Model Audit
Management System
A System to Strengthen the Audit Management Ability of EPA Managers
-------
Foreword
EPA's Model Audit Management System
A Tool to Strengthen the Audit Management Ability of EPA
Managers
The Agency makes significant investments of time and money in
audits. Top management is committed to ensuring that EPA
managers take complete advantage of this commitment and cap-
ture the benefits that are returned from this investment.
EPA spends five billion dollars a year to protect the environment.
A large portion of this money is allotted to states, municipalities,
and private firms in support of EPA efforts. It is a large task to
monitor the funds spent and ensure that they are spent appropriate-
ly. As EPA continues to face a limited availability of resources to
accomplish its goals, audits become more important as manage-
ment tools.
The audit can help EPA managers improve the management of
their programs. To receive the benefits that the audit process can
produce, the Agency must develop positive working relationships
between EPA managers and auditors.
EPA managers must understand the audit process and work within
the Model Audit Management System if the full benefits of the
audit are to be realized. The audit process can help improve Agen-
cy management and should be approached with this goal in mind.
The following pages highlight the main features of EPA's Model
Audit Management System and tell how it will help all Agency
managers make use of the audit process.
-------
Table of Contents
I. Introduction 1
II. Scope of the Model 3
A. Personnel included in the Model Audit Management
System 3
B. Audits covered by the Model 3
C. Time frame covered by the Model 3
III. Components of the Model Audit Management System .. .5
A. Roles and responsibilities 5
B. Communication channels 10
C. Corrective Action Tracking System 11
D. Relationship of the Model to EPA audit policies 12
Appendix A — Early Warning System
Appendix B — Audit resolution directives
-------
I. Introduction
Audits are an Important Management Tool
Each year, numerous audits are performed on the various
programs, activities, and functions of the Environmental Protec-
tion Agency (EPA). These audits are performed by the EPA Of-
fice of the Inspector General (OIG), the U.S. General Accounting
Office (GAO), and commercial audit firms.
These audits often attract the attention of Congress, the public, and
the media. Since these audits identify areas that need improve-
ment within the Agency, external parties often use the results of
these audits to point out deficiencies in Agency performance.
Although audits are often viewed in a negative manner, EPA
management firmly believes that audits can be used in positive
ways to help further the goals of the Agency. Audits can help im-
prove the effectiveness of Agency programs and lead to cost
savings. Audits are an important management tool and can
provide the Agency with valuable information.
EPA's Model Audit Management System... What it is
EPA developed a "Model Audit Management System" to improve
the Agency's use of audits as a positive management tool. The
Model Audit Management System will:
• Enhance EPA's ability to "manage" an audit issue;
• Help all EPA managers respond effectively and ap-
propriately to audits;
• Ensure the timely and appropriate resolution of audits;
and
• Keep senior management informed about sensitive or
significant audit issues.
The Model Audit Management System highlights and recom-
mends three components:
• Organization and staffing for audit resolution, including
the roles and responsibilities of the Agency personnel in-
volved with the audit process;
-------
/. Introduction
m Communication channels among offices to better iden-
tify and respond to emerging audit issues; and
• Corrective action tracking to allow Agency management
to monitor the implementation of corrective actions and
identify systemic weaknesses in programmatic and ad-
ministrative areas.
The recommended components of the Model Audit Management
System have been constructed from the conclusions and recom-
mendations presented in three previous reports for the EPA project
entitled "Strengthening the Audit Management Ability of EPA
Managers." These reports are:
• "Review of the Audit Resolution Process and Assess-
ment of the Follow-Up System;"
• "Approaches to Develop an Early Warning System for
the Audit Management Process;" and
• "Developing a Corrective Action Tracking System."
The Model Audit Management System reflects the views and ex-
periences of Agency management and auditors regarding the audit
process.
-------
n. Scope of the Model
A. Personnel included in the Model Audit
Management System
EPA developed the Model Audit Management System to improve
the Agency's audit management process. The model will help all
managers use the audit as a positive management tool. Senior EPA
officials, managers, and all Agency personnel involved with audits
are covered by the model
The success of this model is contingent upon the cooperation of
both EPA managers and the auditors. EPA management, the OIG,
and the GAO have cooperated in structuring the model and com-
mitting to its implementation. All parties must cooperate and
work within the model to allow the Agency to improve its audit
management capabilities.
