financial statement audits.
    With the passage of Sarbanes-Oxley and the Department of 
Homeland Security Financial Accountability Act of 2004, the 
executive branch took the opportunity of reexamining our A-123 
requirements. Linda Springer, back in November 2003, initiated 
a joint committee of both the CFOs and the IG community, the 
PCIE, to survey Federal agencies and identify differences in 
how current requirements are being implemented, to review 
requirements of publicly traded companies as laid out by 
Sarbanes-Oxley and to report on how these requirements may or 
may not apply to the Federal Government. The joint committee 
first examined the fundamental differences between the public 
and private sectors. Federal entities operate in environments 
steeped in regulation, policies and procedures intended to 
ensure that all fiscal and budgetary actions are legal and 
comply with regulation and standard accounting practice.
    Because the goals and motivation of Federal entities differ 
fundamentally from our private sector counterparts, they are 
much less vulnerable to the risk of manipulation of financial 
reporting to achieve personal gain. Also, the actions of 
Federal entities are open to public scrutiny and subject to 
multiple levels of oversight by the Congress, OMB, the 
Government Accountability Office and the independent inspectors 
general.
    Unlike the private sector, the actions of the Federal 
entities are subject to a myriad of laws and regulations 
designed specifically to promote prudence and accountability. 
The list is long, the FMFIA, the FISMA, the Inspector General 
Act, the Chief Financial Officers Act, the Government 
Management Reform Act, the FFMIA, Improper Payments Act and 
others.
    At the center of these requirements is the FMFIA, which 
establishes the overall internal control requirements. The act 
encompasses controls and programs, operational and 
administrative areas and accounting and financial management. 
It also requires the agency head to evaluate and report on the 
controls and financial systems that protect the integrity of 
Federal programs.
    The joint committee reviewed the existing internal control 
requirements in A-123, and recommended OMB strengthen its 
guidance for assessing the effectiveness of internal controls. 
We developed a revised A-123, which would adopt the standards 
of the internal controls commonly used by private sector and 
developed by the COSO and published in its document. These 
standards were adopted previously by the GAO in its Green Book. 
Key points of definition of the financial audit were included 
in its amendments. As you can see, we did not reinvent the 
wheel amending A-123, we adopted private sector standards that 
were tailored to be more specific and responsive to the Federal 
environment.
    The most significant change to Circular A-123 is the 
requirement for agency management to follow a more 
comprehensive and coordinated approach when assessing the 
effectiveness of internal control over financial reporting, and 
to document its assessment. Management must identify tests of 
documents and internal control effectiveness. A-123 defines the 
scope of reporting to include financial statements, significant 
other financial reports and compliance with laws and 
regulations that pertain to financial reporting.
    The outcome of the assessment process requires a separate 
assurance statement from management to be included in the 
agency's performance and accountability report on the 
effectiveness of internal controls and financial reporting. The 
circular also provides for OMB to require an agency to have an 
internal control opinion level audit if that agency fails to 
meet expectations regarding correction of its internal control 
deficiencies.
    The CFO Council plans to develop an implementation guide 
for A-123 which will complement the policy document and provide 
a more hands-on approach to the assessment of internal 
controls. And we will be sponsoring training for our Federal 
agencies to meet the new requirements.
    In addition, the internal control improvements are being 
tracked through the quarterly scorecard process for improved 
financial performance initiative of the President's management 
agenda. This initiative emphasizes the need for effective 
internal control and getting to a green score on the score card 
requires that agencies eliminate all material control 
weaknesses. Ultimately, the goal is to assure managers are 
making more timely and informed decisions on operations and 
costs at both program and agency levels.
    Yet this objective cannot be achieved without a foundation 
of effective internal controls from which financial information 
can routinely be generated and used for management decisions. I 
am pleased to report that Commerce just attained green status 
for improved financial performance in the first quarter of the 
current fiscal year. We are proud of our success and that of 
our seven other sister agencies who have also achieved green 
status.
    The efforts involved at Cabinet level agencies to overcome 
obstacles to obtain clean audit opinions, to integrate 
financial management systems, and to eliminate material 
weaknesses cannot be overstated. With a higher bar now set by 
A-123 we realize that the implementation will require a serious 
and focused effort.
    As part of the joint committee's review, agencies were 
polled to better understand the costs associated with 
conducting internal control assessments and audits. 
Unfortunately, the majority of agencies did not have sufficient 
experience with the process envisioned in the revised A-123 to 
be able to estimate the costs with any degree of certainty. 
Other agencies who have been performing the internal controls 
work for so long lacked solid data on costs because it is hard 
to identify separately. We will continue to work with the 
agencies to identify more specific cost data and we will let 
you know.
    In closing, I would like to acknowledge the excellent 
collaboration and support in addressing this issue on the part 
of the PCIE, OMB and the whole CFO community. We received 
helpful suggestions as well, sir, from your committee staff and 
the GAO in our discussions with them. The approach presented 
here should be a model for how we can work together to ensure 
that Federal programs operate effectively and efficiently as 
possible. It is incumbent upon all of us to keep the Federal 
financial community focused on its stewardship responsibility.
    Thank you again, Mr. Chairman, for the opportunity to 
appear before you today. I would of course be happy to answer 
any questions you may have.
    [The prepared statement of Mr. Wolff follows:]

    [GRAPHIC] [TIFF OMITTED] T0879.001
    
    [GRAPHIC] [TIFF OMITTED] T0879.002
    
    [GRAPHIC] [TIFF OMITTED] T0879.003
    
    [GRAPHIC] [TIFF OMITTED] T0879.004
    
    [GRAPHIC] [TIFF OMITTED] T0879.005
    
    Mr. Platts. Thank you, Secretary Wolff.
    Secretary Burnham.

              STATEMENT OF CHRISTOPHER B. BURNHAM

    Mr. Burnham. Mr. Chairman, thank you very much, Mr. Towns. 
It's called editing on the go here, so we don't repeat too 
much.
    I would request on behalf of all of us that our full 
written statements might appear in the record, Mr. Chairman.
    Mr. Platts. Without objection.
    Mr. Burnham. Thank you.
    It is a great honor and opportunity to be here. This is a 
terribly important event. Although it is not always looked upon 
as the sexiest thing within our agencies, particularly at the 
State Department, nevertheless it is a terribly important 
aspect of how we run and conduct ourselves as stewards of the 
public trust.
    I am here today not only as Chief Financial Officer of the 
State Department, but also as a member of the CFO Council. The 
CFO Council and Department of State fully support the revisions 
to Circular A-123. We commend this subcommittee for its efforts 
to promote and strengthen internal controls.
    Sarbanes-Oxley was a necessary reaction to the heinous 
abuses of certain members of the corporate community and the 
need to restore broad investor confidence. No less important is 
the need to build taxpayer confidence in how their money is 
spent in Washington. The President's management agenda is the 
premier effort to accomplish this. Circular A-123 is and will 
be an essential part of that effort.
    Under the direction of OMB in 2003 the CFO Council and the 
PCIE formed a joint committee, as my colleague Otto Wolff has 
said. The recommendations resulting from this joint effort 
formed the basis of the policy changes that we have seen today 
in A-123. The CFO Council also plans to work to develop an 
implementation and training guide, as my colleague also 
mentioned.
    Mr. Chairman, I believe this Joint committee effort between 
the PCIE and the CFO Council is an excellent example of how 
both these communities, as well as the IG community, have 
worked together to advance the public good. We are grateful to 
our colleagues in the IG community for their professionalism 
and their dedication and their help in this effort.
    For all Federal agencies implementing the revised Circular, 
it provides a valuable opportunity to reassess the 
effectiveness of our overall internal control structure. The 
level of effort required depends on, in large part, the degree 
to which an agency fully implements the previous version of 
Circular A-123, which was written in 1995. Today the 
implementation of FMFIA varies amongst Federal agencies. Some 
have rigorous FMFIA programs that allow their agency heads to 
provide unqualified annual assurances about their controls, 
while others do not. These mixed results will directly impact 
the level of effort and resources required to successfully 
implement the overall internal control requirements of the 
revised Circular across the Federal Government.
    Some agencies, such as the State Department, will only need 
to modify slightly their existing management control programs. 
Others will need to overhaul their programs, particularly in 
the document and management control area. It is too soon to 
reasonably determine the impact across the agencies of 
implementing Appendix A. Since the requirement of Appendix A is 
more rigorous and prescriptive than the preexisting 
requirements, it is uncertain how many agencies would meet the 
new requirement today.
    Most agencies, including mine, will need to expand 
documentation and enhance assessments of internal controls over 
financial reporting. While we can and will learn from the 
private sector experience implementing Section 404 of Sarbanes-
Oxley, it will take additional time to understand the impact of 
implementing Appendix A in the Federal agencies.
    If I can, Mr. Chairman, let me just highlight a few things 
that State has done as an example of what you have in the 
executive branch and how we are dedicated to meeting these 
goals. Over the last 4 years, we are down from 10 weaknesses to 
zero. This gave the Secretary, in this case Secretary Powell 2 
years ago, the first opportunity to issue a clean assurance 
statement.
    The President's management agenda score card, something we 
all now live and perhaps die by, were double green, in both 
improved financial management as well as budget and performance 
integration. The President's quality award, the Malcolm 
Baldridge Award of Government, and I might also add, a fine 
Connecticut resident, the State Department won this year, one 
of seven agencies to win, recognizing our efforts to integrate 
the performance assessment rating to the PART system that OMB 
runs.
    As many agencies did, we were able to meet the accelerated 
reporting timeframe that OMB mandated of November 15th. This 
has led to huge reforms within the CFO community and has helped 
us and will continue to help us not only to get to green but 
also to meet the particulars of Circular A-123.
    We have a clean, timely financial opinion for the 8th year 
in a row, Mr. Chairman. And finally, our annual report, our 
performance and accountability report, has won the CEAR award, 
the Certificate of Excellence in Accountability Reporting for 4 
years in a row. I might also add that compared with financial 
reports, annual reports in the private sector, 2 years ago we 
were fourth in the Nation, and this last year we were first in 
all of Government.
    None of the successes would have been possible without a 
sound management control structure that permeates our entire 
organization. That starts from the top down. I met with 
Secretary Rice this morning. She emphasized again her support 
of this effort and the effort of what you're trying to lead, 
Mr. Chairman. We stand fully behind this effort and ready to 
implement in any way necessary, as I might add, does the CFO 
community.
    With that sir, I will be happy to answer any questions from 
you or of the committee.
    [The prepared statement of Mr. Burnham follows:]

