Internal Control: Analysis of Joint Study on Estimating the Costs
and Benefits of Rendering Opinions on Internal Control over
Financial Reporting in the Federal Environment (06-SEP-06,
GAO-06-255R).
The Department of Homeland Security (DHS) Financial
Accountability Act, Public Law Number 108-330, requires DHS
management to provide an assertion on the internal control that
applies to financial reporting for fiscal year 2005 and to obtain
an auditor's opinion on the department's internal control over
its financial reporting for fiscal year 2006. The act also
directs the Chief Financial Officers (CFO) Council and the
President's Council on Integrity and Efficiency (PCIE) to conduct
a joint study, and report to the Congress and to the Comptroller
General of the United States, on the potential costs and benefits
of requiring agencies subject to the Chief Financial Officers Act
of 1990 to obtain audit opinions of their internal control over
financial reporting. The DHS Financial Accountability Act also
requires that the Comptroller General of the United States review
the joint study and report the results of this analysis to the
Congress. In December 2005, we briefed available committee staff
on our preliminary analysis of the joint study. This report
provides further details on our review and on our views regarding
a requirement for federal agencies to obtain audit opinions on
their internal control over financial reporting.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-06-255R
ACCNO: A60348
TITLE: Internal Control: Analysis of Joint Study on Estimating
the Costs and Benefits of Rendering Opinions on Internal Control
over Financial Reporting in the Federal Environment
DATE: 09/06/2006
SUBJECT: Accounting procedures
Audit reports
Auditors
Federal agencies
Financial disclosure
Internal audits
Internal controls
Reporting requirements
Auditing standards
Financial management
Accounting
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-06-255R
* PDF6-Ordering Information.pdf
* Order by Mail or Phone
September 6, 2006
The Honorable Susan M. Collins
Chairman
The Honorable Joseph I. Lieberman
Ranking Minority Member
Committee on Homeland Security and Governmental Affairs
United States Senate
The Honorable Thomas M. Davis
Chairman
The Honorable Henry A. Waxman
Ranking Minority Member
Committee on Government Reform
House of Representatives
Subject: Internal Control: Analysis of Joint Study on Estimating the Costs
and Benefits of Rendering Opinions on Internal Control over Financial
Reporting in the Federal Environment
The Department of Homeland Security (DHS) Financial Accountability Act,
Public Law Number 108-330, requires DHS management to provide an assertion
on the internal control that applies to financial reporting for fiscal
year 2005 and to obtain an auditor's opinion on the department's internal
control over its financial reporting for fiscal year 2006. The act also
directs the Chief Financial Officers (CFO) Council1 and the President's
Council on Integrity and Efficiency (PCIE)2 to conduct a joint study, and
report to the Congress and to the Comptroller General of the United
States, on the potential costs and benefits of requiring agencies subject
to the Chief Financial Officers Act of 19903 to obtain audit opinions of
their internal control over financial reporting.4 The DHS Financial
Accountability Act also requires that the Comptroller General of the
United States review the joint study and report the results of this
analysis to the Congress. In December 2005, we briefed available committee
staff on our preliminary analysis of the joint study. This report provides
further details on our review and on our views regarding a requirement for
federal agencies to obtain audit opinions on their internal control over
financial reporting.
1The CFO Council is an organization comprised of the CFOs and Deputy CFOs
of the 24 CFO Act agencies, senior officials in the Office of Management
and Budget (OMB), and the Department of the Treasury who work
collaboratively to improve financial management in the U.S. government.
2The PCIE was established in May 1992 to (1) address integrity, economy,
and effectiveness issues that transcend individual government agencies and
(2) increase the professionalism and effectiveness of inspector general
personnel throughout the government. The PCIE is composed primarily of the
presidentially appointed inspectors general. Officials from OMB and the
Federal Bureau of Investigation, Office of Government Ethics, Office of
Special Counsel, and Office of Personnel Management serve on the PCIE as
well.
3See 31 U.S.C. S: 901(b)(1) for a list of agencies.
The Office of Management and Budget (OMB) revised its Circular Number
A-1235 in December 2004 (effective beginning with fiscal year 2006) to
strengthen the requirements for conducting management's assessment of
internal control over financial reporting. Major revisions contained in
Appendix A of the circular include requiring CFO Act agency management to
annually assess the adequacy of internal control over financial reporting,
provide a report on identified material weaknesses and corrective actions,
and provide separate assurance on the agency's internal control over
financial reporting. In initiating the revisions to Circular No. A-123,
OMB cited the new internal control requirements for publicly traded
companies that are contained in section 404 of the Sarbanes-Oxley Act of
2002 (Sarbanes-Oxley).6 Sarbanes-Oxley was enacted in response to
corporate accountability failures of the past several years and contains a
provision calling for management's assessment of internal control over
financial reporting similar to the long-standing requirements for
executive branch agencies in 31 U.S.C. S: 3512 (c),(d), commonly referred
to as the Federal Managers' Financial Integrity Act (FMFIA), to issue
annual statements of assurance over internal control in the agency.
Opinions on internal control over financial reporting as required by the
Sarbanes-Oxley Act for publicly traded companies are important to protect
investors by improving the accuracy and reliability of corporate
disclosures made pursuant to the securities laws. Regulators, public
companies, audit firms, and investors generally agree that the
Sarbanes-Oxley Act of 2002 has had a positive and significant impact on
investor protection and confidence. At the same time, the costs associated
with the Sarbanes-Oxley Act have been significant and additional steps
should be taken to improve the efficiency and cost-effectiveness of its
implementation.
Federal agencies also have a duty to attain and maintain the public's
trust and confidence. Specifically, federal agencies have a stewardship
obligation to prevent fraud, waste, and abuse; to use tax dollars
appropriately; and to ensure financial accountability to the President,
the Congress, and the American people. In the broadest context, internal
control represents an organization's plans, methods, and procedures used
to meet its missions, goals, and objectives and serves as the first line
of defense in safeguarding assets and preventing and detecting errors,
fraud, waste, abuse, and mismanagement. Effective internal control should
provide reasonable assurance that an organization achieves the following
objectives: (1) effective and efficient operations, (2) reliable financial
reporting, and (3) compliance with applicable laws and regulations.
