1 OMB Circular A-123 Lessons Learned: Strategies for Sustained Compliance and Outlook for the Future Presented by Frank Petersen, Director Office of Quality Assurance, National Aeronautics and Space Administration

2 OMB NASA A-123-A: Multi-Year Approach  NASA instituted a multi-year approach to fully implement the requirements of A-123, Appendix A Year 1 assessment focused on significant financial statement line items Year 1 assessment focused on significant financial statement line items Year 2 focuses on a restructured approach to cover key cycles and sub processes while continuing to building upon the foundation established in year 1 Year 2 focuses on a restructured approach to cover key cycles and sub processes while continuing to building upon the foundation established in year 1

3 Year 1: Laying the Ground Work  Instituted a “Top Down” approach  Established the Senior Assessment Team to oversee A-123 implementation across NASA  Identified significant financial statement line items for documentation and testing  Developed a comprehensive methodology for implementing the A-123 requirements over 3 years

4 Year 1: Lessons Learned  Focus efforts on core requirements to optimize resources  Leverage existing documentation and resources to produce process narratives and flow charts (optional)  Develop “high level” standard processes across financial management  Build “universal ownership” into the process for implementing a system of “sound” financial controls

5 Year 2: Building Upon the Foundation  Continue to promote effective Agency-wide internal control management Senior Assessment Team improving methodology for fully integrated approach to internal control Senior Assessment Team improving methodology for fully integrated approach to internal control  Preparing comprehensive internal control guidance for programmatic, financial, and institutional  Ensuring a uniform process for gathering supporting documentation and evidence for the Annual Statement of Assurance

6 Year 2: Building Upon the Foundation  Incorporate FY ’06 Key controls into Center CFO’s individual development plans  Develop Financial Management Internal Control Framework (ongoing initiative) Define agency level standard business processes Define agency level standard business processes Develop standard control objectives and control activities Develop standard control objectives and control activities Establish financial management training program Establish financial management training program  Establish high level generic Key controls model

7 Strategies for Sustained Compliance  Make internal control management common business practice  Leverage resources across the Agency  Establish an agency-wide internal control training program  Overcome barriers to sound financial management practices through: Universal buy-in from top to bottom Universal buy-in from top to bottom Shared responsibility Shared responsibility Comprehensive communication Comprehensive communication Sound monitoring practices Sound monitoring practices Risk based approach Risk based approach

8 Embed Effective Internal Control Management into the Culture  Continue to build synergy and coalitions agency wide – Involve stakeholders in the process  Ensure controls are adequate, unobtrusive, withstand scrutiny, safeguard assets, and address: Quantitative and Qualitative issues Quantitative and Qualitative issues  Continue growth and development of uniform system of internal control

9 Outlook for the Future  Benefits for Today, Tomorrow, and Beyond… Integrated enterprise system confluence of business processes and accounting information creates greater: Integrated enterprise system confluence of business processes and accounting information creates greater: Need for sound internal controlNeed for sound internal control Understanding of non-financial business process impacts on the general ledgerUnderstanding of non-financial business process impacts on the general ledger Increased reliance on information obtained to make management decisionsIncreased reliance on information obtained to make management decisions

10 Outlook for the Future (cont.) Movement toward shared services and standard business processes across the organization creates need for solid internal control structure Movement toward shared services and standard business processes across the organization creates need for solid internal control structure Inside and outside of shared service environmentInside and outside of shared service environment Stakeholder monitoring and risk assessmentStakeholder monitoring and risk assessment Third party checks and balancesThird party checks and balances Exception processing controlsException processing controls