B. Audits covered by the Model
The concepts presented in the Model Audit Management System
apply generally to any audit of an EPA program, activity, or func-
tion—including audits performed by the OIG, GAO and commer-
cial audit firms. However, the model emphasizes the management
of OIG internal audits and external audlis performed on grants and
cooperative agreements.
This emphasis exists because OIG external audits are often the
most contentious—due to conflicts with external parties and the
large dollars involved—and OIG internal audits are usually very
visible and can require considerable management time and atten-
tion.
C. Time frame covered by the Model
The Model Audit Management System covers the entire audit
process—the time period before the audit, during the audit,
through audit resolution, and the implementation of corrective ac-
tions.
The capability for successful and timely audit resolution must exist
before any audit begins. After an audit begins, Agency managers
and staff should devote appropriate attention to the audit process
and work towards a cooperative and effective resolution. Correc-
-------
//. Scope of the Model
live actions should be well-planned and implemented in a timely
manner.
The guiding philosophy and components of the Model Audit
Management System should be integrated with the daily activities
of EPA management. Weaknesses in Agency programs and ac-
tivities should be identified and continually addressed whether or
not an audit is being conducted.
-------
Components of the Model Audit Management
System
The Model Audit Management System consists of roles and
responsibilities, communication channels, and a corrective action
tracking system to monitor the implementation of corrective ac-
tions. These components of the Model help guide the audit process
within EPA and promote timely and appropriate audit resolution.
A. Roles and responsibilities
There are a number of key individuals who play important roles in
the Model Audit Management System. The roles and respon-
sibilities of these individuals as they relate to the audit resolution
process are defined in EPA Order 2750. However, these key in-
dividuals have additional responsibilities within the Model.
The following paragraphs describe the additional responsibilities
of these individuals within the Model.
1. Agency Follow-up Official
The Assistant Administrator for Administration and Resources
Management is the Agency Follow-up Official. This official is
responsible for Agency-wide audit resolution and implementation
of corrective actions.
In addition to the responsibilities assigned in EPA Order 2750, the
Official should:
• Coordinate Agency-wide policy issues with the OIG;
• Inform senior EPA officials of sensitive and significant
audit issues so that they give appropriate consideration
to those issues; and
• Ensure that audit resolution occurs in a timely and effec-
tive manner.
2. Agency Audit Follow-up Coordinator — Resource
Management Division
The Agency Audit Follow-up Coordinator reports to the Agency
Follow-up Official. The Agency Audit Follow-up Coordinator:
-------
///. Components of the Model Audit Management System
• Obtains audit planning information from the audit agen-
cies and distributes relevant information to the ap-
propriate audit follow-up coordinators in the regional
offices, headquarters program offices, and laboratories;
• Obtains from the OIG periodic listings of the OIG's
"List of Potentially Significant Audits in Process," sum-
maries of Flash Reports, and information on Special
Reviews, and prepares reports on audits with sensitive or
significant audit issues for the Agency Follow-up Offi-
cial;
• Receives from regional and headquarters program office
audit follow-up coordinators all GAO and OIG internal
audit reports and OIG external audit reports with sensi-
tive or significant audit findings, and evaluates them to
identify systemic problems that extend across program
areas or regions and which would otherwise not be iden-
tified individually;
• Disseminates early warning audit information to audit
follow-up coordinators and the Agency Foltow-up Offi-
cial based on audit plans, audit reports, and other infor-
mation supplied by the OIG;
• Compiles audit follow-up information submitted from
the regional offices, headquarters program offices, and
laboratories for EPA headquarters management review;
and
• Prepares reports on audit resolution requested by Agen-
cy management or any other external panics.
3. Action Officials
Action Officials are either the respective Regional Administrators
or Assistant Administrators, or their designees.
• For internal audits addressed to a region, the OIG will
send the report to the Assisant Regional Administrator
for Policy and Management or the RA, depending on sig-
nificance. For internal audits addressed to Headquarters,
the OIG will send the report to the AA or an appropriate
-------
///. Components of the Model Audit Management System
office director, depending on significance. The response
back to the OIG should be from the Action Official
named in the report
• For external audits, the OIG will send the report to an ap-
propriate Action Official based on general agreement
with the RA/AA.