    [GRAPHIC] [TIFF OMITTED] T0879.006
    
    [GRAPHIC] [TIFF OMITTED] T0879.007
    
    [GRAPHIC] [TIFF OMITTED] T0879.008
    
    [GRAPHIC] [TIFF OMITTED] T0879.009
    
    [GRAPHIC] [TIFF OMITTED] T0879.010
    
    [GRAPHIC] [TIFF OMITTED] T0879.011
    
    [GRAPHIC] [TIFF OMITTED] T0879.012
    
    [GRAPHIC] [TIFF OMITTED] T0879.013
    
    [GRAPHIC] [TIFF OMITTED] T0879.014
    
    [GRAPHIC] [TIFF OMITTED] T0879.015
    
    [GRAPHIC] [TIFF OMITTED] T0879.016
    
    [GRAPHIC] [TIFF OMITTED] T0879.017
    
    [GRAPHIC] [TIFF OMITTED] T0879.018
    
    [GRAPHIC] [TIFF OMITTED] T0879.019
    
    [GRAPHIC] [TIFF OMITTED] T0879.020
    
    Mr. Platts. Thank you, Secretary Burnham.
    Before we move on, I do want to recognize our vice 
chairwoman for the subcommittee, the gentlelady from North 
Carolina Ms. Foxx has joined us. Thanks for being with us.
    Inspector General Higgins.

  STATEMENT OF JOHN P. HIGGINS, JR., INSPECTOR GENERAL OF THE 
                    DEPARTMENT OF EDUCATION

    Mr. Higgins. Mr. Chairman and members of the subcommittee, 
on behalf of the President's Council on Integrity and 
Efficiency, thank you for the opportunity to discuss our 
perspectives on the changes made to OMB Circular A-123, 
Management's Responsibility for Internal Control. I would also 
like to thank the committee for its dedication to the goal of 
improving financial management Government-wide, as well as its 
interest in legislation that would enhance the independence of 
the Inspectors General.
    The Federal Managers Financial Integrity Act of 1982 and 
OMB's implementing guidance contained in A-123 defined 
management's responsibility for internal control in Federal 
agencies, and are the center of the existing Federal 
requirements to improve internal control. Other significant 
legislation passed since the passage of the Integrity Act 
continued to highlight the importance of efficient and 
effective internal controls.
    My testimony will focus on four points: first, the 
importance of effective internal controls; second, how the 
audit community can coordinate its efforts with those of agency 
management; third, our perspectives on how the recent changes 
to A-123 may affect Federal financial management in general; 
and fourth, our views on future legislative action on Federal 
financial management.
    Internal control is important because it is the first line 
of defense in safeguarding assets and preventing and detecting 
errors and fraud. Effective internal controls help ensure 
accountability for resources, achievement of organizational 
objectives and availability of improved information for 
external reporting and internal management decisions.
    In short, internal control is a key factor in helping 
agencies achieve effective and efficient operations, reliable 
financial reporting and compliance with applicable laws and 
regulations. It is a fundamental and statutory responsibility 
of management to institute effective internal controls, assess 
them periodically and make course corrections as needed. Events 
of high profile fraud and mismanagement in the private sector 
and the Federal Government's own financial reporting problems 
have resulted in the increased focus on management's 
responsibility for internal control and dispelled the myth that 
internal control is but a mere academic exercise or it is of 
interest only to auditors and accountants.
    We must realize, however, that having effective internal 
control is not a guarantee that agencies will achieve the 
objectives of internal control. Effective internal control is 
designed to provide reasonable, not absolute, assurance of 
achieving those objectives. Establishment of specific controls 
is subject to cost benefit considerations, availability of 
resources to implement the controls, and any limitations or 
restrictions imposed by legislation. Effective internal 
controls also may be overridden by management and circumvented 
through collusion.
    My second point is how the audit community and agency 
management coordinate on internal control issues. This occurs 
at both the agency and Government-wide levels. There is ongoing 
coordination between agencies and their OIGs that can be 
helpful to agencies as they work to implement new guidance. 
Coordination between the audit community and agency management 
on internal control matters is inherent in the OIG's mission. 
The resolution of audit fundings provides a primary avenue for 
OIGs and agency management to discuss control assessments and 
propose corrective actions.
    At the Government-wide level, the type of cooperation that 
occurred between the CFO Council and the PCIE on the revisions 
to A-123 is not uncommon. The audit community, under the PCIE, 
periodically works with the CFO Council on internal control and 
management issues. An example is the joint CFO Council and PCIE 
Working Group on Improper Payments. This collaborative work 
group's mission is to facilitate the reduction of improper 
payments throughout the Federal Government.
    These ongoing efforts to address internal control issues 
are a natural outgrowth of the responsibilities and 
relationships that OIGs have with their agencies. While the 
work of the OIGs can be helpful to agencies as management makes 
its own assessments, it cannot replace management's own 
assessment efforts, which is contemplated under the new 
guidance. In addition, the OIG must guard against consulting 
type arrangements that might impair our independence for 
performing future audits.
    Third, I would like to turn our attention to major changes 
in A-123 and their potential impact on Federal financial 
management. In the past, the implementation of the Integrity 
Act has been inconsistent. The impact of the recent changes to 
A-123 depends on how aggressively an agency assessed its 
controls under the old guidance and how it will implement the 
new guidance.
    The most significant change is the new requirement for 
management to assess and document internal control over 
financial reporting and to provide a corresponding assurance 
statement annually that asserts the effectiveness of internal 
control over financial reporting.
    Another significant change is the more specific and 
strengthened requirement for management to have a clear, 
organized strategy with well-defined documentation processes 
that contain an audit trail, verifiable results, and specify 
document retention periods. This would enable someone not 
connected with the procedures to understand the assessment 
process. The documentation standard pertains to all internal 
control assessments management performs, not just those related 
to controls over financial reporting.
    Another significant change is OMB's inclusion of the 
provision requiring an opinion on internal controls over 
financial reporting, if an agency continually misses agreed 
upon deadlines for correcting material weaknesses. This was a 
prudent, cost-effective way to provide flexibility to address 
serious, longstanding problems without forcing a one size fits 
all approach Government-wide.
    In the end, the effectiveness of the Integrity Act depends 
on management's commitment to the intent of the legislation and 
implementing guidance. If aggressively implemented in a cost-
effective manner, the resulting improvements to internal 
control should assist Government program managers in achieving 
desired results through effective stewardship of public 
resources.
    Finally, let me turn to my fourth point on future 
legislative action. Effective internal controls and financial 
management are core concerns of the PCIE community. We 
appreciate the opportunity to communicate with you and the CFO 
Council on these issues today. As your subcommittee moves 
forward to consolidate laws affecting these areas, we in the IG 
community welcome the opportunity to continue the dialog and 
provide assistance. The reassessment of financial management 
requirements of Federal agencies should be conducted in a 
cautious and deliberate manner, carefully considering the costs 
and the anticipated benefits of the changes.
    This concludes my statement, and I would be happy to answer 
any questions.
    [The prepared statement of Mr. Higgins follows:]

    [GRAPHIC] [TIFF OMITTED] T0879.021
    
    [GRAPHIC] [TIFF OMITTED] T0879.022
    
    [GRAPHIC] [TIFF OMITTED] T0879.023
    
    [GRAPHIC] [TIFF OMITTED] T0879.024
    
    [GRAPHIC] [TIFF OMITTED] T0879.025
    
    [GRAPHIC] [TIFF OMITTED] T0879.026
    
    Mr. Platts. Thank you. Mr. Steinhoff.

