Government Corporations: CFO Act Management Reporting Could Be Enhanced
(Letter Report, 09/19/94, GAO/AIMD-94-73).
Congress passed the Chief Financial Officers Act of 1990 to improve the
federal government's financial management practices, systems, and
reporting. Although most of its provisions target executive agencies,
the act also broadened audit and management reporting for government
corporations. The act strengthened existing audit requirements for
government corporations and requires each to issue an annual management
report to Congress that includes financial statements, management's
statement on internal controls, and the auditor's report resulting from
the audit of the financial statement. In addition, the act provides for
the inclusion of a reconciliation to the corporation's budget report and
other information needed to inform Congress about the corporation's
operations and financial condition. This report discusses whether the
required financial audits for 1992 were done and whether the
corporations issued the management reports. GAO identified the
approaches management used to assess internal controls. GAO also
determined whether government corporations had enough guidance to
effectively implement the act's audit and management reporting
requirements.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-94-73
TITLE: Government Corporations: CFO Act Management Reporting Could
Be Enhanced
DATE: 09/19/94
SUBJECT: Federal corporations
Financial statement audits
Federal agency accounting systems
Reporting requirements
Financial management
Financial disclosure reporting
Financial records
Accounting procedures
Corporate audits
Internal controls
IDENTIFIER: PBGC Multiemployer Fund
**************************************************************************
* This file contains an ASCII representation of the text of a GAO *
* report. Delineations within the text indicating chapter titles, *
* headings, and bullets are preserved. Major divisions and subdivisions *
* of the text, such as Chapters, Sections, and Appendixes, are *
* identified by double and single lines. The numbers on the right end *
* of these lines indicate the position of each of the subsections in the *
* document outline. These numbers do NOT correspond with the page *
* numbers of the printed product. *
* *
* No attempt has been made to display graphic images, although figure *
* captions are reproduced. Tables are included, but may not resemble *
* those in the printed version. *
* *
* A printed copy of this report may be obtained from the GAO Document *
* Distribution Facility by calling (202) 512-6000, by faxing your *
* request to (301) 258-4066, or by writing to P.O. Box 6015, *
* Gaithersburg, MD 20884-6015. We are unable to accept electronic orders *
* for printed documents at this time. *
**************************************************************************
Cover
================================================================ COVER
Report to Congressional Committees
September 1994
GOVERNMENT CORPORATIONS - CFO ACT
MANAGEMENT REPORTING COULD BE
ENHANCED
GAO/AIMD-94-73
CFO Act Reporting
Abbreviations
=============================================================== ABBREV
ADF - African Development Foundation
CFO - chief financial officer
CCC - Commodity Credit Corporation
COSO - Committee on Sponsoring Organizations of the Treadway
Commission
FDIC - Federal Deposit Insurance Corporation
FFB - Federal Financing Bank
FHA - Federal Housing Administration
FMFIA - Federal Managers' Financial Integrity Act
GAO - General Accounting Office
GAAS - generally accepted auditing standards
GAGAS - generally accepted government auditing standards
GCCA - Government Corporation Control Act
GNMA - Government National Mortgage Association
GPRA - Government Performance and Results Act
IAF - Inter-American Foundation
OMB - Office of Management and Budget
PADC - Pennsylvania Avenue Development Corporation
PBGC - Pension Benefit Guaranty Corporation
RTC - Resolution Trust Corporation
Letter
=============================================================== LETTER
B-257154
September 19, 1994
The Honorable John Glenn
Chairman
The Honorable William V. Roth, Jr.
Ranking Minority Member
Committee on Governmental Affairs
United States Senate
The Honorable John Conyers, Jr.
Chairman
The Honorable William F. Clinger, Jr.
Ranking Minority Member
Committee on Government Operations
House of Representatives
The Congress passed the Chief Financial Officers (CFO) Act of 1990
(Public Law 101-576, November 15, 1990) to address critically needed
improvements in the federal government's financial management
practices, systems, and reporting. While most of its provisions are
directed at executive agencies, the CFO Act also broadened audit and
management reporting for government corporations and related entities
which represent a major element of the federal government. The CFO
Act amended the Government Corporation Control Act to strengthen
existing audit requirements for government corporations\1 and
requires each to issue an annual management report to the Congress
that includes financial statements, management's statement on
internal controls, and the auditor's report resulting from the audit
of the financial statements. In addition, the act provides for the
inclusion of a reconciliation to the corporation's budget report and
other information necessary to inform the Congress about the
corporation's operations and financial condition.
As part of our efforts to help ensure the successful implementation
of the CFO Act, we set out to determine, for 1992, whether the
required financial audits were performed and management reports
issued by corporations. Also, to understand management's basis for
its statement on internal controls, we identified the approaches used
by management to assess internal controls. We also determined
whether government corporations had sufficient guidance to
effectively implement the act's audit and management reporting
requirements.
We are sending you this report to assist in your Committees'
oversight of CFO Act implementation.
--------------------
\1 As used in this report, the term "government corporations" refers
to those entities identified in the Government Corporation Control
Act as mixed-ownership or wholly-owned corporations. These entities
generally conduct revenue-producing, commercial-type activities on a
self-sustaining basis and have many of the attributes of private
corporations. The term also includes other entities that are
specifically subject to the audit and management reporting
requirements of the Government Corporation Control Act. See appendix
I for a list of the government corporations and other entities which
are subject to these requirements and included in this review.
RESULTS IN BRIEF
------------------------------------------------------------ Letter :1
Thirty-three of the 34 government corporations obtained audits of
their 1992 financial statements, and the auditors for 31 of these 33
reported that the financial statements were fairly presented in
accordance with generally accepted accounting principles. Accounting
problems caused the auditors for the other two corporations to not
issue opinions on selected financial statements; also, one of these
auditors qualified its opinion on the statement of financial
condition. The one corporation that did not obtain an audit stated
that it was unaware of the CFO Act requirement but planned to comply
in the future. A second corporation was also unaware of the CFO Act
requirement but subsequently took steps to have its 1992 financial
statements audited.
All but three of the 34 government corporations issued the required
management reports for 1992. As previously stated, two were not
aware of the requirements and one did not issue a 1992 management
report because it said resources were needed for higher priority
work. For the remaining 31, the management reports generally
contained the information required by the CFO Act including the
financial statements and management's statement on internal controls.
