Commonwealth of Virginia Department of Accounts

Commonwealth of Virginia Department of Accounts

Agency Risk Management and Internal Control

Standards

(ARMICS)

An Implementation Example

Department of Productivity Enhancement

Example:

The approach of a fictitious agency of the Commonwealth of Virginia to implement ARMICS cost effectively, with minimal disruption, by the deadline.

July 25, 2007

The Agency:Department of Productivity Enhancement

125 Employees (MEL)

Mgt Team – 15 Program Ops – 110 -- Agency Head -- 80 Staff Analysts -- Deputy -- 20 Sr (Lead)

Analysts -- OPS Chief – 2 -- 10 Vacancies -- Planner -- VITA Liaison -- Research Analyst -- HRO – 2 -- Accounting – 5 -- Procurement – 1

Accounting Division

Five Employees– Fiscal Director– Accounting Manager– Staff Accountant– Two Transaction

Processors

Agency Mission

• Examine agency operations

• Recommend improvements

Operations Organization

Two Operations ChiefsTen field teams each

4 Staff Analysts + 1 Senior Analyst

(Leader)= 1 Team

10 VacanciesRoughly 2 Teams per Secretariat

Operations

• All Operations Staff have College Degrees

• Each one is issued a VITA – NG Laptop

• Used for Word Processing (Reporting), Some Excel and Access (Analysis)

• 40% Travel to Agency field operations and HQ

• Economist Contract for $250K/Year

• Misc. supply expenditures

Fiscal Office Attributes

• Use the Payroll Service Bureau (PSB)

• Key Directly into CARS

• No Federal Grants

• Payroll is largest expense

Background

• ARMICS Steering Committee (appointed by Agency Head)– Agency Head, Danny

Murtaugh– Fiscal Director, Dave Cash– Chief Deputy, Roberto

Clemente’– OPS Chief, Wilbur Stargell – OPS Team Leader, Al Oliver

The Plan

The steering team has just emerged from a two day ARMICS Retreat with the following implementation plan . . .

• OPS team leader, Richie Hebner, an expert in MS Access will prepare a Database to accept questionnaire responses. Due July 31, 2007.

• Richie’s team will be responsible for adding information to the database as it is received.

The Plan

• Procurement Manager, Ramon Hernandez, will set-up a mandatory staff meeting on August 1, 2007, to kick-off the ARMICS Project.

• Mr. Murtaugh will lead the mandatory staff meeting (8-1-07) to set the tone for the project.

• The Steering Committee will meet every other week to assess the progress of the project.

The Plan

• Jose’ Pagan, a team leader, will gather general information about the agency to be used by the evaluation teams. Due July 31, 2007

• The Corrective Action Plan (CAP) Team will meet every Friday to assess reports from the evaluation teams.

• At the end of the project, the results will be shared in an agency-wide staff meeting. Plans to implement corrective actions will also be discussed.

The Plan

• Questionnaires will be distributed by E-mail to applicable employees on a staggered basis to distribute the workloads. A secure collection point will be created and operational by July 31, 2007. Mr. Hernandez will be responsible for creating a collection point.

The Plan

• Corrective Action Plan Team– Chief Deputy, Roberto

Clemente’– *Operations Chief, Gene Alley– Planner, Bob Robertson– OPS Team Leader, Doc Ellis– OPS Team Leader, Steve Blass

The Plan

• Evaluation Team Assignments– Control Environment (CE)

• *Chief Deputy, Clemente• Procurement Mgr., Hernandez• OPS Team Leader, Luke Walker• OPS Team Leader, Bob Moose

The Plan

• Evaluation Team Assignments– Risk Assessment (RA)

• *Research Analyst, Manny Sanguillen

• OPS Team Leader, Bruce Kison

The Plan

• Evaluation Team Assignments– Control Activities (CA)

• *VITA Liaison, Rennie Stennett• Fiscal Director, Dave Cash• OPS Team Leader, Richie

Hebner

The Plan

• Evaluation Team Assignments– Information and

Communications (IC)• *HRO Head, Bill Mazeroski• Chief Deputy, Clemente• OPS Team Leader, Mudcat

Grant

The Plan

• Evaluation Team Assignments– Monitoring (M)

• *Research Analyst, Sanguillen• OPS Team Leader, Bob Veale• OPS Chief, Stargell

The Plan

• Evaluation Team Assignments– Stage 2

• *Fiscal Director, Dave Cash• Accounting Mgr., Gene Clines• Staff Accountant, Vic Davalillo• OPS Team Leader, Dave Guisti• OPS Team Leader, Nelson

Briles

Rollout Schedule

Team OutReturn

CE 8-13 8-24RA 8-6 8-10CA 8-9 8-17IC 8-16 8-21M 8-21 8-

28

Preparation

• Steering Committee will provide the training on August 1,2007.