Safeguarding of assets is a subset of these objectives. The scope of this
report mainly deals with one objective of internal control, specifically
that related to the reliability of financial reporting.
4Both the PCIE and the CFO Council are chaired by OMB's Deputy Director
for Management.
5OMB Circular No. A-123, Management's Responsibility for Internal Control
(revised December 2004).
6Pub. L. No. 107-204, S: 404, 116 Stat. 745, 789 (July 30, 2002).
Consistent with the DHS Financial Accountability Act's requirements, our
objective was to review the joint study and provide our perspective on the
important issues regarding a potential requirement for CFO Act agencies to
obtain audit opinions on their internal control over financial reporting.
Specifically, this report provides our analysis of (1) the joint study and
key issues to consider in assessing the costs and benefits of obtaining an
opinion on internal control over financial reporting and (2) factors to
consider in establishing criteria for when such an internal control
opinion is warranted. To address our objective, we reviewed and discussed
the joint study's methodology, results, and conclusions with officials
from OMB and members of the CFO Council and the PCIE. In conducting their
joint study, the CFO Council and the PCIE obtained cost and benefit data
from the CFO Act agency inspectors general (IG), but did not verify the
cost data supporting the cost-benefit analysis. We reviewed the
development and administration of the questionnaire, but because the scope
of our work did not include independently validating the cost information
reported by questionnaire respondents, we cannot comment on the
reliability of its cost estimates.
We reviewed numerous reports and other professional literature that
contributed to the development of the joint study. These materials are
referenced in Attachment A of the joint study. We obtained a copy of the
questionnaire sent to the IGs of the 24 CFO Act agencies and the two
additional questions that were subsequently asked of the CFOs and IGs. We
also reviewed prior GAO reports; applicable federal laws and regulations;
and private sector results after implementation of the Sarbanes-Oxley Act
of 2002, including documents issued by the Securities and Exchange
Commission and the Public Company Accounting Oversight Board (PCAOB). We
performed our work from September 2005 through July 2006 in accordance
with U.S. generally accepted government auditing standards. We requested
comments on a draft of this report from OMB. Written comments from OMB's
Deputy Director for Management are reprinted in enclosure IV. We also
received several technical comments, which we have addressed as
appropriate.
Results in Brief
We recognize that assessing the costs and benefits of obtaining an
auditor's opinion on internal control over financial reporting is
difficult, and the joint study properly noted many challenges inherent in
performing cost-benefit analyses on this issue. The CFO Council and the
PCIE acknowledged in the joint study that estimating the costs to render
an opinion on internal control over financial reporting was "challenging
given the lack of hard data and the number of unknown factors that go into
developing a strong estimate" and refer to their reported estimates as
"not hard numbers." Of the total reported estimated costs7 of about $140
million, the joint study attributed about $56 million (40 percent) to
internal control audits of the 23 civilian CFO Act agencies, with the
balance of $84 million to cover the Department of Defense (DOD). The CFO
Council and the PCIE also stated that the benefits from obtaining an
opinion on internal control over financial reporting are difficult to
measure, and as a result, the joint study discussed some of the potential
benefits only qualitatively. Consequently, the joint study did not
identify all relevant costs and benefits, which may therefore limit the
usefulness of the results and conclusions of the joint study.
7In conducting the joint study, the CFO Council and the PCIE did not
verify the cost data included in the report and our scope of work did not
include independent validation of the cost information.
While the study identified categories of additional work that drive the
cost estimates, we believe additional factors are relevant in considering
the costs of a requirement for audit opinions on internal control over
financial reporting in the federal government. Factors that would likely
affect an estimate of the costs of a requirement in the federal government
include (1) leveraging the resources already in place in areas of the
financial statement audit; (2) using an audit approach that integrates the
financial and internal control audits and includes reasoned risk and
experience-based auditor judgments, similar to the approach in the
GAO/PCIE Financial Audit Manual (FAM); (3) setting criteria for when an
agency should initially be required to obtain an audit of internal control
over financial reporting; and (4) establishing criteria whereby an agency
would qualify for a multiyear cycle for obtaining an audit opinion on
internal control rather than an annual cycle. We also note that some of
the reasons cited for higher-than-estimated costs in early implementation
of the internal control provisions of Sarbanes-Oxley for publicly traded
companies, should not, to nearly the same extent, be factors for
incremental costs in the federal government environment. For example,
auditors of federal agencies have been required for many years to test
internal control to achieve a low level of assessed control risk. As a
result, the FAM includes an integrated audit approach for testing internal
control in connection with a financial statement audit. Similar internal
control testing requirements were not in place for public companies prior
to section 404 of Sarbanes-Oxley. It is important to note, however, that
the standards8 that currently provide the basis for the FAM approach for
providing an auditor's opinion on internal control over financial
reporting are being revised by the Auditing Standards Board of the
American Institute of Certified Public Accountants. The cost of a
requirement for internal control opinions in the federal government could
be impacted by any future changes to the underlying auditing standards.
Additionally, as reported by the joint study, a majority of the IGs and
CFOs believe that benefits would be derived from an audit of internal
control over financial reporting. A majority of the IGs and CFOs cited the
following as benefits that may be derived from this type of audit: (1)
improved internal control and reduced material weaknesses; (2) reduced
errors and improved data integrity, documentation reliability, and
reporting; and (3) improved agency focus and oversight. According to the
study, the true benefit of the auditor's opinion on internal control is
the added independent assurance it provides that management's assessment
of its internal control is reliable. We agree with the benefits identified
by the IGs and CFOs, and in turn, these benefits provide additional
incentives for timely identifying and correcting internal control weakness
over financial reporting. In addition, we have identified several other
benefits that should be considered when concluding on the merits of
establishing a requirement to obtain an opinion on internal control over
financial reporting. We believe independent assessments and auditor
reporting can also
8"Reporting on an Entity's Internal Control over Financial Reporting," AT
Section 501, Codification of Statements on Auditing Standards, American
Institute of Certified Public Accountants.
o strengthen the audit work done to support implementation of
laws enacted to enhance internal control or reinforce the
significance of effective internal control, such as FMFIA and the
Government Performance and Results Act (GPRA);
o help to improve other efforts, such as cost analyses,
budgeting, and performance metrics, through additional assurances
over the reliability of financial and relevant nonfinancial data;
and
o improve monitoring of the effectiveness of an entity's risk
management and accountability systems.
