Kearney’s internal control testing approach mirrors the approach set forth in the Implementation Guide for Office of Management and Budget (OMB) Circular A-123, Appendix A, issued by the Chief Financial Officer’s Council in July 2005 (Implementation Guide). The approach consists of planning activities and an evaluation of the internal controls for the above referenced cycles.
Planning activities consisted of determining significant accounting reports included in the review, materiality, and the key business processes that support the material financial statement line items.
First, Kearney evaluated the two cycles’ internal controls using the Government Accountability Office (GAO) checklist. The evaluation included assessments of the effectiveness of implementing each of the following five standards of internal controls in the two areas:
- Control Environment
- Risk Assessment
- Information and Communication
- Control Activities
- Monitoring.
Overall, EEOC’s internal control structure for the two reviewed cycles is well designed; operationally effective, appropriately updated to meet changing conditions, and provides reasonable assurance that the objectives of the agency are being achieved.
Second, Kearney evaluated controls at the process-level for the reviewed areas. Key controls were identified and evaluated to determine their design effectiveness. The evaluation focused on the directness of the control technique in relation to the financial reporting assertion, the frequency of the control’s application, the experience and skills of the personnel performing the control and control activity review, segregation of duties (to include asset safeguarding), procedural compliance with applicable laws, regulations, and best business practices, procedures followed when a control identifies an exception condition, and procedures documented to ensure continuity of operations.
Overall, although design deficiencies were noted, none were considered to be material weaknesses.
Lastly, Kearney tested key controls at the transaction-level to determine their operating effectiveness. Testing consisted of inquiry, observation, inspection, and re-performance. Although select controls were determined to be ineffective, Kearney identified no material weaknesses.
EEOC’s management provided responses to Kearney’s findings. In general, EEOC concurred with Kearney’s findings and recommendations, and, its responses are included as Appendix A to this document.