Overseeing the FACT process including approving final test plans.

Administering the governance process by chairing the FACT Review Board, providing the status and results of FACT activities to the Management Controls Executive Steering Committee (MC ESC) and the FACT Review Board, and documenting key decisions.

Approving test plans.

Designating a FACT Review Board representative and back-up.

Providing SMEs to review the control design analysis to verify that the transaction lead identified key controls.

Delivering requested internal control documentation stated in the Prepared by Client (PBC) listing timely.

Developing and monitoring corrective action plans (CAPs) for identified weaknesses.

Reviewing and signing the combined procedure report (CPR), combined issues report (CIR) and executive summary, as applicable.

Providing clear and concise communication of FACT assessment objectives throughout the agency.

Approving the FACT assessment methodology and guidance.

Leading the coordination of testing activities and timelines with process owners, Treasury and GAO.

Ensuring the FACT team carries out assessments in a thorough, effective and timely manner.

Communicating agency management issues identified during testing.

Collaborating with SMEs and points of contacts (POCs) to assist in the development of the control design analysis (CDA) and test plans timely.

Communicating and coordinating with external oversight groups.

Ensuring FACT documentation meets retention standards.

Determining an appropriate sampling method and size for each control based on frequency.

Using statistical sampling methods to generate random samples.

Obtaining and reading applicable IRMs, Interim Guidance Memoranda, SOPs, Job Aids, Servicewide Electronic Research Program (SERP) Alerts, IRM Procedural Updates (IPUs), GAO/TIGTA audit reports and other guidance related to assigned test steps.

Reviewing and checking off FACT checklists to verify required steps are completed.

Conducting substantive testing of supporting documents received from the process owners.

Communicating any exceptions found within the test plan.

Verifying all required supporting documentation is available for assigned test steps and timely notifying the POC and SME of any exceptions.

Verifying facts with the appropriate process owner, if exceptions are identified.

Analyzing test results to determine if internal controls are in place and working effectively.

Reporting results of substantive testing to the process owners and management.

Providing suggested test plan updates based on recent execution of the test plan.

Providing guidance and management support for the planning, testing and reporting on the effectiveness of controls related to mitigating risk and ensuring data integrity for financial reporting.

Coordinating with internal stakeholders and business units to identify areas of risk related to key internal controls.

Directing test procedures to evaluate whether internal controls are effective at managing and mitigating risk and ensuring data integrity for financial reporting.

Reporting on the results of testing of internal controls, particularly those related to financial management, and prompting program managers to develop and implement corrective action plans to remediate any control weaknesses or other deficiencies identified during the course of testing.

Engaging with external stakeholders, including the Treasury Department and GAO, on the development and implementation of program guidance, assessment activities, test outcomes, and formal reporting.

Understanding the processes and procedures related to their transactions.

Performing test work in accordance with relevant standards, OMB Circular A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control, Appendix A: Management of Reporting and Data Integrity Risk FACT SOPs and other adopted federal guidance.

Identifying the risks associated with the transactions and the controls in place to mitigate those risks.

Assessing the control risk for each control.

Determining the nature, timing and extent of testing performed.

Developing the CDA, internal control test plan and PBC listing.

Communicating deadlines with process owners to ensure timeliness of work performed.

Verifying necessary meetings and interviews, documenting all conclusions and planning appropriate follow-up actions.

Elevating significant matters to the FACT section chiefs, team leads, and when necessary, Enterprise Assurance and Controls, for further consideration.

Reviewing test work completed by other team members.

Documenting exceptions from the internal control test plan as reported by the test teams.

Submitting completed workpapers at the end of the interim and fourth quarter testing.

Reviewing GAO/TIGTA reports that contain open recommendations.

Providing SMEs to identify key controls and review the CDA to verify that FACT identified key controls.

Participating in FACT interviews and walkthroughs.

Communicating existing MFCs or recommendations noted by GAO or TIGTA and the current status related to processes under review, if applicable.

Gathering and delivering requested Internal Control documentation stated in the PBC listing by the respective due date.

Evaluating existing management review procedures.

Reviewing and signing the CPR, CIR and executive summary, as applicable.

Developing and monitoring CAPs for reported issues.

Providing timely responses to reported issues.

Communicating changes to processes.

Completeness

Existence and occurrence

Accuracy and valuation

Rights and obligations

Presentation and disclosure

Introduction

Scope of the test

Control test

Test objectives

Results of testing

Effectiveness of controls

Test objective (Purpose of the test)

Expected results (What is the expected outcome?)