We view auditor opinions on internal control over financial reporting as
an important component of monitoring the effectiveness of an entity's risk
management and accountability systems. We agree in part with the study's
overall conclusion that federal agencies should first be given the
opportunity to implement revised Circular No. A-123 before there is an
across-the-board requirement to obtain an audit opinion on internal
control over financial reporting. However, we also believe that having set
criteria as to when an agency should initially be required to obtain an
opinion, instead of agency or OMB discretion, would be useful. We
recognize that not all agencies have the same maturity level of internal
control over financial reporting and that an initial determination of an
agency's readiness to undergo an audit may be appropriate. Such an
approach should consider specific criteria to ascertain when an agency
should initially obtain an opinion on internal control, such as whether
management has properly assessed its internal control and has a reasonable
basis for its statement of assurance. We also believe that criteria can be
established to achieve a balance between value, risk, and cost, whereby
once agency management has demonstrated a stabilized effective system of
internal control over financial reporting, subsequent audits could be
performed on a multiyear cycle, for instance, every 3 years. Important to
this consideration is that during the years not subject to an internal
control audit, agency management would still have to comply with the
revised Circular No. A-123, which requires agency management to annually
assess the adequacy of internal control over financial reporting by
providing a report on identified material weaknesses and corrective
actions and providing a separate assurance statement on the agency's
internal control over financial reporting. The overarching goal of
obtaining an audit opinion on internal control is to provide reasonable
independent assurance that management's assessment of internal control is
adequate, which significantly contributes to ongoing improvement in
federal agency internal control and accountability. Any criteria used to
determine when an agency should undergo initial and continual
implementation of the requirement for an audit opinion on internal control
audit should consider at what point the audit will contribute to this
goal.
To reasonably ensure that audit opinions on agency internal control over
financial reporting are obtained at the proper time and for a reasonable
cost, we are making two recommendations to the Director, Office of
Management and Budget, as a function of OMB's financial management
leadership role: (1) develop specific criteria as to when agencies should
initially be required to obtain opinions on internal control over
financial reporting and (2) develop criteria as to when agencies have
demonstrated a stabilized, effective system of internal control over
financial reporting in order to move to a multiyear cycle for obtaining
subsequent opinions on internal control. During the years not subject to
an internal control audit, agency management would still adhere to a
comprehensive ongoing management assessment and reporting process for
internal control over financial reporting, as required by the revised
Circular No. A-123.
In written comments on a draft of this report, OMB agreed with the
ultimate goal of improving internal control in the federal government.
OMB's comments also highlighted the continued cooperation of GAO and the
PCIE and the CFO Council on important issues and stated that OMB looked
forward to working together to achieve the joint goal of effective
internal control in the federal government. (OMB's comments are reprinted
in enc. IV.)
Background
Federal agencies have a significant responsibility for accurate and timely
accounting, controlling, and reporting of the receipts, disbursements, and
applications of public moneys. The Congress has long recognized the
importance of internal control, beginning with the Budget and Accounting
Procedures Act of 1950,9 which placed primary responsibility for
establishing and maintaining internal control squarely on the shoulders of
agency management. In 1982, the Congress passed FMFIA, requiring agency
heads to establish a continuous process for assessment and improvement of
their agencies' internal control and to annually report on the adequacy of
internal control. In addition, FMFIA required the Comptroller General to
establish internal control standards and OMB to issue guidelines for
agencies to follow in assessing their internal control. In December 1982,
following FMFIA enactment, OMB issued Circular No. A-123, which included
the assessment guidelines required by the act. The Comptroller General
issued Standards for Internal Control in the Federal Government in 1983,
which was last revised in November 1999.10
We monitored and reported on FMFIA implementation efforts across the
government in a series of four reports11 from 1984 through 1989, as well
as in numerous reports targeting specific agencies and programs. With each
report, we noted the efforts under way, but also emphasized that more
needed to be done. In 1989, we concluded that while internal control was
improving, the efforts were clearly not producing the results intended.
The management assessment and reporting process itself appeared to have
become the objective of the annual efforts rather than actually improving
internal control, and many serious internal control and accounting systems
weaknesses remain unresolved. We have highlighted these long-standing
weaknesses in our series of high-risk reports starting in 1990, the most
recent of which we issued in January 2005.12
9Pub. L. No. 81-784, 64 Stat. 832 (Sept. 12, 1950).
10The Comptroller General revised the standards in 1999, based on
developments in internal control theory, including the internal control
framework recommended in the report of the Committee on Sponsoring
Organization of the Treadway Commission, the effects of information
technology, and the passage of a series of landmark reforms. GAO,
Standards for Internal Control in the Federal Government,
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
11See (1) GAO, Implementation of the Federal Managers' Financial Integrity
Act: First Year, GAO/OCG-84-3 (Washington, D.C.: Aug. 24, 1984); (2) GAO,
Financial Integrity Act: The Government Faces Serious Internal Control and
Accounting Systems Problems, GAO/AFMD-86-14 (Washington, D.C.: Dec. 23,
1985); (3) GAO, Financial Integrity Act: Continuing Efforts Needed to
Improve Internal Control and Accounting Systems, GAO/AFMD-88-10
(Washington, D.C.: Dec. 30, 1987); and (4) GAO, Financial Integrity Act:
Inadequate Controls Result in Ineffective Federal Programs and Billions in
Losses, GAO/AFMD-90-10 (Washington, D.C.: Nov. 28, 1989).
In 1995, OMB made a major revision to its Circular No. A-123 guidance that
provided a framework for integrating internal control assessments with
other work performed and relaxed the management assessment and reporting
requirements, giving the agencies discretion to determine the tools to use
in arriving at their annual FMFIA assurance statements. OMB's December
2004 revisions (effective beginning with fiscal year 2006) to Circular No.
