SECTION 300:

Internal Control Phase:

Figure 300.1: Methodology Overview 

Planning Phase:   

* Understand the entity's operations: Section 220:
 
* Perform preliminary analytical procedures: Section 225:
 
* Determine planning, design, and test materiality: Section 230:
 
* Identify significant line items, accounts, assertions, and RSSI: 
Section 235:
 
* Identify significant cycles, accounting applications, and financial 
management systems: Section 240:
 
* Identify significant provisions of laws and regulations: Section 245:
 
* Identify relevant budget restrictions: Section 250:
 
* Assess risk factors: Section 260:
 
* Determine likelihood of effective information system controls: 
Section 270:
 
* Identify relevant operations controls to evaluate and test: Section 
275:
 
* Plan other audit procedures: Section 280:
 
* Plan locations to visit: Section 285:

Internal Control Phase: 

* Understand information systems: Section 320:
 
* Identify control objectives: Section 330:
 
* Identify and understand relevant control activities: Section 340:
 
* Determine the nature, timing, and extent of control tests and of 
tests for systems’ compliance with FFMIA requirements: Section 350:
 
* Perform nonsampling control tests and tests for systems’ compliance 
with FFMIA requirements: Section 360:
 
* Assess controls on a preliminary basis: Section 370:

Testing Phase:
 
* Consider the nature, timing, and extent of tests: Section 420:
 
* Design efficient tests: Section 430:
 
* Perform tests and evaluate results: Section 440:
 
** Sampling control tests: Section 450:
 
** Compliance tests: Section 460:
 
** Substantive tests: Section 470:
 
*** Substantive analytical procedures: Section 475:
 
*** Substantive detail tests: Section 480:

Reporting Phase:

* Perform overall analytical procedures: Section 520:
 
* Determine adequacy of audit procedures and audit scope: Section 530:
 
* Evaluate misstatements: Section 540:
 
* Conclude other audit procedures: Section 550:
 
** Inquire of attorneys: 

** Consider subsequent events: 

** Obtain management representations: 

** Consider related party transactions: 

* Determine conformity with generally accepted accounting principles: 
560:
 
* Determine compliance with GAO/PCIE Financial Audit Manual: Section 
570:

* Draft reports: Section 580:

[End of figure]

310 - OVERVIEW: 

.01: 
In the internal control phase, the auditor should gain an understanding 
of internal control and obtain evidence about the effectiveness of 
internal control to (1) assess control risk, (2) determine the nature, 
timing, and extent of control, compliance, and substantive testing, and 
(3) form an opinion or report on internal control over financial 
reporting and compliance. Control risk should be assessed separately 
for each significant financial statement assertion in each significant 
cycle/accounting application (including RSSI). (See figure 300.1.) The 
auditor also should gain an understanding of the components of internal 
control relating to the existence and completeness assertions (and 
valuation for GAO audits) (see definitions of assertions in paragraph 
235.02) relevant to the performance measures reported in the MD&A 
(overview) of the Accountability Report in order to report on controls 
that have not been properly designed and placed in operation. The 
auditor is not required to test performance measures controls, but he 
or she may decide to do so.

.02: 
The entity's management is responsible for establishing and maintaining 
internal control to provide reasonable assurance that the entity's 
objectives will be met. In a financial statement audit, the auditor 
evaluates those internal controls designed to provide reasonable 
assurance that the following objectives are met (also see paragraph 
310.10 for the auditor's responsibility for performance measures 
controls):

* Reliability of financial reporting ("financial reporting controls")
--transactions are properly recorded, processed, and summarized to 
permit the preparation of the financial statements and RSSI in 
accordance with generally accepted accounting principles, and assets 
are safeguarded against loss from unauthorized acquisition, use, or 
disposition;

* Compliance with applicable laws and regulations ("compliance 
controls") --transactions are executed in accordance with (a) laws 
governing the use of budget authority and other laws and regulations 
that could have a direct and material effect on the principal 
statements or RSSI, and (b) any other laws, regulations, and 
governmentwide policies identified by OMB in its audit guidance.

.03: 
The auditor should determine whether such internal control provides 
reasonable assurance that misstatements, losses, or noncompliance, 
material in relation to the financial statements, would be prevented or 
detected during the period under audit. In addition, if the auditor 
intends to opine on internal control, he or she makes a separate 
conclusion on internal control as of the end of the period. 
Additionally, the auditor may test certain operations controls and 
should understand performance measures controls, as discussed in the 
planning phase (section 275).

.04: 
Internal control over safeguarding assets constitutes a process, 
effected by an entity's governing body, management, and other 
personnel, designed to provide reasonable assurance regarding 
prevention or timely detection of unauthorized acquisition, use, or 
disposition of the entity's assets that could have a material effect on 
the financial statements. As used in this manual, safeguarding 
controls, a part of financial reporting controls, relate to protecting 
assets from loss arising from misstatements in processing transactions 
and handling the related assets. Section 395 C includes a list of 
typical safeguarding controls. Safeguarding controls examined as part 
of a financial statement audit do not relate to the loss of assets 
arising from management's operating business decisions, such as 
incurring expenditures for equipment or material that might prove to be 
unnecessary. (Such controls are operations controls.) Safeguarding 
controls consist of (1) controls that prevent or detect unauthorized 
access (direct or indirect) to assets and (2) segregation of duties. 
Safeguarding controls are considered as part of financial reporting 
controls.

.05: 
Just as safeguarding controls are part financial reporting and part 
operations controls, budget controls are part financial reporting and 
part compliance controls. Budget controls that provide reasonable 
assurance that budgetary transactions, such as obligations and outlays, 
are properly recorded, processed, and summarized to permit the 
preparation of the financial statements, mainly the statements of 
budgetary resources and financing, in accordance with GAAP, are 
financial reporting controls. Budget controls are generally also 
compliance controls in that they provide reasonable assurance that 
transactions are executed in accordance with laws governing the use of 
budget authority. Some budget controls may be compliance controls only; 
for example, controls over allotments, to prevent Antideficiency Act 
violations.

.06: 
The auditor must evaluate and test certain controls. AU 319 (SAS 55 
amended by SAS 78) permits the auditor to assess control risk at a high 
(maximum) level and forgo evaluation and testing of financial reporting 
controls if the auditor believes evaluating their effectiveness would 
be inefficient. However, because OMB audit guidance requires the 
auditor to perform sufficient tests of internal controls that have been 
properly designed and placed in operation to support a low assessed 
level of control risk, the auditor may not elect to forgo control tests 
solely because it is more efficient to extend compliance and 
substantive audit procedures.

.07: 
The following are the types of controls to test:

* financial reporting controls (including certain safeguarding and 
budget controls) for each significant assertion in each significant 
cycle/accounting application (identified in section 240),

* compliance controls for each significant provision of laws and 
regulations (identified in section 245), including budget controls for 
each relevant budget restriction (identified in section 250), and:

* operations controls for each operations control (1) relied on in 
performing financial audit procedures or (2) selected for testing by 
the audit team. The auditor also should understand performance measures 
controls, but is not required to test them. However, the auditor may 
decide to test them (see section 275).

.08: 
The auditor is not required to test controls that have not been 
properly designed and placed in operation. Thus, internal controls that 
are not effective in design (or in operation, based on prior years' 
testing) do not need to be tested. If the auditor determined in a prior 
year that controls in a particular accounting application were 
ineffective and if management indicates that controls have not 
improved, the auditor need not test them. On the other hand, if 
controls have been determined to be effective in design and placed in 
operation, the auditor must perform sufficient tests of their 
effectiveness to support a low assessed level of control risk. In such 
cases, the auditor may consider using a rotation approach to testing 
controls over the various accounting applications, as described in 
section 395 G. If the auditor expects to disclaim an opinion because of 
scope limitations or inadequate controls, the auditor may limit 
internal control work to updating the understanding of controls and 
whether they have been placed in operation. The auditor may do this by 
inquiring as to whether previously identified control weaknesses have 
been corrected. In the year the auditor expects to issue an opinion on 
the financial statements, the auditor needs a basis of sufficient work 
on internal control.

.09: 
In the internal control phase, the auditor should perform and document 
the following procedures:

* Understand the entity's information systems for financial reporting, 
compliance with laws and regulations, and relevant operations 
(including reported performance measures) (see section 320).

* Identify control objectives (see section 330).

* Identify and understand relevant control activities that effectively 
achieve the control objectives (see section 340).

* Determine the nature, timing, and extent of control testing (not 
necessary for performance measures controls) (see section 350).

* Perform control tests that do not involve sampling (nonsampling 
control tests - see section 360).[Footnote 1] (Sampling control tests, 
if necessary, are performed in the testing phase, as discussed in 
section 450.) Testing is not required for performance measures 
controls.

* On a preliminary basis, based on the evidence obtained, assess (1) 
the effectiveness of financial reporting, compliance, and relevant 
operations controls and (2) control and combined risk (see section 
370). (Combined risk, which includes inherent and control risk, is 
discussed in paragraph 370.09).

.10: 
OMB's audit guidance also defines internal control over performance 
measures as a process, effected by management and other personnel, 
designed to provide reasonable assurance that the following objective 
is met:

* Reliability of performance reporting--transactions and other data 
that support reported performance measures are properly recorded, 
processed, and summarized to permit the preparation of performance 
information in accordance with criteria stated by management.

OMB requires the auditor to obtain an understanding of the components 
of internal control over performance measures included in the MD&A 
relating to the existence and completeness assertions (for GAO audits, 
the valuation assertion is also included in the understanding) and to 
report deficiencies in the design of those controls that have not been 
properly designed and placed in operation. Note that the auditor is not 
required to test internal control over performance measures.

.11: 
In gaining an understanding of an entity's internal control, the 
auditor should obtain knowledge about the design of relevant controls 
and whether they have been placed in operation. In obtaining knowledge 
about whether controls have been placed in operation, the auditor 
determines whether the entity is using them, rather than merely having 
them written in a manual, for example. This differs from determining a 
control's operating effectiveness, which is concerned with how the 
control was applied, the consistency with which it was applied, and by 
whom. Gaining an understanding of internal control does not require 
that the auditor obtain knowledge about operating effectiveness.

[End of section]

320 - UNDERSTAND INFORMATION SYSTEMS: 

.01: 
The auditor should obtain an understanding of the entity's information 
systems (including methods and records) for processing and reporting 
accounting (including RSSI), compliance, and operations data (including 
performance measures reported in the MD&A (overview) of the 
Accountability Report).[Footnote 3] The information systems are part of 
the information and communication component of internal control. The 
communication portion of this component was considered in section 260. 
The auditor should obtain sufficient knowledge of each type of system 
to understand the information in paragraphs 320.03-.07. The auditor may 
use an IS auditor to assist in understanding and documenting the IS 
aspects of these systems. The understanding of the systems should be 
documented in cycle memorandums or other narratives and flow charts.

.02: 
The auditor should perform sufficient system walkthroughs to confirm 
the understanding of significant information about such systems. 
However, if the auditor already has a sufficient understanding of the 
systems as a result of procedures performed in the preceding year, 
discussion of any system changes with management may be substituted for 
the walkthroughs. In a walkthrough of an accounting system, the auditor 
traces one or more transactions from initiation through all processing 
to inclusion in the general ledger, observing the processing in 
operation and examining related documents. Because walkthroughs are 
important in understanding the transaction process and in determining 
appropriate audit procedures, they should be performed for all 
significant accounting applications. Walkthroughs of budget 
accounting, compliance, and operations systems (including reported 
performance measures) should provide the auditor with evidence about 
the functioning of such systems. This walkthrough is to confirm the 
understanding of the system. The IS aspects of each system should be 
incorporated into the audit workpapers, supplemented by additional flow 
charts, narratives, and checklists, as considered necessary.

ACCOUNTING SYSTEM(S):

.03: 
The auditor should obtain an understanding of and should document the 
following for each significant cycle and accounting application 
(including those dealing with RSSI):

* The manner in which transactions are initiated;

* The nature and type of records, journals, ledgers, and source 
documents, and the accounts involved;

* The processing involved from the initiation of transactions to their 
inclusion in the financial statements, including the nature of computer 
files and the manner in which they are accessed, updated, and deleted; 
and:

* The process used to prepare the entity's financial statements and 
budget information, including significant accounting estimates, 
disclosures, and computerized processing.

.04: 
Understanding the processing involved will be important in determining 
whether the financial management systems substantially comply with 
federal financial management systems requirements, federal accounting 
standards, and the SGL at the transaction level, so the auditor can 
report as required by FFMIA. If the entity is likely to receive an 
unqualified opinion and to have no material weaknesses in internal 
control, the auditor should test, (for efficiency, this could be done 
while performing nonsampling control tests (see section 350)), 
significant information the entity provides to support its assertion 
about the substantial compliance of its systems.

BUDGET ACCOUNTING SYSTEM(S):

.05: 
Through discussions with individuals responsible for accounting for 
budget execution, the auditor should understand and document the 
entity's process for:

* Developing and requesting apportionments from OMB;

* Establishing and allocating allotments within the entity, including 
reprogramming of allotments;

* Establishing and recording commitments, if applicable;

* Establishing, recording, and monitoring obligations (undelivered 
orders);

* Establishing and recording expended authority (delivered orders);

* Establishing and recording outlays;

* Monitoring supplemental appropriations;

* Recording transactions in and adjustments to expired accounts; and:

* Monitoring canceled (closed) accounts.

