    Internal Control: Analysis of Joint Study on Estimating the Costs
    and Benefits of Rendering Opinions on Internal Control over
    Financial Reporting in the Federal Environment (06-SEP-06,
    GAO-06-255R).

    The Department of Homeland Security (DHS) Financial
    Accountability Act, Public Law Number 108-330, requires DHS
    management to provide an assertion on the internal control that
    applies to financial reporting for fiscal year 2005 and to obtain
    an auditor's opinion on the department's internal control over
    its financial reporting for fiscal year 2006. The act also
    directs the Chief Financial Officers (CFO) Council and the
    President's Council on Integrity and Efficiency (PCIE) to conduct
    a joint study, and report to the Congress and to the Comptroller
    General of the United States, on the potential costs and benefits
    of requiring agencies subject to the Chief Financial Officers Act
    of 1990 to obtain audit opinions of their internal control over
    financial reporting. The DHS Financial Accountability Act also
    requires that the Comptroller General of the United States review
    the joint study and report the results of this analysis to the
    Congress. In December 2005, we briefed available committee staff
    on our preliminary analysis of the joint study. This report
    provides further details on our review and on our views regarding
    a requirement for federal agencies to obtain audit opinions on
    their internal control over financial reporting.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-06-255R
        ACCNO:   A60348
      TITLE:     Internal Control: Analysis of Joint Study on Estimating
    the Costs and Benefits of Rendering Opinions on Internal Control
    over Financial Reporting in the Federal Environment
         DATE:   09/06/2006
      SUBJECT:   Accounting procedures
    	     Audit reports
    	     Auditors
    	     Federal agencies
    	     Financial disclosure
    	     Internal audits
    	     Internal controls
    	     Reporting requirements
    	     Auditing standards
    	     Financial management
    	     Accounting

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-06-255R

         * PDF6-Ordering Information.pdf
              * Order by Mail or Phone

    September 6, 2006

    The Honorable Susan M. Collins

    Chairman

    The Honorable Joseph I. Lieberman

    Ranking Minority Member

    Committee on Homeland Security and Governmental Affairs

    United States Senate

    The Honorable Thomas M. Davis

    Chairman

    The Honorable Henry A. Waxman

    Ranking Minority Member

    Committee on Government Reform

    House of Representatives

    Subject: Internal Control: Analysis of Joint Study on Estimating the Costs
    and Benefits of Rendering Opinions on Internal Control over Financial
    Reporting in the Federal Environment

    The Department of Homeland Security (DHS) Financial Accountability Act,
    Public Law Number 108-330, requires DHS management to provide an assertion
    on the internal control that applies to financial reporting for fiscal
    year 2005 and to obtain an auditor's opinion on the department's internal
    control over its financial reporting for fiscal year 2006. The act also
    directs the Chief Financial Officers (CFO) Council1 and the President's
    Council on Integrity and Efficiency (PCIE)2 to conduct a joint study, and
    report to the Congress and to the Comptroller General of the United
    States, on the potential costs and benefits of requiring agencies subject
    to the Chief Financial Officers Act of 19903 to obtain audit opinions of
    their internal control over financial reporting.4 The DHS Financial
    Accountability Act also requires that the Comptroller General of the
    United States review the joint study and report the results of this
    analysis to the Congress. In December 2005, we briefed available committee
    staff on our preliminary analysis of the joint study. This report provides
    further details on our review and on our views regarding a requirement for
    federal agencies to obtain audit opinions on their internal control over
    financial reporting.

    1The CFO Council is an organization comprised of the CFOs and Deputy CFOs
    of the 24 CFO Act agencies, senior officials in the Office of Management
    and Budget (OMB), and the Department of the Treasury who work
    collaboratively to improve financial management in the U.S. government.

    2The PCIE was established in May 1992 to (1) address integrity, economy,
    and effectiveness issues that transcend individual government agencies and
    (2) increase the professionalism and effectiveness of inspector general
    personnel throughout the government. The PCIE is composed primarily of the
    presidentially appointed inspectors general. Officials from OMB and the
    Federal Bureau of Investigation, Office of Government Ethics, Office of
    Special Counsel, and Office of Personnel Management serve on the PCIE as
    well.

    3See 31 U.S.C. S: 901(b)(1) for a list of agencies.

    The Office of Management and Budget (OMB) revised its Circular Number
    A-1235 in December 2004 (effective beginning with fiscal year 2006) to
    strengthen the requirements for conducting management's assessment of
    internal control over financial reporting. Major revisions contained in
    Appendix A of the circular include requiring CFO Act agency management to
    annually assess the adequacy of internal control over financial reporting,
    provide a report on identified material weaknesses and corrective actions,
    and provide separate assurance on the agency's internal control over
    financial reporting. In initiating the revisions to Circular No. A-123,
    OMB cited the new internal control requirements for publicly traded
    companies that are contained in section 404 of the Sarbanes-Oxley Act of
    2002 (Sarbanes-Oxley).6 Sarbanes-Oxley was enacted in response to
    corporate accountability failures of the past several years and contains a
    provision calling for management's assessment of internal control over
    financial reporting similar to the long-standing requirements for
    executive branch agencies in 31 U.S.C. S: 3512 (c),(d), commonly referred
    to as the Federal Managers' Financial Integrity Act (FMFIA), to issue
    annual statements of assurance over internal control in the agency.
    Opinions on internal control over financial reporting as required by the
    Sarbanes-Oxley Act for publicly traded companies are important to protect
    investors by improving the accuracy and reliability of corporate
    disclosures made pursuant to the securities laws. Regulators, public
    companies, audit firms, and investors generally agree that the
    Sarbanes-Oxley Act of 2002 has had a positive and significant impact on
    investor protection and confidence. At the same time, the costs associated
    with the Sarbanes-Oxley Act have been significant and additional steps
    should be taken to improve the efficiency and cost-effectiveness of its
    implementation.

    Federal agencies also have a duty to attain and maintain the public's
    trust and confidence. Specifically, federal agencies have a stewardship
    obligation to prevent fraud, waste, and abuse; to use tax dollars
    appropriately; and to ensure financial accountability to the President,
    the Congress, and the American people. In the broadest context, internal
    control represents an organization's plans, methods, and procedures used
    to meet its missions, goals, and objectives and serves as the first line
    of defense in safeguarding assets and preventing and detecting errors,
    fraud, waste, abuse, and mismanagement. Effective internal control should
    provide reasonable assurance that an organization achieves the following
    objectives: (1) effective and efficient operations, (2) reliable financial
    reporting, and (3) compliance with applicable laws and regulations.
    Safeguarding of assets is a subset of these objectives. The scope of this
    report mainly deals with one objective of internal control, specifically
    that related to the reliability of financial reporting.