Management for 27 of the 31 corporations that issued a management
report reported that its internal controls provided reasonable
assurance that the objectives of internal controls were being
achieved. The other four corporations did not specifically state
whether internal control objectives were being achieved.
We believe the management reports would be more useful if they were
prepared using consistent criteria and implementing guidance for
assessing internal controls and preparing other financial and
performance information. Due in part to an absence of authoritative
guidance, the government corporations used different approaches to
prepare the management reports resulting in significant differences
in assessing and reporting on the condition of internal controls and
other required information which reduced the usefulness of the
reports. OMB has developed criteria and guidance for executive
departments and agencies to follow in implementing various reporting
requirements under the Federal Managers' Financial Integrity Act and
the CFO Act. As a result, OMB is in the best position to assist
government corporations in establishing similar implementation
guidance.
We also believe that the value and usefulness of annual financial
statement audits both to management and the Congress can be enhanced
by obtaining positive assurance from the corporations' auditors on
the effectiveness of internal accounting controls.
BACKGROUND
------------------------------------------------------------ Letter :2
In 1990, the Congress passed the Chief Financial Officers Act (Public
Law 101-576, November 15, 1990) to (1) bring more effective general
and financial management practices to the federal government, (2)
provide for improvement in agency systems of accounting, financial
management, and internal controls to help ensure the issuance of
reliable financial information and to deter fraud, waste, and abuse
of government resources, and (3) provide for the production of
complete, reliable, timely, and consistent financial information to
the executive branch and the Congress to assist them in financing,
managing, and evaluating federal programs.
While most of the CFO Act's provisions are directed at executive
agencies, it also contains provisions regarding financial
accountability and reporting for government corporations. The CFO
Act amended the audit and reporting requirements contained in the
Government Corporation Control Act (GCCA) (31 U.S.C. 9101 et seq.)
which are applicable to the entities listed in the GCCA and to
certain other governmental entities--such as the African Development
and Inter-American Foundations whose enabling legislation requires
that they follow them. Thus, when the CFO Act amended the GCCA to
strengthen audit and management reporting requirements for the
corporations listed in the act, it also strengthened audit and
reporting requirements for those other government entities. See
appendix I for a list of the 34 government entities we identified as
subject to the GCCA's audit and management reporting requirements.
The CFO Act strengthened the GCCA's financial statement audit
requirements by requiring annual audits in place of less frequent
audits previously required for most government corporations. Audits
required under the act are to be conducted by either the
corporation's Inspector General or an external auditor and in
accordance with generally accepted government auditing standards
(GAGAS).\2 Further, GAO may conduct a required audit at its
discretion or at the request of a Committee of the Congress in lieu
of an audit by the Inspector General or an external auditor. Annual
financial statement audits serve to improve the quality and accuracy
of financial information by providing an independent assessment of
the reliability of management's financial statements and helps
establish discipline in the financial systems and controls.
To strengthen management's accountability and make the financial
results more visible, the CFO Act also requires the management of
each government corporation to report to the Congress not later than
180 days after the end of each fiscal year. Each report is required
to contain the following information:
the corporation's annual financial statements;
a reconciliation to the budget report of the government
corporation, if applicable;
the report resulting from the audit of the corporation's financial
statements;
management's statement on internal controls consistent with the
requirements for agency statements on internal accounting and
administrative control systems\3 under the Federal Managers'
Financial Integrity Act of 1982 (FMFIA) (Public Law 97-255); and
any other comments or information necessary to inform the Congress
about the operations and financial condition of the corporation.
Although FMFIA does not apply directly to any government corporation,
the CFO Act established internal control reporting requirements for
corporations that are similar to those imposed on executive agencies
by FMFIA.
Under FMFIA, executive agencies are required to (1) establish a
system of internal accounting and administrative controls which
provide reasonable assurance that three specific internal control
objectives\4 are achieved, (2) evaluate annually their system of
internal accounting and administrative controls using guidelines
established by OMB, and (3) issue a statement annually on whether the
agency's internal accounting and administrative controls fully comply
with established internal control standards and provide reasonable
assurance that internal control objectives are being achieved. If
the system of internal accounting and administrative controls does
not comply with the standards and/or does not provide reasonable
assurance, FMFIA requires that the annual statement include a report
identifying any material internal control weakness found and the
agency's plans for correcting the weakness.
--------------------
\2 GAGAS are issued by the Comptroller General of the United States
and apply to financial and performance audits. For financial
statement audits, GAGAS incorporated the fieldwork and reporting
requirements of generally accepted auditing standards (GAAS) issued
by the American Institute of Certified Public Accountants. However,
unlike GAAS, GAGAS require the auditor to issue a written report on
the results of its work on internal controls and compliance with laws
and regulations conducted as part of the financial audit.
\3 Internal accounting and administrative controls consist of the
plan of organization and the methods and procedures adopted by
management to ensure that resources are used consistent with laws,
regulations, and policies; that resources are safeguarded against
waste, loss, and misuse; and that reliable data are obtained,
maintained, and fairly disclosed in reports.
\4 Under FMFIA, the objectives of the system of internal controls are
to provide reasonable assurance that obligations and costs are in
compliance with applicable law; funds, property, and other assets are
safeguarded against waste, loss, unauthorized use, or
misappropriation; and revenues and expenditures applicable to agency
operations are properly recorded and accounted for to permit the
preparation of accounts and reliable financial and statistical
reports and to maintain accountability over assets.
OBJECTIVES, SCOPE, AND
METHODOLOGY
------------------------------------------------------------ Letter :3
Our objectives in this review were to
determine whether government corporations were meeting the CFO
Act's annual auditing and reporting requirements,
identify the approaches used by corporations to assess internal
controls and support management's statement on internal
controls, and
determine if corporations have sufficient guidance to effectively
implement the act.
To accomplish these objectives, we discussed with OMB officials the
universe of entities subject to the audit and reporting requirements
contained in the GCCA, as amended by the CFO Act. We also obtained
and reviewed any guidance that OMB provided to government
corporations to assist them in implementing the CFO Act. We obtained
and reviewed the 1992 management reports and related documents issued
by government corporations to determine whether the corporations met
the CFO Act's auditing and reporting requirements.