COMPLIANCE SYSTEM(S):

.06: 
The compliance system includes the entity's policies and procedures to 
monitor overall compliance with laws and regulations applicable to the 
entity. Through discussions with entity management, the auditor should 
understand and document the entity's process for:

* Identifying and documenting all laws and regulations applicable to 
the entity;

* Monitoring changes in applicable laws and regulations and responding 
on a timely basis;

* Establishing policies and procedures for complying with specific laws 
and regulations and clearly documenting and communicating these 
policies and procedures to appropriate personnel;

* Assuring that an appropriate number of competent individuals at 
appropriate levels within the entity monitor the entity's compliance 
with applicable laws and regulations; and:

* Investigating, resolving, communicating, and reporting any 
noncompliance with laws and regulations.

OPERATIONS SYSTEM(S) (INCLUDING REPORTED PERFORMANCE MEASURES):

.07: 
Through discussions with appropriate entity personnel, the auditor 
should understand and document any entity systems in which operations 
controls to be evaluated and tested operate, and any systems that 
produce the data used in performance measures reported in the MD&A 
(overview) of the Accountability Report. For example, if the auditor 
intends to evaluate and test an operations control that is dependent on 
certain statistical information, the auditor should understand how such 
statistical information is developed. Also, although the auditor is not 
required to test controls over a system producing data used in 
performance measures (unless it is an accounting or other system tested 
for other reasons), he or she should understand the system and the 
design of internal control related to the existence, completeness, and, 
for GAO audits, valuation (see definition in paragraph 235.02) 
assertions and whether they have been placed in operation. Thus, the 
auditor should understand and document the following:

* How the entity determines the performance measures to report, 
including their relationship to the entity's mission;

* The source of the information used in performance measures;

* The processing involved from the initial source information to its 
inclusion in performance measures; and:

* The process used to prepare the performance measures from the system-
produced data.

[End of section]

330 - IDENTIFY CONTROL OBJECTIVES: 

.01: 
The auditor should identify control objectives for each type of control 
that, if achieved, would provide the entity with reasonable assurance 
that misstatements (whether caused by error or fraud), losses, or 
noncompliance material in relation to the principal statements would be 
prevented or detected. For RSSI, the objectives would relate to 
controls that would provide reasonable assurance that misstatements, 
losses, or noncompliance that would be considered material by users of 
the information would be prevented or detected. Such objectives should 
cover the following general areas:

* Financial reporting controls: Prevent or detect aggregate 
misstatements in significant financial statement assertions, including 
assertions relating to RSSI and the statements of budgetary resources 
and financing. Also, Safeguarding controls: Safeguard assets against 
loss from unauthorized acquisition, use, or disposition.

* Compliance controls: Comply with significant provisions of applicable 
laws and regulations. Also, Budget controls: Execute transactions in 
accordance with budget authority.

* Operations controls: For each relevant operations control, achieve 
the performance level desired by management for the planning, 
productivity, quality, economy, efficiency, or effectiveness of the 
entity's operations. For performance measures controls, report the 
data used to measure the entity's performance in accordance with 
criteria stated by management.

Paragraphs 330.02-.11 describe the process for identifying control 
objectives for each type of control.

FINANCIAL REPORTING CONTROLS:

.02: The auditor should evaluate and test financial reporting controls 
for each significant assertion in each significant line item or 
account, including RSSI and the statements of budgetary resources and 
financing. (See paragraph 235.02 for a discussion of financial 
statement assertions.) The first step in developing control objectives 
for financial reporting controls is to consider the types of 
misstatements that might occur in each significant assertion in each 
significant line item or account. One or more potential misstatements 
can occur in each financial statement assertion. For example, for the 
existence or occurrence assertion, potential misstatements can occur 
in the following four areas:

* Validity: Recorded transactions do not represent economic events that 
actually occurred.

* Cutoff: Transactions are recorded in a different period from that in 
which the economic events occurred.

* Summarization: Transactions are summarized improperly, resulting in 
an overstated total.

* Substantiation: Recorded assets and liabilities of the entity do not 
exist at a given date.

For each potential misstatement, there are one or more control 
objectives that, if achieved, would prevent or detect the potential 
misstatement. These potential misstatements and control objectives 
provide the auditor the primary basis for assessing the effectiveness 
of an entity's control activities.

Identifying Potential Misstatements and Control Objectives:

.03: As discussed in section 240, the auditor identifies the 
significant accounting applications that provide a source of 
significant entries to each significant line item or account. For 
example, as illustrated in section 395 A, (1) sources of significant 
entries to cash typically include the cash receipts, cash 
disbursements, payroll, and cash accounting applications, and (2) 
sources of significant entries to accounts receivable typically 
include the billing, cash receipts, and accounts receivable accounting 
applications. Such accounting applications should have been identified 
in the cycle matrix or ARA or equivalent documentation.

.04: The auditor should understand how potential misstatements in 
significant accounting applications could affect the related line item 
or account at an assertion level. For example, an overstatement of cash 
receipts typically results in (1) an overstatement of the cash account 
(by overstating the debit to cash) and (2) an understatement of 
accounts receivable (by overstating the credit to accounts receivable). 
To illustrate this concept using the assertions, a misstatement in the 
existence or occurrence assertion for cash receipts typically results 
in misstatements in (1) the existence or occurrence assertion for the 
cash account and (2) the completeness assertion for accounts 
receivable.

.05: 
The following general rules may be used to determine the effect of 
transaction-related accounting applications on line items/accounts:

[See PDF for image]

[End of table]

.06: For each potential misstatement in the accounting application, 
the auditor should identify related control objectives that prevent or 
detect the potential misstatement. Section 395 B includes a list of 
potential misstatements that could occur in each assertion in an 
accounting application and related control objectives. The auditor 
should exercise judgment in determining which potential misstatements 
and control objectives to use. The list included in section 395 B 
should be tailored to the accounting application and to the entity and 
may be supplemented with additional objectives or subobjectives.

.07: 
If the above procedures were performed and documented by line item or 
account, a given application might be addressed two or more times. For 
example (see section 395 A), the purchasing accounting application 
typically would be addressed in evaluating controls relating to the 
inventory, property, liabilities, and expenses accounts. To avoid such 
duplication, the auditor should use a Specific Control Evaluation (SCE) 
worksheet or equivalent to document the procedures discussed in 
paragraphs 330.03-.06. The SCE groups potential misstatements and 
control objectives by accounting application (within each cycle), 
providing a format to perform and document the evaluation and testing 
of internal controls efficiently. See section 395 H for an example of a 
completed SCE worksheet. GAO has developed sample forms in WordPerfect 
and MS Word for preparing the ARA and SCE worksheets.

The Need for Testing Safeguarding Controls and Segregation-of-Duties 
Controls:

.08: 
Safeguarding controls and segregation-of-duties controls are often 
critical to the effectiveness of controls over liquid (easily sold or 
traded), readily marketable assets (such as cash, inventories, or 
property) that are highly susceptible to theft, loss, or 
misappropriation in material amounts. These controls are also important 
when there is an increased risk of fraud. Before selecting specific 
control activities to test, the auditor should determine whether 
safeguarding controls are relevant. If the auditor determines that (1) 
the asset is highly liquid or marketable and (2) material amounts are 
susceptible to theft, loss, or misappropriation, the auditor should 
identify control objectives for safeguarding such assets and evaluate 
and test safeguarding controls. On the other hand, if the asset is not 
liquid or marketable or if material amounts are not readily susceptible 
to theft, loss, or misappropriation, the need to test safeguarding 
controls may be lessened. (Testing for segregation of duties is 
discussed in paragraphs 360.11-.12. Other safeguarding controls are 
considered in connection with financial reporting controls, as part of 
the existence assertion.):

BUDGET CONTROLS:

.09: 
The objectives of budget controls are to provide reasonable assurance 
that the entity (1) properly records, processes, and summarizes 
transactions to permit the preparation of the statements of budgetary 
resources and financing in accordance with GAAP and (2) executes 
transactions in accordance with budget authority. Section 395 F 
presents a list of budget control objectives, organized by steps in the 
budget process. In addition, section 395 D presents a list of selected 
statutes relevant to the budget and section 395 E describes budget 
steps of interest to the auditor in evaluating an entity's budget 
controls. Budget control objectives may be documented in a separate SCE 
worksheet for budget controls, in a memo, or incorporated in an SCE 
with related financial reporting controls.

COMPLIANCE CONTROLS:

.10: 
The objective of compliance controls is to provide reasonable assurance 
that the entity complies with significant provisions of applicable laws 
and regulations. Compliance control objectives should be tailored to 
the related provision and may be documented in a separate SCE worksheet 
for compliance controls, in a memo, or incorporated into an SCE with 
related financial reporting controls.

OPERATIONS CONTROLS:

.11: 
The objectives of operations controls are to provide reasonable 
assurance that the entity effectively and efficiently meets its goals. 
The objective of performance measures controls is to provide reasonable 
assurance that the data that support performance measures reported in 
the MD&A (overview) of the Accountability Report are properly recorded 
and accounted for to permit the preparation of reliable and complete 
performance information. Operations control objectives should be 
tailored to the related provision and may be documented in a separate 
SCE worksheet for operations controls, in a memo, or incorporated into 
an SCE with related financial reporting controls.

[End of section]

340 - IDENTIFY AND UNDERSTAND RELEVANT CONTROL ACTIVITIES: 

.01: 
For each control objective, based on discussions with entity personnel, 
the auditor should identify the control activities designed and 
implemented to achieve the specific control objective.[Footnote 4] Such 
controls may be recorded in the auditor's informal notes and/or 
interview write-ups for use in the following procedure, but each 
control activity need not be formally documented on the SCE worksheet 
at this time. The auditor should first screen the activities to 
identify those that are effective and efficient to test. An IS auditor 
may assist the auditor in identifying and understanding IS controls.

BASIC UNDERSTANDING OF EFFECTIVENESS OF CONTROL ACTIVITIES:

.02: 
The auditor should obtain a sufficient understanding of the identified 
control activities to determine whether they are likely to achieve the 
control objectives, assuming an effective control environment, risk 
assessment, communication, and monitoring, appropriate segregation of 
duties, and effective general controls. The purpose of this assumption 
is to identify any weaknesses in the specific control activities that 
should be corrected. When other internal control components are poor, 
there is inadequate segregation of duties, or poor general controls 
preclude the effectiveness of specific control activities that would 
otherwise be effective, the testing of such specific control activities 
may be limited to determining whether such controls are in place. To 
accomplish this, the auditor might (1) discuss the cycle and specific 
controls with management and then (2) perform walkthroughs by observing 
the controls in place or examining several items of documentary 
evidence of their existence.

FACTORS TO CONSIDER:

.03: 
When evaluating whether controls are likely to achieve the control 
objectives, the factors that the auditor should consider include (1) 
directness, (2) selectivity, (3) manner of application, and (4) follow-
up. In determining whether control objectives are achieved, the auditor 
should consider both manual and IS controls, if likely to be effective 
(see section 270).

.04: 
Directness refers to the extent that a control activity relates to a 
control objective. The more direct the relationship, the more effective 
that activity may be in achieving the objective. For example, 
management reviews of inventory reports that summarize the inventory by 
storage facility may be less effective in preventing or detecting 
misstatements in the existence assertion for inventory than a periodic 
physical inventory, which is more directly related to the existence 
assertion.

.05: 
Selectivity refers to the magnitude of the amount, or the significance 
of other criteria or distinguishing characteristics, that a specific 
control will identify as an exception condition. Examples of 
selectivity thresholds are (1) a requirement for additional approvals 
of all payments to vendors in excess of $25,000 and (2) management 
reviews of all payments to vendors not on an entity's approved vendor 
list. When determining whether a control is likely to be effective, the 
auditor should consider the likelihood that items that do not meet the 
selectivity threshold could, in the aggregate, result in material 
misstatements of financial statements, material noncompliance with 
budget authority, material noncompliance with significant provisions of 
laws and regulations, or significant ineffective or inefficient use of 
resources. The auditor also should consider the appropriateness of the 
specified criteria used to identify items on a management or exception 
report. For example, IS input controls (such as the matching of vendor 
invoices with receiving reports and purchase orders) that require exact 
matches of data from different sources before a transaction is accepted 
for processing may be more effective than controls that accept 
transactions that fall within a broader range of values. On the other 
hand, controls based on exception reports that are limited to selected 
information or use more selective criteria may be more effective than 
lengthy reports that contain excessive information.

.06: 
Manner of application refers to the way in which an entity places a 
specific control into operation. The manner of application can 
influence the effectiveness of a specific control. The auditor should 
consider the following factors when determining the effectiveness of 
controls:

* Frequency of application: This refers to the regularity with which 
controls are applied. Generally, the more frequently a control is 
applied, the greater the likelihood that it will be effective.

* Experience and skills of personnel: This refers to whether the person 
applying a control has the necessary knowledge and expertise to 
properly apply it. The lesser the person's experience and skills, the 
less likely that the control will be effective. Also, the effective 
application of a control is generally adversely affected if the 
technique (1) is performed by an employee who has an excessive volume 
of work or (2) is not performed carefully.