The Action Officials ensure that managers and staff within their or-
ganizations understand the audit process, cooperate with the
auditors, and work toward timely and effective audit resolution. In
addition, the Action Official ensures the quality of all audit respon-
ses, regardless of which EPA personnel may prepare the responses.
In addition to the responsibilities assigned in EPA Order 2750, the
Action Officials should:
• Encourage managers to identify and seek solutions to
weaknesses and problems before they become audit is-
sues;
• Ensure that EPA personnel cooperate with the auditors
and provide them with the information requested;
• Respond to sensitive and significant audit findings that
are identified, and notify the Agency Audit Follow-up
Coordinator and senior EPA officials of potentially
newsworthy issues, if deemed necessary;
• Obtain annual audit plans from the OIG;
• Receive draft audit reports from the auditors;
• Direct distribution of copies of the final report to ap-
propriate Agency personnel; and
• Focus attention on the timely and effective resolution of
audits.
4. Audit follow-up coordinators
The audit follow-up coordinators are designated by the Action Of-
ficials.
-------
///. Components of the Model Audit Management System
• In the regional offices, the audit follow-up coordinator
reports to the Assistant Regional Administrator for
Policy and Management.
• In all other reporting units, the audit follow-up coor-
dinator is located within a management division.
The audit follow-up coordinators have lead responsibility relating
to the overall audit process within their organizations. The coor-
dinators help prepare responses to audit reports, where appropriate,
and exercise close oversight over the quality and timeliness of
audit responses prepared by other EPA personnel. In preparing
audit responses, the coordinators articulate the region's position on
the audit in a manner that is responsive to the audit findings and
recommendations and, at the same time, represents the Agency's
position in a positive manner.
In addition to the responsibilities assigned in EPA Order 2750, the
audit follow-up coordinators should:
• Review the audit plans received by their Action Official
and alert the appropriate managers within their organiza-
tions to the potential for an audit;
• Serve as the initial contact point when an audit organiza-
tion announces an audit;
• Arrange for the entrance conference, notifying the ap-
propriate managers, providing a meeting room, and
preparing background materials on the audit process for
those who need it;
• Work with the auditors to provide them with required
working space, notify managers of any special requests,
and compile a list of Agency and audit personnel who
will be involved with the audit;
• Open channels of communication in other organizations
within the regions or Headquarters in cooperation with
the auditors;
• Meet with managers and auditors at any progress meet-
ings that are held during the audit;
8
-------
///. Components of the Model Audit Management System
• Relay to the Agency Audit Follow-up Coordinator,
through the Action Official, any early warning informa-
tion;
• Distribute copies of draft audit reports from the auditors
to the appropriate Agency personnel and provide
guidance in how to construct an appropriate response to
the report;
• Make arrangements for the exit conference, inviting the
appropriate people to attend and providing them back-
ground information about what will be covered in the
meeting;
• Distribute copies of the final report to the appropriate
Agency personnel and provide guidance in how to con-
struct an appropriate response to the report;
• Monitor the progress of audit resolution and alert their
Action Official to any problems that may arise; and
• Track the progress of corrective actions and provide the
Agency Audit Follow-up Coordinator, through the Ac-
tion Official, with required quarterly reports.
5. Staffing and skills
EPA management must devote to the roles described above a level
of staffing, with sufficient skills and knowledge, that can ac-
complish the objectives of the Model Audit Management System.
Background in an appropriate subject area—such as accounting or
auditing—is helpful for Audit Followup Coordinators. Managers
should develop these skills for persons involved in the audit
process.
In addition, managers must provide positive incentives for the
timely and effective resolution of audits and for the implementa-
tion of corrective actions. Senior management must provide posi-
tive motivation for their staff to devote adequate time and attention
to the audit process.
Finally, audit management must be a continuous effort targeted for
quick response by all Agency personnel. Managers who are faced
-------
///. Components of the Model Audit Management System
with an audit management task must be allocated the time and
resources that are necessary to complete the task effectively.