STATEMENT OF JEFFREY C. STEINHOFF, MANAGING DIRECTOR, FINANCIAL 
MANAGEMENT AND ASSURANCE, U.S. GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Steinhoff. Mr. Chairman, members of the subcommittee, 
I'm very pleased to be here today to talk about internal 
control and OMB's recent changes to Circular A-123. Internal 
control gets to the heart of accountability. The subcommittee's 
focus on this topic is very timely and most important. Your 
continuing leadership has been a catalyst to the broad 
accountability improvements we see across the Government today.
    The Congress has long recognized the importance of internal 
control. Over five decades ago, the Budget and Accounting Act 
of 1950 placed the responsibility for internal control squarely 
on the shoulders of management. Management was told that they 
were responsible for maintaining sound systems of internal 
control. That was made very, very clear.
    In 1982, when faced with a series of major internal control 
breakdowns, the Congress responded with the Federal Managers' 
Financial Integrity Act. In many respects, this action by the 
Congress put us two decades ahead of the private sector, which 
is now in some cases grappling for the first time with 
documenting controls and doing some of the things that Federal 
agencies have been doing for many years.
    This straightforward, two-page law reaffirms that sound 
internal control is a fundamental responsibility of management, 
and requires that agency heads sign their name on the dotted 
line each year as to whether their internal control systems 
meet the requirements established by the Comptroller General. 
This is where Circular A-123 comes in. It represents OMB's 
guidance for assessing and reporting on internal control under 
the act.
    In short, we support the recent changes to A-123 and view 
them as a welcome step forward. We applaud the efforts of the 
administration to what I call revitalize this important act.
    I want to spend a few minutes highlighting what I think 
will be six issues critical to effectively implementing these 
changes, and in doing so speaking to some of the lessons 
learned from the early years of FMFIA. First, we support OMB's 
plans to provide further implementation guidance. These 
materials should demand an appropriate rigor to whatever 
assessment and reporting process management adopts. Management 
should have flexibility to do what makes sense in their 
environment.
    But at the same time, whatever guidance is issued, everyone 
must make sure that this does not become a paperwork exercise. 
In the initial years of FMFIA, agencies almost drowned in 
paper. Sometimes it seemed that the assessment and reporting 
process had become the end game. That's why in 1995, OMB 
relaxed the assessment and reporting requirements. But the 
pendulum, I think, swung too far then and you saw very mixed 
implementation of the act. That required the recent 
recalibration or the changes to Circular A-123, to put this 
important accountability component fully back on the radar 
screen. So again, as I mentioned before, this is very, very 
welcome and very, very timely.
    Second, while the revised Circular focuses on internal 
control over financial reporting, which is very appropriate, 
agencies must also remain vigilant to the broader range of 
internal controls that cover program operations, which are 
exemplified by the 25 areas on GAO's high risk list and are 
clearly the focus of FMFIA.
    Third, there will need to be strong support for managers 
throughout an agency, both because of the broader nature of 
FMFIA, about which I just spoke, but also because the CFO 
typically does not control all the systems and processes needed 
for financial reporting. For example, at DOD about 80 percent 
of the information needed for financial reporting comes from 
non-financial systems, such as logistics, procurement, or 
personnel systems. These systems are not under the purview of 
the Comptroller.
    Fourth, assessments will have to be risk-based, and the 
appropriate balance reached between the costs and benefits of 
controls. In focusing on controls, you need to have the right 
controls at the right time and the right place, and to guard 
against both under and over control. I'm speaking not only 
about having cost-effective processes for assessment but 
assuring cost-effective controls as well. Because while the 
Government certainly has serious weaknesses in areas where 
controls must be strengthened, I think there are many 
opportunities to streamline and simplify controls as well.
    Fifth, management testing of controls in operation will be 
important to knowing what is working well and what is not. The 
auditor can be a help here; but this job is a basic ongoing 
management responsibility and should not be just shifted to the 
auditor. This is something you've got to be doing day to day, 
every day.
    Sixth, management has to be held accountable for doing the 
right thing. If there are serious internal control breakdowns 
and it is determined that management has not been vigilant in 
implementing FMFIA and following the concepts that are in the 
OMB circular, there should be some consequence for this. People 
do react and do act if they see there are incentives and 
disincentives. I think that was oftentimes lacking in the past.
    Annual oversight hearings, combined with linkage to the 
appropriations process for agencies that are not doing the job, 
and are valuable tools. And I don't mean that just because an 
agency has a weakness, that they are not doing the job. They 
might have inherited some deeply rooted problems they are still 
working on. So one must make both a qualitative and 
quantitative decision there. But oversight hearings and the 
appropriations process are two ways that Congress can make its 
voice heard and hold managers accountable.
    Let me touch on one final matter: auditor opinions on 
internal control over financial reporting, a concept we have 
long supported and continue to support. At GAO we practice what 
we preach. Not only do we render opinions of internal control 
over financial reporting for the entities that we audit, the 
Bureau of the Public Debt, IRS, the FDIC, and soon to be SEC, 
but we also have our independent auditor render an opinion on 
our internal control over financial reporting.
    We believe that the joint GAO-PCIE financial audit manual 
holds the key to getting this important job done at a 
reasonable cost. We look forward to working with the CFOs and 
the IGs as they conduct the mandated cost benefit study. We 
want to do this right, and to roll it out in a way that makes 
sense. I think it should not be a matter of ``if'' this is 
ultimately done. It's ``when'' it's done and if it's done in a 
way that adds value.
    Also as he discussed with you last week in his testimony on 
the audit of the 2004 consolidated financial statements of the 
U.S. Government, the Comptroller General has been discussing 
this issue with the JFMIP principals.
    Mr. Chairman, this concludes my summary remarks. I want to 
again thank you and the members of the subcommittee for your 
important leadership. I would be pleased to answer any 
questions that you may have.
    [The prepared statement of Mr. Steinhoff follows:]