Controls tested (Identify IRS controls tested in this test plan, and state whether they include all controls in the CDA)

Contact Name (Name of person to contact for explanation of issues/problems)

Delineate the scope of the test based on the control’s nature, frequency, and timing (Are all transactions included or only a specific subset? What is the frequency of the testing?)

Resource capabilities required to perform testing (What degree of knowledge is required for performing the test?)

Resources to be used to perform the control test (Is there separation between individuals who test and individuals who perform the control?)

Determination of the type of relevant reporting assertion provided by the control (What type of assertion do the controls provide?) Rights or Obligations; Completeness or Accuracy; Presentation or Disclosure; Existence or Occurrence; and Valuation or Allocation

Type of test (Inspection, Observation or Reperformance)

Sample size and basis (Specify method used to select the sample and sample size.)

Assess QAR and SMR potential of the transaction (Determine if the transaction meets the criteria to be deemed a QAR or an SMR as discussed in IRM 1.4.3.10.3, Evaluate Quality Assurance Reviews (QARs) and Structured Management Reviews (SMRs) and IRM 1.4.31, IRS Quality Assurance Program.)

Information needed to conduct the test (List documents required for testing)

Steps for testing transaction controls (What are the steps to perform the test against the sample?)

Additional procedures (Describe additional procedures to take if the tester cannot successfully complete the initial test)

Documentation requirements (Describe the documentation process of the test content and results)

Generally, the purpose of a test objective is to obtain and review IMDs to include IRMs (references), SERP IRM IPUs, Interim Guidance Memoranda, SOPs and flowcharts to verify procedures have been developed, implemented and maintained for use by personnel. Also, verify the procedures adequately describe the internal controls for the process and the responsibilities for the organization.

Using the following sources, review findings and related recommendations to assess impact on the process under review and document results:

Determination of Control Effectiveness (Who reviews the test results and determines the effectiveness of the control?)

Determine whether the process owner(s) consistently applied the controls (Does the test reflect consistent application of the control?)

Determine the effectiveness of the controls

Determine if reportable issues are required (If the process owner disagrees with an issue, obtain written documentation from the process owner stating an acceptable level of risk in lieu of implementing a corrective action)

Determine if corrective action plans are required (If overall controls are ineffective, summarize corrective actions to take within a corrective action plan)

Verifying the entire population is accounted for when the sample is drawn.

Determining the source document or the transaction documents to be tested.

Defining the period covered by the test.

If applicable, dividing the population to verify the sample is taken from an appropriate group of the population, such as only high-dollar value items.

The extent of uniformity of the controls and their applications at each location.

Whether the individual locations can make significant changes to the controls or their application.

The amount and nature of centralized oversight or control over local operations.

Whether there could be a need for separate conclusions for each location. If the testers concluded the locations should be separate populations, then transaction leads must select separate samples at each location, and testers and management will evaluate the results of each sample separately.

Reliable: Will a particular technique, applied repeatedly to the same object, yield similar results?

Consistent: Is the test plan’s scope and depth appropriate and consistent with other test plans?

Valid: Does the test plan measure what it is intended to measure?

Non-Statistical sample: A subset of a defined population, selected using judgement, but not valid to make statistical inferences within a defined level of confidence and precision.

Random sample: A subset of a defined population, selected using a statistically valid methodology in which every member of the population has an equal, non-zero probability of being selected. With this method, transaction leads can make inferences about the population with a defined level of confidence and precision. Usually, the larger the sample size, the higher the level of confidence and precision.

In some cases, seasonal fluctuations (such as periods of limited availability) early in the fiscal year for obligations or tax return filing patterns may require selecting samples from several periods throughout the year to verify a representative sample. The transaction lead should fully explain such work patterns to SOI and have them recommend an appropriate sample methodology.

If one of the sample items cannot be reviewed (for example, the transaction was reversed and is no longer there), the transaction lead should not use that item. Instead, select the very next item from the population list to review. The transaction lead must clearly document the reason for the change in the workpapers.

Documented procedures that guide the SMR.

Reviews performed at regular intervals.

Documented and independent review of results.

Documented processes to resolve noted deficiencies.

Objectives, scope and methodology for each transaction, including the testing period, the definition of the sampling universe, and if the team deviated from the approved sampling methodology, the rationale for such actions.

Support for each test conducted, including the copies of documents examined and the rationale for key decisions and any deviations made from approved guidance.

Testing results, analysis and conclusions that provide a clear and concise summary of results cross-referenced to supporting documents and resolution of exceptions or other issues.

Evidence of transaction lead review and sign-off of the workpapers reviewed prior to supervisory review.