Audit management cannot be viewed as an "add-on" assignment
that is performed after "normal" management tasks are completed;
rather, audit management must be an integral part of a manager's
duties.
B. Communication channels
Communication between all parties involved in the audit is impor-
tant throughout the audit process. Information exchanged between
the Agency staff, the auditors, and Agency officials can increase
the value of the audit For example, by improving the under-
standing of program policies, potential findings, and preliminary
recommendations, the audit process can proceed smoothly and the
benefits can be implemented more quickly.
Channels of communication should be maintained among the audit
organizations, the audit follow-up coordinators in the regional of-
fices and headquarters offices, and the Agency Audit Follow-up
Coordinator in RMD.
• EPA management should obtain from the OIG and GAO the in-
formation that would help the Agency manage all audits performed
in EPA. The Agency Audit Follow-up Coordinator should receive,
summarize, and transmit to other audit follow-up coordinators the
information obtained from audit organizations. This information
would include annual audit plans and the listings of new audits in-
itiated.
• The auditors should communicate the scope and purpose of
their audit to the Agency personnel in order to allow the personnel
to provide the auditors with the information they need.
• Agency staff must work with their audit follow-up coordinators
to better understand the audit process and their roles and respon-
sibilities within that process.
• Agency managers must follow the procedures to alert senior offi-
cials in regional and headquarters offices to the presence of or
potential for sensitive or significant audit findings or audit reports.
These procedures formalize the reporting relationships that current-
10
-------
///. Components of the Model Audit Management System
ly exist within the Agency and establish an "Early Warning Sys-
tem" for audit management.
• Audit follow-up coordinators in the regional offices and head-
quarters offices should review all audit reports for their respective
organizations and forward sensitive or significant issues to their
Action Official The Action Official can forward the information
to the Agency Audit Follow-up Coordinator, if deemed necessary.
The Agency Audit Follow-up Coordinator can collect and analyze
the audit information it receives from the audit follow-up coor-
dinators throughout the Agency and disseminate the information
that could prove helpful to the audit management efforts. (A more
detailed discussion of the "Early Warning System" concept for
audit management is presented in Appendix A of this paper.)
C. Corrective Action Tracking System
The Corrective Action Tracking System is a centralized system to
monitor and manage the implementation of corrective actions re-
quired to redress weaknesses identified during audits. The system
provides the EPA with a management tool to use in the audit
process, rather than a system that is an error identification and cor-
rection mechanism.
The Corrective Action Tracking System allows EPA to:
• Enhance the Agency's audit management capability and
assist in the formulation of Agency-wide policy by
providing management information to identify recurrent
operational problems and innovative and successful ap-
proaches to corrective action implementation;
• Reconcile data to companion systems in the Office of
the Inspector General (OIG), Financial Management
Division (FMD), Grants Administration Division (GAD)
and Office of the General Counsel (OGC);
• Improve status reporting by tracking the progress of cor-
rective action implementation;
• Retain historical data for future reporting needs;
11
-------
///. Components of the Model Audit Management System
• Maintain an official Agency record of corrective action
status; and
• Remain responsive to legislative demands, such as the in-
formation processing and consolidation that would be re-
quired under S.908 or other legislation.
The system allows regional offices and headquarters offices to:
• Analyze the progress of and the keys to successful cor-
rective action implementation;
• Make maximum use of existing resources, information,
and reporting structures and build upon the current cor-
rective action process;
• Retain historical data for trend analysis and reporting;
and
• Reduce the time and effort necessary to respond to head-
quarters inquiries and reporting requirements.
Beyond reporting requirements, EPA management at all levels can
use the tracking system to analyze the quality as well as quantity
of "resolved" audits.
D. Relationship of the Model to EPA audit policies
The Model Audit Management System was designed to operate
within the requirements established by existing EPA audit policies.
These audit policies are contained in directives issued by Con-
gress, OMB and EPA. A summary of the relevant directives is
provided in Appendix B of this paper.
12
-------
Appendix A — Early Warning System
A. Current audit communication channels
The OIG has established procedures through which it notifies EPA
management of significant findings identified in an ongoing audit.