To identify the basic approaches used to assess and report on
internal controls and determine whether they had sufficient guidance
to implement the act, we interviewed financial management officials
from each corporation and obtained documentation on the approach each
corporation used to assess and report on internal controls. However,
we did not evaluate the effectiveness of the approaches used or the
results that were produced.
The Office of Management and Budget provided written comments on a
draft of this report. These comments are presented and evaluated in
the "Agency Comments and Our Evaluation" section and are reprinted in
appendix VII. Our work was performed in accordance with generally
accepted government auditing standards.
MOST 1992 FINANCIAL STATEMENTS
WERE RELIABLE
------------------------------------------------------------ Letter :4
Thirty-three of the 34 government corporations had their 1992
financial statements audited in accordance with GAGAS as required by
the CFO Act. The one exception was the African Development
Foundation (ADF). Independent public accounting firms audited the
financial statements of 29 of the 33 corporations that obtained
audits. We audited the financial statements of three
corporations--the Federal Deposit Insurance Corporation (FDIC),
Pension Benefit Guaranty Corporation (PBGC), and Resolution Trust
Corporation (RTC).\5 The Department of Agriculture's Inspector
General audited the 1992 financial statements of the Commodity Credit
Corporation (CCC).
In explaining why ADF did not meet the CFO Act's statutory audit
requirement, officials of the Foundation advised us that they were
initially unaware of the requirement. Once it was determined that
the CFO Act's audit requirement was applicable, the ADF initiated
steps to plan for the preparation and audit of its 1994 financial
statements. A second entity, the Inter-American Foundation (IAF),
was also initially unaware of the audit requirement. Subsequently,
it took steps to have its 1992 financial statements audited. In this
regard, on June 24, 1994, the IAF's auditor issued its report on 1992
financial statements.
For all but two--the Federal Housing Administration (FHA) and
PBGC--of the audited government corporations, the auditors reported
that the financial statements were fairly presented in accordance
with generally accepted accounting principles. A scope limitation on
the FHA independent auditor's work prevented the auditor from
expressing an opinion on FHA's September 30, 1992, statements of
operations and cash flows. The scope limitation occurred because FHA
was unable to identify for the auditor the fiscal years in which the
events giving rise to an additional loss reserve occurred due to the
lack of accurate loan information and a loan assessment process in
prior years.
We qualified our opinion on the statement of financial condition for
one of PBGC's two funds because a scope limitation prevented us from
assessing whether the Multiemployer Fund's liability for future
financial assistance was fairly presented and because material
uncertainties affected the liability assessment process.
Specifically, PBGC had not obtained sufficient data on liabilities of
certain financially troubled multiemployer plans for us to determine
the reliability of the reported liability amount.\6 In addition, we
did not express an opinion on PBGC's fiscal year 1992 statements of
operations and cash flows for its two funds because PBGC's fiscal
year 1991 financial statements were unauditable and those statements
materially affected PBGC's fiscal year 1992 operations and cash
flows. For fiscal year 1993, Price Waterhouse and GAO conducted full
scope audits of FHA and PBGC, respectively. Appendix II lists the
auditors for the government corporations and provides information on
their audit reports.
--------------------
\5 Under separate statutory requirements, GAO is responsible for
auditing the financial statements of FDIC and RTC. GAO has conducted
audits of PBGC's financial statements because of its high risk and
continuing congressional interest. The results of these audits are
contained in Financial Audit: Federal Deposit Insurance
Corporation's 1992 and 1991 Financial Statements (GAO/AIMD-93-5, June
30, 1993); Financial Audit: Pension Benefit Guaranty Corporation's
1992 and 1991 Financial Statements (GAO/AIMD-93-21, September 29,
1993); and Financial Audit: Resolution Trust Corporation's 1992 and
1991 Financial Statements (GAO/AIMD-93-6, June 30, 1993).
\6 After issuing our qualified opinion on PBGC's fiscal year 1992
statement of financial condition for the Multiemployer Fund, PBGC
obtained sufficient information on the multiemployer plans in
question to assess its potential loss exposure. After evaluating the
information, PBGC restated its fiscal year 1992 liability for future
financial assistance to record additional liabilities. As a result,
we subsequently removed the qualification on our fiscal year 1992
opinion on the Multiemployer Funds statement of financial position.
(See GAO/AIMD-94-109, May 4, 1994.)
MOST MANAGEMENT REPORTS WERE
ISSUED
------------------------------------------------------------ Letter :5
Management for 31 of the 34 government corporations issued their 1992
reports as required by the CFO Act. ADF, IAF, and the Federal
Financing Bank (FFB) were the exceptions. As previously discussed,
ADF and IAF initially were not aware of the CFO Act's management
reporting requirement but have taken steps to meet the reporting
requirement in the future. An FFB official advised us that FFB did
not issue a 1992 management report because its resources were needed
for higher priority work. Twenty-eight of the 31 corporations which
issued 1992 management reports did so on a timely basis. The other
three corporations issued their management reports late--by an
average of 4 months--because of administrative delays and because
their auditors were not in a position to complete their audits and
issue their reports before the corporations' management reports were
due.
The 31 management reports generally contained the information--
financial statements, auditor's report, and management's statement on
internal controls--explicitly required by the CFO Act. With respect
to internal controls, management for 27 of the 31 corporations
reported that they had reasonable assurance that internal control
objectives were being achieved. However, management's internal
control reporting for four other corporations--Export-Import Bank,
Pennsylvania Avenue Development Corporation (PADC), FHA, and RTC--did
not specifically state whether or not management had reasonable
assurance that control objectives were being achieved. As part of
their management report, management for 6 of the 31
corporations--CCC, FDIC, FHA, GNMA,\7 PBGC, and RTC--included
descriptions of material weaknesses in internal accounting and
administrative controls identified as part of their assessment. The
management reports for the other 25 government corporations did not
disclose any material weaknesses. Appendix III provides a brief
summary of the weaknesses reported by management of the six
government corporations.