• All key players are required to read the ARMICS Directive and implementation Manual.

• Each Team must have all revisions to their questionnaires sent to Mr. Hebner a minimum of two days before their rollout date.

• August 1, 2007, meeting is set for the Ashland Cultural Arts Center, all day, working lunch provided.

Day One – August 1, 2007

• Mr. Murtaugh’s key points– Late start - Apologizes– Critical to State Government– Concentrated effort for a short period

of time– Extreme cooperation and honesty– If unsure – ASK !!!!– Timing is everything under tight

schedules– Need to cover for each other as

necessary– Weekly updates, direction, and

encouragement are provided by Mr. Murtaugh by e-mail and walk-arounds

Control Environment (CE)• Toughest schedule• All Employees (125)• Agency organization and structure

concerns because of increased travel and field work – Travel is equitably distributed among

staff and team leaders– Team rotation is adequate to keep job

duties fresh and minimize over familiarity with agencies.

– Team assignments are fair, equitable, and follow the agency policy.

– The agency team assignment policy is reasonable.

– Others

CE Progress

• 8-10-07 -- Questionnaire revisions completed and sent to Mr. Hebner

• 8-13-07 -- Mr. Hebner’s group revises the database and distributes the questionnaire to all employees

• 8-13 thru 8-24 -- questionnaires received are keyed to the DB each day

• 8-28 and 8-30 -- Team meetings to analyze results

CE Team Report: 9-5-07

• Summary: overall things are well controlled

• Weaknesses: – Responses indicate displeasure

with assignments and show concerns of favoritism regarding travel.

– No written code of ethics– Others

• Strengths:– Experienced management team

CAP Review: 9-7-07

• Accepted recommendations for CAP for all noted weaknesses except for personnel assignments

• Requested more information on agency policy for assigning personnel and travel rotations

CE Testing 9-7-07

• Completed designing tests to determine if internal controls are functioning as intended for items in survey with proper controls in place

• Development of tests took two days with the whole team working on them

CE Test Examples

• Purpose: Determine if employees know how to react ethically in a given situation.– Test: Develop 20 brief situational

examples and have 30 employees provide answers to these situations.

• Sample Questions: An employee takes office supplies for use at home because they occasionally do some work in the evening on their own time without compensation (FLSA Exempt).

• An employee does not bother to inform their supervisor about a small side business that he and his wife run out of their basement because it is unrelated to his job at work.

CE Test Examples - Continued

• Two employees conducting a field examination out of town for a week, take an hour exercise break in addition to lunch because that is what the people they are reviewing do as part of their routine.

• State and agency travel policies do not allow reimbursement for taxi tips while on travel status. All agency employees think this is unfair and include the tip in with the taxi fare since the cabbie provides them with a blank receipt.

• Others

CE Test examples - continued

• Purpose: Determine the frequency of management communications to employees regarding ethics.– Test: Do an electronic search on

documents containing the word “ethics” in the agency “chron file” or in the files of the Agency Head (Murtaugh) or the HRO Director, Mazeroski.

CE Test examples - continued

• Purpose: To determine if employees are evaluated (Annual Performance Evaluation) based on their ethical behavior in addition to their output criteria.– Test: Review a random sample of 30

EWPs and employee evaluations for the last review cycle and determine if ethical concepts are included in the EWP or the evaluation.

• Others….

CE Test Results

• No employee scored above a 15 (out of 20 questions) on the “Ethics exam” – Average score was 9.8. – Ethical training and guidance is

needed in the agency.

• No ethics communications from either the Agency Head or the HR Director in the last year. (Initial ratings for this in Questionnaire were 3 or 4)

• None of the 30 EWPs contained requirements to evaluate ethical behavior. – 2 evaluations mentioned ethical

activities of the employee – One positive and the other negative.

CE Processing

• Testing completed 9-18-07• CAP recommendations from testing

submitted to CAP Team on 9-19-07• Request for additional info from

original CAP submitted on 9-16-07• All CE CAP items approved with

revisions and submitted to Steering Committee 9-21-07

• All documentation compiled, organized, and submitted to steering committee on 9-25-07

• Reviewed and approved by Steering Committee 9-28-07

Weaknesses and CAP

• General ethical communication and guidance is weak at best.