According to the OIG Manual,
The following situations would require such notification:
a. Survey reports which confirm a major national problem.
b. Pilot audit reports which involve large dollars, major
system deficiencies, or major differences of opinion be-
tween OIG and program management.
c. Multidivisional audits which confirm significant results.
d. External audits by EPA staff which involve very large
and unusual issues which would merit top management
attention while underway.
Flash reports and briefings are used to alert EPA management to
significant audit findings and provide recommendations to address
those findings. The OIG Manual states:
Flash reports will generally be used to notify EPA top
management in writing that significant issues have been
identified and confirmed. Flash reports are appropriate for
use when a situation exists which requires EPA top manage-
ment to take immediate corrective action—Briefings are ap-
propriate when the situation requires an open discussion
with EPA top management.
Aside from the information conveyed to EPA officials through
OIG flash reports and briefings, however, there has been no formal
"system" for Agency personnel to alert senior EPA officials to the
potential for or existence of audits (performed by the OIG or the
GAO) that may contain sensitive or significant findings.
It has been incumbent upon lower- and middle-level Agency
managers to alert senior officials to emerging audit issues that re-
quire senior management attention. These lower- and middle-level
Agency managers needed to rely upon their personal judgment
-------
Appendix A—Early Warning System
when deciding whether to inform senior management of the poten-
tial for or existence of a sensitive or significant audit finding.
The process to elevate an audit issue through successive levels of
management has worked well with most audits. However, infor-
mation pertaining to audit findings is not always transmitted quick-
ly enough or sometimes fails to reach all the parties that could be
affected by the disclosure of those findings, either within the Agen-
cy or with the public.
Although audits involving highly sensitive issues are encountered
relatively infrequently—possibly two or three annually—these
audits require a large investment of management time and atten-
tion to address the sensitive issues. In addition, the inability of the
Agency to respond quickly to the audit findings can lead to public
criticism and embarrassment for EPA. Senior officials should al-
ways be informed about sensitive findings in a timely manner, so
their ability to take a proactive approach to the management of
such findings is not restricted.
B. Improvements to the audit communication
channels
To improve the communication concerning sensitive and sig-
nificant audit findings, the Model Audit Management System in-
cludes additional reporting procedures to enhance the audit
information flow between the auditors, Agency managers, and
senior EPA officials.
The Agency audit communication network consists of four com-
ponents:
• Objectives that the system is .utended to achieve;
• Criteria that define "significant" audit findings/reports
and "sensitive" audit situations;
• Agreements between the auditing organizations and the
Agency to share the necessary audit information; and
• Reporting procedures for Agency managers to follow to
forward the appropriate audit information to senior offi-
cials.
it
-------
Appendix A —Early Warning System
These components collectively provide Agency officials with an
"Early Warning System" that will communicate important audit in-
formation. These components of the Early Warning System are dis-
cussed below.
1. Statement of objectives
Early warning procedures are meant to improve the flow of audit
information in the Agency and help the Agency respond more ef-
fectively to significant audit findings. The early warning network
is not intended as a means for senior officials to "look over the
shoulders" of Agency managers or "monitor" the managers'
ability to respond to an audit. The Early Warning System:
• Draws senior management attention to sensitive and sig-
nificant audit findings and audit reports;
• Enables the Agency to develop responses to significant
audit findings and take corrective actions early in the
audit process; and
• Informs Senior officials of the progress of corrective ac-
tions in order to allow them to respond effectively to
public inquiries concerning a sensitive audit.
2. Criteria to identify "significant" audit findings/reports
and "sensitive" audit situations
The model audit management system establishes a number of
criteria to help managers determine when they should inform a
senior official of an audit finding or report. These criteria can be
modified or enhanced according to the reporting requirements of
individual regional offices or headquarters program offices, as
well as to meet the needs of the headquarters administration.
Specific criteria used to define a "significant" or "sensitive" audit
finding or report include the following situations:
• An audit results in questioned costs (Federal share) of
$100,000 or more.
• An audit results in questioned costs (Federal share) total-
ing over 50 percent of the grant.
ui
-------
Appendix A —Early Warning System
• A new program is audited for the first time.
• The audit is conducted just prior to OMB budget review,
Congressional appropriations hearings, or legislative re-
authorization.