    [GRAPHIC] [TIFF OMITTED] T0879.027
    
    [GRAPHIC] [TIFF OMITTED] T0879.028
    
    [GRAPHIC] [TIFF OMITTED] T0879.029
    
    [GRAPHIC] [TIFF OMITTED] T0879.030
    
    [GRAPHIC] [TIFF OMITTED] T0879.031
    
    [GRAPHIC] [TIFF OMITTED] T0879.032
    
    [GRAPHIC] [TIFF OMITTED] T0879.033
    
    [GRAPHIC] [TIFF OMITTED] T0879.034
    
    [GRAPHIC] [TIFF OMITTED] T0879.035
    
    [GRAPHIC] [TIFF OMITTED] T0879.036
    
    [GRAPHIC] [TIFF OMITTED] T0879.037
    
    [GRAPHIC] [TIFF OMITTED] T0879.038
    
    [GRAPHIC] [TIFF OMITTED] T0879.039
    
    [GRAPHIC] [TIFF OMITTED] T0879.040
    
    [GRAPHIC] [TIFF OMITTED] T0879.041
    
    [GRAPHIC] [TIFF OMITTED] T0879.042
    
    [GRAPHIC] [TIFF OMITTED] T0879.043
    
    [GRAPHIC] [TIFF OMITTED] T0879.044
    
    [GRAPHIC] [TIFF OMITTED] T0879.045
    
    Mr. Platts. Thank you, Mr. Steinhoff.
    Before we continue, I would like to recognize that we have 
been joined by the gentlelady from New York, Mrs. Maloney. 
Thank you.
    We will go right into questions, and we will do 5 minutes 
or so for each Member and have various rounds. Mr. Steinhoff, I 
want to first comment on your work and sitting here with two 
CFOs, and as one who played an integral role in the CFO Act 
back in 1990, and now partnering with our CFOs and our IGs in 
this collaborative effort, what important work it is. Your 
comment about the A-123 Circular revision revitalizing FMFIA 
is, a very important note. And that's really what this 
subcommittee, through our work on the DHS bill last session and 
now continuing with our oversight responsibilities on the 
Circular, is seeking to do.
    Mr. Steinhoff. Mr. Chairman, I would like to add another 
point to that. When you mentioned the CFO Act, at the time of 
FMFIA, agencies really weren't in the same position as they are 
today. You didn't have, for the most part, what I would call 
professional CFOs. And you have a much different set of 
dynamics today. You have that act and that structure in place 
to carry a lot of this out.
    Mr. Platts. That evolution, 50 years ago, when as you 
referenced the legislation back in 1950 and now through to this 
day, combined with everything in between, has put, I believe, 
the Federal Government in a great position to really work hard 
at truly getting its financial house in order. And that's what 
each of you is seeking to do in your individual agencies or in 
a collaborative effort as members of the PCIE or CFO Council 
and with GAO. So we're delighted to have your efforts out there 
and have you here today.
    What I thought, maybe for each of our CFOs and IGs, if all 
or one of you would want to give, just in laymen's terms, an 
example of an internal control in your department, just to kind 
of set the stage for what we are talking about, the kinds of 
things that should be occurring to protect taxpayer funds in 
each of your departments.
    Mr. Wolff. I'd be happy to try and answer that, Mr. 
Chairman. I think internal controls come at all levels, at the 
macro level and a micro level. Where we start in our department 
is leadership at the top. We have a new Secretary of our 
Department, Carlos Guittierez, who was previously the head of 
Kellogg Corp. He turned that corporation around, and he has 
been here a week. He had his first meeting with the senior 
staff early this weekend. One of the first things he emphasized 
was accountability, by his managers sitting around the table, 
by his senior staff and throughout the organization.
    It starts at the top. It's our responsibility to inculcate 
the culture from the top all the way down to the bottom. 
Concurrent with that, I meet with the CFOs in all our bureaus 
on a monthly basis. So those are the macro kinds of controls. 
The other kinds of things, the reviews you do of travel reports 
and those kinds of things. Those would be examples of micro 
level of internal controls.
    Mr. Platts. OK. Mr. Burnham.
    Mr. Burnham. Thank you, Mr. Chairman.
    Like the Department of Commerce, we have a new Secretary as 
well. I think it is indicative of her, of the emphasis she 
places on management, that her first briefing while she was 
going through the confirmation process was from the management 
bureaus of the State Department and the Under Secretary for 
Management. So clearly, we have top down support and focus on 
this effort. We have a best practice that is held up by OMB as 
a best practice. It's also at the macro level. And of course, 
we know that it flows downhill, so it has to start there.
    We have a management control steering committee. This is 
the most important thing that agencies can implement. This is 
chaired by me as the Assistant Secretary and Chief Financial 
Officer. It also consists of nine other assistant secretaries 
and the IG as a non-voting member. This is the group that comes 
together on a regular basis to determine whether or not we have 
material weaknesses, reportable conditions. We receive a report 
from the auditor.
    Government is a hybrid. We have no board of directors. You 
are our board of directors. But yet, unlike a board of 
directors, we don't have an audit committee. We do have an IG, 
but we do not have yet an internal audit capability, but we 
certainly plan to as part of our process of seeking and 
attaining an outside audit of our internal controls.
    But it starts there at that senior level committee that is 
going to provide the top down guidance, the macro guidance, 
that's going to go all the way down.
    Let me just also mention too at the micro level. It's 
supervisory oversight as well, and you mentioned one of these 
in your example. But it's also peer review, peer review in 
terms of making sure that it doesn't always have to be a 
supervisor, it can also be a colleagues in a voucher examiner 
capacity also doing a peer review on someone else. These are 
the kinds of things we have to do at the State Department.
    Mr. Platts. Thank you.
    Before I yield to the ranking member, we are going to get 
into the A-123 Circular. One aspect of that implementation is 
with the CFO Council developing a training program or guidance 
for the effective implementation. Could you give us an update 
where that process is and what kind of timeframe we're looking 
at to have that information, that assistance out there, so that 
all the departments and agencies can go forward in a positive 
way with the new Circular?
    Mr. Burnham. We are fleshing that out right now, Mr. 
Chairman. We anticipate that we will be able to, that OMB will 
be able to issue guidance on that some time in the spring, 
that's as close as I can get it right now, sir.
    And we have established a separate subcommittee of the CFO 
Council that is dealing exclusively with this issue, the 
Sarbanes-Oxley, with A-123 issues.
    Mr. Platts. When you flesh that out and you have some of 
your training programs for your managers, will that training be 
cross-agency, cross-department, to allow that give and take as 
the CFO Council does at the senior level, or will it be more 
within each department or agency?
    Mr. Burnham. No, as a matter of fact, I also chair the Best 
Practices of the CFO Council. Just yesterday we had our monthly 
meeting, in fact, this was brought up. We plan to have a couple 
of different ways, not only in terms of written guidance, in 
terms of training sessions across agency, inter-agency, not 
just for CFOs, but also for our colleagues within the 
community.
    We also are looking at building a panel so that during our 
regular monthly meeting we would bring a panel of outside 
experts that would come in and tell us how they have 
implemented this in the corporate world. We are also seeking a 
panel, sir, of public policy experts, those of you who visit 
this on a daily basis. You, perhaps Congressman Oxley and 
others, sir, we would love to have come before the Council and 
give us your impression.
    Finally, we are looking to do a retreat. We get bombarded 
with e-mails for all kinds of retreats. I'm sure you do as 
well. We can go to Harvard, we can go to all these kinds of 
places for 3, 4, 5 days, they cost thousands of dollars. We're 
looking actually to build possibly in conjunction with the 
Association of Government Accountants a retreat where from the 
assistant secretary level and below we can send numerous 
people, come there and really have an intense two, three in-
depth training session on this.
    Mr. Platts. I commend your efforts in chairing the Best 
Practices subcommittee in that learning, benefiting from each 
other. That's great.
    Mr. Towns.
    Mr. Towns. Thank you very much, Mr. Chairman.
    Mr. Steinhoff, let me start with you. How can an agency 
like NASA, with the vast majority of the budget being allocated 
to private contractors and vendors, ever improve their internal 
control functions without streamlining their procurement 
activities? Have issues concerning the lack of control over 
property, plant and equipment been addressed by the agency?
    Mr. Steinhoff. Congressman Towns, those are areas on GAO's 
high risk list. NASA procurement and that whole array you were 
just speaking about are high risk areas. NASA faces contract 
management challenges. They face challenges in the financial 
management as well. NASA has had problems bringing up financial 
systems that operate effectively and is trying to grapple with 
those now.
    You are really putting your finger on some high risk areas, 
that really affect the ability of NASA to carry out its 
mission, because NASA is dependent on the contract community. 
And when contracting, procurement, and all that oversight is a 
high risk area, it makes it difficult. My understanding is that 
at one time NASA built the platforms and all that itself. It 
had most of the scientific community. Today, as you stated, 
they are largely dependent on contractors. So getting on top of 
contract management is very, very important.
    Mr. Towns. Thank you.
    I am not going to be able to stay throughout, so let me ask 
this question just in case the chairman doesn't ask it, let me 
ask it. Since the enactment of Chairman Platts' legislation 
that requires an independent opinion of DHS' internal controls, 
can you update us on any progress the agency may have made for 
developing and implementing improvements to their internal 
control structure? Have the efforts of DHS been hampered 
because of the distinct nature of its legacy agencies, or are 
they similar to internal control deficiencies at other Federal 
departments?
    Mr. Steinhoff. I have some knowledge on this. DHS is 
another area on our high risk list. Certainly when you put a 
new department together, 1 day they don't exist, the next day 
they do, and you throw together a bunch of groups, that makes 
it hard. Many of those units that were merged into DHS had 
