SECTION 1. PURPOSE.

.01 This Order prescribes policies and procedures and assigns responsibilities for establishing and maintaining adequate systems of internal management control in the programs and activities of the Department of Commerce (the "Department").

.02 This revision reflects changes made in Office of Management and Budget (OMB) Circular A-123, "Internal Control Systems," of August of 1986, provides definitions of key internal control terms, clarifies procedural aspects of the program, and deletes reference to the evaluation of accounting systems under Section 4 of the Federal Managers' Financial Integrity Act (now in DAO 203-3).

SECTION 2. AUTHORITY AND SCOPE.

This Order is issued pursuant to the Accounting and Auditing Act of 1950 and the Federal Managers' Financial Integrity Act (FMFIA) of 1982 (P.L. 97-255), which amends the Act of 1950 to require the heads of departments and agencies to maintain adequate systems of internal control and report annually to the President and Congress on these systems. This Order implements OMB's revised Circular A-123 of August 4, 1986, and also complies with the General Accounting Office's (GAO) "Internal Control Standards" and the OMB's "Guidelines for the Evaluation and Improvement of and Reporting on Internal Control Systems." The provisions of this Order apply to all program, financial, and administrative activities of the Department. Internal control procedures and responsibilities for Department accounting systems are covered in DAO 203-3.

SECTION 3. POLICY.

The Department will establish and operate its Internal Control Program to comply with the requirements of the FMFIA and OMB Circular A-123. The following policies apply:

a. Effective internal control systems shall be formally established and maintained in the Department as an integral part of normal management. Internal control systems will be cost-effective.

b. Systems of internal control shall be evaluated routinely, control shortcomings fully disclosed, and weaknesses corrected promptly.

c. Mission-related activities and administrative areas with a high potential for dollar or information loss shall have the highest priority when scheduling internal control evaluations. Areas with recognized "material" weaknesses, see paragraph 6.07 of this Order, or national security implications should also receive the same priority.

d. Whenever possible, internal control evaluations shall be combined with other management reviews to promote efficiency and save resources.

e. Information on control systems applicable to more than one organizational unit of the Department shall be shared within the Department to promote effective management practices.

SECTION 4. DEFINITIONS.

.01 Assessable Unit - the focus of evaluative work in the internal control process. A conceptually manageable organizational, programmatic, or functional entity upon which a meaningful Vulnerability Assessment and Internal Control Review may be performed. A list of existing assessable units is available from each Internal Control Working Group (Working Group) member, (see paragraph .08 below), or the Departmental Office of Management and Organization (OMO).

.02 Assessable Unit Manager - A manager assigned direct responsibility for ensuring that an internal control system is in place and operating effectively within his/her assessable unit. A list of assessable unit managers is available from each Working Group member or from OMO. (See paragraph 5.06. of this Order.)

.03 Department of Commerce Internal Control Handbook (IC Handbook) - provides detailed guidance on the internal control process and amplifies the procedural phases in OMB's internal control guidance. The IC Handbook also supplements the provisions of this Order.

.04 Internal Control Committee - a committee establishing Department policy on internal control matters. The Committee is comprised of each Secretarial Officer, the head of each Departmental office or operating unit, or designated deputy. The Committee also ensures that all elements of the Department adhere to applicable laws, regulations, and Department policy. (See paragraph 5.04. of this Order.)

.05 Internal Control Review (ICR) - a detailed evaluation process which determines the adequacy of an existing internal control system and provides recommended improvements.

.06 Internal Control Standards - control elements forming the basis of all Federal internal control systems. These elements are presented in the Comptroller General's "Standards for Control in the Federal Government," issued on June 1, 1983. These standards are available from members of the Working Group or from OMO. They apply to all program operations and administrative functions of the Department.

.07 Internal Control System - all formal measures taken and actions prescribed by managers to establish operations which fully meet programmatic or administrative responsibilities. Each level of management participates in developing a system of control which provides reasonable assurance that program and administrative activities are carried out effectively. Internal control measures or actions:

a. define what should be done (manuals, directives, desk procedures, etc.);

b. monitor operations as they occur (supervision, use of checklists, computer edits, etc.); and

c. establish feedback sources on operations (quality assurance reports, client input, financial reports, etc.).