.07: 
Follow-up refers to the procedures followed when a control identifies 
an exception condition. A control's effectiveness is dependent on the 
effectiveness of follow-up procedures. To be effective, these 
procedures should be applied on a timely basis and should (1) determine 
whether control exceptions represent misstatements and (2) correct all 
misstatements noted. For example, as a control, an accounting system 
may identify and put exception transactions into a suspense file or 
account. Lack of timely follow-up procedures to (1) reconcile and 
review the suspense file or account and (2) correct items in the 
suspense file or account would render the control ineffective.

.08: 
When evaluating whether controls are likely to be effective, the 
auditor should consider whether the controls also are applied 
effectively to adjustments/corrections made to the financial records. 
Such adjustments/corrections may occur at the transaction level, during 
summarization of the transactions, or may be posted directly to the 
general ledger accounts.

.09: 
Based on the understanding of control activities and the determination 
as to whether they are likely to achieve the control objectives, the 
auditor reassesses control risk to decide whether to test controls. If 
control risk is high because the control activities for a particular 
accounting application are not effective in design or not effective in 
operation (based on prior years' testing of the control activities and 
management's indication that they have not improved), the auditor does 
not need to test the controls. If they are effective, the auditor must 
test them, but may consider using a rotation approach to testing the 
controls, as discussed in section 395 G.

[End of section]

350 - DETERMINE THE NATURE, TIMING, AND EXTENT OF CONTROL TESTS AND OF 
TESTS FOR SYSTEMS' COMPLIANCE WITH FFMIA REQUIREMENTS: 

.01: 
For each control objective, the auditor should (1) identify specific 
relevant control activities to test, (2) perform walkthroughs to be 
sure that those controls are in operation, (3) document these control 
activities on the SCE worksheet or equivalent, (4) determine the nature 
and timing of control tests, and (5) determine the extent of control 
tests. Internal control includes IS controls, as discussed further in 
paragraphs 360.03-.10 and the FISCAM. For the controls over performance 
measures reported in the MD&A (overview) of the Accountability Report, 
the auditor does not need to test controls (although he or she may 
decide to do so), but should identify the activities likely to achieve 
the objectives, perform walkthroughs to be satisfied that the controls 
have been placed in operation, and document the controls.

.02: The auditor also should determine the nature, timing, and extent 
of tests for compliance of the entity's systems with federal financial 
management systems requirements (these requirements are established by 
OMB Circular A-127 and include the Joint Financial Management 
Improvement Program's series of system requirements documents), federal 
accounting standards (GAAP - see section 560), and the SGL at the 
transaction level in order to report in accordance with FFMIA. 
Substantial compliance includes the ability of the financial management 
systems to routinely provide reliable and timely financial information 
for managing day-to-day operations as well as to produce reliable 
financial statements, have effective internal control, and comply with 
legal and regulatory requirements.

.03: If it is likely that the financial statement opinion will be 
unqualified and internal control will be determined to be effective, 
the auditor should plan to test the systems' compliance with the 
requirements. Many nonsampling control tests will also test for 
compliance with the systems requirements and the SGL, although 
determining compliance with federal accounting standards (GAAP) will 
also require substantive testing. In designing control and substantive 
tests, the auditor should keep in mind the need to report whether the 
entity's financial management systems are in substantial compliance 
with FFMIA requirements so that the control and other tests may serve 
this dual purpose. In addition, for purposes of FFMIA financial 
management systems include systems that produce the information 
management uses day-to-day, not just systems that produce annual 
financial statements. Thus, the auditor should test the financial 
management systems used for managing financial operations and 
supporting financial planning, management reporting, budgeting 
activities, and systems accumulating and reporting cost information, 
including the financial portion of mixed systems.

.04: For agencies with longstanding, well-documented financial 
management 
systems weaknesses that severely affect the systems' ability to comply 
with FFMIA requirements, the auditor need not perform specific tests of 
the systems' compliance with the FFMIA requirements. The auditor will 
generally have adequate information about the systems to describe the 
instances of lack of substantial compliance and make recommendations, 
as required by FFMIA, by gaining an understanding of the systems and 
performing internal control and substantive testing. The auditor also 
should understand management's process for determining whether its 
systems comply with the FFMIA requirements and report any deficiencies 
in management's process (for example, management has not compared its 
systems with JFMIP systems requirements). The auditor's report should 
make clear that there may be other areas of noncompliance.

.05: Similarly, if it is likely that the opinion on the financial 
statements will not be unqualified, that the entity has material 
weaknesses or reportable conditions in internal control, or that it has 
significant noncompliance with legal and regulatory requirements, then 
the auditor may limit the scope of testing performed to support an 
FFMIA assessment. However, if the auditor is concerned that he or she 
may find it difficult to convince management of the systems' 
noncompliance without specific tests, the auditor should perform them. 
Also, the auditor should recognize that if controls have improved and/
or an unqualified opinion can be expressed, the auditor will need to 
test systems for FFMIA compliance.

IDENTIFY RELEVANT CONTROL ACTIVITIES TO TEST:

.06: For each control objective identified in Section 330, the auditor 
should identify the control activity, or combination of control 
activities, that is likely to (1) achieve the control objective and (2) 
maximize the overall efficiency of control tests. In doing this, the 
auditor should consider (1) the extent of any inherent risk[Footnote 5] 
and control environment, risk assessment, communication, or monitoring 
weaknesses,[Footnote 6] including those related to IS (as documented in 
the ARA and/or GRA document or equivalent (see section 260)) and (2) 
the tentative determination of the likelihood that IS controls will be 
effective, as determined in the planning phase (see section 270). The 
auditor should test only the control activities necessary to achieve 
the objective. For example, the entity may have several controls that 
are equally effective in achieving an objective. In such a case, the 
auditor should select and test the control activity that is most 
efficient to test, considering such factors as (1) the extent to which 
a control achieves several control objectives and thereby reduces the 
number of controls that would ordinarily need to be tested and (2) the 
time that will be required to test the control.

.07: For those control objectives for which the auditor preliminarily 
determines that effective control activities exist or are likely to 
exist, the auditor should test the selected control activities, as 
discussed in sections 360 and 450. The auditor may test all, or only 
certain control activities (because others are not likely to be 
effective), related to a control objective. However, the auditor may 
not elect to forgo control tests solely because it is more efficient to 
extend substantive or compliance audit procedures. If, in any phase of 
the audit, the auditor determines that control activities selected for 
testing are, in fact, ineffective in design or operation, the auditor 
should discontinue the specific control evaluation of related control 
objectives and should report resulting weaknesses in internal control 
as discussed in section 580. If the entity's management does not agree 
with the auditor's conclusion that effective control activities do not 
exist or are unlikely to exist, the auditor may need to perform 
procedures sufficient to support that conclusion.

.08: Before testing controls the auditor believes will be effective, 
the auditor may elect to complete the ARA or equivalent tentatively, 
assuming that such controls are effective.

PERFORM WALKTHROUGHS TO DETERMINE WHETHER THOSE CONTROLS ARE IN 
OPERATION:

.09: Before performing control tests, the auditor should perform one or 
more walkthroughs to determine whether the control activities are 
functioning in the manner understood by the auditor. These 
walkthroughs, designed to confirm the auditor's understanding of the 
control activities, differ from those performed to confirm the 
auditor's understanding of the systems in which they operate (see 
paragraph 320.02). Through observations, inspection, and discussions 
with personnel responsible for applying or maintaining each control 
(including walkthroughs), the auditor should determine whether each 
control has, in fact, been placed in operation. If a control has not 
been placed in operation, the auditor should consider whether other 
controls are likely to achieve the related control objective(s) and 
should consider testing such controls.

DOCUMENT CONTROL ACTIVITIES TO BE TESTED:

.10: The auditor should document the control activities to be tested on 
the SCE worksheet or equivalent. (See an illustration in section 395 
H.) (Other components of internal control are generally tested by 
observation and inquiry in the planning phase. See paragraph 260.09.) 
Controls that satisfy more than one control objective may be listed 
(and evaluated) only once and referred to, when applicable, on 
subsequent occasions. For each control to be tested, the auditor should 
determine whether the control is an IS control. An IS auditor generally 
should review and concur with the auditor's identification of IS 
controls.

DETERMINE THE NATURE AND TIMING OF CONTROL TESTS:

.11: To obtain additional evidence of the effectiveness of specific 
controls, the auditor should select the combination of control tests 
(observation, inquiry, or inspection) to be performed and determine the 
timing of such tests. No one specific control test is always necessary, 
applicable, or equally effective in every circumstance. In fact, a 
combination of these types of control tests is usually needed to 
provide the necessary level of assurance. In determining the types of 
tests to apply, the auditor should select the tests that are effective 
and most efficient, as discussed in paragraphs 350.15-.18. Specific 
types of control tests and methods to apply them are discussed below.

.12: Observation - The auditor conducts observation tests by observing 
entity personnel actually performing control activities in the normal 
course of their duties. Observation generally provides highly reliable 
evidence that a control activity is properly applied when the auditor 
is there to observe it; however, it provides no evidence that the 
control was in operation at any other time. Consequently, observation 
tests should be supplemented by corroborative evidence obtained from 
other tests (such as inquiry and inspection) about the operation of 
controls at other times.

.13: Inquiry - The auditor conducts inquiry tests by making either oral 
or written inquiries of entity personnel involved in the application of 
specific control activities to determine what they do or how they 
perform a specific control activity. Such inquiries are typically open 
ended. Generally, evidence obtained through inquiry is the least 
reliable audit evidence and generally should be corroborated through 
other types of control tests (observation or inspection). The 
reliability of evidence obtained from inquiry depends on various 
factors, such as the following:

The competence, experience, knowledge, independence, and integrity of 
the person of whom the inquiry was made. The reliability of evidence is 
enhanced when the person possesses these attributes.

Whether the evidence was general or specific. Evidence that is specific 
is usually more reliable than evidence that is general.

The extent of corroborative evidence obtained. Evidence obtained from 
several entity personnel is usually more reliable than evidence 
obtained from only one.

Whether the evidence was provided orally or in writing. Generally, 
evidence provided in writing is more reliable than evidence provided 
orally.

.14: Inspection - The auditor conducts inspection tests by examining 
documents and records for evidence (such as the existence of initials 
or signatures) that a control activity was applied to those documents 
and records. System documentation, such as operations manuals, flow 
charts, and job descriptions, may provide evidence of control design 
but do not provide evidence that controls are actually operating and 
being applied consistently. To use system documentation as part of the 
evidence of effective control activities, the auditor should obtain 
additional evidence on how the controls were applied. Inspection is 
generally a reliable source of audit evidence and is frequently used in 
multipurpose testing. Because evidence of performance is documented, 
this type of test can be performed at any time. The evidence previously 
obtained from (1) the inspection of documents in walkthroughs (in which 
inspection is performed to a lesser extent than in sampling control 
tests) and (2) observation or inquiry tests may provide sufficient 
evidence of control effectiveness. However, if the auditor needs 
additional evidence, sampling items for inspection should be 
considered. Since documentary evidence generally does not provide 
evidence concerning how effectively the control was applied, the 
auditor generally should supplement inspection tests with observation 
and/or inquiry of persons applying the control. For example, the 
auditor generally should supplement inspection of initials on documents 
with observation and/or inquiry of the individual(s) who initialed the 
documents to understand the procedures they followed before initialing 
the documents. The auditor may also reperform the control being tested 
to determine if it was properly applied.

.15: The type of control test or tests the auditor selects depends on 
(1) the nature of the control to be tested and (2) the timing of and 
period covered by the control test.

.16: The nature of the control influences the type of evidential matter 
that is available. For example, if the control provides documentary 
evidence, the auditor may decide to inspect the documentation. For 
other controls, such documentation may not be available or relevant. 
For example, segregation-of-duties controls generally do not provide 
documentary evidence. In such circumstances, the auditor may obtain 
evidential matter about the effectiveness of the control's operation 
through observation or inquiry.

.17: The timing of and period covered by the control test require 
consideration. The evidential matter should relate to the audit period 
and, unless it is documentary evidence, should be obtained during the 
audit period, when sufficient corroborative evidence is most likely to 
be available. When the evidence relates to only a specific point in 
time, such as evidence obtained from observation, the auditor should 
obtain additional evidence that the control was effective during the 
entire audit period. For example, the auditor may observe the control 
in operation during the audit period and use inquiry and inspection of 
procedures manuals to determine that the control was in operation 
during the entire audit period. Paragraph 380.02 provides guidance 
concerning situations when new controls are implemented during the 
year.

.18: When selecting a particular control test from among equally 
effective tests, the auditor should select the most efficient test. For 
example, the auditor may find that inquiry, observation, and 
walkthroughs (tests of controls that do not involve sampling) provide 
sufficient evidence that the control was effective during the year and 
are most efficient to test. When sampling is considered necessary, the 
auditor should consider performing multipurpose tests to enhance audit 
efficiency (see sections 430 and 450).

DETERMINE THE EXTENT OF NONSAMPLING CONTROL TESTS:

.19: After selecting the nature of control tests to be performed, the 
auditor should determine the extent of control tests (including IS 
controls). This determination is based on the information gathered in 
developing an understanding of internal control, the nature of the 
control to be tested, the nature and availability of evidential matter, 
and the auditor's determination of the amount of additional evidence 
needed. For each control activity considered necessary to achieve the 
control objectives, the auditor should test the control activity to 
determine whether it achieves the control objectives. Relevant 
financial reporting, budget, compliance, and operations controls 
generally should be tested to the same level of assurance. The extent 
of this testing is discussed in section 360 for nonsampling control 
tests and in section 450 for sampling control tests.