internal control issues coming in. Some had serious control 
problems coming in. So you had to face having to be up and 
running from day one without a clear infrastructure at the 
department level. Again, our high risk designation focuses on 
that problem.
    With respect to what they are doing to really address the 
mandate that the chairman had placed in the DHS bill, I can't 
speak to the progress they have made today, other than the fact 
that they had a conference, the Comptroller General spoke at 
it, and they made a presentation on their plans for 
implementing FMFIA and OMB Circular A-123.
    It seemed to me they had a good grasp for how to approach 
this. It seemed to me they were involving all the entities, all 
the activities. They had various levels of steering committees 
that involved their various components, and involved people at 
sufficiently high levels that things should in fact be 
achieved. So they seemed earnest, they seemed to want to 
proceed ahead, they seemed to want to get on top of their 
problems.
    But they do face what anyone would say are high risk 
challenges. It would be again very challenging for them.
    Mr. Towns. Thank you very much.
    Secretary Burnham, it recently came to our attention that 
billions of dollars allocated by Congress toward the 
international efforts in Iraq and elsewhere are unaccounted 
for. While I understand that your agency's mission is distinct 
from that of DOD can you offer us any assurance that our 
appropriations in support of our international efforts within 
the State Department are being well managed and controlled? Are 
there any allocation discrepancies within your agency that we 
should be made aware of?
    Mr. Burnham. Mr. Towns, thank you for that question. Let me 
address just post-turnover, when Ambassador Negroponte arrived 
in Baghdad. Let me just say that most of the programs that we 
are implementing through foreign assistance programs and 
through the Iraqi Relief and Reconstruction Fund are being 
executed by either DOD, which I will not comment on, although I 
have complete faith in, and USAID. USAID has a legacy of 
exceptional controls that they place through their 
comptroller's office, through independent audits, not just only 
in Iraq, but in every country where AID operates. They have 
very strong oversight programs. I have complete faith in what 
AID is doing, particularly under the leadership of 
Administrator Andrew Natsios.
    So, sir, if you would accept my assurance that I have full 
faith as an American taxpayer in what we're doing there and 
what our State Department is doing there, and what AID is doing 
there, then if you'll accept that, sir, I'll leave it at that.
    Mr. Towns. Thank you very much. We're going to have to go 
into recess, Jim had to leave to vote, and I must leave to go 
somewhere. We will just have a 5-minute recess.
    [Recess.]
    Mr. Platts. We will reconvene the hearing. My apologies for 
the delay. Unfortunately, I may need to run out again. We have 
a markup in the Education Committee downstairs. I'm getting my 
exercise today. Hopefully the next vote will be a little while 
before they call it.
    I want to continue on a number of issues here. One 
important aspect of the A-123 Circular, is not requiring every 
department and agency to have an audit opinion on their 
internal controls, as we are doing with DHS. We are going to 
look at the cost benefit of doing that in a broader sense. As 
written, it gives OMB that discretion. I would like each of 
you, if you could touch on what type of threshold you envision 
for when OMB should invoke that discretion and require an 
audit. Is it a dollar amount, is it a persistent number of 
years? What in your opinion would warrant an audit opinion on 
the internal controls?
    Mr. Wolff. I suppose I should let the Government 
Accountability Office go first on this one, sir, but I will 
take a stab at it. It seems to me you can't put a dollar 
threshold on implementing this provision of A-123. I think it 
is more a subjective call on how an agency is doing. Are they 
properly identifying their internal controls? Are they carrying 
out the plans that they have set in place to correct those 
internal controls, and are they doing it in a timely way?
    I think that is the bottom line on the call at OMB. You 
can't just set a dollar threshold, because what might be 
material at the Department of Defense may not be in one of our 
sub-bureaus, for example. There is a great debate going on at 
each agency right now about this materiality issue. It is one 
that is fairly well parochialized because of the difference in 
programs across Government.
    That's the short answer, I think, sir, to what you are 
asking.
    Mr. Burnham. Mr. Chairman, stewardship has no price. I 
think we all agree on that in the room. It doesn't mean that we 
spend a nickel to account for a nickel. But it does mean that 
we have to eventually get to a point where we have required 
audits of our internal controls.
    For the State Department, that means $4.5 million is our 
best guess at this point, 2 to 3 years. It has to do with 
testing. It has to do with documentation. And finally, it has 
to do with building what we call a senior review committee, 
otherwise known in the outside world as an internal audit 
capability. We want to be very respectful of our IG, but the 
reality is that we should all have an internal audit capability 
or internal senior review committee.
    When those three things are well on their way, when using 
the balance score card, OMB can say that most agencies are at 
yellow, if not green for progress, yellow for status, then I 
think it's time for OMB or the Congress to act. I don't think 
it's 2 years, but I think certainly within the next 5, sir.
    Mr. Platts. Thank you.
    Mr. Higgins. I think that one of the things you have to 
take into consideration initially is the cost benefit of this 
opinion. Certainly it would be a concern from my perspective if 
you had repeat findings that continued year after year without 
being corrected.
    But I do think the first thing you have to do is look at 
the cost benefit of this, how much it is going to cost you and 
what you are going to get out of it.
    Mr. Steinhoff. A couple of thoughts on this, since we have 
been pretty vocal for many years on this matter. Not only do we 
do it, but really in a strict technical sense, we're not 
required to follow FMFIA. The law doesn't really apply to GAO 
per se. But we follow that law.
    I agree with what Mr. Burnham said. I think the agency has 
to see where they are on this. I believe it can be done in a 
cost-effective manner. It should be a by-product of doing a 
financial audit using the joint GAO/PCIE Financial Audit 
Manual, which I think has taken us to the level that we are 
doing first rate financial audits. I would put the Federal 
financial audits ahead of what was being done in the private 
sector in terms of quality. It gives the auditor the ability to 
render an opinion on controls. We do it right now by following 
the GAO/PCIE methodology.
    I think you have to look at the value in terms of that, 
it's an independent set of eyes. When agencies were first 
required to prepare financial statements, there was a lot of 
the same thinking that it was not cost effective to audit the 
financial statements you know, let's just send in the reports. 
So what an audit opinion provides is a second, independent set 
of eyes. And it is providing an assurance.
    If you look at SSA, which I really think is the role model, 
they voluntarily prepared financial statements and had them 
audited in the mid-1980's. They took their lumps long before 
there was any glimmer that this thing was ever going to become 
law. And they are now one of the first to be up front and get 
an opinion on controls. I believe this year was the first year 
they got a clean opinion on controls because they were able to 
get past the computer security hurdle, which is a difficult 
hurdle. That's a tough hurdle, even if you get by it once.
    SSA should be most proud of the fact that on their own 
volition they have had that tone at the top and have pushed 
ahead, as Mr. Burnham explained was his goal at State, and have 
voluntarily done so. But I think it is really a cost of doing 
business in Government. I think we can do it in a cost-
effective manner. I think it can add value. If management does 
have the kind of internal control program in place that is 
envisioned in A-123, it makes the auditor's job a lot easier, 
because management has tested its controls. Management has a 
basis for its assurance, and management can say to you that 
yes, we do meet the standard and this is what we base that on.
    If you have an entity that has lots and lots of problems 
and they can't provide that assurance, I could see the 
auditor's job being very easy, they don't have assurance. It 
shouldn't cost the auditor anything. Take DOD, I could give 
that opinion in just the time it would take me to write it up.
    So I think moving through in an orderly manner, whether 
it's 2, 3, 4, 5 years, it would differ by agency, makes a lot 
of sense.
    Mr. Platts. Secretary Burnham, your statement was that you 
envision State being at that point in 2 to 3 years, right?
    Mr. Burnham. Yes. I would anticipate regardless that we 
will have an internal audit of our internal controls within the 
next 2 to 3 years. I think as I said, it will cost $4 million 
to $5 million to get there because of the three steps that we 
have to take. Then I think beyond that it's fairly de minimis. 
It's perhaps a 25 to 50 percent increase in our overall 
independent outside audit, which right now stands just below $1 
million.
    Mr. Platts. Secretary Wolff.
    Mr. Wolff. May I just add, Mr. Chairman, the comments of my 
friends, notwithstanding, I don't think we can underestimate 
the cost. I think we run the risk of underestimating the true 
costs of the audit part of this provision. There is no question 
in my mind that the exercise is beneficial. No one is arguing 
that.
    But when you do audits of the Social Security 
Administration's internal controls, it is quite different, they 
are a single focus agency. As important as they are, it's a 
single focus. They pay folks checks.
    When you have an agency as diverse as ours, where you've 
got everything from counting all the people in the country 
every 10 years with 500,000 employees to running weather 
satellites to controlling radio spectrum, the costs start going 
up considerably. That, coupled with the open source news 
reports in the Wall Street Journal, the Financial Times and 
others in which the cost of the additional burden in the 
private sector ranges anywhere upward to 100 percent over 
current audit costs, we need to very closely look at that 