– No code of ethics– No communications from the

top– Weak scores on agency

ethics exam

Weaknesses and CAP

• Corrective Action Plan (Ethics Guidance)– 12-31-07 Interim Code of Ethics

based on best practices

– 3-31-08 Final Code of Ethics based on Agency needs produced at Annual Strategic Planning Session in February

– Monthly Ethics Question included in Agency newsletter created by HRO –

• Analysis of answers included in following edition

Weaknesses and CAP

• Corrective Action Plan (Ethics Guidance)

– Initial direction provided by Agency Head Murtaugh at all-staff meeting to be held in December 2007

• Ethics memos to be distributed each Quarter from Murtaugh beginning January 2008

– Create new ethics exam and retest in September 2008

Weaknesses and CAP

• Ethical behavior is not encouraged by the annual evaluation process– No ethical evaluation criteria in

the EWPs tested

• Corrective Action Plan– Upcoming EWPs for the new

evaluation year will include at least one general and one specific ethical criteria

Weaknesses and CAP

• There is no formal job rotation and assignment policy. As a result the following can occur:– Burnout from excessive travel– Complacency from becoming too

familiar with customer operations– Inter-unit squabbling over choice

assignments (low Morale)– High turnover – vacancies –

overtime – increased costs to continually hire staff

Weaknesses and CAP

Corrective Action Plan (Job Rotation)

– Create a task force to create job rotation policy by June 30, 2008

• Research best practices, • Gather input from employees

– Devise an implementation plan to be effective September 30, 2008

Risk Assessment (RA)

• Short Section

• Management team and OPS Team Leaders only

• Addresses the use of Risk Assessment as a management tool and SWOT for evaluating Strategic Objectives

• No variations to questionnaire

• Will change dramatically during the 2nd year of implementation – Questionnaire will refer to the

ARMICS process (Completed) and not the current risk assessment process

RA Progress

• 8-02-07 Questionnaire sent to Mr. Hebner – no revisions

• 8-06-07 Mr. Hebner’s group revises the database and distributes the questionnaire to all employees

• 8-06 thru 8-10 questionnaires received are keyed to the DB each day

• 8-13 and 8-15 Team meetings to analyze results

RA Team Report: 8-16-07• Summary: Overall things are

well controlled• Weaknesses:

– Management does not routinely use the evaluation of risk in making business decisions

• Strengths:– Experienced management team

CAP Review: 8-17-07

• Accepted recommendations for CAP

• Forwarded CAP items to Steering Committee

RA Testing 8-(20 to 21)-07• Completed designing tests

to determine if internal controls are functioning as intended for items in survey with proper controls in place

RA Test Examples

• Purpose: Determine if the agency addresses risk as an entity as well as for individual functions.– Test: Review Agency’s last strategic

planning meeting (minutes, agenda, output, etc.) and determine if:

• Risks to the agency as a whole were addressed

• A SWOT analysis was completed for strategic objectives

RA Test examples - continued

• Purpose: Determine if opportunities and long range solutions are considered to mitigate risks as well as short range solutions– Test: Select the last two issues in

which risk was evaluated to see if long range opportunities were considered along with short term answers to the risk problem.

RA Test Results

• A risk analysis was performed to accompany the DPB annual budget submission

• No formal risk assessment process was used to address situations or risks encountered during the year

• The testing of recent projects confirmed the lack of using risk assessment as a management tool to address agency issues

RA Processing

• Testing completed 8-23-07• CAP recommendations from

testing submitted to CAP Team on 8-24-07

• All RA CAP items approved and submitted to Steering Committee 8-24-07



Weaknesses and CAP

• Risk Assessment is not used as a tool to manage agency operations and projects

• Corrective Action Plan– Require all agency plans, projects,

and operations to include risk management as part of their routine functions

– Carefully re-evaluate this section after ARMICS begins its second year to determine if the use of ARMICS has improved the agency’s perspective on risk analysis as a management tool

Control Activities (CA)

• Most questions but they are also the most direct and concrete

• Management Team and all OPS Team Leaders

• Since Systems are controlled by VITA – NG and there are no agency specific major applications (COTS – PC SW only); this is beyond any agency employee control. General assurances have been obtained from VITA that they have proper controls in this area. We will pursue obtaining copies of General control reviews from APA and other sources that evaluate VITA

• Questions revised to emphasize agency controllable activities like physical security and computer usage.

• Change controls and access controls are only directed at agency approval.