    4Both the PCIE and the CFO Council are chaired by OMB's Deputy Director
    for Management.

    5OMB Circular No. A-123, Management's Responsibility for Internal Control
    (revised December 2004).

    6Pub. L. No. 107-204, S: 404, 116 Stat. 745, 789 (July 30, 2002).

    Consistent with the DHS Financial Accountability Act's requirements, our
    objective was to review the joint study and provide our perspective on the
    important issues regarding a potential requirement for CFO Act agencies to
    obtain audit opinions on their internal control over financial reporting.
    Specifically, this report provides our analysis of (1) the joint study and
    key issues to consider in assessing the costs and benefits of obtaining an
    opinion on internal control over financial reporting and (2) factors to
    consider in establishing criteria for when such an internal control
    opinion is warranted. To address our objective, we reviewed and discussed
    the joint study's methodology, results, and conclusions with officials
    from OMB and members of the CFO Council and the PCIE. In conducting their
    joint study, the CFO Council and the PCIE obtained cost and benefit data
    from the CFO Act agency inspectors general (IG), but did not verify the
    cost data supporting the cost-benefit analysis. We reviewed the
    development and administration of the questionnaire, but because the scope
    of our work did not include independently validating the cost information
    reported by questionnaire respondents, we cannot comment on the
    reliability of its cost estimates.

    We reviewed numerous reports and other professional literature that
    contributed to the development of the joint study. These materials are
    referenced in Attachment A of the joint study. We obtained a copy of the
    questionnaire sent to the IGs of the 24 CFO Act agencies and the two
    additional questions that were subsequently asked of the CFOs and IGs. We
    also reviewed prior GAO reports; applicable federal laws and regulations;
    and private sector results after implementation of the Sarbanes-Oxley Act
    of 2002, including documents issued by the Securities and Exchange
    Commission and the Public Company Accounting Oversight Board (PCAOB). We
    performed our work from September 2005 through July 2006 in accordance
    with U.S. generally accepted government auditing standards. We requested
    comments on a draft of this report from OMB. Written comments from OMB's
    Deputy Director for Management are reprinted in enclosure IV. We also
    received several technical comments, which we have addressed as
    appropriate.

    Results in Brief

    We recognize that assessing the costs and benefits of obtaining an
    auditor's opinion on internal control over financial reporting is
    difficult, and the joint study properly noted many challenges inherent in
    performing cost-benefit analyses on this issue. The CFO Council and the
    PCIE acknowledged in the joint study that estimating the costs to render
    an opinion on internal control over financial reporting was "challenging
    given the lack of hard data and the number of unknown factors that go into
    developing a strong estimate" and refer to their reported estimates as
    "not hard numbers." Of the total reported estimated costs7 of about $140
    million, the joint study attributed about $56 million (40 percent) to
    internal control audits of the 23 civilian CFO Act agencies, with the
    balance of $84 million to cover the Department of Defense (DOD). The CFO
    Council and the PCIE also stated that the benefits from obtaining an
    opinion on internal control over financial reporting are difficult to
    measure, and as a result, the joint study discussed some of the potential
    benefits only qualitatively. Consequently, the joint study did not
    identify all relevant costs and benefits, which may therefore limit the
    usefulness of the results and conclusions of the joint study.

    7In conducting the joint study, the CFO Council and the PCIE did not
    verify the cost data included in the report and our scope of work did not
    include independent validation of the cost information.

    While the study identified categories of additional work that drive the
    cost estimates, we believe additional factors are relevant in considering
    the costs of a requirement for audit opinions on internal control over
    financial reporting in the federal government. Factors that would likely
    affect an estimate of the costs of a requirement in the federal government
    include (1) leveraging the resources already in place in areas of the
    financial statement audit; (2) using an audit approach that integrates the
    financial and internal control audits and includes reasoned risk and
    experience-based auditor judgments, similar to the approach in the
    GAO/PCIE Financial Audit Manual (FAM); (3) setting criteria for when an
    agency should initially be required to obtain an audit of internal control
    over financial reporting; and (4) establishing criteria whereby an agency
    would qualify for a multiyear cycle for obtaining an audit opinion on
    internal control rather than an annual cycle. We also note that some of
    the reasons cited for higher-than-estimated costs in early implementation
    of the internal control provisions of Sarbanes-Oxley for publicly traded
    companies, should not, to nearly the same extent, be factors for
    incremental costs in the federal government environment. For example,
    auditors of federal agencies have been required for many years to test
    internal control to achieve a low level of assessed control risk. As a
    result, the FAM includes an integrated audit approach for testing internal
    control in connection with a financial statement audit. Similar internal
    control testing requirements were not in place for public companies prior
    to section 404 of Sarbanes-Oxley. It is important to note, however, that
    the standards8 that currently provide the basis for the FAM approach for
    providing an auditor's opinion on internal control over financial
    reporting are being revised by the Auditing Standards Board of the
    American Institute of Certified Public Accountants. The cost of a
    requirement for internal control opinions in the federal government could
    be impacted by any future changes to the underlying auditing standards.

    Additionally, as reported by the joint study, a majority of the IGs and
    CFOs believe that benefits would be derived from an audit of internal
    control over financial reporting. A majority of the IGs and CFOs cited the
    following as benefits that may be derived from this type of audit: (1)
    improved internal control and reduced material weaknesses; (2) reduced
    errors and improved data integrity, documentation reliability, and
    reporting; and (3) improved agency focus and oversight. According to the
    study, the true benefit of the auditor's opinion on internal control is
    the added independent assurance it provides that management's assessment
    of its internal control is reliable. We agree with the benefits identified
    by the IGs and CFOs, and in turn, these benefits provide additional
    incentives for timely identifying and correcting internal control weakness
    over financial reporting. In addition, we have identified several other
    benefits that should be considered when concluding on the merits of
    establishing a requirement to obtain an opinion on internal control over
    financial reporting. We believe independent assessments and auditor
    reporting can also

    8"Reporting on an Entity's Internal Control over Financial Reporting," AT
    Section 501, Codification of Statements on Auditing Standards, American
    Institute of Certified Public Accountants.

               o  strengthen the audit work done to support implementation of
               laws enacted to enhance internal control or reinforce the
               significance of effective internal control, such as FMFIA and the
               Government Performance and Results Act (GPRA);
               o  help to improve other efforts, such as cost analyses,
               budgeting, and performance metrics, through additional assurances
               over the reliability of financial and relevant nonfinancial data;
               and
               o  improve monitoring of the effectiveness of an entity's risk
               management and accountability systems.