before we start mandating these things absent additional 
funding from the Congress.
    Mr. Platts. Secretary Wolff, is it fair to say, though, 
that given the complexity of Commerce or State or Education 
that because you are not single focused, really, as Social 
Security is, it's all the more important that we ensure that 
your internal controls are up to the challenge before you? It 
would make the argument why you should be doing them because of 
the complexity of your mission.
    Mr. Wolff. Sir, we are already hard at work documenting our 
internal controls. I am not arguing with that. I think it is a 
very worthwhile exercise.
    As far as annual audit opinions, though, of the 
management's assertions and internal controls, it's quite a 
different story. I think we need to look at it very closely. 
This interagency review that's being undertaken jointly with 
the PCIE and the CFO Council will hopefully lead us to a 
satisfactory conclusion.
    Mr. Platts. Actually, you led into my next question, which 
was, under my DHS legislation, the requirement for this joint 
study, cost benefit study, I was wondering, between CFOs and 
our Inspector General where we are in that review, that study, 
at this point. Are we still kind of early on?
    Mr. Wolff. Yes, sir, pretty early on.
    Mr. Platts. OK. Great.
    Mr. Burnham. Mr. Chairman, can I just add one thing to my 
colleague, Secretary Wolff? He did bring up a very important 
point. From my own legislation days, I know how objectionable 
we found it when we had to vote on something which was an 
unfunded mandate. The importance, of course, of understanding 
that, finding $4.5 million in the State Department budget, is 
going to be a difficult task. So unless we do have support 
across the board, both from our own colleagues as well as from 
the Congress, it is going to be very tough to implement this. 
So we certainly would urge you, sir, to work with the 
appropriators in full support.
    Mr. Platts. That leads nicely into the next question I 
have, but I have to run downstairs and put a vote in. I 
apologize, but if you are patient, I will be right back and we 
will continue the dialog. We stand in recess for a few minutes.
    [Recess.]
    Mr. Platts. The subcommittee will reconvene.
    The Federal Managers Financial Integrity Act, having been 
in place for 23 years now, an aspect of that was to focus on 
the internal controls. Is it that what we are requiring now is 
so much greater that we have this infrastructure buildup, that 
we need to expend these dollars to get up to where we can do 
internal audits or is it that over those 20 years there wasn't 
the level of focus and commitment on internal controls as 
Congress intended when FMFIA was passed that we're now kind of 
all on the same page, finally, with the new Circular and really 
making the investment?
    Mr. Wolff. Sir, I think Mr. Steinhoff touched on that a 
little bit in his testimony. Back in the 1980's, there was a 
great deal of attention, as you probably know, given to 
internal controls. It became as he said, a paper intensive 
process. The documentation of the process became an end unto 
itself.
    So the internal control weaknesses remained while the 
process was fine. So that's what led the administration, back 
in 1995, apparently, to make the judgment that they should back 
off on the requirement for the reporting part of it. I think 
the pendulum, as he said, did swing too much the other way and 
now we're back, and with a different focus. The documentation 
requirement is there, but it's more an inculcation of the 
culture rather than a paper process. So there's a huge 
difference.
    Mr. Platts. Maybe we can explore in that difference, 
because a big part of the audit is compliance with all the laws 
and regulations of each department and agency. Would it be 
logical to require your Department's auditor to get an opinion 
on compliance with FMFIA and how would that opinion differ from 
an actual opinion on your internal controls?
    Mr. Steinhoff. Yes, FMFIA requires management to have an 
evaluation process that meets the guidelines that are 
established by OMB. If you are going to give an opinion on 
that, you would basically say whether or not management was 
assessing its controls in some orderly manner that made sense, 
was in a position to put its assurance statement together, and 
had in fact rendered the report that the law required it to 
render. You wouldn't, though, be giving an opinion on the 
controls themselves. You would be giving an opinion on the 
process they followed.
    Going back, and I apologize for being back here a minute 
late.
    Mr. Platts. I was quick.
    Mr. Steinhoff. You were very quick. In looking at the 1982 
act, you really had such a steep learning curve that agencies 
didn't know what to do. But they had to immediately be doing 
something. There was this tremendous cry for a lot of specific 
guidance. So what you had was in-depth guidance that would be 
used by an auditor to do a vulnerability assessment or internal 
control review, massive training and a lot of very specific 
things.
    It really drove people to just generate lots of paper to be 
trying to comply with a very rigorous evaluation process for 
which they did not understand the principles undergirding it. 
You had entities that might have 30,000 or 40,000 assessable 
units and each unit would apply an assessment guide. Then they 
would roll it up at all these levels. It just became a blizzard 
of paper.
    My job for about 10 years was overseeing all this. It got 
worse and worse as people became more sophisticated in the 
process. It really took hold. They worked very hard. I would 
give them an A for effort. But we ended up with too much paper, 
and finally that pendulum swung and OMB basically said, forget 
the whole thing. I think it fell off the radar screen around 
1995. Now it's back on, which I think is very positive.
    Mr. Platts. Secretary Burnham, did you have something you 
wanted to say?
    Mr. Burnham. No, I just, while you left the room, I got 
into a little bit of hot water with my colleagues. They said I 
was jumping the gun.
    Mr. Platts. On the 2 to 3 years? [Laughter.]
    Mr. Burnham. They didn't use the word showboat, but--
[laughter]--we have a great team at State that was there long 
before I got there. But we have priorities. Our No. 1 priority 
is building a global financial platform and integrating six 
legacy data bases into one legacy data base and building that 
across 171 different countries and 150 different currencies. 
That's our premier goal, building a global financial management 
system.
    Getting an independent audit of our internal controls is 
something we certainly want to do, certainly want to work 
toward, whether or not in a scarce resource environment like 
the one we're heading toward, and with the responsibility that 
you and other members of this committee and Congress hold to 
get the deficit cut in half for the next few years and then 
eliminated.
    If we can do all of this, these are certainly things we 
want to do. So that's certainly the direction we're trying to 
head.
    Mr. Platts. With all due respect, I know at least one or 
more of your fellow witnesses here are military veterans as 
well. I think that's the can-do attitude of the Marine in you 
coming out, that we're just going to get it done. And that's a 
good thing.
    I think the point you just made about the scarce resource 
environment in which we're in is all the more why making sure 
we get it right on internal controls needs to be a priority. We 
talked last week with the Comptroller General about the $45 
billion, OMB's estimate, best possible, which doesn't include 
all departments and agencies, of the improper payments. As we 
get ready in January 2006 to begin the new Medicare 
prescription drug plan that is going to cost somewhere in the 
$50 billion or $60 billion a year range, we can fix our 
internal controls, especially at DOD and some of the larger 
agencies, Medicare itself. It goes a long way to paying that 
commitment on prescription drugs without new money, but just 
with the money we have, but better accounting and use of it.
    So even in scarce resources, I know it's going to be 
challenging to come up with these dollars for the additional 
cost. But it's all the more why we need to do it. But your 
message is still well heard. I have said many times, I'm not an 
appropriator. All of us wish we were. If I could wear my 
oversight hat and my appropriation hat, it would be a perfect 
match, although that would not be a good internal control 
probably. [Laughter.]
    So I need somebody watching me.
    I want to actually take up where I got off track here. With 
FMFIA, from the management attestation requirement there, is 
that in your opinion, both from the Department and GAO, fulfill 
the new Circular requirement of attestation on your internal 
controls, if you do go through what's required under FMFIA?
    Mr. Steinhoff. Yes.
    Mr. Platts. So is there a belief that we need to do 
anything from a statutory standpoint with the act itself to 
strengthen it, to kind of dovetail with what OMB has done 
through the administrative process?
    Mr. Steinhoff. No, because the act envisioned that OMB 
would issue the guidance and would lay out how to assess and 
report.
    Mr. Platts. So to maintain that discretion?
    Mr. Steinhoff. Yes.
    Mr. Platts. OK. I'm always an optimist, that when we lay 
out our plans we are going to move forward and achieve them and 
strive to our best ability to do so. But given that 20 year 
history, Mr. Steinhoff, you have recounted it well in your 
testimony, both written and here today, of FMFIA from 1982 
through the 1980's and mid-1990's and basically kind of like, 
it's not working. Well intended, but we didn't get the results.
    Why would you believe that we should be more optimistic 
this time, that we are really going to get it right and do what 
we're all setting out to do, and wy shouldn't we be? Is there a 
reason we should not be optimistic?
    Mr. Higgins. I think 20 years ago there was a lack of 
appreciation for the importance of internal control. Since that 
time, there has been a lot of emphasis given to financial 
reporting, financial statement audits. There is a better 
understanding of the need for that. Plus, we have had some 
terrible situations in the private sector that brings it to 
everybody's mind.
    I think the revisions to the new A-123 would do a lot. It 
lays out management's responsibility, it gives specific 
guidance into what they should do for the financial statement 
part of the reporting. So I think that we should wait and see.
    Mr. Platts. Kind of the silver lining in some of the bad 
occurrences of ENRON and WorldCom is that it's raised the level 
