ARMICS Update: May 14, 2008

1. ARMICS Update:May 14, 2008 FOCUS

2. ARMICS Update: FOCUS Presentation • Best Practices • Room for Improvement • Flexibility • Where do we go from here? Accounting and Internal Control Compliance Oversight Unit

3. ARMICS Update: Best Practices • Written Plan • – Approved by Agency Head / Board Chair • Written Internal Report • – To Agency Head / Board Chair (Audit Committee) • Internal Quality Assurance Review • – Good use of an Internal Audit function • Management • – Designation of an Internal Control Officer / Manager Accounting and Internal Control Compliance Oversight Unit

4. ARMICS Update: Best Practices • Survey Automation • – Zoomerang, Survey Monkey, etc. • Survey Experts • – Questionnaire modification, Statistical Analysis • – Source: Colleges and Universities • Documentation • – Parallel Flowcharts and narratives w/ IC Identification Accounting and Internal Control Compliance Oversight Unit

5. ARMICS Update: Room for Improvement • General: • – Stage 1 Testing: Key controls that can be tested. • – Input, All levels when applicable • – NOT just management • – NOT just Finance / Fiscal • – Attitude: Process has a benefit other than getting DOA off my back • – Over-reliance on Exhibits as the only tool to identify risk – No customization Accounting and Internal Control Compliance Oversight Unit

6. ARMICS Update: Room for Improvement • Stage 1: Customize Questionnaires • – Corrections: Access and Security • – Federal Grants: Sub-grantee monitoring (Pass-thru) • – Colleges: Students – System Access - Security • – Shared Services Agreements – Split controls - MOU • – External Entities (Providing input services – Contracts) • – Avoid a Minimalist Approach (Underestimating Risks) Accounting and Internal Control Compliance Oversight Unit

7. ARMICS Update: Room for Improvement • Stage 1: Control Environment • – Ethics Programs not JUST a Code of Ethics • – Testing the effectiveness of Ethics Programs • -- Random mini-exams (verbal or written) • – Ethics awareness program • – Awareness programs in general (Safety, Harassment, Sensitivity, Terrorism, etc.) • – Ethics and control responsibility in EWPs Accounting and Internal Control Compliance Oversight Unit

8. ARMICS Update: Room for Improvement • Stage 1: Risk Assessment • – External Risks (Data Flows and sources) • – Evaluate Risks – Impact & Likelihood • – Don’t forget SWOT (High Level) Accounting and Internal Control Compliance Oversight Unit

9. ARMICS Update: Room for Improvement • Stage 1: Control Activities • – Stage 1 VS Stage 2 • – Example: General VS Application controls • – Good area for Stage 1 “Testing” Accounting and Internal Control Compliance Oversight Unit

10. ARMICS Update: Room for Improvement • Stage 1: Information and Communication • – Agency FOIA process • – Sensitive data, redaction, privacy restrictions • – Info. Security: Not just electronic – check your garbage • – Error 1: Release what should be restricted • – Error 2: Restrict what should be released • – Perception VS Reality = Communication gaps • – Add Question on Hotline effectiveness Accounting and Internal Control Compliance Oversight Unit

11. ARMICS Update: Room for Improvement • Stage 1: Monitoring • – Special Monitoring • – Grant Pass Thrus (OMB Circular A-133) • – Audit CAPs • – Internal projects • – System Development • – NCAA Accounting and Internal Control Compliance Oversight Unit

12. ARMICS Update: Room for Improvement • Stage 2: Identification of Significant Fiscal Processes • – So far, so good • – Definition of Significant • – Consistency Accounting and Internal Control Compliance Oversight Unit

13. ARMICS Update: Room for Improvement • Stage 2: Documentation of Fiscal Processes • – The key is your flexibility Accounting and Internal Control Compliance Oversight Unit

14. ARMICS Update: Room for Improvement • Stage 2: Identification of Internal Controls • – Steady as she goes Accounting and Internal Control Compliance Oversight Unit

15. ARMICS Update: Room for Improvement • Stage 2: Testing of Key Internal Controls • – Document, Document, Document Accounting and Internal Control Compliance Oversight Unit

16. ARMICS Update: Room for Improvement • Stage 3: Corrective Action Plans • – Include all elements listed in the ARMICS Manual Accounting and Internal Control Compliance Oversight Unit

17. ARMICS Update: Flexibility • Deferring SWOT until Strategic Planning • Review after major operations change Accounting and Internal Control Compliance Oversight Unit

18. ARMICS Update: The Future • One Certification per Year • Replaces DOA-FR Year End Certification • Update only for processes done well • Stage 1: Refresh and Refine • Stage 2: Update and Retest • Stage 3: Follow-up and Test from Prior Year + new • Addresses Service Provider Agreements • Constant Improvement Accounting and Internal Control Compliance Oversight Unit

19. Conclusion • Good First Try • Room for Improvement • Variance in Implementation – A Good Thing • “Forward, always forward, everywhere forward.” • – Boniface Wimmer, OSB • “Don’t look back, you can never look back.” • – Don Henley, The Boys of Summer • “Don't look back — something might be gaining on you.“ • – Leroy “Satchel” Paige Accounting and Internal Control Compliance Oversight Unit

20. Contact Information • Joseph A. Kapelewski, CGFM, CPA, CIA • Joe.kapelewski@doa.virginia.gov • 804-225-4366 • Commonwealth of Virginia • Department of Accounts • www.doa.virginia.gov • Click on ARMICS Accounting and Internal Control Compliance Oversight Unit