A-123 are intended to strengthen the requirements for conducting
management's assessment of internal control over financial reporting at
CFO Act agencies. Major revisions include requiring CFO Act agency
management to annually provide a separate assurance statement on internal
control over financial reporting in its performance and accountability
report, along with a report on identified material weaknesses and
corrective actions. The revision also establishes that OMB may, at its
discretion, require a CFO Act agency to obtain an opinion on internal
control over financial reporting if the agency is not meeting its
deadlines as outlined in its corrective action plans. In general, we
supported the revisions to Circular No. A-123 as they recognize that
effective internal control is critical to improving federal agencies'
effectiveness and accountability and to achieving the goals that the
Congress established for them.13
The recent revisions to Circular No. A-123 were initiated in response to
the new internal control requirements for publicly traded companies that
are contained in Sarbanes-Oxley. Under section 404 of Sarbanes-Oxley,
management of a publicly traded company is required to (1) annually assess
internal control over financial reporting at the company and (2) issue an
annual statement on the effectiveness of internal control over financial
reporting. The company's auditors are then required to attest to
management's assessment as to the effectiveness of its internal control
over financial reporting and issue an auditor's opinion as to the
effectiveness of internal control over financial reporting.
The Joint Study and Key Issues to Consider in Assessing Costs and Benefits
The CFO Council and the PCIE joint study transmits the results obtained
from a questionnaire of the IGs for the 24 CFO Act agencies with
additional input from the CFO Council's Policies and Practice Committee. A
copy of the joint study report is reprinted in enclosure I. The CFO
Council and the PCIE acknowledged inherent limitations in conducting the
joint study and noted that "performing any sort of meaningful cost/benefit
analysis has proven elusive." Specifically, the joint study faced numerous
challenges, including (1) identifying and estimating all relevant costs
and benefits and (2) a lack of historical data from the agencies on the
costs and benefits of implementing the requirement. Because only a few
agencies have experience with obtaining audit opinions on internal control
over financial reporting, there is limited specific information about the
trade-offs between the costs of obtaining an opinion and the benefits
provided. The joint study identified general categories of the additional
work that it stated drive the cost estimates, along with a qualitative
discussion of some benefits. We believe additional factors related to both
costs and benefits are also relevant and should be included in considering
the cost-benefit of the audit requirement.
12GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January
2005).
13GAO, Financial Management: Effective Internal Control Is Key to
Accountability, GAO-05-321T (Washington, D.C.: Feb. 16, 2005).
Methodology, Results, and Conclusion of the Joint Study
To accomplish their objective, the CFO Council and the PCIE, under the
leadership of OMB, which chairs both councils, gathered information from
the IGs and the CFOs about the costs and benefits of the proposed
requirement. The PCIE Audit Committee coordinated the collection of cost
and benefit information from the IGs. The Audit Committee Chair sent a
questionnaire to the IGs at the 24 CFO Act agencies to gather data on the
estimated audit costs and the benefits of performing an examination under
the standards of ATS:501, Reporting on an Entity's Internal Control Over
Financial Reporting,14 which are issued by the American Institute of
Certified Public Accountants and incorporated by reference as part of U.S.
generally accepted government auditing standards. Enclosure II contains a
copy of the PCIE questionnaire used to gather estimated costs and benefits
of opining on internal control over financial reporting. The CFO Council
and the PCIE acknowledged some limitations in the joint study. For
example, they acknowledged that they did not validate the cost estimates
submitted by the 24 CFO Act agency IGs. In addition, the study noted that
the estimates are "not hard numbers," meaning that they were only overall
estimates that were not necessarily based, for example, on the potential
number of hours and labor rates that would be included by a contracted
auditor in a formal contract proposal.
The PCIE Audit Committee summarized the responses from each of the IGs at
the 24 CFO Act agencies, and then shared the summary with the respondents
to ensure they had accurately captured their comments. The PCIE Audit
Committee also shared the results with the CFO Council's Financial
Management Policies and Practices Committee15 and incorporated its
comments. The draft study was then shared with both the full CFO Council
and the PCIE, whose comments were also incorporated. During the final
comment period, two additional questions were asked of the CFOs and IGs
about the expected benefits of the revised Circular No. A-123 and on
obtaining opinions on internal control over financial reporting. Enclosure
III contains the two additional questions that were asked of the CFOs and
IGs. The CFO Council and PCIE also considered the experiences of publicly
traded companies by reviewing numerous articles, surveys, and statements
made before regulatory bodies relating to the implementation of section
404 of the Sarbanes-Oxley Act.
14This section of the Attestation Standards, issued by the American
Institute of Certified Public Accountants, provides the standards for the
practitioner who is engaged to issue or does issue an examination report
on the effectiveness of an entity's internal control over financial
reporting. This section is currently under revision.
15The CFO Council's Financial Management Policies and Practices Committee
is comprised of representatives from federal agencies who work
collaboratively to identify and address emerging issues.
Of the total reported estimated costs of about $140 million, the joint
study attributed about $56 million (40 percent) to internal control audits
of the 23 civilian CFO Act agencies, with the balance of $84 million to
cover DOD. The joint study notes that driving the cost estimates are the
additional work that the auditor would need to perform beyond the
requirements of OMB Bulletin No. 01-02, Audit Requirements for Federal
Financial Statements,16 and the GAO/PCIE FAM in order to render an opinion
on an agency's internal control over financial reporting.
The joint study also noted that the benefits of obtaining an opinion on
internal control are difficult to measure. The joint study stated that
"benefits can only be described in general terms, making a cost/benefit
analysis difficult." Some of the benefits cited were (1) improved internal
control and reduced material weaknesses; (2) reduced errors and improved
data integrity, documentation reliability, and reporting; and (3) improved
agency focus and oversight. The joint study did not quantify these
benefits, but noted that these benefits should largely be achieved when
agencies effectively implement the revisions to Circular No. A-123.
The joint study concluded that (1) most industry experts agree that there
are significant incremental costs to obtaining an opinion on internal
control over financial reporting; (2) before incurring the additional
costs, it would be prudent to see how federal managers implement the
revised Circular No. A-123 and to evaluate the private sector's
implementation of the internal control provisions of Sarbanes-Oxley when
additional information becomes available; and (3) the decision on whether
to obtain an opinion needs to be decided on an agency-by-agency basis,
depending on the condition of an agency's financial management program.
The CFOs and the IGs recommended that all CFO Act agencies should not be
required to conduct such an audit at this time. Rather, agencies should be
given the opportunity to implement the revised Circular No. A-123, and
obtain an internal control audit only where particular circumstances
warrant such an audit.