In addition to management's statement on internal controls, all but
one of the management reports contained the results of the financial
statement audit, the auditor's tests of compliance with laws and
regulations, and the auditor's work on internal controls. The
exception was PBGC which issued its management report without the
auditor's report because the audit was ongoing in March 1993 when
PBGC's management report was due. With respect to compliance with
laws and regulations, the auditors for 29 corporations reported that
they found no material instance of noncompliance with laws and
regulations tested. For the other three corporations that were
audited, the auditors' report on compliance with laws and regulations
reported individual instances of material noncompliance with laws and
regulations.\8
The auditors for the six corporations discussed above also reported
material internal control weaknesses identified during their audit.
GAO, as auditor for three of the corporations--FDIC, PBGC, and
RTC--identified and reported material internal control weaknesses
that were not identified by management, while the weaknesses reported
by the auditors for the other three corporations were generally
consistent with the weaknesses reported by management.
In addition to the items explicitly required, the CFO Act also
provides for management to include in its annual report a
reconciliation to the budget, if applicable, and other information
necessary to inform the Congress about the corporation's operations
and financial condition. The management reports for 7 of the 31
corporations included some form of reconciliation to the budget.
With respect to other information, 29 of the 31 management reports
included other information; however, the nature and extent of this
information varied. Most of the reports contained a description of
the corporation, highlights of financial condition and results of
operations, and other information about the operation of the
corporation. Two corporations--the Financing Corporation and
Resolution Funding Corporation--only included their financial
statements, auditor's report, and management's statement on internal
controls.
Appendix IV provides further details on the contents of each
corporation's management report for fiscal year 1992.
--------------------
\7 Government National Mortgage Association.
\8 The auditors' report on compliance with laws and regulations for
three separate Federal Home Loan Banks described separate instances
of material noncompliance with Federal Home Loan Bank Board policies,
but did not always refer to specific provisions of laws and
regulations.
CFO ACT REPORTING CAN BE
ENHANCED
------------------------------------------------------------ Letter :6
We found that due, in part, to a lack of authoritative criteria and
guidance, government corporations followed a variety of approaches in
assessing and reporting on internal controls and in reporting other
information in their annual management report to the Congress. The
absence of authoritative criteria and guidance has contributed to
assessment and reporting differences which effectively reduce the
usefulness of the annual management reports.
Establishing a common framework for government corporations to follow
in assessing and reporting on internal controls and in developing and
reporting other information should improve the informative value and
consistency of the reports and enhance their usefulness to the
Congress. In addition, we believe that expanding the independent
auditor's responsibilities for examining and reporting on the
effectiveness of internal controls as part of the CFO Act financial
audit can complement and enhance management's assessment and
reporting on internal controls and provide the Congress with an
independent evaluation of management's assessment.
VARIOUS APPROACHES USED TO
ASSESS AND REPORT ON
INTERNAL CONTROLS
---------------------------------------------------------- Letter :6.1
We found that government corporations used a variety of approaches to
assess and report on internal controls in support of management's
statement on internal controls required by the CFO Act. The CFO Act
requires government corporations to annually report on the adequacy
of their internal controls in a manner consistent with internal
control assessment and reporting requirements imposed on executive
agencies by the FMFIA. However, government corporations are
generally not required to follow assessment criteria and
guidelines--established by OMB for executive agencies--in assessing
and reporting on internal controls.
FMFIA required OMB to issue guidelines for executive agencies to
follow in evaluating internal controls in support of FMFIA's annual
internal control reporting requirement. OMB's guidance (Circular
A-123) provides a common baseline or framework for executive agencies
to follow in establishing a system of internal accounting and
administrative controls and evaluating the effectiveness of their
system of internal controls. Additionally, FMFIA requires that
executive agencies prepare an annual statement on the adequacy of
internal controls based on their assessment conducted in accordance
with OMB's guidance. OMB's guidance also requires that the agency's
annual statement on internal controls include a description of any
material weaknesses (and related plans for corrective actions)
identified as part of the internal control assessment process.
In August 1992, OMB sent a memorandum to the heads of the government
corporations reminding them of the CFO Act requirement to report on
their assessment of internal accounting and administrative controls.
To further assist the corporations, OMB provided them with a copy of
OMB's reporting instructions which executive agencies are required to
follow in preparing their annual FMFIA internal control report.
However, its memorandum was only advisory in nature because OMB does
not issue similar guidelines for government corporations.
Our review of the approaches used by government corporations to
assess and report on internal controls found that three
corporations--ADF, FFB, and IAF--did not perform an internal control
assessment. Of the 31 government corporations for which an internal
control assessment was performed, 14 reported that they followed
OMB's assessment and reporting guidelines to support management's
statement on internal controls. The other 17 corporations used a
variety of alternative approaches--ranging from utilizing the work
performed by external auditors to reviewing the internal and external
auditors' work and discussions with the auditors and management
officials--to support management's statement on internal controls.
While the scope of our review did not include an evaluation of the
effectiveness of each corporation's approach, we found that most of
the alternative approaches used by the 17 corporations did not
address important elements of OMB's guidelines. In our view, the
absence of these elements effectively limits the scope and
comprehensiveness of management's assessment of and conclusions on
the effectiveness of internal controls.
Most of the 17 corporations using alternative approaches did not
require a specific management evaluation of the effectiveness of
internal controls and/or did not require that material internal
control weaknesses be identified and reported, along with appropriate
corrective actions, as part of management's statement on internal
controls required by the CFO Act. Specific internal control
evaluations which are designed to identify and raise, for
management's consideration, material weaknesses (and related
corrective actions) are important features of OMB's guidelines. They
provide management with an informed basis from which to draw a
conclusion on the overall adequacy of internal controls, as well as
provide the information on material weaknesses (and related
corrective actions) needed for effective reporting to the Congress
under the CFO Act.
We noted other significant differences in the alternative approaches
followed by some corporations. For three government corporations,\9
the assessment of internal controls was not performed internally.
Instead, management stated that it relied on the internal control
work performed by external auditors as support for management's
statement on the adequacy of internal controls. However, auditing
standards do not require that financial auditors conduct the kind of
evaluation or assessment of the effectiveness of internal controls
which management is expected to perform under FMFIA and the CFO Act.
In addition, under normal circumstances, the scope of internal
control work performed by financial auditors would not necessarily
include internal administrative controls which are included within
the scope of management's statement on internal controls required by
the CFO Act. Appendix V provides information on the approaches
followed by management of the government corporations to support
their statements on internal controls.