CA Progress

• 8-03-07 Questionnaire revisions completed and sent to Mr. Hebner



• 8-20 through 8-22 Team meetings to analyze results

CA Team Report: 8-22-07• Summary: Overall things are

well controlled

• Weaknesses: – Scattered, old, and weak process

flow documentation– No Divisional accounting process

P&P– Others

• Strengths:– Automation of Accounting Controls

where applicable

CAP Review: 8-24-07

• Accepted recommendations for CAP for all noted weaknesses

CA Testing 8-(27 to 29)-07• Completed designing tests

to determine if internal controls are functioning as intended for items in the survey with proper controls in place

CA Test Examples

• Purpose: To determine if accounting processes are complete, accurate, current, and effective– Test: Obtain the most recent copy of

the agency accounting P&P to determine:

• Is enough detail provided to ensure the process can be understood?

• Does P&P addresses all fiscal processes?

• Are manuals or applicable portions thereof distributed to all personnel who need access?

• Is finance office using the most recent version of CAPP Manual?

CA Test examples - continued

• Purpose: Determine if the agency has an ethical computing policy and if it is enforced– Test: Obtain a copy of the

policy and develop tests to determine if each attribute of the policy is being enforced.

CA Test Results

• Not all division personnel were using the most recent version of agency accounting P&P and were not aware that all of the policies were kept on the Agency LAN

• Some parts of the P&P were based on sections of the CAPP that have been rescinded or revised

• No active enforcement of the ethical computing policy for unauthorized use. – Five computers were used to prepare tax

returns for multiple persons including spreadsheets to show those persons paid the employee to do those returns. Using agency resources to benefit a private business.

CA Processing

• Testing completed 8-29-07• CAP recommendations from

testing submitted to CAP Team on 8-31-07

• All CAP items approved and submitted to Steering Committee 9-6-07



Weaknesses and CAP

• Accounting P&P need improvement– Out of date– Too generalized

• Corrective Action Plan– 9-30-2008, Use Stage two

information to update significant fiscal process P&P and process flows

– 6-30-2009, Update the remaining P&P and process flows

– Incorporate new processes as needed

Weaknesses and CAP

• Insufficient direction is provided to non-fiscal office personnel who have an impact on fiscal processes– Travel authorizations and approvals– Purchasing approvals– Initial coding– Etc.

• Corrective Action Plan– Develop a fiscal user manual tailored to

the specific needs of division personnel who interact with the fiscal office to ensure faster and more accurate throughput of fiscal transactions

Weaknesses and CAP

• There is an official computer usage agreement that employees are required to sign BUT there are no procedures to enforce the policy:– 5 instances of personal business use

for profit were identified from testing– 10 examples of questionable usage

activity– 15 instances of unauthorized software

of which five probably constitute software piracy

– 1 example of excessive use of state time on non-business web sites of over five hours in one day

• Corrective Action Plan– Develop a program of random testing

to ensue enforcement of agency policy

Information and Communication (IC)

• Smaller component compared with others

• Fast-track approach

• Questionnaires will be sent to all employees

• Add State Hotline questions:– Is it an effective deterrent?– Is it truly anonymous?– Are investigations adequate?

IC Progress

• 8-14-07 Questionnaire revisions completed and sent to Mr. Hebner




IC Questionnaire Results

• Summary: Overall things are well controlled

• Weaknesses: – Some sensitive information

that was disseminated should have been redacted

• Strengths:– Quick dissemination of

information

IC Testing

• Draft tests were designed in mid-August and finalized on August 25th after input from questionnaires was received

• Testing was done on August 28th and 29th

• Results of Testing finalized on August 30th

IC Test Examples

• Purpose: Determine if employees are receiving enough information to adequately perform their duties– Test: Randomly select 5 management

and 15 staff (field) employees and conduct interviews to determine if:

• Information flow is adequate• Information is received on a timely

basis• Dissemination of information is done

as efficiently as possible• There is a process to ensure that

dissemination of sensitive or classified information is handled appropriately

IC Test examples - continued• Purpose: Determine if audit findings

are discussed with all appropriate personnel to ensure all players have input to corrective action plans

• Test: – Obtain copies of the last two APA

audits and the last two internal audits (If applicable) plus any other audits or reviews (DGS, JLARC, Federal agency, etc.) received in the last year.