of scrutiny and the priority of this issue?
    Mr. Higgins. Absolutely. I mean, in my department alone, 
there has been a tremendous amount of improvement in the last 4 
or 5 years. The Student Financial Aid Office just got taken off 
the high risk list.
    Mr. Steinhoff. And I think in looking at it, there were 
some very positive by-products of FMFIA in the early years. It 
did drive internal control down to the lowest level. There were 
literally thousands and thousands of small control tweaks at 
those lower levels. And agencies did a lot, some maintained it, 
some perhaps did not. But they did a lot to document their 
underlying systems. There has been a lot done with the passage 
of the CFO Act to document the underlying accounting systems 
and those operations, which really is a great jump start to 
revitalize FMFIA.
    So I think in some respects, as I mentioned before, we are 
ahead of the private sector going in. We have some tremendous 
challenges. We have a different level of accountability, and 
our accountability is much more visual to the average person 
when they don't get their benefit check or the Government does 
something wrong. But I think there is that appreciation. I also 
believe you have a different type of manager in Government 
today and you have a set of, a cadre of highly qualified CFOs, 
which you did not have back in 1982. That was kind of an 
afterthought that was added to someone's title, and they really 
didn't focus on internal control.
    Mr. Platts. I share that belief as well, in the CFO Act. 
It's one of the reasons we pushed for Senate confirmation of 
the DHS CFO, was to ensure we didn't regress. We have 
established a high standard for our CFOs, and to ensure that 
scrutiny does occur, because we do want that mind set that's 
changed to continue and not go the other way.
    Mr. Wolff. Sir, I fully concur with what my colleagues have 
said. Certainly the financial environment today is 
substantially different in many ways from the way it was back 
in the 1980's. I was around back in those days, too. It is a 
totally different way of doing things. There is far more 
emphasis on doing things the way the private sector does them 
and lifting best practices from the private sector and applying 
them appropriately in Government.
    But probably more important than that is, for reasons I'm 
not quite certain I understand, the folks that are doing all 
the hard work on this internal controls review and 
documentation are seeing the value of doing it. So you are 
institutionalizing something that is essential to begin with. I 
think that is going to be the key to the success of this, that 
people are actually seeing the benefit of what they are doing.
    Mr. Platts. I think when I caught my breath I remembered 
the question I wanted to followup with when we were talking 
about the cost of doing it. This kind of relates to Secretary 
Wolff, the value of doing it.
    Now at State, Secretary Burnham, you're looking at, say, 
$4.5 million extra to get your Department in place to do the 
internal audit and move forward from there, which is going to 
be out of, in essence, your portion of State's money that you 
are given. Is there any discussions, dialog at the senior level 
in State, or Commerce or Education, that there is an incentive 
to do it? I'll give you an example, with Homeland Security. 
Last year, as we were pushing for my legislation, there was a 
report about within the Transportation Security Administration, 
I forget how many tens of millions of dollars of overruns 
regarding, I think it was screening equipment or something, 
because of lack of good internal controls.
    So even if they had spent $10 million in making sure their 
internal controls were up to par, they would have come out way 
ahead as a Department whole. But to the IG or financial 
management sector of DHS, they spent more money. In other 
words, if by doing this audit you are able to identify savings 
that those savings accrue to your office within the Department 
to help pay for the cost, are there any discussions of that 
nature?
    Mr. Burnham. We do have discussions of that nature, 
although I think long term, the State Department is going to 
get savings from other areas, such as the 21st century 
technology platform, such as fulfilling the President's vision 
of competitive sourcing, the PMA agenda item on competitive 
sourcing. I think this is going to be far more beneficial to 
the State Department and to the American taxpayer, at least in 
our case.
    And as of now, I would certainly say we are going to have 
to find the money to get us to a level of testing and 
documentation. Although I would not say that the goal of 
getting to a place where we can receive and be comfortable that 
we are going to receive a clean opinion on an independent audit 
of our internal controls is anything different from what we had 
planned to do before Circular A-123 Appendix A. In other words, 
I think that, as my colleagues today have outlined, it's a new 
environment than it was 20 years ago. It's a new environment 
than it was 4 years ago. And reflecting that, we have changed 
our focus and are trying to grow with it.
    Mr. Platts. And with the suggestion in my question about 
sharing of the benefits, there is a little bit of caution 
there, because there would be a little bit of a gotcha, if one 
part of State finds wrongdoing by another part, you get the 
benefit of that savings, which could create some internal 
battles or tension. But it's something that when we are looking 
to how to pay for this renewed effort, there are going to be 
benefits reaped.
    The example my staff shared with me in my memory is, the 
total contract was $18 million, and the question here of which 
$9 million was not able to be accounted for by the Department. 
And originally it was only a $4 million score to begin with. So 
it escalated dramatically and then couldn't be accounted for in 
the end, half of what that escalation was. So obviously it 
would have been a Department-wide benefit to having better 
controls in place. So something to perhaps look at as you are 
looking for money. Because you rightfully acknowledge it's 
going to be hard getting additional dollars from Congress, 
given the fiscal challenges we are facing as a Nation.
    Mr. Burnham. Mr. Chairman, I believe you are referring to 
the Iraqi money, not the IRRF money.
    Mr. Platts. This is in TSA here, stateside.
    Mr. Burnham. OK.
    Mr. Platts. Yes, not within State, but within Homeland 
Security.
    Mr. Higgins. From the IG's perspective, the community 
certainly thinks this is like apple pie. But the highest people 
in the Department of Education clearly recognize that we bring 
back through our recommendations and work more than we cost the 
Government. But these unfunded mandates are killing us. In my 
office alone, in 1996, we were at 368 people. Today we are at 
285. That's almost an 80 person FTE reduction because of the 
cost of the financial statement audit, and the cost of doing 
business. So we're getting fewer people and more 
responsibility. So it is a concern of the IG community.
    Mr. Platts. As we demand more, we give you less.
    Mr. Higgins. Well, you actually give us more, but it 
doesn't cover the bill. It's sort of like my home budget. 
[Laughter.]
    Mr. Wolff. May I comment, Mr. Chairman?
    Mr. Platts. Yes, Secretary Wolff.
    Mr. Wolff. I would just like to make sure that my record is 
clear here. I strongly support this review. We are eating 
internally in each of our bureaus the costs of doing the 
reviews and the documentation. My concern is that the annual 
audit opinions are going to increase costs considerably. That's 
quite different from doing the work that we are doing under A-
123. We are going to be doing the work, and monitoring the 
progress. The IG is going to be watching what we are doing as 
are GAO and your committee and a host of other folks.
    It's rendering the audit opinion by one of the big four 
where we run the risk of giving them a blank check, quite 
frankly.
    Mr. Platts. Point well made. It is something that we need 
to be smart about how we do this and not create a new problem 
as we try to fix an old one.
    Mr. Steinhoff. Mr. Chairman, I would say that I agree that 
the process has to be well managed and expectations should be 
well managed. It has to be done in a very smart manner. That's 
why we see some kind of phased approach to opinions on internal 
control, when it makes sense for an agency.
    I want to add another perspective on control which I think 
benefits from really exploring one's controls. In some areas, 
frankly, there's too much control. I'll give you an example. We 
did a review a few years ago where we benchmarked what were the 
travel policies for best practice companies. And they would 
have anywhere from 8 to 15 pages of rules. They would enforce 
those rules. If you broke the rule, you were no longer employed 
there.
    We compared that to DOD; we worked with DOD on this in a 
collaborative effort. They had 1,357 pages of travel rules at 
that time. They were accounting for every nickel and dime. They 
had to have people there to help people fill out the vouchers. 
And they went through a major process to streamline and knock 
out pages and pages of rules. There were unnecessary controls. 
Probably every time something went wrong over 50 years, they 
added another requirement. They went through and they just 
simplified it. They got some legislation and no longer do you 
have to have a cab receipt for $5. You have to trust the person 
if it's less than $75.00, and just change the whole 
accountability approach.
    We did another review where we found horrendous controls 
over property, but at the same time, we found millions of 
accounting transactions that Defense was processing, thinking 
they were providing more accountability. Those accounting 
transactions actually were dropping the items from visibility. 
So there was a tremendous expense to process all those 
transactions. And those transactions were worsening control.
    So when someone gets down there and starts kicking the 
tires, and gets down there in the weeds, I think they will find 
as a by-product there are ways to streamline and simplify. 
Agencies should be allowed to look at things in a cost 
beneficial manner, not spend $1.10 to save $1.
    Mr. Platts. That's something that, this committee, we share 
that perspective, with those 1,357 pages of travel rules, they 
probably had about 100 different systems to monitor compliance 
with them, too, given the number of systems over there at DOD.
    Mr. Steinhoff. Yes.
    Mr. Platts. But that point is something that, will be 
something we are going to pursue as a committee on the 
financial management laws, is that we have added over the last 