.20: Controls that do not leave documentary evidence of existence or 
application generally cannot be tested with sampling procedures. When 
control activities, such as segregation of duties, do not leave 
documentary evidence, the auditor should test their effectiveness by 
observation and/or inquiry. For example, the auditor may obtain 
evidential matter about the proper segregation of duties by (1) direct 
observation of the control activities being applied at a specific time 
during the audit period and (2) inquiry of the individual(s) involved 
about applying the activities at other times during the audit period. 
The appropriate extent of observation and inquiry is not readily 
quantifiable. To determine whether a control is effective, the auditor 
should consider whether sufficient evidence has been obtained to 
support the preliminary assessment of control effectiveness (see 
section 370).

DETERMINE THE NATURE, TIMING, AND EXTENT OF TESTS FOR SYSTEMS' 
COMPLIANCE WITH FFMIA REQUIREMENTS:

.21: If the auditor believes it is likely that the opinion on the 
financial statements will be unqualified (or qualifications will not 
relate to the entity's ability to prepare reliable financial statements 
or provide reliable financial information when needed), that internal 
control will be determined to be effective, and that the auditor will 
find no instances of noncompliance with legal and regulatory 
requirements, then the auditor should test each of the elements of 
systems' compliance with FFMIA requirements. Also, the auditor may need 
to test for systems' compliance with FFMIA requirements in other 
circumstances, as discussed in paragraph 350.05.

.22: The determination of substantial compliance with the requirements 
requires auditor judgment. To assist the auditor in making these 
judgments, he or she should identify any management-developed 
documentation for its assertion about the systems' conformance with 
systems requirements in its FMFIA section 4 report and any work it may 
have done for FFMIA. The documentation may include the Financial 
Management Series of Checklists for Systems Reviewed Under the Federal 
Financial Management Improvement Act of 1996 or other tools. The issues 
discussed earlier in this section with regard to nature, timing, and 
extent of control tests also apply to tests of systems' compliance with 
FFMIA requirements. These tests generally should be done concurrently 
with nonsampling control tests as described in section 360.

.23: Management's documentation may be the basis for tests of the 
systems' compliance. If, for example, management provides the auditor 
with a checklist detailing the functions the systems are able to 
perform, the auditor generally should select some significant functions 
from the checklist and determine whether the systems perform them. This 
may be done based on knowledge the auditor has acquired from gaining an 
understanding of the systems, as well as by additional observation, 
inquiry, inspection, and walkthroughs as discussed earlier in this 
section for control tests. If management has not provided 
documentation, testing may be based directly on the FFMIA requirements. 
If management is unable to provide any documentation, the auditor 
should ask why there is no documentation and how management knows 
whether it is in compliance. Lack of documentation often indicates that 
the systems do not substantially comply with FFMIA.

[End of section]

360 - PERFORM NONSAMPLING CONTROL TESTS AND TESTS FOR SYSTEMS' 
COMPLIANCE WITH FFMIA REQUIREMENTS: 

.01: 
The auditor should design and conduct tests of control activities that 
are effective in design to confirm their effectiveness in operation. 
(The auditor should refer to paragraph 380.02 if control activities 
were not effective in design during the entire audit period.) The 
auditor should perform the following procedures in connection with 
control tests:

* Request an IS auditor to test IS controls.

* Perform nonsampling control tests. (Sampling control tests are 
performed in the testing phase, as discussed in section 450.):

* Evaluate the results of nonsampling control tests.

.02: 
Similarly, the auditor should design and conduct tests of the financial 
management systems' compliance with the three FFMIA requirements, if he 
or she determined such tests were necessary (see paragraphs 350.02-.05 
and 350.21-.23). Many nonsampling control tests will also serve as 
tests for compliance with FFMIA requirements, especially the systems 
requirements and the SGL, although testing for federal accounting 
standards (GAAP) will include substantive testing, done as part of the 
testing phase.

TESTS OF IS CONTROLS:

.03: 
In an entity that uses information systems to perform accounting 
functions, the auditor might identify controls whose effectiveness 
depends on the computer (IS controls). Such IS controls are discussed 
in more detail in section 295 F. Due to the technical nature of certain 
IS controls, an IS auditor should perform or supervise tests of such 
controls and should document conclusions on the effectiveness of IS 
controls during the audit period. The financial auditor may perform 
tests of less technical IS controls but the IS auditor should supervise 
such testing to evaluate the results and to consider such controls in 
relation to other IS controls.

.04: 
If IS controls are identified for testing, an IS auditor should 
evaluate the effectiveness of:

* general controls at the entity or installation level;

* general controls as they relate to the application to be tested; and:

* specific application controls and/or user controls, unless the IS 
controls that achieve the control objectives are general controls.

.05: 
The IS auditor should determine whether overall or installation-level 
general controls are effectively designed and operating by:

* identifying applicable general controls,

* determining how those controls function, and:

* evaluating and testing the effectiveness of those controls.

The IS auditor should consider knowledge obtained in the planning 
phase. At the conclusion of this step, the IS auditor should document 
the understanding of general controls and should conclude whether such 
controls are effectively designed and operating as intended.

Tests of General Controls at the Installation Level:

.06: 
General controls ordinarily are tested through a combination of 
procedures, including observation, inquiry, inspection (which includes 
a review of documentation on systems and procedures), and reperformance 
using appropriate test software. Although sampling is generally not 
used to test general controls, it may be used to test certain controls, 
such as those involving approvals.

.07: 
If general controls are not effectively designed and operating as 
intended, the auditor will generally be unable to obtain satisfaction 
that application controls are effective. In such instances, (1) the IS 
auditor should discuss the nature and extent of risks resulting from 
ineffective general controls with the audit team and (2) the auditor 
should consider whether manual controls achieve the control objectives 
that the IS controls were supposed to achieve. However, if manual 
controls do not achieve the control objectives, the IS auditor should 
determine whether any specific IS controls are designed to achieve the 
objectives. If not, the auditor should develop appropriate findings 
principally to provide recommendations to improve internal control. If 
specific IS controls are designed to achieve the objectives, but are in 
fact ineffective due to poor general controls, testing would typically 
not be necessary, except to support findings.

Tests of General Controls at the Application Level:

.08: 
Based on favorable conclusions reached on general controls at the 
entity or installation level, the IS auditor should evaluate and test 
the effectiveness of general controls for those applications within 
which application controls or user controls are to be tested.

.09: 
If general controls are not operating effectively within the 
application, application controls and user controls generally will be 
ineffective. In such instances, the IS auditor should discuss the 
nature and extent of risks resulting from ineffective general controls 
with the audit team and should determine whether to proceed with the 
evaluation of application controls and user controls.

Tests of Application Controls and User Controls:

.10: 
The IS auditor generally should perform or supervise tests of those 
application controls and user controls necessary to achieve the control 
objectives where the overall and application-level general controls 
were determined to be effective.

NONSAMPLING CONTROL TESTS:

.11: 
The auditor should (1) develop a detailed control test audit program 
that incorporates the nature, timing, and extent of planned nonsampling 
control tests, including tests for compliance with FFMIA requirements 
and (2) perform nonsampling control tests according to the audit 
program. The following paragraphs discuss the testing of segregation of 
duties.

Segregation of Duties:

.12: 
Nonsampling control tests relating to segregation of duties require 
special consideration. Such controls are designed to reduce the 
opportunities for any person to be in a position both to perpetrate and 
to conceal misstatements, especially fraud, in the normal course of 
duties. Typically, an entity achieves adequate segregation of duties by 
establishing controls (such as segregating asset custody from 
recordkeeping functions) to prevent any person from having uncontrolled 
access to both assets and related records. Paragraph 330.08 describes 
situations in which the auditor should test segregation of duties.

.13: 
The auditor may use the following method to test segregation-of-duties 
controls:

a. Identify the assets to be controlled through the segregation of 
duties.

b. Identify the individuals who have authorized access (direct or 
indirect) to the assets. Direct access exists when the individual is 
authorized to handle the assets directly (such as during the processing 
of cash receipts). Indirect access exists when the individual is 
authorized to prepare documents that cause the release or transfer of 
assets (such as preparing the necessary forms to request a cash 
disbursement or transfer of inventory).

c. For each individual with authorized access to assets, determine 
whether there are sufficient asset access controls. Asset access 
controls are those controls that are designed to provide assurance that 
actions taken by individuals with authorized access to assets are 
reviewed and approved by other individuals. For example, an approval of 
an invoice for payment generally provides asset access controls 
(relating to cash) over those individuals authorized to prepare 
supporting documentation for the transaction. If IS provides access to 
assets, evaluation and testing of IS controls should be designed to 
identify (1) individuals (including IS personnel) who may use the 
computer to obtain access and (2) asset access controls over such 
individuals.

d. For individuals with authorized access to assets over which asset 
access controls are insufficient, determine whether such individuals 
can affect any recording of transactions in the accounting records. If 
so, segregation of duties is insufficient, unless such access to 
accounting records is controlled. For example, the person who processes 
cash receipts may also be able to record entries in the accounting 
records. Such a person may be in a position to manipulate the 
accounting records to conceal a shortage in the cash account, unless 
another individual reviews all accounting entries made by that person. 
In an IS accounting system, access to assets frequently provides access 
to records. For example, generation of a check may automatically record 
a related accounting entry. In such circumstances, a lack of asset 
access controls would result in inadequate segregation of duties, and 
the auditor should consider whether other controls would mitigate the 
effects of this lack of asset access control.

EVALUATING THE RESULTS OF NONSAMPLING TESTS:

.14: 
The auditor should investigate and understand the reasons for any 
deviations from control activities noted during nonsampling control 
tests. The auditor may find, for example, that significant 
subpopulations were not subject to controls or that controls were not 
applied during a specific period during the year. In such instances, 
the auditor should conclude whether controls are effective for at least 
some parts of the population. For example, an otherwise effective 
control may not have been applied effectively in one month due to 
personnel turnover. For all but that month, the auditor may assess 
controls as effective and reduce related testing. The auditor also 
should consider whether other controls can achieve the related control 
objective(s).

.15: 
Additionally, the auditor should gather sufficient evidence to report 
the control weakness. As discussed in paragraphs 580.37-.58, the 
significance of the weakness will determine how the auditor reports the 
finding and therefore which elements of the finding (condition, cause, 
criteria, effect, and recommendation or suggestion) need to be 
developed.

.16: 
Finally, the auditor may make preliminary conclusions as to whether the 
entity's financial management systems substantially comply with federal 
financial management systems requirements, federal accounting 
standards (GAAP), and the SGL at the transaction level. However, a 
final conclusion as to compliance, especially with federal accounting 
standards, needs to wait for the results of substantive testing.

[End of section]

370 - ASSESS CONTROLS ON A PRELIMINARY BASIS: 

.01: 
Based on the evaluation of internal control and results of nonsampling 
control tests, the auditor should preliminarily assess the 
effectiveness of internal control during the period (for reporting on 
internal control in a non-opinion report and for determining the extent 
of procedures to be performed in the testing phase) and/or as of the 
end of the period (for an opinion on internal control). Considerations 
for assessing the effectiveness of IS controls and each type of control 
(financial reporting (including safeguarding and budget), compliance, 
and operations) are discussed in paragraphs 370.06-.14 below and in the 
FISCAM.

.02: 
To assess the effectiveness of internal control, the auditor considers 
whether the control objectives are achieved. For each control objective 
that is not fully achieved, the auditor should obtain sufficient (1) 
information to develop comments in the auditor's report or management 
letter (see paragraphs 580.32-.61) and (2) evidence to support the 
preliminary assessment of the effectiveness of internal control.

INFORMATION SYSTEM RESULTS:

.03: 
Based on the procedures performed, the IS auditor should discuss 
conclusions on the effectiveness of IS controls with the audit team and 
obtain concurrence. The auditor should (1) incorporate the IS auditor's 
conclusions into the audit workpapers for each IS control tested and 
(2) perform tests of application controls (principally manual follow-up 
of exceptions) or user controls identified by the IS auditor for the 
audit team to test.

.04: 
If IS controls are determined to be effective, the auditor may also ask 
the IS auditor to identify any IS controls within the applications 
tested using the above procedures that were not previously identified 
by the auditor. For example, such IS controls might achieve control 
objectives not otherwise achieved through manual controls or might be 
more efficient or effective to test than manual controls. The IS 
auditor can assist the auditor in determining the cost effectiveness of 
searching for and testing additional IS controls. Decisions made in 
response to these considerations should be documented, including a 
description of the expected scope of the IS auditor's work.

.05: 
Audit programs and supporting workpapers should be prepared to document 
the procedures for evaluating and testing the effectiveness of IS 
controls. Such workpapers should be included in the audit workpapers.

FINANCIAL REPORTING CONTROLS:

.06: 
Based on procedures performed and before sampling control 
tests,[Footnote 7] if any, the auditor should form a preliminary 
conclusion about (1) the effectiveness of financial reporting controls 
as of the end of the period and (2) the assessed level of control and 
combined risk during the period for each significant assertion in each 
significant line item or account. Combined risk is the risk that, prior 
to the application of substantive audit procedures, a material 
misstatement exists in a financial statement assertion. Combined risk 
consists of the risks that (1) a financial statement assertion is 
susceptible to material misstatement (inherent risk) and (2) such 
misstatement is not prevented or detected on a timely basis by the 
entity's internal control (control risk). The use of professional 
judgment is essential in assessing both control and combined risk.