– Review all findings and management letter comments

– Contact all persons connected with the process deficiency (Management and staff) and interview them to determine what part they had in providing input to the solution of the issue

IC Test Results

• Not all applicable personnel were consulted in resolving audit issues

• In one instance, a team leader was using a form they developed to ensure Personal vehicle mileage at the higher rate was appropriately justified – The agency was cited in a

decentralized records review two years in a row for inadequate justification of POV mileage

– No team leaders were consulted for potential solutions to this finding

CAP Review: 8-31-07

• Accepted recommendations for CAP for all noted weaknesses

IC Processing

• Testing completed 8-30-07

• CAP recommendations from testing submitted to CAP Team on 8-31-07

• All CAP items approved and submitted to Steering Committee 9-4-07



Weaknesses and CAP

• Sensitive information (Agency information on private companies’ processes) was inadvertently disseminated in a review report

• Corrective Action Plan– 10-31-2007, Include a step in the

report review process to examine content for sensitive or classified information that should not be disclosed to the general public (all agency reports are public information)

Weaknesses and CAP

• Audit and review findings were not communicated to all parties involved. As a result one instance was found that a solution was already in place for one unit that could have been applied to others to quickly address an audit finding

• Corrective Action Plan– The individual(s) with auditor liaison

responsibilities should ensure that all employees whose duties relate to a finding are involved in determining solutions to findings.

– NOTE: OPS Team Leaders may substitute for issues affecting field reviews after obtaining information from their respective teams

Monitoring (M)

• Shortest section

• Send questionnaire out to all employees

• No Questionnaire revisions

M Progress

• 8-18-07 Questionnaire sent to Mr. Hebner with Okay to distribute

• 8-21-07 Mr. Hebner’s group distributes the questionnaire to all employees



M Questionnaire Results

• Summary: overall things are well controlled

• Weaknesses:

– None Noted

• Strengths:

– Fiscal monitoring by independent source – DOA (Quarterly Report data)

M Testing

• Draft tests designed August 21st – 25th and finalized on August 28th after input from questionnaires was received

• Testing was done on the 29th and 30th of August

• Results of Testing finalized on August 31th

M Test Examples

• Purpose: Determine the accuracy and validity of Agency performance measures.– Test: Compile a list of all

performance measures (prompt pay, travel reimbursement timing, review reports/team/year, etc.) and determine:

• Is reported data accurate (recalculate – test basis)

• Is the measurement data clean (contains no improperly allocated costs)

• Is the measurement process valid (no improper assumptions or missing data)

M Test Results

• No issues identified from testing

CAP Review: 8-31-07

• Submitted report to CAP Team that no items requiring a corrective action plan were noted

M Processing

• Testing completed 8-30-07

• Report to CAP Team on 8-31-07

• Report to Steering Committee 8-31-07


• Reviewed by Steering Committee 9-6-07

Steering Committee Review• The review of this component

failed to evaluate the performance measures reported to DPB as part of the annual budgeting process

• The Monitoring team should include additional tests for the performance measures 1 and 3 in the Strategic Plan as reported to DPB in the Budget that were not covered in the original review

M Final Processes

• Additional areas tested on September 10, 11, and 12, 2007

• No deficiencies identified• Additional working papers

submitted to Steering Committee for review on 9-14, 2007

• Steering Committee completed review of Monitoring team work on 9-16-2007

• Steering Committee approves additional work with no deficiencies.

Corrective Action Plan (CAP) Team• Compile CAP actions as approved and

key into matrix (Excel or Access) with all of DOA required criteria

• Develop regular reports.– By due dates– By importance (Priority/ranking)

• Report progress on each item to Steering Committee quarterly beginning 12-31-07

• Assemble a team to test each completed corrective action before it has final approval as completed. Document all testing.

• Final submission of all weaknesses and status to DOA as required in ARMICS Manual

Steering Committee Duties• Prioritize weaknesses• Work with Agency Head (Murtaugh) for

final submission to DOA• Other Activities

– Quality Assurance review of documentation

– Recommendations for next year’s process (add 12 questions, delete 8 questions, modify 15 questions)

– 3 suggestions on how to improve documentation and 4 better ways to test

– General procedural recommendations:• Rotate assignments for OPS team leaders• Start earlier• Identify system changes during the year

and put into file for next ARMICS processing

References The Comptroller’s

Directive and Agency Risk Management & Internal Control Standards are available from

http://www.doa.virginia.gov/Financial_Reporting/ARMICS/ARMICS_Main.cfm

Contacts

804-225-4366 – voice804-225-4250 – [email protected]

[email protected]

Commonwealth of Virginia Department of Accounts

Documents

steering team

hernandezops team leader

richies team

bob robertsonops team

doc ellisops team leader

luke walkerops team

agency field operations

fictitious agency