Certain Factors That Could Influence Costs and Benefits
Not Included in the Joint Study
We view auditor opinions on internal control over financial reporting as
an important component of monitoring the effectiveness of an entity's risk
management and accountability systems. We agree in part with the study's
overall conclusion that agencies should first be given the opportunity to
implement the revised Circular No. A-123 before there is an
across-the-board requirement to obtain an audit opinion on internal
control over financial reporting. Internal control is a fundamental
management responsibility. Management, not the auditor, should be the
first line of defense and be held accountable for establishing a
continuous evaluation process to ensure the adequacy of internal control.
However, as discussed later, we also believe that there should be specific
criteria for ascertaining when an agency should initially be required to
obtain an opinion on internal control. We also recognize that assessing
the costs and benefits of obtaining an opinion is difficult and agree
there are many challenges inherent to performing cost-benefit analyses on
this issue. While the joint study identified categories of additional work
that drive the cost estimates along with key benefits, we believe
additional factors that could influence costs and benefits are relevant in
considering a requirement for audit opinions on internal control.
16 OMB Bulletin No. 01-02, Audit Requirements for Federal Financial
Statements, was recently superseded by the updated audit requirements
included in OMB Bulletin No. 06-03, Audit Requirements for Federal
Financial Statements (Aug. 23, 2006).
Additional Factors That Could Influence Costs
We identified five additional factors that could influence costs and
should be considered: (1) leveraging resources, (2) using an efficient
auditor approach, (3) using a staggered implementation approach, (4)
implementing a multiyear cycle for an audit opinion on internal control
over financial reporting, and (5) applying Sarbanes-Oxley lessons learned.
Leveraging resources. In developing cost estimates to obtain an opinion on
internal control over financial reporting, consideration needs to be given
to fully leveraging the resources already deployed as part of the
financial statement audits. For example, it may be possible to leverage
the resources deployed to determine compliance with laws and regulatory
requirements that were enacted to strengthen internal control or reinforce
the significance of effective internal control, such as the following:
o OMB Bulletin No. 01-02, Audit Requirements for Federal
Financial Statements, which requires auditors of federal financial
statements to test and report on agencies' internal control over
financial reporting in connection with the audit of the financial
statements;
o FMFIA, which since its passage in 1982 has called for a
continuous process for assessment and improvement of internal
control, including control over financial reporting, and an annual
assessment and statement of assurance by agency heads;
o revised Circular No. A-123, which is intended to strengthen the
requirements for conducting management's assessment of internal
control over financial reporting; and
o revised Circular No. A-127, which is intended to highlight
internal control requirements unique to financial management
systems.
Leveraging the resources already deployed in other areas of the financial
statement audit would help reduce the additional work needed to opine on
internal control over financial reporting and therefore decrease the
incremental cost. For example, OMB Bulletin 01-02 requires auditors to (1)
gain an understanding of internal control over financial reporting, (2)
obtain an understanding of the process by which the agency identifies and
evaluates weaknesses required to be reported under FMFIA, (3) determine if
internal control has been properly designed and placed in operation, (4)
assess control risk, (5) perform tests of internal control to determine
whether it is effective, and (6) report any identified deficiencies. In
meeting the requirements of OMB's Bulletin No. 01-02, auditors are already
performing steps that could be leveraged for opining on internal control
over financial reporting. As noted in the FAM, audit work performed in
connection with OMB Circular No. 01-02 may be sufficient to provide an
opinion on internal control over financial reporting.
The CFO Council and the PCIE requested and received from the IG community
cost estimates to obtain an opinion on internal control over financial
reporting. The guidance given to the IG community was to exclude
management's cost to support the audit effort or to implement the new
requirements of Appendix A to Circular No. A-123.17 Costs incurred to
comply with Circular No. A-123 will be incurred irrespective of a
requirement to obtain an opinion on internal control over financial
reporting. We agree that these costs do not add to the incremental cost of
obtaining an opinion on internal control over financial reporting and
should not be included in the estimate to perform the opinion-level work.
Instead, these activities can be leveraged by the auditors to reduce
internal control audit costs. The activities that must be performed for
agency compliance with the revised Circular No. A-123 include identifying,
documenting, and testing internal control over financial reporting. These
are the same types of activities that would have to be performed in
conducting an audit of internal control over financial reporting and would
offer the auditor the ability to consider the work of management in
evaluating the effectiveness of internal control over financial reporting
and deciding on the level of audit evidence needed to support an opinion.
Specifically, the auditor might decide to consider the work of management
as part of the process of gaining an understanding of internal control
over financial reporting and in determining the nature, timing, and extent
of the auditor's tests. Preparation of such information by management
reduces the costs for the auditor to gather the information. This requires
close coordination and up-front planning so that the auditor is in a
position to leverage management's work.
Efficient auditor approach. An audit approach that uses reasoned risk and
experience-based auditor judgments in areas such as designing efficient
internal control testing and additional flexibility in using the work of
others, similar to the approach in the FAM, would provide an efficient and
cost-effective means to accomplish audits of internal control. These
flexibilities in audit approaches would also help reduce the additional
audit work needed to opine on internal control and thus decrease the
incremental cost. It is important to note, however, that the standards18
that currently provide the basis for the FAM approach for providing an
auditor's opinion on internal control over financial reporting are being
revised by the Auditing Standards Board of the American Institute of
Certified Public Accountants. The cost of a requirement for internal
control opinions in the federal government could be impacted by any future
changes to the underlying auditing standards.
17Appendix A to Circular No. A-123 provides a methodology for agency
management to assess, document, and report on internal control over
financial reporting.
18See footnote 14.
Staggered implementation approach. Having set criteria as to when an
agency should initially be required to obtain an opinion on internal
control over financial reporting would be an important cost consideration.
