Principle 2 - Exercise Oversight Responsibility
2.0 Exercise Oversight Responsibility
External Link to US GAO Green Book Principle 2
Overview
2.01
The oversight body should oversee the entity’s internal control system.
2.1 Oversight Structure
2.02
The entity determines an oversight structure to fulfill responsibilities set forth by applicable laws and regulations, relevant government guidance, and feedback from key stakeholders. The entity will select, or if mandated by law will have selected for it by an applicable body, an oversight body. When the oversight body is composed of entity management, activities referenced in the Green Book as performed by “management” exclude these members of management when in their roles as the oversight body.
2.03
When the oversight structure of an entity is led by senior management, senior management may distinguish itself from divisional or functional management by establishing an oversight body. An oversight body oversees the entity’s operations; provides constructive criticism to management; and where appropriate, makes oversight decisions so that the entity achieves its objectives in alignment with its integrity and ethical values. Members of an oversight body review management’s activities, present alternative views, and act when faced with actual or suspected wrongdoing.
2.04
In selecting members for an oversight body, the entity or applicable body defines the entity knowledge, relevant expertise, number of members, and possible independence needed to fulfill the oversight responsibilities for the entity.
2.05
Members of an oversight body understand the entity’s objectives, its related risks, and expectations of its stakeholders. In addition to an oversight body, an organization within the federal government may have several bodies that are key stakeholders for the entity, such as the White House, Congress, the Office of Management and Budget, and the Department of the Treasury. An oversight body works with key stakeholders to understand their expectations and help the entity fulfill these expectations if appropriate.
2.06
The entity or applicable body also considers the expertise members need to oversee, question, and evaluate management. Capabilities expected of all members of an oversight body include integrity and ethical values, leadership, critical thinking, and problem-solving abilities.
2.07
Further, in determining the number of members of an oversight body, the entity or applicable body considers the need for members of the oversight body to have specialized skills to enable discussion, offer constructive criticism to management, and make appropriate oversight decisions.
2.08
If authorized by applicable laws and regulations, the entity may also consider including independent members as part of an oversight body. Independent members with relevant expertise provide value through their impartial evaluation of the entity and its operations in achieving objectives.
2.2 Oversight for the Internal Control System
2.09
The oversight body oversees management’s design, implementation, and operation of the entity’s internal control system.
The oversight body’s responsibilities for the entity’s internal control system include the following:
- Control Environment - Establish integrity and ethical values, develop expectations of competence, and maintain accountability to all members of the oversight body and key stakeholders.
- Risk Assessment - Oversee management’s assessment of risks to achieving objectives, including risks related to fraud, improper payments, information security, identified and potential changes, and management override of internal control.
- Control Activities - Provide oversight to management in the development and performance of control activities.
- Information and Communication - Analyze and discuss information relating to the entity’s achievement of objectives.
- Monitoring - Scrutinize the nature and scope of management’s monitoring activities as well as its evaluation and remediation of identified deficiencies.
2.10
These responsibilities are supported by the organizational structure that management establishes. The oversight body oversees management’s design, implementation, and operation of the entity’s organizational structure so that the processes necessary to enable the oversight body to fulfill its responsibilities exist and are operating effectively.
2.3 Input for Remediation of Deficiencies
2.11
The oversight body provides input to management’s plans for remediation of deficiencies in the internal control system as appropriate.
2.12
Management reports deficiencies identified in the internal control system to the oversight body. The oversight body oversees and provides direction to management on the remediation of these deficiencies. The oversight body also provides direction when a deficiency crosses organizational boundaries or units, or when the interests of management may conflict with remediation efforts. When appropriate and authorized, the oversight body may direct the creation of teams to address or oversee specific matters critical to achieving the entity’s objectives.
2.13
The oversight body is responsible for overseeing the remediation of deficiencies as appropriate and for providing direction to management on appropriate time frames for correcting these deficiencies
Assessment Observations Compared to Green Book Components, Principles, & Attributes
Control Environment
Component: Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives.
- Principle 1 - Demonstrate Commitment to Integrity and Ethical Values
- Principle 2 - Exercise Oversight Responsibility
- Principle 3 - Establish Structure, Responsibility, and Authority
- Attributes (3.01, 3.02, 3.03, 3.04, 3.05, 3.06, 3.07, 3.08, 3.09, 3.10, 3.11, 3.12)
- Principle 4 - Demonstrate Commitment to Competence
- Attributes (4.01, 4.02, 4.03, 4.04, 4.05, 4.06, 4.07, 4.08)
- Principle 5 - Enforce Accountability
- Attributes (5.01, 5.02, 5.03, 5.04, 5.05, 5.06, 5.07, 5.08)
Risk Assessment
Component: Risk Assessment - The identification and analysis of risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses.
- Principle 6 - Define Objectives and Risk Tolerances
- Attributes (6.01, 6.02, 6.03, 6.04, 6.05, 6.06, 6.07, 6.08, 6.09, 6.10)
- Principle 7 - Identify, Analyze, and Respond to Risks
- Attributes (7.01, 7.02, 7.03, 7.04, 7.05, 7.06, 7.07, 7.08, 7.09, 7.10, 7.11, 7.12, 7.13, 7.14, 7.15)
- Principle 8 - Assess Fraud, Improper Payment, and Information
- Attributes (8.01, 8.02, 8.03, 8.04, 8.05, 8.06, 8.07, 8.08, 8.09, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20)
- Principle 9 - Identify, Analyze, and Respond to Change
- Attributes (9.01, 9.02, 9.03, 9.04, 9.05, 9.06, 9.07, 9.08, 9.09, 9.10, 9.11, 9.12, 9.13)
Control Activities
Component: Control Activities - The actions management establishes through policies and procedures to mitigate risks to achieving the entity's objectives to acceptable levels.
- Principle 10 - Design Control Activities
- Attributes (10.01, 10.02, 10.03, 10.04, 10.05, 10.06, 10.07, 10.08, 10.09, 10.10, 10.11, 10.12, 10.13, 10.14, 10.15, 10.16, 10.17, 10.18, 10.19, 10.20, 10.21, 10.22, 10.23)
- Principle 11 - Design General Control Activities over Information
- Attributes (11.01, 11.02, 11.03, 11.04, 11.05, 11.06, 11.07, 11.08, 11.09, 11.10, 11.11, 11.12, 11.13, 11.14, 11.15, 11.16, 11.17)
- Principle 12 - Implement Control Activities
- Attributes (12.01, 12.02, 12.03, 12.04, 12.05)
Information and Communication
Component: Information and Communication - The quality information management and other personnel communicate and use to support the internal control system.
- Principle 13 - Use Quality Information
- Attributes (13.01, 13.02, 13.03, 13.04, 13.05, 13.06, 13.07)
- Principle 14 - Communicate Internally
- Attributes (14.01, 14.02, 14.03, 14.04, 14.05, 14.06, 14.07, 14.08)
- Principle 15 - Communicate Externally
- Attributes (15.01, 15.02, 15.03, 15.04, 15.05, 15.06, 15.07, 15.08, 15.09)
Monitoring
Component: Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews.
- Principle 16 - Perform Monitoring Activities
- Attributes (16.01, 16.02, 16.03, 16.04, 16.05, 16.06, 16.07, 16.08, 16.09, 16.10)
- Principle 17 - Evaluate Issues and Remediate Deficiencies
- Attributes (17.01, 17.02, 17.03, 17.04, 17.05, 17.06, 17.07, 17.08)