The limitations of some of the assessment and reporting approaches
can be seen by examining the nature and extent of management's
internal control disclosures included as part of management's
statement on internal controls. In addition to including
management's statement on internal controls as required by the CFO
Act, six corporations disclosed the nature and extent of material
internal control weaknesses (and related corrective actions). Each
of the six corporations reported that they followed OMB's guidelines,
which require that material weaknesses and corrective actions be
reported. The fact that OMB guidelines require management to
identify and report publicly any material weaknesses and corrective
actions identified during its internal control assessment, likely
explains why the CFO Act management reports for the six corporations
also contained these important disclosures. However, because the
alternative approaches followed by most of the 17 corporations did
not require the identification and reporting of material internal
control weaknesses, no conclusions on whether material internal
control weaknesses existed at these corporations can be reached from
reviewing their management reports. In addition, while management
for four government corporations--Export-Import Bank, FHA, PADC, and
RTC--included in their management report a discussion of internal
controls, they did not explicitly state whether or not management had
reasonable assurance that internal control objectives were being
achieved.
To provide the Congress with consistent and meaningful information on
the adequacy of internal controls and the existence of material
weaknesses, we believe that government corporations should adopt a
common framework or approach to assessing and reporting on internal
controls. While this can be achieved by following OMB's internal
control guidelines applicable to executive agencies, another
alternative exists. Government corporations could elect to follow
the framework for evaluating and reporting on internal controls
issued by the Committee of Sponsoring Organizations of the Treadway
Commission (COSO)\10 entitled Internal Control-Integrated Framework.
This framework, issued in September 1992, with its May 1994 addendum
concerning safeguarding of assets, represents an effective approach
for evaluating and reporting on internal controls.
--------------------
\9 Two of the three corporations--the Financing Corporation and the
Resolution Funding Corporation--relied on assessments made by a team
of outside auditors from the audit departments of the 12 Federal Home
Loan Banks. The management of the Pennsylvania Avenue Development
Corporation relied on the internal control work performed by its
independent financial auditor to support management's assurance
statement on internal controls.
\10 COSO consists of the Financial Executives Institute, American
Institute of Certified Public Accountants, American Accounting
Association, The Institute of Internal Auditors, and the Institute of
Management Accountants.
VARIED REPORTING OF OTHER
INFORMATION
---------------------------------------------------------- Letter :6.2
While the 31 management reports issued for 1992 generally contained
the financial statements, auditor's report, and management's
statement on internal controls, most reports did not include a
reconciliation to the corporation's budget report or provide a
consistent level of other information on the operations and financial
condition of the corporations. The act requires that management's
annual CFO Act report contain a reconciliation to the budget report
of the corporation, if applicable, as well as other information
necessary to inform the Congress about the operations and financial
condition of the corporation. However, while OMB established
guidance for executive departments and agencies to follow in
preparing similar information for inclusion in agencies' CFO Act
reports, government corporations are not subject to the guidance and
no other mechanism presently exists for establishing such guidance
for corporations.
By preparing a reconciliation to its budget report, an entity shows
how its expenses reported on its statement of operations relate to
amounts reported in the President's budget. It provides a meaningful
comparison or crosswalk between an entity's accrual-based operating
results and its obligations and outlays information reported in the
President's budget. Also, this type of reconciliation provides
increased credibility to unaudited budgetary information reported as
"actual" by linking such information back to audited financial
information for the same period.
While many government corporations receive no direct government
funds, 17 of the 31 corporations that issued management reports for
1992 had some aspect of their 1992 financial operations reported in
the President's FY 1994 budget which, in our view, suggests that a
reconciliation to the budget would have been appropriate. However,
only 7 of the 17 corporations included a reconciliation to the budget
in their management reports. In addition, officials for most of
those corporations that prepared reconciliations indicated their
uncertainty about what the reconciliation should contain and that
guidance applicable to government corporations would have been
useful. We believe that the relatively few government corporations
that prepared a reconciliation to budget and the uncertainties
experienced by those corporations that prepared one is due largely to
the absence of authoritative guidance on when a reconciliation should
be prepared and its contents.
Management reports for government corporations are also required by
the CFO Act to contain "... any other comments and information
necessary to inform the Congress about the operations and financial
condition of the corporation." Again, OMB has issued guidance
specifying the form and content of the other financial information
that is to accompany agency financial statements. The guidance is
intended to provide executive agencies with a framework for meeting a
major CFO Act objective to develop financial statements that supply
information useful to the Congress, government managers, and the
public. OMB's guidance applicable to executive agencies requires an
overview of the reporting entity which explains and expands upon the
financial statements by providing a clear and concise discussion of
the reporting entity; its mission, goals, and objectives; performance
measures; financial results and condition; and relevant financial and
performance data on programs and activities. However, as with
internal controls and reconciliation to budget, government
corporations are not required to follow this guidance in developing
the other information to include in their management reports.
All but 2 of the 31 Corporations--the Financing Corporation and
Resolution Funding Corporation--issued management reports that
contained other information. However, the nature and extent of the
information varied widely. Some corporations provided only limited
information on their operations and financial condition, while others
supplied more extensive information on financial condition, program
operations, and, in some cases, performance information.
We believe that the usefulness of government corporations' management
reports would be improved by including, at a minimum, the type of
overview information currently called for in OMB's guidance to
executive agencies on the form and content of other financial
information. Providing this type of information as part of each
corporation's management report would enable government corporations
to begin meeting new strategic planning and performance measurement
requirements established by the Government Performance and Results
Act of 1993 (GPRA).\11 When GPRA is fully implemented, government
corporations will be required to develop and report on strategic and
annual performance plans, performance goals and indicators, and
resource requirements. Beginning now to develop and report
overview-type information will improve the usefulness of annual CFO
Act management reports while facilitating corporations'
implementation of GPRA.
--------------------
\11 Strategic plans are required no later than September 30, 1997,
followed by annual performance plans beginning with fiscal year 1999,
and annual program performance reports no later than March 31, 2000.