As discussed later, not all agencies will be in a position to have
efficient internal control audits at this time. For example, in our view,
under most circumstances, it would not be prudent for agencies with
extensive known internal control weaknesses to pay for opinions on
internal control over financial reporting, assuming that an agency
acknowledges the seriousness of its problems and is working to remediate
those weaknesses. However, in the case of DHS, where the Congress has
particular oversight concerns because it is a new agency comprising
numerous entities, auditor involvement in overseeing management's efforts
to evaluate and report on internal control should be beneficial to both
management and congressional oversight. In addition, if management of an
agency, such as DHS, which has a significant number of material
weaknesses,19 either decides to or is required to report on internal
control over financial reporting and is willing to acknowledge the
agency's weaknesses in its assurance statement, then there should be very
minimal costs for the auditor to issue an adverse opinion on internal
control.
Multiyear audit cycle. Once agency management has demonstrated effective
internal control over financial reporting as evidenced by unqualified
opinions issued by an independent external auditor, we believe
establishing a multiyear audit cycle could be appropriate. Important to
this consideration is that during the years not subject to audit, agency
management would still have to comply with the revised Circular No. A-123,
which requires agency management to annually assess the adequacy of
internal control over financial reporting, provide a report on identified
material weaknesses and corrective actions, and provide separate assurance
on the agency's internal control over financial reporting. On a multiyear
cycle, the audit of internal control over financial reporting would
provide independent assurance that management's assessment of its internal
control is reliable. This would be a similar quality control practice much
like that used in the peer review requirements for audit organizations,
which occur every 3 years.
Sarbanes-Oxley lessons learned. According to the joint study report, some
of the agencies pointed to the higher-than-estimated cost of implementing
section 404 of Sarbanes-Oxley as a deterrent to requiring an opinion on
internal control over financial reporting in the federal government.
However, the private sector internal control environment differs from that
of federal agencies. Although many companies in the private sector have
been required to maintain effective internal control under the Foreign
Corrupt Practices Act of 1977,20 there was no management assessment or
reporting requirement until passage of Sarbanes-Oxley. On the other hand,
federal managers have been subject to statutory internal control
assessment and reporting similar to the requirements of Sarbanes-Oxley
since 1982, as well as other numerous legislative and regulatory
requirements that promote and support effective internal control. Although
these laws and regulatory requirements have not proven fully effective in
establishing a strong system of internal control by themselves, taken as a
whole, they have long created an environment that has demanded and
promoted effective control and management accountability.
19In the case of DHS, as part of the audit of its fiscal year 2005
financial statements, the auditor in disclaiming its opinion on the
financial statements reported 10 material weaknesses and 2 reportable
conditions. Individually and collectively, these problems are very
serious.
20Pub. L. No. 95-213, 91 Stat. 1494 (Dec. 19, 1977).
In November 2005, PCAOB, which, among other things, is charged by
Sarbanes-Oxley to issue auditing, quality control, and ethics standards
for public company audits, issued a report on the first-year
implementation of Sarbanes-Oxley requirement for an audit of internal
control over financial reporting performed in conjunction with an audit of
financial statements.21 The board's monitoring focused on whether public
accounting firms' audit methodologies, as well as firms' execution of
those methodologies, have resulted in audits of internal control that are
effective and efficient. PCAOB found that both public accounting firms and
public companies faced enormous challenges in the first year of
implementation, arising from the limited time frame that firms and public
companies had to implement the new requirements; a shortage of staff with
prior training and experience in designing, evaluating, and testing
control; and related strains on available resources. These challenges were
compounded in those companies that needed to make significant improvements
in their internal control systems to make up for deferred maintenance of
those systems.
In our review of the lessons learned from the private sector first-year
implementation of section 404 of Sarbanes-Oxley, we noted that some of the
issues identified that affected the efficiency of the audit and,
therefore, the cost of the audit, should not affect CFO Act agencies to
the same extent. Proper implementation of the FAM integrated audit
approach, which uses reasoned risk, efficient internal control testing,
additional flexibilities in using the work of others, as well as other
measures, would to a large extent mitigate the inefficiencies noted in the
lessons learned for first-year section 404 implementation. Based on the
PCAOB report, the following is a summary of the audit lessons learned as a
result of the implementation of section 404 of Sarbanes-Oxley.
o Some independent public accountants (IPA) did not integrate
their audits of internal control with their audits of financial
statements. In an integrated audit of the financial statements and
internal control, the auditor designs and simultaneously executes
procedures that accomplish the objectives of both audits. These
objectives are not identical but are interrelated. By not
integrating both audits, the auditors may perform additional audit
work than would otherwise be necessary, therefore increasing the
costs of the audits.
o Some IPAs did not effectively apply a preferred top-down
approach. To varying degrees, auditors often approached the audit
of internal control from the bottom up. Using a top-down approach,
the auditor would instead begin by evaluating company-level
control and significant accounts at the financial statement level
and then work down to relevant individual control at the process,
transaction, or application levels. The results of the auditors'
testing at each level help the auditor tailor the remainder of the
work. Therefore, auditors may be able to reduce tests of internal
control, which should result in reduced audit costs.
o Some IPAs performed inefficient, and sometimes ineffective,
walk-throughs of major classes of transactions because they used
different transactions to test each control separately rather than
walking a single transaction through the entire process.
o Some IPAs did not use the work of others to the extent
permitted by PCAOB Auditing Standard No. 2.22 Auditors that more
effectively use the work of others as permitted will likely be
able to make more efficient use of their own time in performing
the audits of internal control.
21Public Company Accounting Oversight Board, Report of the Initial
Implementation of Auditing Standard No. 2, "An Audit of Internal Control
over Financial Reporting Performed in Conjunction with an Audit of
Financial Statements," PCAOB Release No. 2005-023 (Washington, D.C.: Nov.
30, 2005).
Additionally, in the report, PCAOB noted that the most common reasons why
audits were not as effective as expected include the following:
o In the face of identified control deficiencies, often
discovered late in the audit process, some auditors failed to
sufficiently evaluate the adequacy of compensating controls. For
example, in some cases, auditors relied on management assertions
about compensating controls without testing those controls in
operation.
o Some IPAs did not perform sufficient testing of the controls
over preparing financial statement disclosures. The controls in
this area are among the most important in the financial reporting
process because of the relatively high risk of material
misstatement or omission due to fraud or error. Sufficient testing
of controls in this area also can make the auditors' substantive
testing of financial statement disclosures more efficient.