.07: 
Preliminary assessment of control risk. For each significant assertion 
in each significant account, the auditor should assess control risk at 
one of the following three levels:

* Low control risk: The auditor believes that controls will prevent or 
detect any aggregate misstatements that could occur in the assertion in 
excess of design materiality.

* Moderate control risk: The auditor believes that controls will more 
likely than not prevent or detect any aggregate misstatements that 
could occur in the assertion in excess of design materiality.

* High control risk: The auditor believes that controls will more 
unlikely than likely prevent or detect any aggregate misstatements that 
could occur in the assertion in excess of design materiality.

.08: 
In assessing control risk in a line item/account assertion, the auditor 
should consider the aggregate magnitude of misstatements that might not 
be prevented or detected in significant accounting applications that 
affect the line item or account. For example, the cash receipts, cash 
disbursements, and payroll accounting applications typically affect the 
cash account. Accordingly, the auditor should consider the risk that 
aggregate misstatements could arise from a combination of those 
accounting applications and not be prevented or detected by controls.

.09: 
Preliminary assessment of combined risk. In assessing combined risk, 
the auditor should consider the likelihood that a material misstatement 
would occur (inherent risk) and not be prevented or detected on a 
timely basis by the entity's internal control (control risk). This 
preliminary assessment of combined risk should be consistent with the 
auditor's assessment of inherent risk and control risk. For each 
significant assertion in each significant account, the auditor should 
assess combined risk at one of the following three levels:

* Low combined risk: Based on the evaluation of inherent risk and 
control 
risk, but prior to the application of substantive audit procedures, the 
auditor believes that any aggregate misstatements in the assertion do 
not exceed design materiality.

* Moderate combined risk: Based on the evaluation of inherent risk and 
control risk, but prior to the application of substantive audit 
procedures, the auditor believes that it is more likely than not that 
any aggregate misstatements in the assertion do not exceed design 
materiality.

* High combined risk: Based on the evaluation of inherent risk and 
control risk, but prior to the application of substantive audit 
procedures, the auditor believes that it is more unlikely than likely 
that any aggregate misstatements in the assertion do not exceed design 
materiality. As a result, the auditor will need to obtain most, if not 
all, audit reliance from substantive tests.

.10: The minimum substantive assurance level required for substantive 
tests 
varies directly with combined risk. In other words, as combined risk 
increases, so does the minimum substantive assurance level. Section 470 
discusses the assurance level. The auditor should document the 
preliminary assessment of control risk and combined risk in the ARA or 
equivalent.

COMPLIANCE CONTROLS:

.11: Based on the results of compliance control tests and other audit 
procedures, the auditor should:
 
* conclude whether the entity's internal control provides reasonable 
assurance that the entity complied with the significant provisions of 
laws and regulations and executed transactions in accordance with 
budget authority during the period (to assess control risk, to test 
compliance as discussed in section 460, and/or to report (non-opinion 
report) on internal control) and/or as of the end of the period (to 
support the opinion on internal control) and:

* report weaknesses in compliance controls that come to the auditor's 
attention (see paragraphs 580.32-.61).

If compliance controls are effective in preventing or detecting 
noncompliance with relevant provisions of laws and regulations during 
the period, the extent of compliance testing can be less than if such 
controls were not effective, as discussed in section 460.

.12: When forming conclusions on internal control related to budget 
execution, the auditor should consider the impact of any unadjusted 
misstatements noted in the proprietary accounts and should determine 
any impact on the budgetary amounts. If the budgetary amounts are also 
misstated, the auditor should consider whether these misstatements are 
indications of weaknesses in internal control related to budget 
execution. If audit evidence indicates that internal control might not 
provide reasonable assurance that the entity executed transactions in 
accordance with budget authority, the auditor should discuss the legal 
implications with OGC.

OPERATIONS CONTROLS:

.13: 
If the results of control tests indicate that operations controls were 
not effective during the period, the auditor should not place reliance 
on the ineffective operations controls when performing other audit 
procedures. Based on gaining an understanding of performance measures 
systems and other procedures (which may include optional tests of 
controls), the auditor will have an understanding of the design of 
performance measures controls as they relate to the existence and 
completeness assertions (for GAO audits, the valuation assertion is 
also included in the understanding) and whether they have been placed 
in operation. The auditor should report weaknesses in performance 
measures controls that come to his or her attention. See paragraphs 
580.32-.61 regarding reporting of control weaknesses.

REEVALUATION OF CONTROL RISK AND COMBINED RISK ASSESSMENT:

.14: After completing the testing phase, discussed in section 400, the 
auditor should reevaluate the preliminary assessment of control risk 
for financial reporting controls and control effectiveness for 
compliance and operations controls. If the test results are contrary to 
the preliminary assessment, the auditor should reconsider the adequacy 
of the audit procedures performed and perform additional procedures as 
considered necessary.

[End of section]

380 - OTHER CONSIDERATIONS: 

ROTATION TESTING OF CONTROLS:

.01: 
When the entity's control environment, risk assessment, communication, 
and monitoring are strong and inherent and fraud risk are low, using a 
rotation approach for testing controls may be appropriate for IS 
controls. When appropriate, based primarily on favorable results from 
prior tests and limited work in the current year, the auditor may test 
IS internal controls of certain cycles/applications on a rotating basis 
rather than every year. Rotation is generally not appropriate for use 
in first-time audits where an opinion is expressed or for audits of 
entities that do not have strong control environments, risk assessment, 
communication, and monitoring. Section 395 G provides additional 
requirements and guidelines for rotation testing of controls.

PARTIAL-YEAR CONTROLS:

.02: 
In certain situations, such as when new controls are implemented during 
the year, the auditor may elect to test controls only for the period 
that the new controls were operating. In such situations, the extent of 
control testing should remain similar, but be concentrated over the 
period the new controls are in place. For any portion of the audit 
period that financial reporting, budget, and compliance controls were 
not tested directly or through a rotation plan (see paragraph 380.01), 
the auditor should assume that such controls were ineffective for 
purposes of designing compliance and substantive tests.

PLANNED CHANGES IN CONTROLS:

.03: 
The auditor may become aware of an entity's plans to implement new 
accounting or control systems after the audit period ends. Even though 
new systems or controls are planned, the auditor should evaluate and 
test controls in effect through the end of the audit period to (1) 
provide support for the report on internal controls, (2) recommend any 
improvements to the current system that should be considered in 
designing the new systems or controls, and/or (3) obtain audit evidence 
to reduce substantive testing in the current audit. During the current 
audit, the auditor may elect to review controls designed into the new 
system.

[End of section]

390 - DOCUMENTATION: 

.01: 
In addition to preparing a control testing audit program and other 
workpapers relevant to the internal control phase, the auditor should 
prepare the documents described in paragraphs 390.04-.07 or their 
equivalent.

.02: 
In the audit program, the auditor generally should explain the 
objectives of audit procedures. Also, written guidance, either within 
or accompanying the audit program to explain possible exceptions, their 
nature, and why they might be important, may help auditors focus on key 
matters, more readily determine which exceptions are important, and 
identify significant exceptions.

.03: 
As the audit work is performed, the auditors may become aware of 
possible reportable conditions or other matters that should be 
communicated to the auditee. The auditor generally should document and 
communicate these as described in paragraph 290.02.

CYCLE MEMORANDUM AND FLOWCHART:

.04: 
The auditor is required to document (AU 319.44) the understanding 
gained of each component of internal control, among them, the 
information system (AU 319.36). The auditor should prepare sufficient 
documentation to clearly describe and illustrate the accounting system; 
such documentation may include memorandums and flowcharts. Flowcharts 
provide a good mechanism to document the process and need not be 
extremely detailed. In some systems, particularly IS, it is difficult 
to understand the system without a flowchart. For each significant 
cycle, the auditor should prepare a cycle memorandum or equivalent, and 
a complementary flowchart of the cycle and component accounting 
application(s) is also recommended. To the extent relevant, these 
documents should include the following accounting systems information 
for financial reporting controls:

* The cycle memorandum or equivalent should (1) identify the cycle 
transactions, each significant accounting application, and each 
significant financial management system included in the cycle, (2) 
describe interfaces with other cycles, (3) identify financial statement 
line items and general ledger accounts included in the cycle, (4) 
describe the operating policies and procedures relating to the 
processing of cycle transactions (see paragraph 320.03),[Footnote 8] 
and (5) identify major internal controls (overview only). The cycle 
memorandum may also include information on FFMIA requirements 
considered to this point, such as systems requirements and the SGL.

* The flowchart should complement the related cycle memorandum and 
summarize the significant transaction flows in terms of (1) input and 
report documents, (2) processing steps, (3) files used, (4) units 
involved, and (5) interfaces with other cycles and accounting 
applications.[Footnote 9]

.05: The auditor should document the understanding of compliance and 
relevant operations (including performance measures) control systems in 
a memorandum and, if applicable, a flowchart addressing each point 
discussed in paragraphs 320.05-.07.

SPECIFIC CONTROL EVALUATION WORKSHEET:

.06: The auditor should document the evaluation of specific control 
activities in the SCE worksheet or equivalent. Control tests should be 
documented in a control test audit program and in accompanying 
workpapers. Any IS control tests should also be documented in the audit 
workpapers, as discussed in paragraph 370.05. Section 395 H presents an 
example of a completed SCE worksheet.

UPDATING THE ACCOUNT RISK ANALYSIS FORM:

.07: 
The auditor should update the ARA form or equivalent by completing the 
internal control phase columns, as illustrated in section 395 I.

[End of section]

395 A - TYPICAL RELATIONSHIPS OF ACCOUNTING APPLICATIONS TO LINE ITEMS/
ACCOUNTS: 

This section illustrates the typical relationships between accounting 
applications and line items or accounts. For example, sources of 
significant accounting entries to cash typically include the cash 
receipts, cash disbursements, payroll, and cash accounting 
applications. For each significant line item or account, the auditor 
should develop an understanding of how potential misstatements in 
significant accounting applications could affect the related line item 
or account. In turn, control objectives and relevant control techniques 
to achieve those objectives should be identified.

[See PDF for image]

[End of table]

[End of section]

395 B - FINANCIAL STATEMENT ASSERTIONS AND POTENTIAL MISSTATEMENTS: 

This section lists potential misstatements that could occur in each 
financial statement assertion within an accounting application, 
together with related control objectives. The auditor should use 
judgment to tailor this information to the accounting application and 
to the entity and should consider supplementing this list with other 
control objectives or subobjectives. The assertions, potential 
misstatements, and control objectives illustrated in this section can 
be used in preparing the first, fourth, and fifth columns of the SCE 
worksheet, which is illustrated in section 395 H. However, this section 
is provided as a reference and does not require completion as a form.

[See PDF for image]


Note: Segregation-of-duties controls are a type of safeguarding control 
and are often crucial to the effectiveness of controls, particularly 
over liquid, readily marketable assets that are highly susceptible to 
theft, loss, or misappropriation. Such controls are designed to reduce 
the opportunities for any person to be in a position to both perpetrate 
and conceal fraud. The lack of segregation-of-duties controls may be 
pervasive and affect several misstatements. Paragraph 330.08 discusses 
when segregation-of-duties controls should be tested.

[End of table]

[End of section]

395 C - TYPICAL CONTROL ACTIVITIES: 

AUTHORIZATION:

.01: 
Authorization controls are designed to provide reasonable assurance 
that (1) transactions, (2) events from which they arise, and (3) 
procedures under which they are processed are authorized in accordance 
with laws, regulations, and management policy. Typical authorization 
controls include:

* documented policies establish events or transactions that the 
entity is authorized to engage in by law, regulation, or management 
policy;

* documented policies and procedures exist for processing transactions 
in accordance with laws, regulations, or management policy; and:

* master files include only authorized employees, customers, or 
suppliers.

APPROVAL:

.02: 
Approval controls are designed to provide reasonable assurance that 
appropriate individuals approve recorded transactions in accordance 
with management's general or specific criteria. Typical approval 
controls include the following:

* Specific transactions are approved by persons having the authority to 
do so (such as the specific approval of purchases by the procurement 
officer or other designated individual with procurement authority) in 
accordance with established policies and procedures.

* Transactions are compared with predetermined expectations (invoice 
terms are compared with agreed-upon prices, input is checked for valid 
data type for a particular field, etc.), and exceptions are reviewed by 
someone authorized to approve them.

* Transactions are compared with approved master files (such as 
approved customer credit limits or approved vendors) before approval 
or acceptance, and exceptions are reviewed by someone authorized to 
approve them.

* Key records are matched before a transaction is approved (such as 
the matching of purchase order, receiving report, and vendor invoice 
records before an invoice is approved for payment).

* Before acceptance, changes to data in existing files are 
independently approved, evidenced by either documentary or on-line 
approval of input before processing.

SEGREGATION OF DUTIES:

.03: 
Segregation-of-duties controls are designed to reduce the opportunities 
for someone to both perpetrate and conceal errors or fraud in the 
normal course of duties. Typically, an entity achieves adequate 
segregation of duties by establishing controls (such as segregating 
asset custody from recordkeeping functions) to prevent any person from 
having uncontrolled access to both assets and records. See paragraphs 
330.08 and 360.11 for additional discussions of segregation-of-duties 
controls.