• The program audited has recently been extensively
covered in the media or has attracted substantial atten-
tion from Congress.
• A program is re-audited to determine if previous audit
findings have been addressed and corrective actions
taken.
• The activities of a program have an immediate effect
upon public health, or that is the perception of the
public—e.g., asbestos removal, hazardous waste cleanup.
• Large expenditures of funds are involved in the program
audited and cost controls are known to need improve-
ment.
Agency managers should be informed that, if these criteria apply
to an audit, the senior officials should be notified. Agency report-
ing requirements established under the Early Warning System
should be followed in these circumstances.
3. Audit information transfer between the auditing
organizations and the Agency
EPA management has established agreements with the OIG and
GAO to obtain the information to help the Agency implement this
Early Warning System.
The Agency Audit Follow-up Coordinator will obtain information
pertaining to audits planned, ongoing audits that are identified by
the auditing organization as sensitive or significant, or audits com-
pleted that may have implications for Agency-wide policy.
Specifically, the Agency Audit Follow-up Coordinator will obtain
the following items from the OIG:
• Annual audit plans.
IV
-------
Appendix A —Early Warning System
• Quarterly updates of the annual audit plans.
• Periodic listings of new audits initiated.
• List of audits in process that may contain significant or
sensitive issues..
• Notification of and information on Flash Reports.
• Information on Special Reviews on a case-by-case basis,
as deemed appropriate by the OIG.
The Agency Audit Follow-up Coordinator is responsible to meet
with GAO officials on a periodic basis to discuss the potential
areas for audit and determine what audit issues the Congress may
consider sensitive or significant.
To ensure that all regional offices and headquarters program of-
fices receive the necessary audit information, the Agency Audit
Follow-up Coordinator receives, summarizes, and transmits to
other office audit follow-up coordinators the information obtained
from the audit organizations.
Based on the information obtained from the written materials, the
Agency Audit Follow-up Coordinator will identify the potential
for or existence of audit findings or reports that warrant the atten-
tion of senior EPA officials. When the Agency Audit Follow-up
Coordinator has questions about the audit, the coordinator will dis-
cuss these with the Action Official or his designee.
On a regular basis (e.g., monthly) the Agency Audit Follow-up
Coordinator should transmit to the designated Agency officials a
summary of potential or actual audit findings containing sensitive
or significant issues. This communication is intended to keep
senior EPA officials throughout the Agency informed about sig-
nificant audits and to help them respond effectively to developing
audit issues.
4. Reporting procedures
The audit information under the early warning system flows
through three primary channels within the Agency:
-------
Appendix A — Early Warning System
• The existing management reporting relationships
(OIG/GAO - regional/program management - RA/AA -
EPA Administrator);
• Early warning reporting incorporating audit follow-up
coordinators in each regional office and headquarters
program office (OIG/GAO - regional/program office
audit follow-up coordinator - RA/AA - Agency Audit
Follow-up Coordinator - EPA Administrator); and
• Early warning to transmit audit information between
headquarters and regional offices (OIG/GAO - Agency
Audit Follow-up Coordinator - regional/program office
audit follow-up coordinators).
These three communication and reporting channels are described
in the sections that follow.
• Existing management reporting relationships. The existing
management reporting relationships within the Agency will con-
tinue to operate within the scope of the Early Warning System.
Both formal and informal communication among all levels of
management will need to continue. Based on the program
manager's assessment of the audit situation, that manager will
decide when it is appropriate to forward audit information to
higher management. The criteria clarifying sensitive and sig-
nificant audit findings help the manager decide when to elevate an
audit issue.
The existing management reporting relationships dictate that the
program manager will forward the audit information to senior
management within the appropriate office. If the audit is con-
ducted within a regional office, the RA may be notified. If the
audit is conducted within a headquarters office, the AA may be
notified. If the issue warrants more senior attention, the EPA Ad-
ministrator may be notified. The senior officials should be in-
formed of the status of the audit, the sensitive or significant issues
involved, and any corrective actions taken or proposed.