Further, implementing the requirements of section 404 of Sarbanes-Oxley
has put tremendous pressure on the availability of resources in the
accounting and auditing profession. For instance, the four largest
accounting firms have reported that they have significantly increased
their assurance staff in the past 5 years and are expected to continue to
experience a significant strain on resources to supply their need for
assurance staff in the next 5 years.
Additional Benefits
The CFO Council and PCIE joint study identified several important benefits
of obtaining an opinion on internal control over financial reporting, such
as independent assurance, improved internal control, reduced material
weaknesses, reduced errors and improved data integrity, improved
documentation reliability and reporting, and improved agency focus and
oversight, with which we agree. We believe that there are additional
benefits that should also be considered when concluding on the merits of
such a requirement. Some of the benefits we identified are not direct
benefits of having an opinion on internal control, but they are important
indirect benefits that should be considered in concluding on the merits of
this requirement. We believe annual independent assessments and audit
reporting can also:
22 Pursuant to 15 U.S.C. S:7213, PCAOB issued Auditing Standard No. 2, An
Audit of Internal Control Over Financial Reporting Performed in
Conjunction with an Audit on Financial Statements, PCAOB Release No.
2003-017 (Washington, D.C.: Oct. 7, 2003). PCAOB has recently announced
that it is considering amending this standard.
o Strengthen the work done to support implementation of other
laws enacted to enhance internal control or reinforce the
significance of effective internal control. Examples include (1)
FMFIA, which calls for a continuous process for assessment of
internal control, and (2) GPRA, which requires agencies to set
strategic and performance goals and measure performance toward
those goals. Internal control plays a significant role in helping
managers achieve their goals.
o Help to improve other efforts, such as cost analyses,
budgeting, and performance metrics, through assurances over the
reliability of financial and relevant nonfinancial data. For
example, the internal control audit would provide additional
assurances about internal control over the accuracy of
management's estimates of improper payments (over $38 billion
reported by the federal government for fiscal year 2005) across
federal programs. Identifying improper payments and accurately
measuring them over time is an important factor in eventually
addressing and reducing them.
o Improve monitoring of the effectiveness of an entity's risk
management and accountability systems. An audit requirement would
not only provide assurance, but would also provide a mechanism for
reporting on the extent to which management is carrying out its
fundamental responsibilities in establishing and maintaining
internal control.
Factors to Consider in Establishing Criteria
for an Internal Control Audit Requirement
We view auditor opinions on internal control over financial reporting as
an important component of monitoring the effectiveness of an entity's risk
management and accountability systems. In putting this concept into
practice at GAO, we not only issue an opinion on internal control over
financial reporting at the federal entities where we perform the financial
statement audit,23 including the consolidated financial statements of the
U.S. government, but since the early 1990s, we have also obtained an
auditor's opinion on internal control over financial reporting in
conjunction with the audit of our own annual financial statements. Other
agencies have also exhibited such initiative. For example, the Social
Security Administration (SSA) and the Nuclear Regulatory Commission
received opinions (unqualified and qualified, respectively) on their
internal control over financial reporting for fiscal year 2005 from their
respective independent auditors.
23Currently, we perform financial statement audits at the Federal Deposit
Insurance Corporation, the Internal Revenue Service, the Securities and
Exchange Commission, and the American Battle Monuments Commission.
We agree in part with the study's conclusion that CFO Act agencies should
first be given the opportunity to implement the revised OMB Circular No.
A-123 before there is an across-the-board requirement to obtain an audit
opinion on internal control over financial reporting. At the same time, we
also believe that specific criteria should be established as to when such
an audit initially would be warranted and, therefore, required.
Establishing specific criteria will help ensure that current efforts are
sustained over time and with changes in administrations. As discussed
previously, while management already has the fundamental responsibility to
maintain and assess internal control as a key element of properly managing
a federal agency, history has shown that sustained financial management
progress requires ongoing, active congressional oversight. A requirement
for an auditor's opinion on internal control over financial reporting
would help ensure that the intended benefits of management's assertion are
fully realized and that the Congress, through an independent set of eyes,
has an important tool for oversight. Additionally, once effective internal
control over financial reporting has been established, as evidenced by an
unqualified opinion, the cost of the requirement may be mitigated by
implementing a multiyear cycle for the audit opinion on internal control
over financial reporting, as noted previously.
As we stressed in our February 2005 testimony,24 the auditor's role,
similar to its opinion on the financial statements issued by management,
would be to state whether the auditor agrees with management's assertion
about the effectiveness of its internal control so that the reader has
independent assurances about management's assertion. This is especially
important when management asserts its internal control is adequate. The
following are some key factors to consider when establishing criteria for
when to require an auditor opinion on internal control over financial
reporting at each entity.
o Is management providing an unqualified assurance statement? If
so, an auditor opinion can be cost effective and would serve as an
independent validation of the reliability of management's
conclusions.
o What is the effectiveness of management's process for assessing
internal control? Even though internal control weaknesses may be
reported, an opinion can add value to the reliability of
management's process. Further, if there are indications that
management's process for assessing internal control is not
effective, a targeted, limited scope review of the process could
be performed to identify deficiencies in management's process.
o What is the current condition of internal control over
financial reporting? The condition can be assessed by a number of
factors, including
o recent audit opinion findings;
o nature of material weaknesses over financial
reporting, if any;
o reported weaknesses or noncompliance under FMFIA
and the Federal Financial Management Improvement Act;
o results of OMB Circular No. A-123 assessments;
o the President's Management Agenda "Report card"
status; and
o percentage or amount of improper payments reported
under the Improper Payments Information Act.
o Is the agency demonstrating measurable improvements in its
internal control? If not, OMB may encourage progress by requiring
an audit on internal control over financial reporting, as it may
assist agencies to identify and prioritize solutions to
long-standing internal control weaknesses.
24GAO, Financial Management: Effective Internal Control Is Key to
Accountability, GAO-05-321T (Washington, D.C.: Feb. 16, 2005).