DESIGN AND USE OF DOCUMENTS AND RECORDS:

.04: 
The purpose of controls over the design and use of records is to help 
provide reasonable assurance that transactions and events are properly 
recorded. Such controls typically include the following.

* Prenumbered forms are used to record all of an entity's transactions, 
and accountability is maintained for the sequence of all numbers used. 
(For example, prenumbered billing documents, vouchers, purchase orders, 
etc., are accounted for in numerical sequence when they are used, and 
any numbers missing from the sequence are investigated).

* Receiving reports, inspection documents, etc., are matched with 
billing notices, such as vendor invoices, or other documents used to 
record delivered orders and related liabilities to provide assurance 
that all and only valid transactions are recorded.

* Transaction documents (such as vendor invoices or shipping documents) 
are stamped with the date and tracked (through periodic supervisory 
reviews) to provide assurance that transactions are recorded promptly.

* Source documents are canceled after processing (for example, invoices 
are stamped, perforated, or written on after they are paid) to provide 
assurance that the same documents will not be reused and will not 
result in recording transactions more than once. Also, only original 
documents are used to process transactions.

ADEQUATE SAFEGUARDS OVER ACCESS TO AND USE OF ASSETS AND RECORDS:

.05: Access controls are designed to protect assets and records against 
physical harm, theft, loss, misuse, or unauthorized alteration. These 
controls restrict unauthorized access to assets and records. Evaluation 
of segregation of duties is also required for persons who have 
authorized access to assets and records. Typical access controls 
follow:

* Cash receipt totals are recorded before cash is transmitted for 
deposit.

* Secured facilities (locked rooms, fenced areas, vaults, etc.) are 
used. Access to critical forms and equipment (such as check signing 
machines and signature stamps) is limited to authorized personnel.

* Access to programs and data files is restricted to authorized 
personnel. (For example, manual records, computer terminals, and backup 
files are kept in secured areas to which only authorized persons can 
gain access.):

* Assets and records are protected against physical harm. (For example, 
intruder alarms, security guards, fire walls, a sprinkler system, etc., 
are used to prevent intentional or accidental destruction of assets and 
records).

* Incoming and outgoing assets are counted, inspected, and received or 
given up only on the basis of proper authorization (such as a purchase 
order, contract, or shipping order) in accordance with established 
procedures.

* Procedures are established to provide reasonable assurance that 
current files can be recovered in the event of a computer failure. (For 
example, the entity has implemented a backup and recovery plan, such as 
using on-premises or off-premises file backup, off-site storage of 
duplicate programs and operating procedures, and standby arrangements 
to use a second processing facility if the entire data center is 
destroyed).

* Access to critical forms and records is restricted. (For example, 
secured conditions are established and maintained for manual records 
and media used to access assets, such as blank checks or forms for the 
release of inventory).

INDEPENDENT CHECKS:

.06: 
Controls in this category are designed to provide independent checks 
on the validity, accuracy, and completeness of processed data. The 
following procedures are typical of this category of controls:

* Calculations, extensions, additions, and accounting classifications 
are independently reviewed. (For example, arithmetic on vouchers is 
independently recomputed, and transactions and accounting 
classifications are subsequently reviewed).

* Assets on hand are periodically inspected and counted, and the results 
are compared with asset records. (For example, inventories are 
inspected and physically counted at the end of each year and compared 
with inventory records).

* Subsidiary ledgers and records are reconciled to general ledgers.

* The entity promptly follows up on complaints from vendors, customers, 
employees, and others.

* Management reviews performance reports. (For example, the warehouse 
manager reviews performance reports on the accuracy and timeliness of 
fulfilling shipping orders and recording them in the sales processing 
system).

* Data from different sources are compared for accuracy and completeness. 
(For example, the cash journal entry is compared with the authenticated 
bank deposit slip and with the detailed listing of cash receipts 
prepared independently when mail was opened, and units billed are 
compared with units shipped).

* Actual operating results (such as personnel cost or capital 
expenditures for a particular organizational component or an entity as 
a whole) are compared with approved budgets, and variances are 
explained.

VALUATION OF RECORDED AMOUNTS:

.07: 
Controls in this category are designed to provide assurance that assets 
are valued at appropriate amounts. Typical valuation controls follow:

* Periodically, the condition and marketability of assets are evaluated. 
(For example, inventory is periodically reviewed for physical damage, 
deterioration, or obsolescence, or receivables are evaluated for 
collectibility).

* Recorded data are compared with information from an independent third 
party. (For example, recorded cash is reconciled to bank statements, 
and suppliers' accounts are reconciled to monthly statements from 
suppliers).

* Assessed values (such as independent appraisals of assets) are 
compared with the accounting records.

SUMMARIZATION OF ACCOUNTING DATA:

.08: Controls in this category are designed to provide assurance that 
transactions are accurately summarized and that any adjustments are 
valid. Typical controls in this category include the following:

* The sources of summarized data (such as subsidiary ledgers, journals, 
and/or other records) are compared with the underlying subsidiary 
records and/or documents before the data are accepted for inclusion in 
summarized records and reports. (For example, journal entries are 
compared to source documents, and the daily summaries of journal 
entries are compared with to the individual journal entries before the 
summarized entries are posted to the general ledger.):

* Procedures are followed to check the completeness and accuracy of 
data summarization, and exceptions are reviewed and resolved by 
authorized persons. (For example, batch totals are compared with 
appropriate journals, hash totals are compared at the beginning and 
end of processing, and totals passed from one system or application to 
another are compared).

RIGHTS AND OBLIGATIONS:

.09: 
Controls in this category are designed to provide assurance that (1) 
the entity owns recorded assets, with the ownership supported by 
appropriate documentation, (2) the entity has the rights to its assets 
at a given date, and (3) recorded liabilities reflect the entity's 
legal obligations at a given date. The following procedures are typical 
of this category of controls:

* Policies and procedures are documented (such as policy, procedures, 
and training manuals, together with organization charts) for initiating 
transactions and for identifying and monitoring those transactions and 
accounts warranting attention with respect to ownership.

* Policies and procedures are documented for initiating and monitoring 
transactions and accounts related to obligations.

* Significant transactions require the approval of senior management.

* Reported results and balances are compared with plans and 
authorizations.

PRESENTATION AND DISCLOSURE:

.10: 
Controls in this category are designed to provide assurance that (1) 
accounts are properly classified and described in the financial 
statements, (2) the financial statements are prepared in conformance 
with GAAP, and (3) footnotes contain all information required to be 
disclosed. The following procedures are typical of this category of 
controls:

* Policies and procedures are documented for accumulating and 
disclosing financial information in the financial statements by 
appropriate personnel. Responsibility is assigned to specific 
individuals.

* Policies and procedures are documented for preparing financial 
statements by authorized personnel having sufficient experience and 
expertise to assure compliance with GAAP.

* Policies and procedures are documented (such as policy and procedures 
manuals, together with organization charts) for properly classifying 
and describing financial information in the financial statements.

* Reports are periodically substantiated and evaluated by supervisory 
personnel. Procedures are implemented to detect errors and omissions 
and to evaluate recorded balances.

* A written chart of accounts containing a description of each account 
is used, such as the SGL. Journal entries are prepared, reviewed, 
compared with supporting details where necessary, and approved each 
accounting period.

* Appropriate processing procedures are used, including control or 
batch totals, etc. Written cutoff and closing schedules are also used.

* The same chart of accounts is used for both budgeting and reporting, 
and variances between actual and planned results are analyzed.

[End of section]

395 D - SELECTED STATUTES RELEVANT TO BUDGET EXECUTION: 

.01: 
Antideficiency Act: This statute places limitations on the obligation 
and expenditure of government funds. Expenditures and obligations may 
not exceed the amounts available in the related appropriation or fund 
accounts. Unless allowed by law, amounts may not be obligated before 
they are appropriated. Additionally, the amount of obligations and 
expenditures may not exceed the amount of the apportionments received. 
(See 31 U.S.C. sections 1341-1342, 1349-1351, and 1511-1517 for further 
information.):

.02: Purpose statute: This statute states that appropriations may be 
obligated and expended only for the purposes stated in the 
appropriation. (See 31 U.S.C. 1301 for further information.):

.03: 
Time statute: This statute states that appropriations may be obligated 
or expended only during the period of availability specified by law. 
(See 31 U.S.C. 1502 for further information.) Annual or multiple year 
appropriations often are referred to as "fixed accounts." Fixed 
accounts are available for obligation for a definite period of time. 
"No year" authority or accounts are resources that are available for 
obligation for an indefinite period of time, usually until the purposes 
for which they were provided are carried out.

[End of section]

395 E - BUDGET EXECUTION PROCESS: 

The steps of a simplified budget process are illustrated in the 
following table.

[See PDF for table]

[End of table]

.02: 
The following budget execution process is of interest to the auditor 
when testing the statement of budgetary resources and when evaluating 
an entity's internal control relating to budget execution:[Footnote 10]

* Congress provides an entity with an appropriation (or other budget 
authority), which is authority provided by law to enter into 
obligations that result in immediate or future outlays (2 U.S. 622(2)).

The Secretary of the Treasury issues warrants, which establish the 
amount of moneys authorized to be withdrawn from the central accounts 
maintained by Treasury.

* OMB makes an apportionment, which is a distribution of amounts 
available for obligation. Apportionments divide amounts available for 
obligation by specific periods (usually quarters), activities, 
projects, or objects, or a combination thereof. The amounts so 
apportioned limit the amount of obligations that may be incurred.

* The entity head (or other authorized employee) makes an allotment, 
which is an authorization to subordinates to incur obligations within a 
specified amount. The total amount allotted by an entity may not exceed 
the amount apportioned by OMB. The entity, through its fund control 
regulations, establishes allotments at a legally binding level for 
complying with the Antideficiency Act. Suballotments and allowances are 
further administrative divisions of funds, usually at a more detailed 
level (i.e., suballotments are divisions of allotments established as 
needed).

* The entity may make a commitment, which is an administrative 
reservation of an allotment or of other funds in anticipation of their 
obligation. Commitments are not required by law or regulation nor are 
they considered formal/official use of budget authority. Rather, 
commitments are used by entities for financial planning in the 
acquisition of goods and services and control over obligations and the 
use of budget authority.

* The entity incurs an obligation, which is the amount of orders placed, 
contracts awarded, services received, and similar transactions during a 
given period that will require payments during the same or future 
periods. Obligations need to comply with legal requirements before they 
may be properly recorded against appropriation accounts (title 7 of the 
GAO Policies and Procedures Manual). These legal requirements include 
consideration of whether the purpose, the amount, and the timing of 
when the obligation was incurred are in accordance with the 
appropriation. Additionally, there are legal requirements concerning 
the documentary evidence necessary for recording an obligation. The 
term "obligation" in this manual refers to orders for goods and 
services that have not been delivered (undelivered orders).

The entity records expended authority, which is the reduction of an 
obligation by the receipt and acceptance of goods and services ordered. 
Expended authority means that the budget authority has been used to 
acquire goods or services.[Footnote 11]

* The entity records an "outlay," which, as used in the President's 
budget, Congressional budget documents, and the statement of budgetary 
resources, refers to payments made to liquidate obligations for goods 
and services. The statement of budgetary resources reconciles 
obligations incurred net of offsetting collections to net outlays.

* The appropriation account expires when, according to the restrictions 
contained in the appropriation, the appropriation is no longer 
available for new obligations. Adjustments may be made for valid 
obligations that were either (1) recorded at an estimated amount that 
differs from the actual amount[Footnote 12] or (2) incurred before the 
authority expired, but were not recorded. Adjustments may be recorded 
for 5 years after the appropriation expires. For both expired accounts 
and closed accounts, the entity's obligations and expenditures may not 
exceed the related budget authority. The auditor should refer to OMB 
Circular A-34 (2000), sections 30.6-.10, for additional guidance on 
these types of adjustments and transactions.

Examples of valid adjustments to expired accounts within the 5-year 
period include adjustments for (1) canceled orders or orders for which 
delivery is no longer likely, (2) refunds received in the current 
period that relate to recovery of erroneous payments or accounting 
errors, (3) legal and valid obligations that were previously 
unrecorded, and (4) differences between the estimated and actual 
obligation amounts.

* After the 5-year period, the budget authority 
for the expired accounts 
is canceled and the expired accounts are closed. No further adjustments 
or outlays may be made in those closed accounts. Payments for any 
outstanding unliquidated obligations in closed accounts may be made 
from unexpired appropriations that have the same general purpose (but 
are limited in aggregate to 1 percent of the current year 
appropriation). For both expired accounts and closed accounts, the 
entity's obligations and expenditures may not exceed the related budget 
authority. The auditor should refer to OMB Circular A-34 (2000), 
sections 30.6-10, for additional guidance on these types of adjustments 
and transactions.