POSITIVE ASSURANCE ON
INTERNAL CONTROLS SHOULD
ENHANCE MANAGEMENT REPORTING
---------------------------------------------------------- Letter :6.3
We believe that increasing the auditors' responsibilities to test and
report on the effectiveness of internal accounting controls would
enhance the usefulness of the auditors' internal control work to
management and the Congress. Requiring the auditor to conduct an
examination of internal accounting controls of sufficient scope to
support positive assurance on their effectiveness would complement
and enhance management's internal assessment of internal controls
while providing the Congress with an independent assessment of
management's statement on the adequacy of internal accounting
controls.
Government auditing standards require auditors to obtain a sufficient
understanding of the internal control structure to determine the
nature, timing, and extent of audit procedures. After assessing the
audit risk associated with relying on internal controls, the auditor
may plan to rely on internal controls which, in turn, requires that
the operating effectiveness of specific internal controls be
evaluated. If the controls are effective, the auditor may reduce the
nature and extent of other audit procedures. The auditor is not
required to test the effectiveness of specific controls, if the
auditor believes that it would be inefficient to do so. The
likelihood that the auditor will find it efficient and effective to
test specific controls increases with the size and complexity of the
entity being audited. Because the extent of the auditors' internal
control work can vary, government auditing standards do not require
auditors to express any assurance about the effectiveness of internal
controls when reporting on internal controls or on the results of
their financial statement audits. However, the standards do require
auditors to report any significant internal control deficiencies
identified in the course of their internal control work.
Recognizing the importance and value of an independent assessment of
the effectiveness of internal controls, OMB and GAO have placed
greater emphasis on testing internal controls as part of federal
financial audits. OMB, in establishing guidance for CFO Act audits
of executive agencies' financial statements (OMB Bulletin No. 93-06,
January 8, 1993), required auditors to go beyond government auditing
standards and test significant internal controls when the auditor
believed that the controls were properly designed and likely to be
operating. While the level of internal control work required on the
fiscal year 1992 audits was not sufficient for the auditors to
provide positive assurance on the effectiveness of internal
accounting controls, OMB, in its bulletin, stated its intention to
expand future guidance to require the level of testing needed to
support an auditor's conclusion of positive assurance.
In 1992, GAO revised its financial audit methodology to go beyond
existing government auditing standards by requiring that our auditors
perform sufficient internal control work to enable us to provide
management and the Congress with an opinion on the effectiveness of
internal accounting controls.\12 We implemented our revised audit
methodology on seven fiscal year 1992 CFO Act audits of both
executive agencies and government corporations. In these audits, we
performed sufficient work on internal accounting controls to
determine whether they provided reasonable assurance that assets were
safeguarded against loss from unauthorized use or disposition;
transactions were executed in accordance with management authority,
and laws and regulations; and transactions were properly recorded,
processed, and summarized to permit the preparation of financial
statements in accordance with the applicable accounting principles
and to maintain accountability for assets. Appendix VI lists our
reports on our 1992 CFO Act financial audits of four executive
departments and agencies and three government corporations.
The value and benefit of performing the additional internal control
work needed to support positive assurance is evident in the results
of our additional work. In each of our seven CFO Act audits for
1992, we found that internal controls were not effective in achieving
all of their objectives. We believe the results of our additional
work complemented and enhanced management's internal assessment by
identifying serious internal control weaknesses that had not been
recognized in management's assessment and provided the Congress with
an independent evaluation of management's statement on internal
controls. Identifying additional weaknesses should also help to
strengthen future management control assessments and speed the
corrective actions needed to strengthen asset safeguards and
facilitate more timely and reliable financial reporting.
Government corporations can increase the value and usefulness of
their external auditor's work on internal controls and provide the
Congress with an independent assessment of the effectiveness of
internal controls by expanding their external auditors'
responsibilities to examine and report on management's
representations on the effectiveness of internal controls over
financial reporting, safeguarding of assets, and compliance with laws
and regulations. However, while current government auditing
standards do not require financial auditors to perform the work
needed to provide positive assurance on internal controls, they do
permit the auditor to examine and report, with positive assurance, on
management's written representations concerning the effectiveness of
an entity's internal control structure.\13
--------------------
\12 The broader-scope internal control work required by our financial
audit methodology and the assurances that result typically apply only
to internal accounting controls and not to internal administrative or
operational controls.
\13 Comptroller General's Government Auditing Standards, 1994
Revision, and Statement on Standards for Attestation Engagements No.
2: Reporting on an Entity's Internal Control Structure Over
Financial Reporting issued by the Auditing Standards Board, American
Institute of Certified Public Accountants, May 1993.
CONCLUSIONS
------------------------------------------------------------ Letter :7
Although most government corporations had their 1992 financial
statements audited and issued their required CFO Act management
reports, the value and usefulness of the audits and management
reports required by the act can be enhanced by ensuring that
government corporations follow a common framework or approach in
assessing and reporting on internal controls and in preparing a
reconciliation to the budget and other information to be included in
the annual management report. Building on its experience with
executive agencies and departments in implementing FMFIA and the CFO
Act, OMB could work closely with the government corporations to
address each of the assessment and reporting issues raised in this
report.
Expanding the auditor's responsibilities on federal financial audits
to perform the internal control work needed to provide positive
assurance on internal accounting controls would provide management
and the Congress with an independent, comprehensive report on these
controls. Accordingly, we strongly encourage the management of
government corporations to build on recent OMB and GAO efforts by
requesting that their auditors examine and report on management's
representations concerning the effectiveness of the internal controls
structure. The COSO Internal Control-Integrated Framework
establishes criteria for assessing and reporting on internal controls
that are recognized by business management and auditors that OMB and
government corporations should consider adopting. We believe that
management reporting on controls coupled with an auditor's review of
management's representation is an effective model for examining and
reporting on internal controls.
RECOMMENDATIONS
------------------------------------------------------------ Letter :8
To improve the usefulness of the CFO Act's audit and reporting
requirements for government corporations and to enhance the
consistency of management reporting to the Congress, we recommend
that the Director of the Office of Management and Budget work closely
with the heads of government corporations to establish an appropriate
framework for corporations to follow in
assessing and reporting on internal controls;
determining when a reconciliation to budget is appropriate and, if
so, what it should contain; and
establishing the nature and extent of other information to be
included in corporations' annual management reports.