20 plus years numerous laws. And part of our efforts, we have 
stated as a subcommittee this session, is to try to streamline 
all those laws to make them more efficient, that you can 
comply, as our Federal financial managers out there, a little 
easier on the financial management community to know that you 
are in full compliance with what Congress is expecting of you.
    So as we said last week, and will say again today, we will 
be looking for great insights from CFO Council, from the PCIE, 
from GAO as we move forward in that streamlining process.
    I want to just maybe touch on one last issue here from the 
auditing process. Inspector General Higgins, we had your 
colleague, the CFO at Education, here last week, we talked 
about the continuous auditing process, and how, because of 
Sarbanes-Oxley and the private sector more of a year-round 
engagement rather than end of the year run, or sprint, I would 
be interested in each of your Department's perspective. My 
understanding is at Education that is kind of more the norm, 
where you are starting in February or so, leading up to the end 
of the year, rather than waiting for the last couple of months.
    Where is Commerce, State? I want to make sure I'm accurate 
with Education. And then Jeff, from a broad perspective, your 
familiarity with others. What is the norm out there now and is 
this a good idea that we see in the private sector, that it is 
more a year-round process, hand in hand with your auditors?
    Mr. Wolff. We are getting close to having a year-round 
auditor presence. They left in December and they are going to 
be back next week for their in-brief for the current fiscal 
year. I think it's beneficial. I think it's beneficial to have 
them there, quite frankly. The earlier they start, the easier 
it is to get all the problems that they may encounter out of 
the way by the end of the year.
    So that's where we are, and I anticipate that we will be 
eventually getting them regular office space.
    Mr. Burnham. Similar to State, thanks to the leadership of 
OMB that required quarterly statements, of course. We now are 
around the clock, around the year producing the kinds of 
financials that are necessary to achieve OMB's requirement. By 
the way, that's also part of the PMA. So just getting to green 
in fulfilling the President's vision is also part of that.
    Our own audit started last month. We will continue to press 
on to November 15th of this calendar year.
    Mr. Platts. OK. Thank you.
    Mr. Higgins. You are correct about Education. I do think it 
is a benefit. I mean, as issues come up during the year, they 
are there and they know about them in advance. So they are able 
to give more information while it is going on. I think it is a 
benefit.
    Mr. Steinhoff. I think it is the norm for large entities. 
These are large entities, when you talk about the CFO Act 
agencies. That's the norm. It's got benefits on both sides. 
This is a real key to audit quality. This morning I 
participated in a forum that the Public Company Accounting 
Oversight Board held where there was lots of talk that the key 
to a good audit of a private sector corporation, publicly 
traded company, is the auditor's knowledge of the business. If 
you're auditing Proctor and Gamble, you have to understand the 
business. You have to understand their competitors. You have to 
be looking at things in that context and have a complete 
understanding of the business and how they operate.
    To successfully audit these large Federal entities, you 
have to have an understanding of the Federal Government, of the 
Federal environment and of the missions and programs and 
operations of that Department. So having auditors there full 
time year-round, is very beneficial to the auditor. For the 
financial audits that we conduct, we are there year-round. We 
never leave IRS. That's a huge, complex operation. We are there 
12 months a year.
    Also, we work very hard to have continuity on that audit. 
We don't put a new bunch of people on every year, when we 
rotate someone off, we bring them along and we have experienced 
people doing that work. They have to understand those 
processes, how those systems work over there, the complexity of 
the tax systems. Year-round is the only way to go. Small 
entity, that's a different story. You can come in and out.
    Mr. Platts. The fact that we are more and more the norm 
being year-round I think is another reflection of that change 
in mind set and focus on these issues. I have had the benefit, 
as a new subcommittee chairman, last term, coming in following 
Steve Horn, who really took his responsibilities very seriously 
for this subcommittee's oversight role and focusing on 
financial management. And I came into the Congress in 2000 with 
a President who has made good management a cornerstone of his 
administration through the President's management agenda, which 
I'm trying to help keep pushing the ball in the right direction 
down the field as a newer chairman.
    One last thing, and for our two CFOs, kind of a little bit 
off the issue of internal controls. But it's just a structural 
question, and I think Secretary Burnham, you mentioned earlier 
internally your work with CFOs of different offices, programs 
within the Department that you work with that are specific to 
one part of the Department. I was curious, within both your 
Departments structurally your oversight of those subordinate 
CFOs from a hiring review standpoint relates to another agency 
we are looking at and how you in the end are the one who is 
going to be responsible for the entire Department's 
information. But what really direct interaction do you have or 
oversight do you have of those subordinate CFOs?
    Mr. Wolff. Yes, sir, I can't speak for Secretary Burnham, 
but I will say that at the Commerce Department, I personally 
interview each major bureau CFO before he or she is hired. My 
statutory deputy CFO also interviews them. My statutory deputy, 
Jim Taylor, who is sitting behind me here, also has 25 percent 
of their performance evaluations each performance cycle, in 
consultation with me.
    Mr. Platts. Great.
    Mr. Burnham. I believe it was Secretary Wolff who mentioned 
that he had the CFOs in other parts of the Department of 
Commerce. We don't have CFOs, actually, elsewhere. I have a 
deputy CFO. But what we do have is financial management 
officers at our posts overseas. These are incredible men and 
women, the quality of these individuals, many of them certified 
public accountants that are now coming in, many of them in 
second careers that have come in from the private sector who 
want to join the Department, who want to go overseas and are 
fulfilling the role of Chief Financial Officer of an embassy. 
Some of these embassies are absolutely enormous. In Cairo, we 
have over 3,000 individuals, in Berlin, certainly Baghdad is 
also going to be quite large.
    So just because we don't call them a CFO does not mean that 
they are not. It is that individual embassy's assurance 
statement that Ambassador must submit to my office annually. 
That is the backbone of the Secretary's assurance statement and 
part of our overall review and existing internal control 
process, leading of course not only to mine, to the Secretary, 
but ultimately to the Secretary as reported in the Performance 
and Accountability report.
    Mr. Platts. You don't have the same direct interaction on 
the interview process and review, given the number of posts out 
there, it sounds, as at Commerce?
    Mr. Burnham. Because of the uniqueness of the State 
Department, they are Foreign Service officers, thus they go 
through the hiring process of the Foreign Service. Then they do 
not report to me, they report to the Ambassador, who is the 
chief executive officer, and as we know, the chief American in 
country, except when the President visits.
    Mr. Platts. OK. Inspector General Higgins, are you familiar 
with that structural oversight within Education? I didn't think 
to ask Mr. Martin last week.
    Mr. Higgins. Actually, he was just here a little while ago. 
Jack reports directly to the Under Secretary or Deputy 
Secretary in the Department. I think that's the appropriate 
line of reporting.
    Mr. Platts. As far as other subordinate CFOs, you're not 
sure what----
    Mr. Higgins. There are no other--well, there is a CFO at 
FSA--the PBO, at the Department of Education--but she reports 
to the COO of FSA. But there is a reporting relationship down 
at the CFO level to Jack's office. It's not real clear, 
actually.
    Mr. Platts. OK. Something I think that as we look at 
promoting greater internal controls, including in the 
management standpoint, because ultimately as we say, at 
Commerce you are responsible for those final or overall 
department financial management and having input, reviews and 
hiring input to who is running those operations at the 
subordinate level is, I think, very important.
    Mr. Wolff. Yes, sir. I just want to make sure I clarify, my 
colleague mentioned the PBO over there. We also have a PBO, 
which is the Patent and Trademark Office. I do not have 25 
percent of their performance evaluation, nor do I interview 
their selectees for their financial positions over there, by 
law.
    Mr. Platts. OK. Thank you.
    I think we touched on the issues we wanted to cover. I want 
to thank you again for your patience with me running in and 
out. As we go forward, we touched on two very important issues 
that both the Council and the President's PCIE and CFO Council 
are going to play a role in that implementation of the new 
Circular and in that cost benefit, that joint study. We will 
look forward, as a subcommittee, working with all of you on 
that, as well as with GAO on this issue.
    I want to commend each of you for your efforts. I said as 
we had a staff briefing in anticipation of today's hearing, one 
of the things, in reading your bios and your experience and the 
successor efforts at your respective departments or at GAO is, 
we want you to kind of finish that 2 or 3 year focus at State, 
do your work, and then we want to move you en masse over to 
DOD. [Laughter.]
    We're going to put you to the next challenge. Because that 
certainly is, as we heard last week, ultimately for the Federal 
Government as a whole, we can do great work, but eventually we 
have to take on that 600 pound gorilla that's sitting out 
there. You are getting great experience and doing great work 
that we want to at some point have benefit that Department as 
well.
    So thank you for your testimony and your time today. We 
will keep the record open for 2 weeks for any additional 
information and submissions that you may have. This hearing 
stands adjourned.
    [Whereupon, the subcommittee was adjourned.]

                                 