[End of section]

395 F - BUDGET CONTROL OBJECTIVES: 

.01: 
This section lists budget control objectives by steps in the budget 
process. The auditor may consider these control objectives for either 
or both of the audit of the statement of budgetary resources 
(evaluation of financial reporting controls) and/or as part of the 
compliance control evaluation. The auditor may evaluate many of these 
controls at the same time as controls over expenses, disbursements, and 
liabilities.

a. Appropriations (or other forms of budget authority): The recorded 
appropriation (or other form of budget authority) is the same as that 
made available in the appropriation or other appropriate legislation, 
including restrictions on amount, purpose, and timing.

b. Apportionments: The recorded apportionments agree with the OMB 
apportionments (as indicated on the apportionment schedules), and the 
total amount apportioned does not exceed the total amount 
appropriated.[Footnote 13]

c. Allotments/suballotments: The total amount allotted does not exceed 
the total amount apportioned.

d. Commitments: The auditor may not be concerned with controls over 
budgetary commitments because commitments are not required by law or 
regulation nor are they considered formal/official use of budget 
authority. Controls over budgetary commitments are considered a type of 
operations control.

The auditor should consider evaluating controls over commitments if the 
entity is using commitments and relying on controls over commitments to 
achieve the control objectives relating to obligations. If controls 
over commitments are evaluated, the auditor should apply the same 
control objectives used for obligations and expenditures, as discussed 
below.

e. Obligation transactions: The following control objectives relate to 
obligation transactions (undelivered orders):

* Validity: Obligations recorded are valid. An obligation is considered 
valid only if it meets these criteria:

The obligation has been incurred. This is usually evidenced by 
appropriate supporting documentation, such as a purchase order or 
binding contract.

The auditor should be alert for instances of "block obligating" or 
"block dumping," which occur when an entity records obligations to 
"reserve" funds even though the goods or services have not been 
ordered. This is most likely to occur near the expiration of the 
appropriation. The auditor should be alert for such signs as large, 
even-amount obligations near the end of the fiscal year for annual 
appropriations or during the last year of a multiyear appropriation 
account.

The purpose of the obligation is one for which the appropriation was 
made.

The obligation was incurred within the time that the appropriation was 
made available for new obligations.

The obligation did not exceed the amount allotted or appropriated by 
statute, nor was it incurred before the appropriation became law, 
unless otherwise provided by law.

The obligation complies with any other legally binding restrictions, 
such as obligation ceilings, identified in the planning phase.

The obligation has not subsequently been canceled nor the goods or 
services received.

For adjustments to obligations in expired accounts, the following 
objectives also are to be met:

If the adjustment represents a "contract change" as defined in OMB 
Circular A-34 (2000), the auditor should refer to section 30.7 of that 
circular for reporting and approval requirements.

The adjustment does not cause the entity to exceed the amount allotted 
or appropriated by statute.

The adjustment is recorded during the period when the account is 
available for adjustments (5 years) and was made for a valid obligation 
incurred before the authority expired.

New obligations may not be recorded in expired accounts.

* Completeness: All obligation transactions are recorded.

* Valuation: Obligations are recorded at the best available estimate of 
actual cost.

* Cutoff: Obligations are recorded in the proper period.

* Classification: Obligations are recorded in the proper appropriation 
or fund accounts (also by program and by object, if applicable), 
including 
the proper appropriation year if the account has multiple years. 
Examples of programmatic account classifications are "school lunch 
program" and "nutrition education and training." Examples of object 
account classifications are "salaries," "rent," and "travel.":

f. Expended authority transactions: The following control objectives 
relating to expended authority transactions, as defined in section 395 
E, are generally the same as those for obligation transactions:

* Validity: For all expended authority transactions, recorded expended 
authority transactions have occurred. This occurrence is usually 
evidenced by appropriate supporting documentation. For expended 
authority transactions (or adjustments to expended authority 
transactions) in expired accounts, the following objectives also are to 
be met:

The expended authority transaction does not cause the entity to exceed 
the amount appropriated by statute:

The expended authority transaction is recorded during the period when 
the account is available for adjustments (5 years).

The expenditure is not made out of a closed account.

* Completeness: All expended authority transactions and adjustments are 
recorded.

* Valuation: Expended authority transactions and adjustments are 
recorded at the correct amount.

* Cutoff: Expended authority transactions and adjustments are recorded 
in the proper period.

* Classification: Expended authority transactions and adjustments are 
recorded in the proper appropriation or fund accounts (also by program 
and by object, if applicable), including the proper appropriation year 
if the account has multiple years.

g. Outlay transactions: The following control objectives relate to 
outlay transactions (to be considered while auditing cash 
disbursements):

* Validity: Outlays are supported by sufficient evidence such as 
contractor invoices and receiving reports. The outlay is recorded 
against an obligation made during the period of availability of the 
appropriation (not made out of a closed account) and is for a purpose 
for which the appropriation was provided as evidenced by being in an 
amount not exceeding the obligation, as adjusted, authorizing the 
outlay. Use of "first-in, first-out" or other arbitrary means to 
liquidate obligations based on outlays is not generally acceptable 
unless supporting evidence demonstrates that, in fact, these estimating 
techniques reasonably represent the manner in which costs are incurred 
and should be charged to unliquidated obligations. Accrual of 
liabilities based on incurred but unbilled contractor costs alone is 
not sufficient evidence of validity (i.e., it does not ensure that the 
purpose, time, and amount provisions of an appropriation are met). 
Internal control over liquidation of the corresponding obligation by 
outlays is a safeguard against improper payments, including erroneous, 
duplicative, or fraudulent contractor billings.

* Completeness: All outlays and adjustments are recorded in a timely 
manner.

* Classification: Outlays are recorded in the proper accounts (both by 
program and by object, if applicable), including the proper 
appropriation year if the account has multiple years. This is evidenced 
by "matching" the outlay to the underlying obligation.

h. Obligation and expended authority balances: The following control 
objectives relate to obligation and expended authority balances as of a 
point in time:

* Summarization: Recorded balances of obligation and expended authority 
accounts as of a given date are supported by appropriate detailed 
records that are accurately summarized and reconciled to the 
appropriation or fund account balance, by year, for each account.

* Substantiation: Recorded account balances are supported by valid 
obligations and expended authority transactions.

* Limitation: Total undelivered orders plus total expended authority 
transactions do not exceed the amount of the appropriation or other 
statutory limitations (such as obligation ceilings) that may exist by 
appropriation period. These other statutory limitations may limit the 
amount of obligations that can be incurred by program or object 
classification. In addition, total payments of outstanding unliquidated 
obligations that relate to closed accounts cannot exceed the limits 
described in A-34 (2000), section 30.10 (for annual accounts, 1 percent 
of the account's current year appropriation, for multiyear accounts, 1 
percent of all appropriations that are available for obligation for the 
same purpose - this is a single, cumulative limit).

i. Appropriation account balances: The following control objectives 
relate to appropriation account balances as of a point in time:

* Fixed appropriation accounts are identified by fiscal year after the 
end of the period in which they are available for obligation until they 
are closed. (31 USC 1553(a)):

* Fixed appropriation accounts are closed on September 30th of the 5th 
fiscal year after the end of the period that they are available for 
obligation. Any remaining balance (whether obligated or unobligated) in 
the account is canceled and is no longer available for obligation or 
expenditure for any purpose. (31 USC 1552(a)). For example, at the end 
of fiscal year 1995, the entity should only have accounts for fixed 
appropriations that expired at the end of fiscal years 1991, 1992, 
1993, 1994, and 1995. All fixed appropriations that expired prior to 
these dates should have been closed and canceled as of the end of 
fiscal year 1995.

* Appropriation accounts that are available for obligation for an 
indefinite period are closed if (1) the entity head or the President 
determines that the purposes for which the appropriation was made have 
been carried out and (2) no disbursement has been made against the 
appropriation for two consecutive fiscal years. (31 USC 1555):

j. Recording of cash receipts related to closed appropriation accounts: 
(to be considered only if such amounts are expected to exceed design 
materiality):

* Collections authorized or required to be credited to an 
appropriation account but not received before the account is closed 
are deposited in the Treasury as miscellaneous receipts. (31 USC 1552
(b)):

[End of section]

395 F Sup - BUDGET CONTROL OBJECTIVES - FEDERAL CREDIT REFORM ACT 
SUPPLEMENT: 

.01: 
The Federal Credit Reform Act (FCRA) contains many provisions regarding 
the recording and reporting of activity related to direct loans, loan 
guarantees, and modifications of these items for budget accounting 
purposes. (Definitions of these and other FCRA terms are included in 
the notes to this supplement.) For transactions and account balances 
related to these types of activities, the auditor should consider each 
of the budget control objectives listed in FAM 395 F and supplement 
them with the following budget control objectives related to FCRA. 
Additional guidance on FCRA accounting for budget purposes is included 
in OMB Circular A-34 (2000), section 70, Federal Credit Programs. Also, 
see Federal Financial Accounting and Auditing Technical Release No. 3, 
Preparing and Auditing Direct Loan and Loan Guarantee Subsidies Under 
the Federal Credit Reform Act, issued by FASAB's Accounting and 
Auditing Policy Committee (AAPC) in July 1999.

a. 
Obligation transactions: Obligation transactions include direct loan 
obligations, loan guarantee commitments, and modifications that change 
the cost of an outstanding direct loan or loan guarantee (except 
modifications within the terms of existing contracts or through other 
existing authorities). The following are supplemental control 
objectives related to obligation transactions under FCRA:

* Valuation: Obligations are recorded at the best available estimate of 
actual cost.

** The cost of a direct loan is recorded as the net present value, at 
the time when the loan is disbursed, of the following cash flows:

*** loan disbursements,

*** estimated principal repayments,

*** estimated interest payments, and:

*** estimated amounts and timing of any other payments by or to the 
government over the life of the loan. These amounts include fees, 
penalties, and other recoveries. Administrative costs and any 
incidental effects on governmental receipts and outlays are excluded. 
(2 USC 661a(5)(A) and (B)):

These estimated cash flows include the effects of the timing and 
amounts of expected defaults and prepayments. These cash flows are 
discounted using the appropriate rate as described below.

** The cost of a loan guarantee is recorded as the net present value, 
at the time when the related guaranteed loan is disbursed, of the 
following cash flows:

*** estimated amounts and timing of payments by the government for 
defaults, delinquencies, interest subsidies, or other payments, 
excluding administrative costs; and:

*** estimated amounts and timing of payments to the government for 
origination and other fees, penalties, and recoveries. (2 USC 
661a(5)(A) and (C)):

Any incidental effects on governmental receipts and outlays are 
excluded. These cash flows are discounted using the appropriate rate as 
described below.

** The cost of a modification is recorded as the difference between the 
current estimated net present value of the cash flows under the 
existing direct loan or guarantee contract and the estimated net 
present value of the cash flows under the modified contract. The cash 
flows for each of these calculations is discounted at the rate for 
modifications described below. (2 USC 661a(5)(D)):

** The discount rate used to estimate the net present values described 
above is the average interest rate, in effect when the obligation is 
incurred, for marketable Treasury securities of similar maturity to the 
related loan. For modifications, the discount rate used is the average 
rate, in effect at the time of modification, for marketable Treasury 
securities with a maturity similar to the remaining maturity of the 
modified loan. (2 USC 661a(5)(E)):

b. Expended authority transactions: Expended authority transactions 
include transactions that occur when loans are disbursed. The following 
are supplemental control objectives related to expended authority 
transactions under FCRA:

* Valuation: Expended authority transactions are recorded at the proper 
amount. The same specific criteria for the amounts of FCRA obligations 
are also applicable to expended authority transactions.

* Cutoff: Expended authority transactions are recorded in the proper 
period.

** Expended authority transactions for the cost of loans or guarantees 
are recorded in the fiscal year in which the direct or guaranteed 
loan is disbursed or its costs altered. (2 USC 661c(d)(2)):

* Classification/Presentation and Disclosure: Amounts are recorded in 
the proper account and reported appropriately.

** Differences in subsequent years between original estimated cost and 
reestimated costs are recorded in a separately identified subaccount in 
the credit program account and shown as a change in program costs and a 
change in net interest. (2 USC 661c(f)):

** Funding for the administration of a direct loan or loan guarantee 
program is recorded in separately identified subaccounts within the 
same budget account as the program's cost. (2 USC 661c(g)):

** Cash disbursements for direct loan obligations or loan guarantee 
commitments made on or after October 1, 1991, are made out of the 
financing account. (2 USC 661a(7)):

c. Obligation and expended authority balances: The following are 
supplemental control objectives related to obligation and expended 
authority balances under FCRA as of a point in time:

* Limitation: Total obligations plus total expended authority 
transactions do not exceed the amount of the appropriation or other 
statutory limitations that may exist by appropriation period.

** Direct loan obligations made on or after October 1, 1991, do not 
exceed the available appropriation or other budget authority.

** Modifications made to direct loan obligations or direct loans do 
not exceed the available appropriation or other budget authority. (The 
auditor should discuss applicability of this budget restriction to 
direct loans and direct loan obligations that were outstanding prior to 
October 1, 1991, with OGC prior to performing control or compliance 
tests.):

** Obligations for new loan guarantee commitments made on or after 
October 1, 1991, do not exceed the available appropriation or other 
budget authority.

** Modifications made to loan guarantee commitments or outstanding loan 
guarantees do not exceed the available appropriation or other budget 
authority. (The auditor should discuss applicability of this budget 
restriction to loan guarantees, or loan guarantee commitments that were 
outstanding prior to October 1, 1991, with OGC prior to performing 
control or compliance tests.):

d. Cash receipts: The following are supplemental control objectives 
related to cash receipts under FCRA:

* Classification: Cash receipts are recorded in the proper account.