AGENCY COMMENTS AND OUR
EVALUATION
------------------------------------------------------------ Letter :9
In commenting on a draft of this report, OMB concurred with our
recommendations and said it plans to work with the corporations to
improve their CFO Act management reports. Specifically, OMB said it
would (1) continue to provide corporations with access to criteria
and guidance it has developed for executive departments and agencies
to follow in implementing the requirements of the CFO Act and (2)
provide the technical assistance necessary to assist government
corporations in implementing the CFO Act. OMB's written comments are
included in appendix VII.
---------------------------------------------------------- Letter :9.1
We are sending copies of this report to the Director, Office of
Management and Budget; heads of all government corporations; and
interested congressional committees. Copies will also be made
available to others upon request.
Please call me at (202) 512-9406 if you or your staffs have any
questions concerning the report. Major contributors to this report
are listed in appendix VIII.
Robert W. Gramling
Director, Corporate Financial
Audits
GOVERNMENT CORPORATIONS SUBJECT TO
THE CFO ACT
=========================================================== Appendix I
African Development Foundation
Amtrak (National Railroad Passenger Corporation)
Bonneville Power Administration
Commodity Credit Corporation
Export-Import Bank
Federal Crop Insurance Corporation
Federal Deposit Insurance Corporation
Federal Financing Bank
Federal Home Loan Bank of Atlanta
Federal Home Loan Bank of Boston
Federal Home Loan Bank of Chicago
Federal Home Loan Bank of Cincinnati
Federal Home Loan Bank of Dallas
Federal Home Loan Bank of Des Moines
Federal Home Loan Bank of Indianapolis
Federal Home Loan Bank of New York
Federal Home Loan Bank of Pittsburgh
Federal Home Loan Bank of Seattle
Federal Home Loan Bank of San Francisco
Federal Home Loan Bank of Topeka
Federal Housing Administration
Federal Prison Industries
The Financing Corporation
Government National Mortgage Association
Inter-American Foundation
National Credit Union Administration Central Liquidity Facility
Overseas Private Investment Corporation
Pennsylvania Avenue Development Corporation
Pension Benefit Guaranty Corporation
Resolution Funding Corporation
Resolution Trust Corporation
Rural Telephone Bank
Saint Lawrence Seaway Development Corporation
Tennessee Valley Authority
GOVERNMENT CORPORATIONS' 1992
FINANCIAL AUDIT REPORTS
========================================================== Appendix II
Internal
Type of control report Compliance
Corporation Auditor opinion prepared report prepared
-------------- -------------- -------------- -------------- ----------------
African Financial N/A N/A N/A
Development statements not
Foundation prepared
Amtrak Arthur Unqualified Yes Yes
Andersen
Bonneville Price Unqualified Yes Yes
Power Waterhouse
Administration
Commodity Agriculture Unqualified Yes Yes
Credit Inspector
Corporation General
Export-Import Price Unqualified Yes Yes
Bank Waterhouse
Federal Crop KPMG Peat Unqualified Yes Yes
Insurance Marwick
Corporation
Federal GAO Unqualified Yes Yes
Deposit
Insurance
Corporation
Federal Gregory K. Unqualified Yes Yes
Financing Bank Washington
Federal Home Price Unqualified Yes Yes
Loan Banks Waterhouse
(all 12)
Federal Price Disclaimer Yes Yes
Housing Waterhouse (with respect
Administration to statements
of operations
and cash
flows)
Federal Prison Urbach Kahn & Unqualified Yes Yes
Industries Werlin
The Financing Price Unqualified Yes Yes
Corporation Waterhouse
Government Price Unqualified Yes Yes
National Waterhouse
Mortgage
Association
Inter- Brown & Unqualified Yes Yes
American Company
Foundation
National Price Unqualified Yes Yes
Credit Union Waterhouse
Administration
Central
Liquidity
Facility
Overseas Price Unqualified Yes Yes
Private Waterhouse
Investment
Corporation
Pennsylvania Urbach Kahn & Unqualified Yes Yes
Avenue Werlin
Development
Corporation
Pension GAO Disclaimer Yes Yes
Benefit (with respect
Guaranty to statements
Corporation of operations
and cash
flows) and
qualified
(with respect
to one fund)
Resolution Price Unqualified Yes Yes
Funding Waterhouse
Corporation
Resolution GAO Unqualified Yes Yes
Trust
Corporation
Rural Urbach Kahn & Unqualified Yes Yes
Telephone Bank Werlin
Saint Lawrence Arthur Unqualified Yes Yes
Seaway Andersen
Development
Corporation
Tennessee Coopers & Unqualified Yes Yes
Valley Lybrand
Authority
--------------------------------------------------------------------------------
MANAGEMENT REPORTING ON INTERNAL
CONTROLS
========================================================= Appendix III
Thirty-one of the 34 government corporations issued management
reports for 1992. Twenty-seven of the 31 management reports reported
management's conclusions that it had reasonable assurance that its
internal control objectives were being achieved. The management
report for the four other corporations--Export-Import Bank, FHA, PADC
and RTC--did not specifically state whether management had reasonable
assurance or not.
In reporting on internal controls, management for 6 of the 31
corporations included a description of material weaknesses in
internal controls.
CCC reported three material weaknesses pertaining to interest
waived due to statutory marketing price-support loan provisions,
the inventory management system, and issuance of grain warehouse
receipts.
FDIC reported 12 material internal control weaknesses. These
weaknesses included the reliability, data integrity, user
training, and reconciliations of several management information
systems. FDIC also noted the need for stronger controls in its
procurement activities and security over certain official
records and information systems.
FHA reported four material internal control weaknesses. The
weaknesses related to FHA's automated systems and the lack of
staff and financial resources to effectively service notes and
maintain property values.
GNMA reported three material weaknesses in internal controls.
These weaknesses addressed the need for improvements in
subserver and contractor monitoring, and systems development,
operation, and maintenance. In addition, GNMA cited the need to
formally define and approve criteria for withholding commitment
authority and granting waivers.
PBGC reported nine material internal control weaknesses. The areas
identified included general accounting systems, premium
collections, procurement operations, loss prevention, and claim
recoveries related to terminated pension plans. PBGC also noted
weaknesses with document backup and storage, accounting
controls, and unsupported accounting policies and actuarial
assumptions.