• Early warning reporting procedures incorporating audit follow-
up coordinators. Audit Followup Coordinators should review
their organizations' draft and final internal audit reports, external
audits with significant findings, and any progress reports supplied
VI
-------
Appendix A — Early Warning System
by program managers. Using these reports, the coordinators deter-
mine the potential for or existence of sensitive or significant issues
and forward these issues to the RA/AA.
Having the audit follow-up coordinator responsible for Agency-
wide audit information establishes a new communication channel
in the audit management process. The Agency Audit Follow-up
Coordinator serves as a central audit information review point at
which certain audit findings and reports can be evaluated to iden-
tify the potential for or existence of audit issues that could have im-
plications for Agency-wide policy.
Audit Followup Coordinators will send to the Agency Audit Fol-
lowup Coordinator, through the RA/AA (or designee), all draft and
final internal audits. As appropriate, the RA/AA should forward
these reports with a summary of the potential policy implications
identified by the senior official. By allowing the Agency Audit
Follow-up Coordinator to review all GAO and OIG internal audit
reports, regardless of whether the RA/AA believes it contains sen-
sitive or significant findings, the Agency should increase its ability
to identify systemic problems that extend across programs or
regions and which would otherwise not be identified by an in-
dividual RA or AA.
Due to the large volume of OIG external audits, the same review
procedure would not be practical for the Agency Audit Follow-up
Coordinator. Therefore, OIG external draft and final audit reports
will be reviewed by the regional office or headquarters program of-
fice audit follow-up coordinator to determine the potential for or
existence of sensitive or significant audit findings.
Using the early warning criteria for "significant" or "sensitive"
findings established by the Agency Audit Follow-up Coordinator,
the regional office or headquarters program office audit follow-up
coordinator will review the OIG external audit reports and forward
the relevant audit issues to the Agency Audit Follow-up Coor-
dinator. As the Agency Audit Follow-up Coordinator receives in-
formation about the external audit findings, the appropriate audit
information will be forwarded to senior EPA management as
necessary.
vu
-------
Appendix A — Early Warning System
• Early warning procedures to transmit audit information from
headquarters (RMD) to regional offices and headquarters
program offices. The early warning procedures to transmit audit
information from the Agency Audit Follow-up Coordinator to the
regional offices and headquarters program offices represents a new
communication channel created within the Early Warning System.
As the potential for or existence of sensitive or significant audit
findings is identified by the Agency Audit Follow-up Coordinator,
the Coordinator will forward the information to the audit follow-
up coordinators in the appropriate regional offices and head-
quarters program offices.
No matter how sophisticated the Early Warning System used in
the audit management process, senior EPA officials will need to
continue to rely upon open communication among all levels of
management and the proper attention of program managers to the
audit process in order to respond effectively to sensitive and sig-
nificant audit findings. In addition, Agency officials will need to
work closely with OIG and GAO officials to ensure that open com-
munication exist between the program managers and auditors.
The effectiveness of the Early Warning System will be influenced
heavily by the quality and timeliness of information exchanged be-
tween program managers and audit managers.
Vlll
-------
Appendix B —Audit resolution directives
A number of policies govern the audit process within EPA. These
policies are implemented through directives issued by Congress,
OMB, and the Agency. EPA's Model Audit Management System
incorporates the guidance provided by the directives summarized
below.
A. OMB Circular A-50
OMB Circular A-50 provides the policies and procedures for agen-
cies to follow for audit resolution. OMB Circular A-50 defines
"resolution" as: "For most audits, the point at which the audit or-
ganization and Agency management or contracting officials agree
on action to be taken on reported findings and recommendations."
The Circular specifies the roles of audit follow-up officials and the
Inspectors General and establishes procedures for audit resolution.
Circular A-50 also requires the establishment of a system to
monitor and to track the progress of corrective actions, the im-
plementation of audit recommendations, and the documentation of
improved accounting and collection controls.
Agencies are required to assign high priority to audit resolution
and corrective action via: the appointment of top-level personnel
to the audit resolution process; the establishment of specific
criteria with milestones to ensure timeliness of audit resolution;
and the structuring of a periodic evaluation of audit recommenda-
tions to identify and redress any problems endemic to the current
audit follow-up system. OMB Circular A-50 specifies that audit
resolution shall be made within a maximum of six months after is-
suance of a final audit report.