    We view auditor opinions on internal control over financial reporting as
    an important component of monitoring the effectiveness of an entity's risk
    management and accountability systems. We agree in part with the study's
    overall conclusion that federal agencies should first be given the
    opportunity to implement revised Circular No. A-123 before there is an
    across-the-board requirement to obtain an audit opinion on internal
    control over financial reporting. However, we also believe that having set
    criteria as to when an agency should initially be required to obtain an
    opinion, instead of agency or OMB discretion, would be useful. We
    recognize that not all agencies have the same maturity level of internal
    control over financial reporting and that an initial determination of an
    agency's readiness to undergo an audit may be appropriate. Such an
    approach should consider specific criteria to ascertain when an agency
    should initially obtain an opinion on internal control, such as whether
    management has properly assessed its internal control and has a reasonable
    basis for its statement of assurance. We also believe that criteria can be
    established to achieve a balance between value, risk, and cost, whereby
    once agency management has demonstrated a stabilized effective system of
    internal control over financial reporting, subsequent audits could be
    performed on a multiyear cycle, for instance, every 3 years. Important to
    this consideration is that during the years not subject to an internal
    control audit, agency management would still have to comply with the
    revised Circular No. A-123, which requires agency management to annually
    assess the adequacy of internal control over financial reporting by
    providing a report on identified material weaknesses and corrective
    actions and providing a separate assurance statement on the agency's
    internal control over financial reporting. The overarching goal of
    obtaining an audit opinion on internal control is to provide reasonable
    independent assurance that management's assessment of internal control is
    adequate, which significantly contributes to ongoing improvement in
    federal agency internal control and accountability. Any criteria used to
    determine when an agency should undergo initial and continual
    implementation of the requirement for an audit opinion on internal control
    audit should consider at what point the audit will contribute to this
    goal.

    To reasonably ensure that audit opinions on agency internal control over
    financial reporting are obtained at the proper time and for a reasonable
    cost, we are making two recommendations to the Director, Office of
    Management and Budget, as a function of OMB's financial management
    leadership role: (1) develop specific criteria as to when agencies should
    initially be required to obtain opinions on internal control over
    financial reporting and (2) develop criteria as to when agencies have
    demonstrated a stabilized, effective system of internal control over
    financial reporting in order to move to a multiyear cycle for obtaining
    subsequent opinions on internal control. During the years not subject to
    an internal control audit, agency management would still adhere to a
    comprehensive ongoing management assessment and reporting process for
    internal control over financial reporting, as required by the revised
    Circular No. A-123.

    In written comments on a draft of this report, OMB agreed with the
    ultimate goal of improving internal control in the federal government.
    OMB's comments also highlighted the continued cooperation of GAO and the
    PCIE and the CFO Council on important issues and stated that OMB looked
    forward to working together to achieve the joint goal of effective
    internal control in the federal government. (OMB's comments are reprinted
    in enc. IV.)

    Background

    Federal agencies have a significant responsibility for accurate and timely
    accounting, controlling, and reporting of the receipts, disbursements, and
    applications of public moneys. The Congress has long recognized the
    importance of internal control, beginning with the Budget and Accounting
    Procedures Act of 1950,9 which placed primary responsibility for
    establishing and maintaining internal control squarely on the shoulders of
    agency management. In 1982, the Congress passed FMFIA, requiring agency
    heads to establish a continuous process for assessment and improvement of
    their agencies' internal control and to annually report on the adequacy of
    internal control. In addition, FMFIA required the Comptroller General to
    establish internal control standards and OMB to issue guidelines for
    agencies to follow in assessing their internal control. In December 1982,
    following FMFIA enactment, OMB issued Circular No. A-123, which included
    the assessment guidelines required by the act. The Comptroller General
    issued Standards for Internal Control in the Federal Government in 1983,
    which was last revised in November 1999.10

    We monitored and reported on FMFIA implementation efforts across the
    government in a series of four reports11 from 1984 through 1989, as well
    as in numerous reports targeting specific agencies and programs. With each
    report, we noted the efforts under way, but also emphasized that more
    needed to be done. In 1989, we concluded that while internal control was
    improving, the efforts were clearly not producing the results intended.
    The management assessment and reporting process itself appeared to have
    become the objective of the annual efforts rather than actually improving
    internal control, and many serious internal control and accounting systems
    weaknesses remain unresolved. We have highlighted these long-standing
    weaknesses in our series of high-risk reports starting in 1990, the most
    recent of which we issued in January 2005.12

    9Pub. L. No. 81-784, 64 Stat. 832 (Sept. 12, 1950).

    10The Comptroller General revised the standards in 1999, based on
    developments in internal control theory, including the internal control
    framework recommended in the report of the Committee on Sponsoring
    Organization of the Treadway Commission, the effects of information
    technology, and the passage of a series of landmark reforms. GAO,
    Standards for Internal Control in the Federal Government,
    GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).

    11See (1) GAO, Implementation of the Federal Managers' Financial Integrity
    Act: First Year, GAO/OCG-84-3 (Washington, D.C.: Aug. 24, 1984); (2) GAO,
    Financial Integrity Act: The Government Faces Serious Internal Control and
    Accounting Systems Problems, GAO/AFMD-86-14 (Washington, D.C.: Dec. 23,
    1985); (3) GAO, Financial Integrity Act: Continuing Efforts Needed to
    Improve Internal Control and Accounting Systems, GAO/AFMD-88-10
    (Washington, D.C.: Dec. 30, 1987); and (4) GAO, Financial Integrity Act:
    Inadequate Controls Result in Ineffective Federal Programs and Billions in
    Losses, GAO/AFMD-90-10 (Washington, D.C.: Nov. 28, 1989).

    In 1995, OMB made a major revision to its Circular No. A-123 guidance that
    provided a framework for integrating internal control assessments with
    other work performed and relaxed the management assessment and reporting
    requirements, giving the agencies discretion to determine the tools to use
    in arriving at their annual FMFIA assurance statements. OMB's December
    2004 revisions (effective beginning with fiscal year 2006) to Circular No.
    A-123 are intended to strengthen the requirements for conducting
    management's assessment of internal control over financial reporting at
    CFO Act agencies. Major revisions include requiring CFO Act agency
    management to annually provide a separate assurance statement on internal
    control over financial reporting in its performance and accountability
    report, along with a report on identified material weaknesses and
    corrective actions. The revision also establishes that OMB may, at its
    discretion, require a CFO Act agency to obtain an opinion on internal
    control over financial reporting if the agency is not meeting its
    deadlines as outlined in its corrective action plans. In general, we
    supported the revisions to Circular No. A-123 as they recognize that
    effective internal control is critical to improving federal agencies'
    effectiveness and accountability and to achieving the goals that the
    Congress established for them.13

    The recent revisions to Circular No. A-123 were initiated in response to
    the new internal control requirements for publicly traded companies that
    are contained in Sarbanes-Oxley. Under section 404 of Sarbanes-Oxley,
    management of a publicly traded company is required to (1) annually assess
    internal control over financial reporting at the company and (2) issue an
    annual statement on the effectiveness of internal control over financial
    reporting. The company's auditors are then required to attest to
    management's assessment as to the effectiveness of its internal control
    over financial reporting and issue an auditor's opinion as to the
    effectiveness of internal control over financial reporting.