.08 Internal Control Working Group - a permanent group establishing procedural requirements to implement the Department's internal control policy. The Working Group may also address operational problems or concerns as the Department's internal control program is carried out. Working Group members shall be senior operating unit managers designated by Internal Control Committee members. (See paragraph 5.05.)

.09 Management Control Plan (MCP) - a brief written plan, developed annually by OMO, summarizing the Department's vulnerability assessment ratings, planned internal control evaluations, and other planned actions to provide reasonable assurance that controls are in place and operating as intended. The MCP serves as a guide in managing the Department's implementation of the FMFIA.

.10 Segmentation - the process of identifying, inventorying, and describing organizational or functional units (Assessable Units) throughout the Department in preparation for other internal control activities (e.g., Vulnerability Assessments and Internal Control Reviews).

.11 Vulnerability Assessment (VA) - a quick evaluation which documents an assessable unit's susceptibility to waste, loss, unauthorized use, or misappropriation and the import that poor controls could have within Commerce or on the public. The VA results in an assessable unit score which helps management determine the scheduling priority for Internal Control Reviews.

SECTION 5. RESPONSIBILITIES.

.01 The Secretary of Commerce has overall responsibility for the Department's compliance with the FMFIA and OMB Circular A-123, as amended. The Secretary is required by the FMFIA to report annually, by December 31, to the President and the Congress on the status of internal management and accounting controls at the Department.

.02 The Assistant Secretary for Administration manages the Department's Internal Control Program, and will:

a. promote the development and effective functioning of internal control systems;

b. chair the Internal Control Committee;

c. ensure that plans for internal control activity comply with the requirements of the FMFIA, OMB Circular A-123, and other OMB and Department guidance;

d. prepare, issue, and maintain written guidance (IC Handbook and other material as required) to implement and manage the Department's Internal Control Program, (see paragraph 6.01 of this Order);

e. establish appropriate internal control training programs for managers and evaluation teams;

f. monitor the progress of internal control plans and perform quality assurance reviews on completed actions, as necessary;

g. promote full and accurate disclosure of internal control weaknesses and ensure their timely correction;

h. provide guidance to Departmental offices and operating units on the form and content of their yearly internal control statements to the Secretary (see .03b., below);

i. review end-of-year statements by Departmental offices and operating units on the status of their internal control systems, and prepare the Secretary's consolidated report to the President and the Congress;

j. prepare the Department's MCP (see paragraph 4.09) and submit an updated version to OMB annually, and

k. respond to internal control requests from OMB, GAO, and other Federal agencies.

.03 Secretarial Officers, Heads of Departmental Offices, and Heads of Operating Units will:

a. ensure that efficient and cost effective internal control systems are established and maintained within their units;

b. provide a written statement to the Secretary on the status of internal control systems by October 31 of each year;

c. promote full and accurate disclosure of internal control weaknesses, and ensure their timely correction;

d. ensure that internal control activities conform with this Order and other Departmental guidance;

e. serve as a member, or appoint a senior deputy/official to serve as a member, of the Internal Control Committee and;

f. ensure that the performance plan of each assessable unit manager covers the development and maintenance of effective internal control systems and, as appropriate, specifies the timely completion of a Vulnerability Assessment or Internal Control Review.

.04 The Internal Control Committee will meet, as necessary, to determine Departmentwide policy on internal control issues. Decisions shall be binding Departmentwide. Committee meetings shall be scheduled when a significant Governmentwide internal control policy change occurs or when other conditions warrant, as deemed appropriate by the Assistant Secretary for Administration.

.05 The Internal Control Working Group will meet, as necessary, to discuss and approve procedures to implement policy changes made by the Internal Control Committee. Decisions shall be binding Departmentwide. Working Group meetings shall be held when internal control policy changes occur or when other conditions warrant, as deemed appropriate by the Director, OMO, who will also chair the Working Group.

.06 Assessable Unit Managers shall ensure that internal control systems are developed and maintained in all areas under their authority in conformance with GAO's "Standards for Control in the Federal Government" and with the precepts of good management. Assessable Unit Managers shall also ensure that internal control evaluations for their areas of responsibility are completed in a timely manner and in accordance with the Department's IC Handbook, including the complete and timely implementation of all corrective measures.