B. OMB Circular A-128
OMB Circular A-128, in response to the Single Audit Act of 1984,
requires audits for all major programs with expenditures totalling
more than $300,000 or 3% of federal expenditures, whichever is
greater. Governments receiving less than $25,000 are exempt from
any audit requirements. In addition, A-128 requires that all instan-
ces of "material" findings be reported for both major and non-
major programs and that audit reports identify all amounts
questioned for each federal program.
-------
Appendix B —Audit resolution directives
As a result of the Single Audit Act, any audit performed must in-
clude tests and reviews of the validity of costs as well as general
determination of the eligibility of recipients, compliance with
matching contribution requirements, the "reasonableness and fair-
ness" of financial reports, and cash draw-downs via advance or let-
ters of credit.
C. EPA Order 2750—Management of EPA Audit
Reports and Follow-up Actions
The manual serves as the formal EPA directive establishing audit
terminology, assignment of responsibilities, a time frame for the
implementation of corrective actions, and the process for resolving
internal and external audits. As stated in its scope and ap-
plicability section, the directive applies "Agency-wide to all find-
ings and recommendations included in internal audits and in
pre-award, interim, and final audit reports covering EPA grants,
cooperative agreements, and direct contract procurement." This
directive serves as guidance for all programs and activities in-
volved in the audit resolution process.
D. EPA Order 2780.1B—GAO Audits: Agency
Relationships With GAO and Responsibilities for
Follow-up Actions
EPA Order 2780.IB and its companion piece, EPA Order 2750,
constitute the EPA response to OMB Circular A-50. EPA Order
2780.IB establishes policies, procedures, and assigns respon-
sibilities that govern audit relationships between EPA and the
General Accounting Office (GAO). The Order also prescribes pro-
cedures for EPA follow-up to GAO audit findings.
E. EPA Office of Inspector General Manual
The manual contains the policies, standards, and guidelines for the
EPA Office of the Inspector General. Chapters 104,105,109,
111, 112, and 150 are the primary chapters involved with audits
and audit follow-up. These chapters cover the audit from the sur-
vey phase, review of operations, nature of presentation of audit
findings and recommendations, review and issuance of audit
reports, distribution or audit reports, and special reports. These
u
-------
Appendix B —Audit resolution directives
chapters formulate the procedures to be used in conducting audits
as well as incorporate the Standards for Audit of Governmental Or-
ganizations, Programs, Activities, and Functions issued by the
Comptroller General of the United States.
F. AA and RA Directives
Assistant Administrator and Regional Administrator directives es-
tablish methodologies for the resolution of audits. Particular
regional practices may vary, but each region derives its authoriza-
tion and formulates its procedures based on EPA Orders 2750 and
2780.IB, OMB Circular A-50 and 40 CFR Part 30. Regional
directives provide the most specific guidance pertaining to the es-
tablishment of final authority and responsibilities for audit resolu-
tion within a regional office. They can define terminology used in
the audit process and establish interim reporting deadlines during
audit resolution.
Regional directives can cover guidelines for the review of audit
findings, including criteria for acceptability of responses, and for
the coordination of responses to audit findings between the region
and the OIG. Regional directives can also establish procedures for
the issuance of bills for collection and for the documentation of
audit close-out
G. 40CFRPart30SubpartL
This directive in the Code of Federal Regulations governs grants
for assistance programs. Subpart L is the section that sets forth
procedures for resolving assistance disputes between EPA officials
and assistance recipients of applicants.
H. Comprehensive Audit Manual
This manual is published by the General Accounting Office and
details the guidance and protocols for audits conducted by the
GAO. This manual is one of several publications issued by the
GAO explaining and supplementing the standards and demonstrat-
ing how auditing can improve efficiency and effectiveness of
government operations and programs.
m
-------
Appendix B —Audit resolution directives
I. Standards for Audit of Governmental
Organizations. Programs, Activities, and
Functions
The standards are published in what is commonly referred to as the
GAO "Yellow Book." The standards are to be followed by the
Federal auditors and all non-Federal auditors who perform audits
of Federal organizations. The standards include those established
by the American Institute of Certified Public Accountants for
financial audits and establish additional guidance for non-financial
audits.
IV
------- |