Audit of implementation of the Federal Managers" Financial Integrity Act at overseas missions

Requirements for implementing the Act are: assessing vulnerability; establishing assessable units; preparing an internal control plan; and performing internal control and quality control reviews. The primary objective of this audit was to determine implementation of the Act by A.I.D."s 71 overseas Missions which manage a $22.2 billion portfolio located in 82 countries. The audit showed that A.I.D. had made progress by establishing an Internal Control Oversight Committee, establishing assessable units, preparing a 3-year plan for internal control reviews, selecting an alternative internal control review process and initiating quality control reviews. However, the audit also showed that A.I.D."s 1987 report to the President and Congress dated January 22, 1988, inaccurately portrayed A.I.D."s vulnerability at its 71 overseas Missions because no significant vulnerabilities were reported while concurrent Inspector General audit reports showed significant weaknesses in Mission programs and projects valued at over $1.7 billion. Further, A.I.D. implemented the short-cut method of reviewing internal controls (allowed only when system documentation is adequate) even though system documentation was known to be inadequate. Audit tests at six Missions revealed that $28.9 million of deficiencies went undetected because event cycle reviews were not performed. Internal control assessments at the overseas Missions were also inadequate because: a) review documentation requirements (type, scope, responsible official, pertinent data and facts, key findings and corrective action) were not followed, resulting in documentation that did not support the internal control assessments; and b) Internal Control Committees were not formally established, resulting in no evidence that managers were significantly involved in the process as required. At those Missions where committees were established, their activities could not be evaluated because committee agendas and minutes were not documented. Although a quality control review system was to be established to evaluate the internal control assessment process, quality reviews were not made. The reviews that were made included only the Mission Controller function, did not specifically review internal controls, and were not documented as required for an effective quality control review. (Author abstract)