    The Joint Study and Key Issues to Consider in Assessing Costs and Benefits

    The CFO Council and the PCIE joint study transmits the results obtained
    from a questionnaire of the IGs for the 24 CFO Act agencies with
    additional input from the CFO Council's Policies and Practice Committee. A
    copy of the joint study report is reprinted in enclosure I. The CFO
    Council and the PCIE acknowledged inherent limitations in conducting the
    joint study and noted that "performing any sort of meaningful cost/benefit
    analysis has proven elusive." Specifically, the joint study faced numerous
    challenges, including (1) identifying and estimating all relevant costs
    and benefits and (2) a lack of historical data from the agencies on the
    costs and benefits of implementing the requirement. Because only a few
    agencies have experience with obtaining audit opinions on internal control
    over financial reporting, there is limited specific information about the
    trade-offs between the costs of obtaining an opinion and the benefits
    provided. The joint study identified general categories of the additional
    work that it stated drive the cost estimates, along with a qualitative
    discussion of some benefits. We believe additional factors related to both
    costs and benefits are also relevant and should be included in considering
    the cost-benefit of the audit requirement.

    12GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January
    2005).

    13GAO, Financial Management: Effective Internal Control Is Key to
    Accountability, GAO-05-321T (Washington, D.C.: Feb. 16, 2005).

    Methodology, Results, and Conclusion of the Joint Study

    To accomplish their objective, the CFO Council and the PCIE, under the
    leadership of OMB, which chairs both councils, gathered information from
    the IGs and the CFOs about the costs and benefits of the proposed
    requirement. The PCIE Audit Committee coordinated the collection of cost
    and benefit information from the IGs. The Audit Committee Chair sent a
    questionnaire to the IGs at the 24 CFO Act agencies to gather data on the
    estimated audit costs and the benefits of performing an examination under
    the standards of ATS:501, Reporting on an Entity's Internal Control Over
    Financial Reporting,14 which are issued by the American Institute of
    Certified Public Accountants and incorporated by reference as part of U.S.
    generally accepted government auditing standards. Enclosure II contains a
    copy of the PCIE questionnaire used to gather estimated costs and benefits
    of opining on internal control over financial reporting. The CFO Council
    and the PCIE acknowledged some limitations in the joint study. For
    example, they acknowledged that they did not validate the cost estimates
    submitted by the 24 CFO Act agency IGs. In addition, the study noted that
    the estimates are "not hard numbers," meaning that they were only overall
    estimates that were not necessarily based, for example, on the potential
    number of hours and labor rates that would be included by a contracted
    auditor in a formal contract proposal.

    The PCIE Audit Committee summarized the responses from each of the IGs at
    the 24 CFO Act agencies, and then shared the summary with the respondents
    to ensure they had accurately captured their comments. The PCIE Audit
    Committee also shared the results with the CFO Council's Financial
    Management Policies and Practices Committee15 and incorporated its
    comments. The draft study was then shared with both the full CFO Council
    and the PCIE, whose comments were also incorporated. During the final
    comment period, two additional questions were asked of the CFOs and IGs
    about the expected benefits of the revised Circular No. A-123 and on
    obtaining opinions on internal control over financial reporting. Enclosure
    III contains the two additional questions that were asked of the CFOs and
    IGs. The CFO Council and PCIE also considered the experiences of publicly
    traded companies by reviewing numerous articles, surveys, and statements
    made before regulatory bodies relating to the implementation of section
    404 of the Sarbanes-Oxley Act.

    14This section of the Attestation Standards, issued by the American
    Institute of Certified Public Accountants, provides the standards for the
    practitioner who is engaged to issue or does issue an examination report
    on the effectiveness of an entity's internal control over financial
    reporting. This section is currently under revision.

    15The CFO Council's Financial Management Policies and Practices Committee
    is comprised of representatives from federal agencies who work
    collaboratively to identify and address emerging issues.

    Of the total reported estimated costs of about $140 million, the joint
    study attributed about $56 million (40 percent) to internal control audits
    of the 23 civilian CFO Act agencies, with the balance of $84 million to
    cover DOD. The joint study notes that driving the cost estimates are the
    additional work that the auditor would need to perform beyond the
    requirements of OMB Bulletin No. 01-02, Audit Requirements for Federal
    Financial Statements,16 and the GAO/PCIE FAM in order to render an opinion
    on an agency's internal control over financial reporting.

    The joint study also noted that the benefits of obtaining an opinion on
    internal control are difficult to measure. The joint study stated that
    "benefits can only be described in general terms, making a cost/benefit
    analysis difficult." Some of the benefits cited were (1) improved internal
    control and reduced material weaknesses; (2) reduced errors and improved
    data integrity, documentation reliability, and reporting; and (3) improved
    agency focus and oversight. The joint study did not quantify these
    benefits, but noted that these benefits should largely be achieved when
    agencies effectively implement the revisions to Circular No. A-123.

    The joint study concluded that (1) most industry experts agree that there
    are significant incremental costs to obtaining an opinion on internal
    control over financial reporting; (2) before incurring the additional
    costs, it would be prudent to see how federal managers implement the
    revised Circular No. A-123 and to evaluate the private sector's
    implementation of the internal control provisions of Sarbanes-Oxley when
    additional information becomes available; and (3) the decision on whether
    to obtain an opinion needs to be decided on an agency-by-agency basis,
    depending on the condition of an agency's financial management program.
    The CFOs and the IGs recommended that all CFO Act agencies should not be
    required to conduct such an audit at this time. Rather, agencies should be
    given the opportunity to implement the revised Circular No. A-123, and
    obtain an internal control audit only where particular circumstances
    warrant such an audit.

