I recently came across OMB Circular A-123 and thought it was worth a discussion regarding the intersection of this government regulatory mandate and the topic of Spreadsheet Controls. So, here is a quick run down of what you need to know for government entities. Keep in mind this summary is focused on spreadsheet use in financial reporting and close the books activities within government agencies.
First, the Office of Budget and Management (OMB) Circular A-123 is the federal government’s version of SOX. Like SOX 404, it requires that management that management establish effective internal controls over the financial reporting (ICFR) process. Further, it requires that such controls and the assessment process should be documented. As with SOX, material weaknesses (e.g. material misstatements due to spreadsheet errors) can result in non-compliance, and the OMB can request audit opinion if needed to enforce corrective actions. It also recommends a risk assessment to identify areas at risk (e.g. uncontrolled spreadsheets used in financial reporting). In addition, Circular A-123 recommends continuous monitoring and testing to improve the control environment. As specified, “appropriate internal control should be integrated into each system…” which implies an automated approach is preferred over manual controls. With automation, effective controls can be embedded into the business process so that they become part of doing business as usual.
Control activities recommended in Circular A-123 include: policies, segregation of duties, access control, documentation, accurate information processing (e.g. data integrity), input/output control, safeguarding of records (e.g. critical spreadsheets and EUCs), monitoring of controls (e.g. reporting & dashboards). These are all standard control requirements which are consistent with SOX guidelines. That said, spreadsheets controls are not specifically called out, but as with SOX, the NAIC Model Audit Rule, Solvency II, Basel II, and OCC guidelines and similar regulatory mandates, we do know that external auditors are scrutinizing the spreadsheet environment, especially when they see a heavy reliance on uncontrolled spreadsheets.
So, my recommendation on OMB Circular A-123 is to follow Big 4 auditor guidance on Spreadsheet Controls. As a government entity, to be prepared for an audit, you need to be able to answer a few questions with certainty and appropriate documentation:
- Have you created an inventory of spreadsheets, Access databases and other end-user computing applications?
- If so, have you performed a risk assessment to determine which ones are considered high risk (e.g. those that directly impact financial, regulatory and management reporting)?
- For the high risk spreadsheets, what controls are currently in place?
If you can pass this test, then you have taken a proactive approach to mitigating the risks associated with uncontrolled spreadsheets. For more details on controls recommended by Big 4 auditors, I recommend reading my previous post on Spreadsheets and SOX 404 Compliance which references guidance from PwC.
Also, you can access the complete OMB Circular A-123 here.
A 
Accounting Fraud on the Rise
In 2006, a leading US energy provider performed an audit of spreadsheets and end-user computing applications and recognized the need to establish tighter IT controls. Many key spreadsheets used within finance and accounting operations were used in financial, regulatory and management reporting, and were considered in-scope for SOX 404 compliance. At the time, SOX testing for spreadsheets was a manual process evaluating access controls and security, documentation, change management and formula and link verification.
Prodiance ESM provided pervasive monitoring (24×7x365) of all changes to critical spreadsheets and automated change control through cell level audit trails and versioning. Prodiance Spreadsheet Compare was utilized by business analysts to compare changes between spreadsheet versions in a side-by-side fashion to help speed review and approval cycles. Prodiance Spreadsheet IQ provided automated spreadsheet diagnostics to help internal auditors accelerate spreadsheet error checking and the evaluation of links.
Eric Perry