RTC reported 13 material internal control weaknesses for 1992. The
areas identified included acquisition of legal services,
controls over receiverships, deposits insurance payouts, and
claims assessment. The RTC also noted weaknesses in its
contracting policies and procedures, property appraisal
practices, asset management, monitoring of contractors, and
oversight of conservatorships.
GOVERNMENT CORPORATIONS' 1992
MANAGEMENT REPORTS
========================================================== Appendix IV
Reconcili
Submitted Financial ation to Internal
Corporati by due statement budget control Audit Other
on date s report statement report information
--------- --------- --------- --------- --------- --------- --------------
African (1992 N/A N/A N/A N/A N/A
Developme managemen
nt t report
Foundatio not
n issued)
Amtrak Yes Yes No Yes Yes Yes
Bonnevill Yes Yes No Yes Yes Yes
e Power
Administr
ation
Commodity No Yes Yes Yes Yes Yes
Credit
Corporati
on
Export- Yes Yes No Yes Yes Yes
Import
Bank
Federal Yes Yes Yes Yes Yes Yes
Crop
Insurance
Corporati
on
Federal Yes Yes No Yes Yes Yes
Deposit
Insurance
Corporati
on
Federal (1992 N/A N/A N/A N/A N/A
Financing managemen
Bank t report
not
issued)
Federal Yes Yes No Yes Yes Yes
Home Loan
Banks
(12)
Federal No Yes Yes Yes Yes Yes
Housing
Administr
ation
Federal Yes Yes No Yes Yes Yes
Prison
Industrie
s
The Yes Yes No No Yes Yes
Financing
Corporati
on
Governmen No Yes Yes Yes Yes Yes
t
National
Mortgage
Associati
on
Inter- (1992 N/A N/A N/A N/A N/A
American managemen
Foundatio t report
n not
issued)
National No Yes No Yes Yes Yes
Credit
Union
Administr
ation
Central
Liquidity
Facility
Overseas Yes Yes No Yes Yes Yes
Private
Investmen
t
Corporati
on
Pennsylva Yes Yes Yes Yes Yes Yes
nia
Avenue
Developme
nt
Corporati
on
Pension Yes Yes Yes Yes No Yes
Benefit
Guaranty
Corporati
on
Resolutio Yes Yes No Yes Yes No
n Funding
Corporati
on
Resolutio Yes Yes No Yes Yes Yes
n Trust
Corporati
on
Rural Yes Yes No Yes Yes Yes
Telephone
Bank
Saint Yes Yes Yes Yes Yes Yes
Lawrence
Seaway
Developme
nt
Corporati
on
Tennessee Yes Yes No Yes Yes Yes
Valley
Authority
--------------------------------------------------------------------------------
INTERNAL CONTROL ASSESSMENT
PROCEDURES USED BY GOVERNMENT
CORPORATIONS
=========================================================== Appendix V
Corporation Procedures
--------------------------------------- ---------------------------------------
African Development Foundation Did not assess controls.
Amtrak Internally developed internal control
assessment procedures.
Bonneville Power Administration OMB internal control assessment
guidance.
Commodity Credit Corporation OMB internal control assessment
guidance.
Export-Import Bank OMB internal control assessment
guidance.
Federal Crop Insurance Corporation OMB internal control assessment
guidance.
Federal Deposit Insurance Corporation OMB internal control assessment
guidance.
Federal Financing Bank Did not assess controls.
Federal Home Loan Banks (12) Internally developed internal control
assessment procedures.
Federal Housing Administration OMB internal control assessment
guidance.
Federal Prison Industries OMB internal control assessment
guidance.
The Financing Corporation Has not developed internal procedures
to assess internal controls but
utilized the work of external auditors.
Government National Mortgage OMB internal control assessment
Association guidance.
Inter-American Foundation Did not assess controls.
National Credit Union Administration OMB internal control assessment
Central Liquidity Facility guidance.
Overseas Private Investment Corporation OMB internal control assessment
guidance.
Pennsylvania Avenue Development Has not developed internal procedures
Corporation to assess internal controls but
utilized the work of external auditors.
Pension Benefit Guaranty Corporation OMB internal control assessment
guidance.
Resolution Funding Corporation Has not developed internal procedures
to assess internal controls but
utilized the work of external auditors.
Resolution Trust Corporation OMB internal control assessment
guidance.
Rural Telephone Bank OMB internal control assessment
guidance.
Saint Lawrence Seaway Development OMB internal control assessment
Corporation guidance.
Tennessee Valley Authority Internally developed internal control
assessment procedures.
--------------------------------------------------------------------------------
GAO 1992 CFO ACT FINANCIAL AUDIT
REPORTS
========================================================== Appendix VI
Financial Audit: Examination of the Army's Financial Statements for
Fiscal Years 1992 and 1991 (GAO/AIMD-93-1, June 20, 1993).
Financial Audit: Examination of IRS' Fiscal Year 1992 Financial
Statements (GAO/AIMD-93-2, June 30, 1993).
Financial Audit: Examination of Customs' Fiscal Year 1992 Financial
Statements (GAO/AIMD-93-3, June 30, 1993).
Financial Audit: Federal Family Education Loan Program's Financial
Statements for Fiscal Year 1992 (GAO/AIMD-93-4, June 30, 1993).
Financial Audit: Federal Deposit Insurance Corporation's 1992 and
1991 Financial Statements (GAO/AIMD-93-5, June 30, 1993).
Financial Audit: Resolution Trust Corporation's 1992 and 1991
Financial Statements (GAO/AIMD-93-6, June 30, 1993).
Financial Audit: Pension Benefit Guaranty Corporation's 1992 and
1991 Financial Statements (GAO/AIMD-93-21, September 29, 1993).
(See figure in printed edition.)Appendix VII
COMMENTS FROM THE OFFICE OF
MANAGEMENT AND BUDGET
========================================================== Appendix VI
(See figure in printed edition.)
MAJOR CONTRIBUTORS TO THIS REPORT
======================================================== Appendix VIII
ACCOUNTING AND INFORMATION
MANAGEMENT DIVISION, WASHINGTON,
D.C.
John J. Reilly, Assistant Director
Gregory J. Ziombra, Audit Manager
Louise E. Mullen, Staff Accountant