    Certain Factors That Could Influence Costs and Benefits
    Not Included in the Joint Study

    We view auditor opinions on internal control over financial reporting as
    an important component of monitoring the effectiveness of an entity's risk
    management and accountability systems. We agree in part with the study's
    overall conclusion that agencies should first be given the opportunity to
    implement the revised Circular No. A-123 before there is an
    across-the-board requirement to obtain an audit opinion on internal
    control over financial reporting. Internal control is a fundamental
    management responsibility. Management, not the auditor, should be the
    first line of defense and be held accountable for establishing a
    continuous evaluation process to ensure the adequacy of internal control.
    However, as discussed later, we also believe that there should be specific
    criteria for ascertaining when an agency should initially be required to
    obtain an opinion on internal control. We also recognize that assessing
    the costs and benefits of obtaining an opinion is difficult and agree
    there are many challenges inherent to performing cost-benefit analyses on
    this issue. While the joint study identified categories of additional work
    that drive the cost estimates along with key benefits, we believe
    additional factors that could influence costs and benefits are relevant in
    considering a requirement for audit opinions on internal control.

    16 OMB Bulletin No. 01-02, Audit Requirements for Federal Financial
    Statements, was recently superseded by the updated audit requirements
    included in OMB Bulletin No. 06-03, Audit Requirements for Federal
    Financial Statements (Aug. 23, 2006).

    Additional Factors That Could Influence Costs

    We identified five additional factors that could influence costs and
    should be considered: (1) leveraging resources, (2) using an efficient
    auditor approach, (3) using a staggered implementation approach, (4)
    implementing a multiyear cycle for an audit opinion on internal control
    over financial reporting, and (5) applying Sarbanes-Oxley lessons learned.

    Leveraging resources. In developing cost estimates to obtain an opinion on
    internal control over financial reporting, consideration needs to be given
    to fully leveraging the resources already deployed as part of the
    financial statement audits. For example, it may be possible to leverage
    the resources deployed to determine compliance with laws and regulatory
    requirements that were enacted to strengthen internal control or reinforce
    the significance of effective internal control, such as the following:

               o  OMB Bulletin No. 01-02, Audit Requirements for Federal
               Financial Statements, which requires auditors of federal financial
               statements to test and report on agencies' internal control over
               financial reporting in connection with the audit of the financial
               statements;
               o  FMFIA, which since its passage in 1982 has called for a
               continuous process for assessment and improvement of internal
               control, including control over financial reporting, and an annual
               assessment and statement of assurance by agency heads;
               o  revised Circular No. A-123, which is intended to strengthen the
               requirements for conducting management's assessment of internal
               control over financial reporting; and
               o  revised Circular No. A-127, which is intended to highlight
               internal control requirements unique to financial management
               systems.

    Leveraging the resources already deployed in other areas of the financial
    statement audit would help reduce the additional work needed to opine on
    internal control over financial reporting and therefore decrease the
    incremental cost. For example, OMB Bulletin 01-02 requires auditors to (1)
    gain an understanding of internal control over financial reporting, (2)
    obtain an understanding of the process by which the agency identifies and
    evaluates weaknesses required to be reported under FMFIA, (3) determine if
    internal control has been properly designed and placed in operation, (4)
    assess control risk, (5) perform tests of internal control to determine
    whether it is effective, and (6) report any identified deficiencies. In
    meeting the requirements of OMB's Bulletin No. 01-02, auditors are already
    performing steps that could be leveraged for opining on internal control
    over financial reporting. As noted in the FAM, audit work performed in
    connection with OMB Circular No. 01-02 may be sufficient to provide an
    opinion on internal control over financial reporting.

    The CFO Council and the PCIE requested and received from the IG community
    cost estimates to obtain an opinion on internal control over financial
    reporting. The guidance given to the IG community was to exclude
    management's cost to support the audit effort or to implement the new
    requirements of Appendix A to Circular No. A-123.17 Costs incurred to
    comply with Circular No. A-123 will be incurred irrespective of a
    requirement to obtain an opinion on internal control over financial
    reporting. We agree that these costs do not add to the incremental cost of
    obtaining an opinion on internal control over financial reporting and
    should not be included in the estimate to perform the opinion-level work.
    Instead, these activities can be leveraged by the auditors to reduce
    internal control audit costs. The activities that must be performed for
    agency compliance with the revised Circular No. A-123 include identifying,
    documenting, and testing internal control over financial reporting. These
    are the same types of activities that would have to be performed in
    conducting an audit of internal control over financial reporting and would
    offer the auditor the ability to consider the work of management in
    evaluating the effectiveness of internal control over financial reporting
    and deciding on the level of audit evidence needed to support an opinion.
    Specifically, the auditor might decide to consider the work of management
    as part of the process of gaining an understanding of internal control
    over financial reporting and in determining the nature, timing, and extent
    of the auditor's tests. Preparation of such information by management
    reduces the costs for the auditor to gather the information. This requires
    close coordination and up-front planning so that the auditor is in a
    position to leverage management's work.

    Efficient auditor approach. An audit approach that uses reasoned risk and
    experience-based auditor judgments in areas such as designing efficient
    internal control testing and additional flexibility in using the work of
    others, similar to the approach in the FAM, would provide an efficient and
    cost-effective means to accomplish audits of internal control. These
    flexibilities in audit approaches would also help reduce the additional
    audit work needed to opine on internal control and thus decrease the
    incremental cost. It is important to note, however, that the standards18
    that currently provide the basis for the FAM approach for providing an
    auditor's opinion on internal control over financial reporting are being
    revised by the Auditing Standards Board of the American Institute of
    Certified Public Accountants. The cost of a requirement for internal
    control opinions in the federal government could be impacted by any future
    changes to the underlying auditing standards.

    17Appendix A to Circular No. A-123 provides a methodology for agency
    management to assess, document, and report on internal control over
    financial reporting.

    18See footnote 14.

    Staggered implementation approach. Having set criteria as to when an
    agency should initially be required to obtain an opinion on internal
    control over financial reporting would be an important cost consideration.
    As discussed later, not all agencies will be in a position to have
    efficient internal control audits at this time. For example, in our view,
    under most circumstances, it would not be prudent for agencies with
    extensive known internal control weaknesses to pay for opinions on
    internal control over financial reporting, assuming that an agency
    acknowledges the seriousness of its problems and is working to remediate
    those weaknesses. However, in the case of DHS, where the Congress has
    particular oversight concerns because it is a new agency comprising
    numerous entities, auditor involvement in overseeing management's efforts
    to evaluate and report on internal control should be beneficial to both
    management and congressional oversight. In addition, if management of an
    agency, such as DHS, which has a significant number of material
    weaknesses,19 either decides to or is required to report on internal
    control over financial reporting and is willing to acknowledge the
    agency's weaknesses in its assurance statement, then there should be very
    minimal costs for the auditor to issue an adverse opinion on internal
    control.