.07 The Office of Inspector General (OIG) will review internal controls as a routine part of internal audits; selectively evaluate internal control reviews performed by Departmental offices and operating units to verify compliance with all applicable policies, standards, and procedures; provide technical assistance and advice to Department officials; coordinate with Internal Control Committee members to ensure that audit activities do not duplicate internal control reviews; consider recommendations from Internal Control Committee members when establishing audit priorities; participate in or perform internal control reviews, in agreement with Internal Control Committee members; and report annually to the Secretary on whether the evaluation required by the FMFIA has been completed in accordance with OMB and Department guidance.

SECTION 6. PROCEDURES.

.01 The Director, OMO will prepare, issue, and maintain the IC Handbook covering the evaluation of internal control systems and other procedures related to preliminary and follow-up activities. The IC Handbook will have the status and effect of a Department Administrative Order. Prior to issuance, the IC Handbook will be reviewed by the Internal Control Working Group, which includes the Office of Inspector General, and approved by the Director for Budget, Planning and Organization. (See paragraph 4.03. of this Order.)

.02 Segmentation will be performed as determined by the Assistant Secretary for Administration, but not less than once every five years. When a significant reorganization takes place, assessable units should be redefined by the affected organizational unit, and changes forwarded to OMO within three months of the effective date of the reorganization. Segmentation shall be completed in accordance with the IC Handbook.

.03 A Vulnerability Assessment (VA) shall be performed on all assessable units following each Departmentwide resegmentation. In addition, a VA will be performed on assessable units changed significantly during a reorganization. VAs prompted by a reorganization will be completed within six months after the effective date of the reorganization. VAs shall be conducted and completed assessments examined by the operating unit or Departmental office prior to submission to OMO in accordance with the IC Handbook.

.04 ICR schedules shall be determined on a yearly basis. Proposed schedules shall be developed in accordance with the IC Handbook. These schedules shall be submitted to the Departmental Director for Budget, Planning and Organization for review and approval by August 31 of each year.

.05 ICRs shall be completed in accordance with the IC Handbook. ICR teams shall consult with OMO regarding technical assistance, as specified in the Handbook. Working Group members shall ensure that ICRs are completed as scheduled. ICR reports, including recommendations, shall be approved by the assessable unit manager, and, as appropriate, by a more senior official, and submitted to OMO by the organizational unit's Working Group member. In addition, Working Group members shall ensure, in advance, that ICRs meet the minimum review standards in the IC Handbook. ICR recommendations should be reviewed within each operating unit for operational feasibility and availability of funds.

.06 Recommendations from end-of-year internal control statements, ICRs, and other internal control activities will be monitored by OMO. Working Group members shall ensure that all corrective measures are completed on schedule. At OMO's request, Working Group members will report on the status of corrective measures. This report will be due approximately two weeks after the end of each quarter (December 31, March 31, June 30, and September 30).

.07 Secretarial Officers, heads of Departmental offices, and heads of operating units shall submit a yearly statement to the Secretary on the status of internal control systems within their operating units. (Procedures for submitting a statement on accounting systems can be found in DAO 203-3.) The annual statement must include a determination of whether or not the existing control structure provides reasonable assurance that the unit's program and administrative operations conform to the objectives of the FMFIA. This determination shall be made in accordance with the Department's policy paper, "Reasonable Assurance/ Material Weakness: A Departmental Perspective," available from OMO. The statement shall cover the preceding fiscal year, and be submitted to the Secretary no later than October 31 of each year. The specific format and content shall conform to guidance issued by the Departmental Director for Budget, Planning and Organization. All material control weaknesses existing at the end of the fiscal year shall be noted in the statement to the Secretary. A "material" weakness is defined in the policy paper mentioned above.

.08 The Assistant Secretary for Administration shall prepare a consolidated statement on the status of internal control and accounting systems in the Department. This statement, with supporting documents, shall be submitted to the Secretary for signature and transmitted to the President and Congress by December 31 of each year.

SECTION 7. EFFECT ON OTHER ORDERS.

This Order supersedes Department Administrative Order 216-15, dated August 6, 1984.

Signed by: Assistant Secretary for Administration

Office of Primary Interest: Office of Management and Organization