As stated previously, set criteria for when an agency should initially
require audits of internal control over financial reporting would be more
cost effective and efficient in many cases. For example, DOD has many
known material internal control weaknesses. Of the 25 areas on GAO's
high-risk list, 14 relate to DOD, including DOD financial management. DOD
management is currently working on a long-term plan to remediate its
weaknesses, and today it is clearly not even close to being in a position
to state that the department has effective internal control over financial
reporting. Therefore, little, if any, additional work would be needed for
an auditor to render an opinion that internal control over financial
reporting was not effective. Thus, the joint study's reported estimate of
about $84 million for a DOD internal control opinion does not appear to
reflect a reasonable approach to DOD's current situation, and the DOD
Inspector General would likely not even contemplate undertaking such an
effort at this time. On the other hand, for fiscal year 2005, SSA
management reported that SSA had adequate internal control over financial
reporting. The auditor's unqualified opinion on internal control over
financial reporting at SSA for fiscal year 2005 provided an independent
assessment of management's assertion about internal control, which we
believe by its nature adds value and credibility similar to the auditor's
opinion on the financial statements and provides an external check on the
effectiveness of internal control and accountability at SSA.
As noted in the joint study, in deciding when to require an opinion on
internal control over financial reporting, the facts and circumstances of
individual agencies should be considered on a case-by-case basis. For
example, as in the case of the recently enacted internal control audit
requirement at DHS, the Congress may have particular oversight concerns
that could be addressed by an internal control audit. As discussed
earlier, because DHS is a new agency comprising numerous entities, the
requirement for an internal control audit at this time should be
beneficial to both management and congressional oversight. Similar to DOD,
DHS has many documented internal control weaknesses, the number and nature
of which are so serious they should minimize any additional work and
incremental cost necessary to issue an adverse opinion on internal control
over financial reporting. On the other hand, it is likely that the
requirement for an internal control audit has expedited DHS management's
development of remediation plans to correct DHS's internal control
weaknesses. In any event, while DHS continues toward remediation of its
internal control weaknesses, the current incremental cost to render an
opinion on DHS's internal control over financial reporting should be
minimal.
Conclusions
As the Congress and the American public have increased demands for
accountability, the federal government must respond by having a high
standard of accountability for its programs and activities. We view
auditor opinions on internal control over financial reporting as an
important component of monitoring the effectiveness of an entity's risk
management and accountability systems. OMB's efforts to enhance Circular
No. A-123 through the December 2004 revision and its continued efforts to
improve the quality of internal control in the federal government
financial management environment reflect substantial progress in both the
criteria and expectations for this issue. History, though, has proven that
the execution of laws and regulations needs to be monitored to effectively
implement and maintain financial management improvement in the federal
government. To that end, specific criteria to ascertain when an agency
should initially be required to obtain an audit opinion on its internal
control over financial reporting are critical to ensuring that the
internal control audits fully contribute to the overarching goal of
ongoing improvement in federal agency internal control and accountability.
Additionally, implementing a multiyear cycle for an opinion on internal
control over financial reporting could assist in mitigating the cost of
the requirement while still providing an effective quality control
mechanism for ascertaining that management's assessment of its internal
control is reliable. The benefits identified in the joint study along with
the additional benefits we identified, although not quantifiable in
monetary terms, clearly indicate that having set criteria as to when an
agency should initially be required to obtain an auditor opinion on
internal control over financial reporting would be a key oversight
mechanism for the Congress and ultimately the American taxpayer.
Recommendations for Executive Action
To ensure that audit opinions on agency internal control over financial
reporting are obtained at the proper time and for a reasonable cost, we
recommend that the Director, Office of Management and Budget, as a
function of OMB's financial management leadership role, (1) develop
specific criteria related to when an agency should initially be required
to obtain an opinion on internal control over financial reporting and (2)
consider establishing criteria whereby an agency would qualify for a
multiyear cycle for obtaining an audit opinion on internal control over
financial reporting, rather than an annual cycle. Such criteria should
address the overarching goal of ongoing improvements in federal agency
internal control and also consider the facts and circumstances of
individual agencies and oversight needs.
Agency Comments and Our Evaluation
In comments on a draft of this report, reprinted in enclosure IV, OMB's
Deputy Director for Management agreed with the ultimate goal of improving
internal control in the federal government. While not specifically
addressing our two recommendations, OMB indicated that the most effective
and efficient path toward the goal is to give agencies reasonable time to
fully implement the requirements of the revised OMB Circular No. A-123
before considering additional requirements. As noted in our report, we
agree that agencies should be given the opportunity to implement the
revised Circular No. A-123 before there is an across-the-board requirement
to obtain an audit opinion on internal control over financial reporting.
OMB also provided technical comments, which we reviewed and incorporated
as appropriate.
_ _ _ _ _
We are sending copies of this report to other interested congressional
committees and to the Deputy Director of the Office of Management and
Budget, who chairs both the CFO Council and the PCIE. Copies will be made
available to others upon request. In addition, this report will also be
available at no charge on GAO's home page at http://www.gao.gov .
If you or your staffs have any questions regarding this report, please
contact me at (202) 512-9095 or at [email protected]. Contact points for
our Offices of Congressional Relations and Public Affairs may be found on
the last page of this report. Major contributors to this report include
Casey Keplinger, Assistant Director; Cherry Clipper; Francine DelVecchio;
Gabrielle Fagan; and Tim Guinane.
McCoy Williams
Director, Financial Management and Assurance
Enclosures - 4
Enclosure I
Joint Study by the Chief Financial Officers Council and the President's Council
on Integrity and Efficiency on Estimating the Costs and Benefits of Rendering an
Opinion on Internal Control over Financial Reporting
To access the Joint Study, see www.ignet.gov/randp/rpts1.html#2005 .
Enclosure II
PCIE Survey - "Estimated Audit Costs of Opining on Your Agency's Internal
Control over Financial Reporting in Accordance with ATS:501 of the Professional
Standards and Related Information"
Enclosure III
Two Additional Questions Asked of the CFOs and IGs about the Expected Benefits
of Circular A-123 and Obtaining an Opinion on Internal Control
Enclosure IV
Comments from the Office of Management and Budget
(195089)
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
GAO's Mission
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony
The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061
To Report Fraud, Waste, and Abuse in Federal Programs
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: [email protected]
Automated answering system: (800) 424-5454 or (202) 512-7470
Congressional Relations
Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Washington,
D.C. 20548
Public Affairs
Paul Anderson, Managing Director, [email protected] (202) 512-4800 U.S.
Government Accountability Office, 441 G Street NW, Room 7149 Washington,
D.C. 20548
*** End of document. ***