    Multiyear audit cycle. Once agency management has demonstrated effective
    internal control over financial reporting as evidenced by unqualified
    opinions issued by an independent external auditor, we believe
    establishing a multiyear audit cycle could be appropriate. Important to
    this consideration is that during the years not subject to audit, agency
    management would still have to comply with the revised Circular No. A-123,
    which requires agency management to annually assess the adequacy of
    internal control over financial reporting, provide a report on identified
    material weaknesses and corrective actions, and provide separate assurance
    on the agency's internal control over financial reporting. On a multiyear
    cycle, the audit of internal control over financial reporting would
    provide independent assurance that management's assessment of its internal
    control is reliable. This would be a similar quality control practice much
    like that used in the peer review requirements for audit organizations,
    which occur every 3 years.

    Sarbanes-Oxley lessons learned. According to the joint study report, some
    of the agencies pointed to the higher-than-estimated cost of implementing
    section 404 of Sarbanes-Oxley as a deterrent to requiring an opinion on
    internal control over financial reporting in the federal government.
    However, the private sector internal control environment differs from that
    of federal agencies. Although many companies in the private sector have
    been required to maintain effective internal control under the Foreign
    Corrupt Practices Act of 1977,20 there was no management assessment or
    reporting requirement until passage of Sarbanes-Oxley. On the other hand,
    federal managers have been subject to statutory internal control
    assessment and reporting similar to the requirements of Sarbanes-Oxley
    since 1982, as well as other numerous legislative and regulatory
    requirements that promote and support effective internal control. Although
    these laws and regulatory requirements have not proven fully effective in
    establishing a strong system of internal control by themselves, taken as a
    whole, they have long created an environment that has demanded and
    promoted effective control and management accountability.

    19In the case of DHS, as part of the audit of its fiscal year 2005
    financial statements, the auditor in disclaiming its opinion on the
    financial statements reported 10 material weaknesses and 2 reportable
    conditions. Individually and collectively, these problems are very
    serious.

    20Pub. L. No. 95-213, 91 Stat. 1494 (Dec. 19, 1977).

    In November 2005, PCAOB, which, among other things, is charged by
    Sarbanes-Oxley to issue auditing, quality control, and ethics standards
    for public company audits, issued a report on the first-year
    implementation of Sarbanes-Oxley requirement for an audit of internal
    control over financial reporting performed in conjunction with an audit of
    financial statements.21 The board's monitoring focused on whether public
    accounting firms' audit methodologies, as well as firms' execution of
    those methodologies, have resulted in audits of internal control that are
    effective and efficient. PCAOB found that both public accounting firms and
    public companies faced enormous challenges in the first year of
    implementation, arising from the limited time frame that firms and public
    companies had to implement the new requirements; a shortage of staff with
    prior training and experience in designing, evaluating, and testing
    control; and related strains on available resources. These challenges were
    compounded in those companies that needed to make significant improvements
    in their internal control systems to make up for deferred maintenance of
    those systems.

    In our review of the lessons learned from the private sector first-year
    implementation of section 404 of Sarbanes-Oxley, we noted that some of the
    issues identified that affected the efficiency of the audit and,
    therefore, the cost of the audit, should not affect CFO Act agencies to
    the same extent. Proper implementation of the FAM integrated audit
    approach, which uses reasoned risk, efficient internal control testing,
    additional flexibilities in using the work of others, as well as other
    measures, would to a large extent mitigate the inefficiencies noted in the
    lessons learned for first-year section 404 implementation. Based on the
    PCAOB report, the following is a summary of the audit lessons learned as a
    result of the implementation of section 404 of Sarbanes-Oxley.

               o  Some independent public accountants (IPA) did not integrate
               their audits of internal control with their audits of financial
               statements. In an integrated audit of the financial statements and
               internal control, the auditor designs and simultaneously executes
               procedures that accomplish the objectives of both audits. These
               objectives are not identical but are interrelated. By not
               integrating both audits, the auditors may perform additional audit
               work than would otherwise be necessary, therefore increasing the
               costs of the audits.
               o  Some IPAs did not effectively apply a preferred top-down
               approach. To varying degrees, auditors often approached the audit
               of internal control from the bottom up. Using a top-down approach,
               the auditor would instead begin by evaluating company-level
               control and significant accounts at the financial statement level
               and then work down to relevant individual control at the process,
               transaction, or application levels. The results of the auditors'
               testing at each level help the auditor tailor the remainder of the
               work. Therefore, auditors may be able to reduce tests of internal
               control, which should result in reduced audit costs.
               o  Some IPAs performed inefficient, and sometimes ineffective,
               walk-throughs of major classes of transactions because they used
               different transactions to test each control separately rather than
               walking a single transaction through the entire process.
               o  Some IPAs did not use the work of others to the extent
               permitted by PCAOB Auditing Standard No. 2.22 Auditors that more
               effectively use the work of others as permitted will likely be
               able to make more efficient use of their own time in performing
               the audits of internal control.

    21Public Company Accounting Oversight Board, Report of the Initial
    Implementation of Auditing Standard No. 2, "An Audit of Internal Control
    over Financial Reporting Performed in Conjunction with an Audit of
    Financial Statements," PCAOB Release No. 2005-023 (Washington, D.C.: Nov.
    30, 2005).

    Additionally, in the report, PCAOB noted that the most common reasons why
    audits were not as effective as expected include the following:

               o  In the face of identified control deficiencies, often
               discovered late in the audit process, some auditors failed to
               sufficiently evaluate the adequacy of compensating controls. For
               example, in some cases, auditors relied on management assertions
               about compensating controls without testing those controls in
               operation.
               o  Some IPAs did not perform sufficient testing of the controls
               over preparing financial statement disclosures. The controls in
               this area are among the most important in the financial reporting
               process because of the relatively high risk of material
               misstatement or omission due to fraud or error. Sufficient testing
               of controls in this area also can make the auditors' substantive
               testing of financial statement disclosures more efficient.

    Further, implementing the requirements of section 404 of Sarbanes-Oxley
    has put tremendous pressure on the availability of resources in the
    accounting and auditing profession. For instance, the four largest
    accounting firms have reported that they have significantly increased
    their assurance staff in the past 5 years and are expected to continue to
    experience a significant strain on resources to supply their need for
    assurance staff in the next 5 years.