Evidence of FACT section chief, team lead or senior team member review of the work performed that supports conclusions about the controls tested.

Plans for the review, including the test plans.

Examination and the evaluation of the adequacy and effectiveness of the systems of internal control.

Test procedures followed, the information obtained, and the conclusions reached.

Management reviews.

Audit reports.

Issues.

A lead sheet identifying all items, attributes and findings (i.e., x = exception, check mark = no exception).

For one sample, the workpapers must include one complete example that clearly identifies and documents all attributes tested.

For samples that contain exceptions, the workpapers must include all supporting documents.

Documents that may not be retrievable in their exact form at a later date. For example, if a screen print is necessary to support a number or dollar amount that may change in the future, that screen print should be retained to verify that figure as of the test date.

Planning documents and review plans.

Control questionnaires, flowcharts, checklists and the results of control evaluations.

Documentation of walkthroughs and interviews.

Organization charts, policy and procedures statements and job descriptions.

Copies of important contracts and agreements.

Letters of confirmation and representation.

Photographs, diagrams and other graphic displays.

Results of analytical review procedures.

Audit reports and management replies.

Emails, memos and other relevant correspondence.

CAPs, if appropriate and available.

Obtained guidance to understand the internal control, plan the testing, and determine the nature, timing and extent of the tests performed.

Adequately planned and supervised work.

Observed standards of test work.

Obtained sufficient competent documentation to afford a reasonable conclusion.

Notation: Highlight or identify the specific attribute in the workpapers that the team member verified, such as a signature indicating managerial approval.

Indexing: Workpapers will be automatically indexed once loaded into TeamMate to verify test plan results are properly referenced and can be easily traced to supporting documentation. When referring to reports in TeamMate, use the reference number and page number. Based on the associated test objective to the workpapers, TeamMate will automatically assign each workpaper a reference and a page number.

Sources of data: Clearly identify the source of any information appearing in workpapers. An independent reviewer should be able to retrace the reviewer’s steps, from basic schedules to summaries and comments. Worksheets should be cross-referenced to other related workpapers and to the test plans. Effective cross-referencing often reduces the need to duplicate data.

Workpaper summaries: The process of summarizing provides an objective overview and puts findings in perspective. The team’s summary should focus on key information and data. Do not include trivial information or editorial comments not supported by testing. Periodically summarizing findings helps verify firm control over the test.

Record Key Meetings and Interviews: Record all key discussions (meetings and interviews) used as support for key decisions (testing decisions/conclusions) and understanding the subject matter or test evidence and include the notes in the workpapers. Key decisions and conclusions are often a result of meetings and interviews. Without a record, important information will be lost. Use the format below.

Keep the Writing Simple: Workpapers should be clear and concise to an uninitiated reviewer. Avoid jargon and explain all technical terms and acronyms in a separate part of the workpapers (glossary of terms).

Keep Workpapers Understandable: Workpapers should be clear, concise and must stand on their own. They should not need any supplementary information. Anyone reading the papers should be able to determine what the team member set out to do, what they did, what they found, and what they concluded.

Keep Workpapers Free of PII: The workpaper documentation should not contain taxpayer, employee, vendor data, etc. All information must be protected according to the guidelines in 1.4.18.12.4, Personally Identifiable Information (PII).

Keep Workpapers Relevant: Workpapers should be restricted to relevant and material matters; they should directly relate to the review’s objectives. Well-organized test plans, execution of FACT procedures and workpaper reviews help verify the inclusion of relevant documents only. Do not include editorial comments and observations not supported by testing. It is important that all conclusions are in context and related to specific evidence.

The complexity of the transactions (Will one control failure at the early stages of a process create errors later in the process?)

The volume of transactions (Is the volume of transactions so large that one or two exceptions will not have an impact?)

The potential risk of fraud (Is this exception an indication of fraud, which should be pursued?)

The extent to which the controls have been subjected to on-going monitoring activities throughout the year (Are the controls monitored throughout the year, and exceptions possibly caught at a later time in the year?)

ICW - A weakness that exists in an internal control such that the overall system of controls is compromised.

OFI - A weakness exists in an internal control; however, the overall system of controls is not compromised.

MIO - An exception exists that does not present a weakness in an internal control; however, it warrants management’s attention.

The type of issue (ICW, OFI or MIO).

A description of the test objective and the test step where the exception occurred.

A description of the condition in which the exception occurred.

The criteria that was used to determine that the exception occurred. For example, the internal control standard, IRM or SOP.

The cause of the exception.

The effect the exception has on internal controls.

A recommended corrective action.

The process owner and contact information.

The process owner response.

The estimated completion date.