** Cash receipts related to direct loans obligated or loan guarantees 
committed prior to October 1, 1991, are recorded in the liquidating 
accounts. (2 USC 661f(b)):

** Cash receipts related to direct loan obligated or loan guarantees 
committed on or after October 1, 1991, are recorded in the financing 
account. (2 USC 661a(7)):

Note 1: A direct loan is a disbursement of funds by the government to 
a nonfederal borrower under a contract that requires the repayment of 
such funds with or without interest. The term also includes the 
purchase of, or participation in, a loan made by another lender. The 
term does not include the acquisition of a federally guaranteed loan in 
satisfaction of default claims or the price support loans of the 
Commodity Credit Corporation. (2 USC 661a(1)):

Note 2: A direct loan obligation is a binding agreement by a federal 
agency to make a direct loan when specified conditions are fulfilled by 
the borrower. (2 USC 661a(2)):

Note 3: A loan guarantee is any guarantee, insurance, or other pledge 
with respect to the payment of all or a part of the principal or 
interest on any debt obligation of a nonfederal borrower to a 
nonfederal lender, but does not include the insurance of deposits, 
shares, or other withdrawable accounts in financial institutions. (2 
USC 661a(3)):

Note 4: A loan guarantee commitment is a binding agreement by a federal 
agency to make a loan guarantee when specified conditions are fulfilled 
by the borrower, the lender, or any other party to the guarantee 
agreement. (2 USC 661a(4)):

Note 5: Costs are defined as the estimated long-term cost to the 
government of a direct loan or loan guarantee, calculated on a net 
present value basis, or modification thereof, excluding administrative 
costs and any incidental effects on governmental receipts or outlays (2 
USC 661a(5)). These calculations are described in further detail under 
the valuation control objective for obligations in FAM 395 F.

Note 6: A credit program account is a budget account associated with 
each program account into which an appropriation to cover the cost of a 
direct loan or loan guarantee program is made and from which such cost 
is disbursed to the financing account. (2 USC 661a(6)):

Note 7: A liquidating account is a budget account that includes all 
cash flows to and from the government resulting from direct loan 
obligations or loan guarantee commitments made prior to October 1, 
1991. These accounts are required to be shown on a cash basis. (2 USC 
661a(8)):

Note 8: A financing account is a nonbudget account(s) associated with 
each credit program account that holds balances, receives the cost 
payment from the credit program account, and also includes all other 
cash flows to and from the government resulting from direct loan 
obligations or loan guarantee commitments made on or after October 1, 
1991. (2 USC 661a(7)):

Note 9: Modifications are government actions that alter the estimated 
cost of an outstanding direct loan or loan guarantee from the current 
estimate of cash flows (2 USC 661c(9)); for example, a policy change 
affecting the repayment period or interest rate for a group of existing 
loans. Changes within the terms of existing contracts or through other 
existing authorities are not considered modifications under FCRA. In 
addition, "work outs" of individual loans, such as a change in the 
amount or timing of payments to be made, are not considered 
modifications. The effects of these changes should be included in the 
annual reestimates of the estimated net present value of the 
obligations.

Note 10: OMB Circular A-34, section 70.2(x) instructs agencies to make 
annual reestimates to adjust the net present value of direct loans and 
loan guarantee obligations for changes in the estimated amounts of 
items such as defaults and the timing of payments. Permanent indefinite 
authority has been provided for reestimates.

[End of section]

395 G - ROTATION TESTING OF CONTROLS: 

OVERVIEW:

.01: 
Rotation testing of controls, as discussed in paragraph 380.01, may be 
considered for testing financial reporting controls of an entity with 
multiple significant accounting cycles/applications, provided that 
effective financial reporting controls within all significant cycles/
applications have been evaluated and tested within a sufficiently 
recent period of years. Under a rotation plan, such controls are tested 
in different cycles/applications each year such that each cycle/
application is selected for testing, as described in sections 310-380, 
at least once during a rotation period of several years, but not 
necessarily every year. For example, a rotation plan for an entity with 
five significant cycles/applications might include tests of two or 
three cycles/applications annually, covering all cycles/applications 
in a two or three year period. Rotation testing should be limited to 
computerized applications that have strong computer general controls 
because computer programs ordinarily function consistently in the 
absence of programming changes, reducing the probability of random 
errors.

.02: 
Less extensive work must be performed annually for financial reporting 
controls in significant cycles/applications not selected for testing. 
This work consists of:

* 
updating the auditor's understanding of the control environment, risk 
assessment, communication, and monitoring, accounting system, and 
financial reporting control activities, including performing 
walkthroughs, and:

* performing any other procedures that may be necessary under the 
specific circumstances to support the report on internal control and 
the evaluation of internal controls relied on in performing certain 
audit procedures.

.03: 
The auditor's decision to use rotation is made on a cycle-by-cycle or 
application-by-application basis, so some cycles/applications might be 
tested annually and others by rotation. In rotation testing, the 
auditor relies on cumulative audit evidence and knowledge, including 
that gathered in prior years, to support the assessment of and report 
on internal control. Accordingly, rotation may be used only when all 
the following conditions exist:

* The auditor possesses a "foundation" of audit evidence on which to 
develop current audit conclusions.

* Control risk is low; the control environment, risk assessment, 
communication, and monitoring are strong; and inherent and fraud risk 
factors are reasonably low.

* Financial reporting controls over all significant cycles/applications 
have been evaluated and tested during a sufficiently recent period 
(generally within 3 years).

* Recurring audits of the entity enable a rotation plan to be effective.

* No specific reporting or risk issues preclude the use of rotation. 
(For example, cycles/applications do not affect such sensitive areas 
as loan loss reserves.):

.04: 
Ordinarily, the following cycles/applications should be subjected to 
tests of financial reporting controls and should be excluded from 
rotation testing:

* any cycle/application that is disproportionately significant.

* any cycle/application that has undergone major change since financial 
reporting controls were most recently tested.

The auditor should consider whether assets susceptible to loss or 
theft, such as cash on hand or imprest funds, also should be excluded 
from rotational testing.

.05: 
The foundation of audit evidence to support a rotation plan, which is 
updated and increased through limited tests and other relevant audit 
evidence, may be obtained from one or a combination of the following:

* evidence gathered in one or more prior audits and:

* the current or prior work of another auditor, after the auditor 
considers the requirements of FAM section 650.

CIRCUMSTANCES UNDER WHICH ROTATION TESTING MAY BE USED:

.06: 
The auditor should exercise judgment in determining whether to use 
rotation. Factors that the auditor should consider include the 
following:

* The results and extent of the auditor's prior experiences with the 
entity and its cycles/applications, including the length of time since 
financial reporting controls were tested.

The effectiveness of prior evidence ordinarily diminishes with the 
passage of time.

* The importance of the cycles/applications to the overall entity and 
the nature of the audit assertion or assertions involved.

As the significance of cycles/applications and assertions increases, 
the frequency of testing thereof ordinarily increases.

* The auditor's assessment of inherent and fraud risk.

The effectiveness of rotation ordinarily diminishes as inherent and 
fraud risk increase.

* The auditor's preliminary assessment of control risk.

The effectiveness of rotation ordinarily diminishes rapidly as control 
risk increases.

* The extent to which control is centralized or decentralized.

The effectiveness of rotation ordinarily diminishes rapidly as control 
becomes more decentralized.

* The number and relative sizes of the respective cycles/applications.

The efficiency of rotation ordinarily increases as the number and size 
of cycles/applications increase.

* The nature and extent of audit evidence about internal controls that 
may result from substantive testing in the current audit.

Information obtained concurrently with substantive testing might 
provide evidence about the functioning of cycles/applications.

* The extent of oversight provided by others.

Work performed by others might be used to reduce tests of financial 
reporting controls. (See FAM section 650.):

* Any special reporting or entity requirements.

The auditor should perform sufficient tests to meet any special 
requirements, such as a special report on the functioning of a specific 
cycle/application.

.07: 
For any rotation testing plan, the auditor should document in a 
memorandum approved by the Reviewer:

* the schedule for testing all significant cycles/applications;

* the reasons for using such a plan;

* any limitations on the use of such a plan; and:

* any other significant aspects, including descriptions of any 
modifications to rotation plans established in previous years. A 
rotation plan should be reevaluated annually.

[End of section]

395 H - SPECIFIC CONTROL EVALUATION WORKSHEET: 

The auditor should use the SCE worksheet or equivalent to document the 
evaluation of control activities in the internal control phase. This 
section illustrates an SCE worksheet for the cash receipts application 
for a hypothetical federal government entity, "XYZ Agency" (XYZ). (See 
page 395 H-3.):

An SCE worksheet should be prepared for each significant accounting 
application. The auditor generally should use the SCE worksheet to 
document the evaluation of compliance (including budget) and operations 
controls. The worksheet may be completed for financial reporting 
controls as follows:

1. List each assertion that is relevant to the accounting application. 
While all five financial statement assertions relate to line item/
account-related accounting applications, the existence or occurrence, 
completeness, and valuation assertions relate principally to 
transaction-related accounting applications, as illustrated at section 
395 B. Therefore, assertions relevant to cash receipts would be 
existence or occurrence, completeness, and valuation.

2. From the Account Risk Analysis (see section 240), list the 
significant line items or accounts that the accounting application 
affects. For example, cash and accounts receivable are ordinarily 
affected by cash receipts.

3. Document the assertions for each of the line items or accounts 
identified in step 2 that relate to each accounting application 
assertion (see section 330).

4. For each significant account assertion, identify the potential 
misstatements that could occur in the accounting application and the 
related control objectives, based on the generic list of potential 
misstatements and control objectives included in section 395 B. This 
list should be tailored to the accounting application and the entity 
and, if necessary, should be supplemented with additional objectives or 
subobjectives.[Footnote 14]

5. List control activities selected for testing that achieve each 
control objective identified above and indicate whether each is an IS 
control. Section 395 C illustrates typical control activities to 
achieve financial reporting control objectives. User controls where the 
user would be able to detect misstatements in the computer-generated 
information independently of IS is not an IS control.

6. Document the effectiveness of control activities in achieving the 
control objectives in relation to each potential misstatement and 
cross-reference to the audit procedures in the testing program. (The 
overall assessment of financial reporting controls should be documented 
in the ARA document, as illustrated in section 395 I.):

[See PDF for image]

[End of table]

FOOTNOTES

[1] The auditor should consider coordinating sampling control tests 
with substantive audit procedures and/or tests of compliance with laws 
and regulations (multipurpose tests) to maximize efficiency. See 
section 450 for further discussion.

[2] The auditor should consider coordinating sampling control tests 
with substantive audit procedures and/or tests of compliance with laws 
and regulations (multipurpose tests) to maximize efficiency. See 
section 450 for further discussion.

[3] As indicated in paragraphs 260.27-.31, the FMFIA report and its 
supporting documentation may be considered as a starting point for 
evaluating internal control. The auditor may use management's 
documentation of systems and internal control where appropriate. 
Management's tests of controls may be used by the auditor in testing 
controls, if such tests were executed by competent individuals 
independent of the controls. (See AU 322 (SAS 65) and section 650 for 
further information.)

[4] Section 395 C presents a list of typical control activities that an 
entity may establish to help prevent or detect misstatements in 
financial statement assertions.

[5] Assertions that have high inherent risk normally require stronger 
or more extensive controls to prevent or detect misstatements than 
assertions without such risk.

[6] Control environment, risk assessment, communication, and monitoring 
weaknesses may result in ineffective control activities. If so, the 
auditor should still identify and test specific control activities, but 
the extent of such testing should be limited, as discussed in paragraph 
340.02.

[7] The auditor may assess control and combined risk on a preliminary 
basis at an earlier point in the audit, if preferred.

[8] Specific relevant control activities will be documented later in 
the specific control evaluation worksheet or equivalent, after related 
control objectives have been identified. (See paragraphs 330.02-.11.)

[9] Although the auditor may gather information on control activities 
in preparing the flowchart, such techniques should be documented in the 
SCE worksheet or equivalent, if applicable, and need not be documented 
in the flowchart.

[10] For additional information on budget execution, see OMB Circular 
A-34, Instructions on Budget Execution, November 3, 2000.

[11] In the normal flow of business, when obligations are incurred, a 
credit to "undelivered orders" or "unexpended obligations - unpaid" is 
recorded. When the goods or services are received, the obligation is 
reduced and a credit to "expended authority - unpaid" (a payable) is 
recorded. When the obligation is paid and the outlay is made, the 
transaction is credited to "expended authority - paid." For additional 
transaction details, see the U.S. Standard General Ledger Accounting 
Transactions Supplement of the Treasury Financial Manual.



[12] Amounts of commitments, obligations, and expended authority may 
differ for a particular item acquired. Commitments are made at 
"initial" estimates, obligations at "later" estimates," and expended 
authority at "actual" amounts.

[13] OMB apportionments may, as a result of impoundments (rescissions 
or deferrals), be less than the amount of the apportionments requested 
by the entity. The auditor should notify OGC of any impoundments that 
come to his or her attention. OMB may also approve amounts available 
different from those requested by time period, activities, projects, or 
objects.

[14] In the SCE worksheet, the auditor may either commingle the 
documentation of compliance (including budget) and operations controls 
with that of financial reporting controls to the extent relevant or 
present each of these types of controls in a separate SCE. To complete 
the SCE worksheet for these controls, the auditor begins by inserting 
relevant control objectives and performs steps 5 and 6 above.