    Additional Benefits

    The CFO Council and PCIE joint study identified several important benefits
    of obtaining an opinion on internal control over financial reporting, such
    as independent assurance, improved internal control, reduced material
    weaknesses, reduced errors and improved data integrity, improved
    documentation reliability and reporting, and improved agency focus and
    oversight, with which we agree. We believe that there are additional
    benefits that should also be considered when concluding on the merits of
    such a requirement. Some of the benefits we identified are not direct
    benefits of having an opinion on internal control, but they are important
    indirect benefits that should be considered in concluding on the merits of
    this requirement. We believe annual independent assessments and audit
    reporting can also:

    22 Pursuant to 15 U.S.C. S:7213, PCAOB issued Auditing Standard No. 2, An
    Audit of Internal Control Over Financial Reporting Performed in
    Conjunction with an Audit on Financial Statements, PCAOB Release No.
    2003-017 (Washington, D.C.: Oct. 7, 2003). PCAOB has recently announced
    that it is considering amending this standard.

               o  Strengthen the work done to support implementation of other
               laws enacted to enhance internal control or reinforce the
               significance of effective internal control. Examples include (1)
               FMFIA, which calls for a continuous process for assessment of
               internal control, and (2) GPRA, which requires agencies to set
               strategic and performance goals and measure performance toward
               those goals. Internal control plays a significant role in helping
               managers achieve their goals.
               o  Help to improve other efforts, such as cost analyses,
               budgeting, and performance metrics, through assurances over the
               reliability of financial and relevant nonfinancial data. For
               example, the internal control audit would provide additional
               assurances about internal control over the accuracy of
               management's estimates of improper payments (over $38 billion
               reported by the federal government for fiscal year 2005) across
               federal programs. Identifying improper payments and accurately
               measuring them over time is an important factor in eventually
               addressing and reducing them.
               o  Improve monitoring of the effectiveness of an entity's risk
               management and accountability systems. An audit requirement would
               not only provide assurance, but would also provide a mechanism for
               reporting on the extent to which management is carrying out its
               fundamental responsibilities in establishing and maintaining
               internal control.

    Factors to Consider in Establishing Criteria
    for an Internal Control Audit Requirement

    We view auditor opinions on internal control over financial reporting as
    an important component of monitoring the effectiveness of an entity's risk
    management and accountability systems. In putting this concept into
    practice at GAO, we not only issue an opinion on internal control over
    financial reporting at the federal entities where we perform the financial
    statement audit,23 including the consolidated financial statements of the
    U.S. government, but since the early 1990s, we have also obtained an
    auditor's opinion on internal control over financial reporting in
    conjunction with the audit of our own annual financial statements. Other
    agencies have also exhibited such initiative. For example, the Social
    Security Administration (SSA) and the Nuclear Regulatory Commission
    received opinions (unqualified and qualified, respectively) on their
    internal control over financial reporting for fiscal year 2005 from their
    respective independent auditors.

    23Currently, we perform financial statement audits at the Federal Deposit
    Insurance Corporation, the Internal Revenue Service, the Securities and
    Exchange Commission, and the American Battle Monuments Commission.

    We agree in part with the study's conclusion that CFO Act agencies should
    first be given the opportunity to implement the revised OMB Circular No.
    A-123 before there is an across-the-board requirement to obtain an audit
    opinion on internal control over financial reporting. At the same time, we
    also believe that specific criteria should be established as to when such
    an audit initially would be warranted and, therefore, required.
    Establishing specific criteria will help ensure that current efforts are
    sustained over time and with changes in administrations. As discussed
    previously, while management already has the fundamental responsibility to
    maintain and assess internal control as a key element of properly managing
    a federal agency, history has shown that sustained financial management
    progress requires ongoing, active congressional oversight. A requirement
    for an auditor's opinion on internal control over financial reporting
    would help ensure that the intended benefits of management's assertion are
    fully realized and that the Congress, through an independent set of eyes,
    has an important tool for oversight. Additionally, once effective internal
    control over financial reporting has been established, as evidenced by an
    unqualified opinion, the cost of the requirement may be mitigated by
    implementing a multiyear cycle for the audit opinion on internal control
    over financial reporting, as noted previously.

    As we stressed in our February 2005 testimony,24 the auditor's role,
    similar to its opinion on the financial statements issued by management,
    would be to state whether the auditor agrees with management's assertion
    about the effectiveness of its internal control so that the reader has
    independent assurances about management's assertion. This is especially
    important when management asserts its internal control is adequate. The
    following are some key factors to consider when establishing criteria for
    when to require an auditor opinion on internal control over financial
    reporting at each entity.

               o  Is management providing an unqualified assurance statement? If
               so, an auditor opinion can be cost effective and would serve as an
               independent validation of the reliability of management's
               conclusions.
               o  What is the effectiveness of management's process for assessing
               internal control? Even though internal control weaknesses may be
               reported, an opinion can add value to the reliability of
               management's process. Further, if there are indications that
               management's process for assessing internal control is not
               effective, a targeted, limited scope review of the process could
               be performed to identify deficiencies in management's process.
               o  What is the current condition of internal control over
               financial reporting? The condition can be assessed by a number of
               factors, including

                            o  recent audit opinion findings;
                            o  nature of material weaknesses over financial
                            reporting, if any;
                            o  reported weaknesses or noncompliance under FMFIA
                            and the Federal Financial Management Improvement Act;
                            o  results of OMB Circular No. A-123 assessments;
                            o  the President's Management Agenda "Report card"
                            status; and
                            o  percentage or amount of improper payments reported
                            under the Improper Payments Information Act.

               o  Is the agency demonstrating measurable improvements in its
               internal control? If not, OMB may encourage progress by requiring
               an audit on internal control over financial reporting, as it may
               assist agencies to identify and prioritize solutions to
               long-standing internal control weaknesses.

    24GAO, Financial Management: Effective Internal Control Is Key to
    Accountability, GAO-05-321T (Washington, D.C.: Feb. 16, 2005).

    As stated previously, set criteria for when an agency should initially
    require audits of internal control over financial reporting would be more
    cost effective and efficient in many cases. For example, DOD has many
    known material internal control weaknesses. Of the 25 areas on GAO's
    high-risk list, 14 relate to DOD, including DOD financial management. DOD
    management is currently working on a long-term plan to remediate its
    weaknesses, and today it is clearly not even close to being in a position
    to state that the department has effective internal control over financial
    reporting. Therefore, little, if any, additional work would be needed for
    an auditor to render an opinion that internal control over financial
    reporting was not effective. Thus, the joint study's reported estimate of
    about $84 million for a DOD internal control opinion does not appear to
    reflect a reasonable approach to DOD's current situation, and the DOD
    Inspector General would likely not even contemplate undertaking such an
    effort at this time. On the other hand, for fiscal year 2005, SSA
    management reported that SSA had adequate internal control over financial
    reporting. The auditor's unqualified opinion on internal control over
    financial reporting at SSA for fiscal year 2005 provided an independent
    assessment of management's assertion about internal control, which we
    believe by its nature adds value and credibility similar to the auditor's
    opinion on the financial statements and provides an external check on the
    effectiveness of internal control and accountability at SSA.

    As noted in the joint study, in deciding when to require an opinion on
    internal control over financial reporting, the facts and circumstances of
    individual agencies should be considered on a case-by-case basis. For
    example, as in the case of the recently enacted internal control audit
    requirement at DHS, the Congress may have particular oversight concerns
    that could be addressed by an internal control audit. As discussed
    earlier, because DHS is a new agency comprising numerous entities, the
    requirement for an internal control audit at this time should be
    beneficial to both management and congressional oversight. Similar to DOD,
    DHS has many documented internal control weaknesses, the number and nature
    of which are so serious they should minimize any additional work and
    incremental cost necessary to issue an adverse opinion on internal control
    over financial reporting. On the other hand, it is likely that the
    requirement for an internal control audit has expedited DHS management's
    development of remediation plans to correct DHS's internal control
    weaknesses. In any event, while DHS continues toward remediation of its
    internal control weaknesses, the current incremental cost to render an
    opinion on DHS's internal control over financial reporting should be
    minimal.

    Conclusions

    As the Congress and the American public have increased demands for
    accountability, the federal government must respond by having a high
    standard of accountability for its programs and activities. We view
    auditor opinions on internal control over financial reporting as an
    important component of monitoring the effectiveness of an entity's risk
    management and accountability systems. OMB's efforts to enhance Circular
    No. A-123 through the December 2004 revision and its continued efforts to
    improve the quality of internal control in the federal government
    financial management environment reflect substantial progress in both the
    criteria and expectations for this issue. History, though, has proven that
    the execution of laws and regulations needs to be monitored to effectively
    implement and maintain financial management improvement in the federal
    government. To that end, specific criteria to ascertain when an agency
    should initially be required to obtain an audit opinion on its internal
    control over financial reporting are critical to ensuring that the
    internal control audits fully contribute to the overarching goal of
    ongoing improvement in federal agency internal control and accountability.
    Additionally, implementing a multiyear cycle for an opinion on internal
    control over financial reporting could assist in mitigating the cost of
    the requirement while still providing an effective quality control
    mechanism for ascertaining that management's assessment of its internal
    control is reliable. The benefits identified in the joint study along with
    the additional benefits we identified, although not quantifiable in
    monetary terms, clearly indicate that having set criteria as to when an
    agency should initially be required to obtain an auditor opinion on
    internal control over financial reporting would be a key oversight
    mechanism for the Congress and ultimately the American taxpayer.

    Recommendations for Executive Action

    To ensure that audit opinions on agency internal control over financial
    reporting are obtained at the proper time and for a reasonable cost, we
    recommend that the Director, Office of Management and Budget, as a
    function of OMB's financial management leadership role, (1) develop
    specific criteria related to when an agency should initially be required
    to obtain an opinion on internal control over financial reporting and (2)
    consider establishing criteria whereby an agency would qualify for a
    multiyear cycle for obtaining an audit opinion on internal control over
    financial reporting, rather than an annual cycle. Such criteria should
    address the overarching goal of ongoing improvements in federal agency
    internal control and also consider the facts and circumstances of
    individual agencies and oversight needs.

    Agency Comments and Our Evaluation

    In comments on a draft of this report, reprinted in enclosure IV, OMB's
    Deputy Director for Management agreed with the ultimate goal of improving
    internal control in the federal government. While not specifically
    addressing our two recommendations, OMB indicated that the most effective
    and efficient path toward the goal is to give agencies reasonable time to
    fully implement the requirements of the revised OMB Circular No. A-123
    before considering additional requirements. As noted in our report, we
    agree that agencies should be given the opportunity to implement the
    revised Circular No. A-123 before there is an across-the-board requirement
    to obtain an audit opinion on internal control over financial reporting.
    OMB also provided technical comments, which we reviewed and incorporated
    as appropriate.

                                       _ _ _ _ _

    We are sending copies of this report to other interested congressional
    committees and to the Deputy Director of the Office of Management and
    Budget, who chairs both the CFO Council and the PCIE. Copies will be made
    available to others upon request. In addition, this report will also be
    available at no charge on GAO's home page at http://www.gao.gov .

    If you or your staffs have any questions regarding this report, please
    contact me at (202) 512-9095 or at williamsm1@gao.gov. Contact points for
    our Offices of Congressional Relations and Public Affairs may be found on
    the last page of this report. Major contributors to this report include
    Casey Keplinger, Assistant Director; Cherry Clipper; Francine DelVecchio;
    Gabrielle Fagan; and Tim Guinane.

    McCoy Williams

    Director, Financial Management and Assurance

    Enclosures - 4

    Enclosure I

    Joint Study by the Chief Financial Officers Council and the President's Council
    on Integrity and Efficiency on Estimating the Costs and Benefits of Rendering an
                  Opinion on Internal Control over Financial Reporting

    To access the Joint Study, see www.ignet.gov/randp/rpts1.html#2005 .

    Enclosure II

    PCIE Survey - "Estimated Audit Costs of Opining on Your Agency's Internal
    Control over Financial Reporting in Accordance with ATS:501 of the Professional
                           Standards and Related Information"

    Enclosure III

     Two Additional Questions Asked of the CFOs and IGs about the Expected Benefits
             of Circular A-123 and Obtaining an Opinion on Internal Control

    Enclosure IV

                   Comments from the Office of Management and Budget

    (195089)

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed in
    its entirety without further permission from GAO. However, because this
    work may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this material
    separately.

    GAO's Mission

    The Government Accountability Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting its
    constitutional responsibilities and to help improve the performance and
    accountability of the federal government for the American people. GAO
    examines the use of public funds; evaluates federal programs and policies;
    and provides analyses, recommendations, and other assistance to help
    Congress make informed oversight, policy, and funding decisions. GAO's
    commitment to good government is reflected in its core values of
    accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony

    The fastest and easiest way to obtain copies of GAO documents at no cost
    is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts newly
    released reports, testimony, and correspondence on its Web site. To have
    GAO e-mail you a list of newly posted products every afternoon, go to
    www.gao.gov and select "Subscribe to Updates."

    Order by Mail or Phone

    The first copy of each printed report is free. Additional copies are $2
    each. A check or money order should be made out to the Superintendent of
    Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
    copies mailed to a single address are discounted 25 percent. Orders should
    be sent to:

    U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
    D.C. 20548

    To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
    512-6061

    To Report Fraud, Waste, and Abuse in Federal Programs

    Contact:

    Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
    Automated answering system: (800) 424-5454 or (202) 512-7470

    Congressional Relations

    Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S.
    Government Accountability Office, 441 G Street NW, Room 7125 Washington,
    D.C. 20548

    Public Affairs

    Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 U.S.
    Government Accountability Office, 441 G Street NW, Room 7149 Washington,
    D.C. 20548
    *** End of document. ***