Principle 2 - Exercise Oversight Responsibility: Difference between revisions

From Corrective Action Plan AZ
← Older edit

Kelly (talk | contribs)

3 user groups
352 edits
VisualWikitext
No edit summary
No edit summary
 
(12 intermediate revisions by the same user not shown)
Line 1: Line 1:
== 2.0 Exercise Oversight Responsibility ==
[https://guides.gaoinnovations.gov/greenbook/2025/principle-2-exercise-oversight-responsibility/ External Link to US GAO Green Book Principle 2]


2.01 The oversight body should oversee the entity’s internal control
=== Overview ===
system.


Oversight Structure
==== <span id="2.01"></span>'''2.01''' ====
The oversight body should oversee the entity’s internal control system.


2.02 The entity determines an oversight structure to fulfill
=== 2.1 Oversight Structure ===
responsibilities set forth by applicable laws and regulations, relevant
<span id="2.1"></span>
government guidance, and feedback from key stakeholders. The entity will
==== <span id="2.02"></span>'''2.02''' ====
select, or if mandated by law will have selected for it by an applicable
The entity determines an oversight structure to fulfill responsibilities set forth by applicable laws and regulations, relevant government guidance, and feedback from key stakeholders. The entity will select, or if mandated by law will have selected for it by an applicable body, an oversight body. When the oversight body is composed of entity management, activities referenced in the Green Book as performed by “management” exclude these members of management when in their roles as the oversight body.
body, an oversight body. When the oversight body is composed of entity
management, activities referenced in the Green Book as performed by
“management” exclude these members of management when in their roles as
the oversight body.


2.03 When the oversight structure of an entity is led by senior
==== <span id="2.03"></span>'''2.03''' ====
management, senior management may distinguish itself from divisional or
When the oversight structure of an entity is led by senior management, senior management may distinguish itself from divisional or functional management by establishing an oversight body. An oversight body oversees the entity’s operations; provides constructive criticism to management; and where appropriate, makes oversight decisions so that the entity achieves its objectives in alignment with its integrity and ethical values. Members of an oversight body review management’s activities, present alternative views, and act when faced with actual or suspected wrongdoing.
functional management by establishing an oversight body. An oversight
body oversees the entity’s operations; provides constructive criticism
to management; and where appropriate, makes oversight decisions so that
the entity achieves its objectives in alignment with its integrity and
ethical values. Members of an oversight body review management’s
activities, present alternative views, and act when faced with actual or
suspected wrongdoing.


2.04 In selecting members for an oversight body, the entity or
==== <span id="2.04"></span>'''2.04''' ====
applicable body defines the entity knowledge, relevant expertise, number
In selecting members for an oversight body, the entity or applicable body defines the entity knowledge, relevant expertise, number of members, and possible independence needed to fulfill the oversight responsibilities for the entity.
of members, and possible independence needed to fulfill the oversight
responsibilities for the entity.


2.05 Members of an oversight body understand the entity’s objectives,
==== <span id="2.05"></span>'''2.05''' ====
its related risks, and expectations of its stakeholders. In addition to
Members of an oversight body understand the entity’s objectives, its related risks, and expectations of its stakeholders. In addition to an oversight body, an organization within the federal government may have several bodies that are key stakeholders for the entity, such as the White House, Congress, the Office of Management and Budget, and the Department of the Treasury. An oversight body works with key stakeholders to understand their expectations and help the entity fulfill these expectations if appropriate.
an oversight body, an organization within the federal government may
have several bodies that are key stakeholders for the entity, such as
the White House, Congress, the Office of Management and Budget, and the
Department of the Treasury. An oversight body works with key
stakeholders to understand their expectations and help the entity
fulfill these expectations if appropriate.


2.06 The entity or applicable body also considers the expertise members
==== <span id="2.06"></span>'''2.06''' ====
need to oversee, question, and evaluate management. Capabilities
The entity or applicable body also considers the expertise members need to oversee, question, and evaluate management. Capabilities expected of all members of an oversight body include integrity and ethical values, leadership, critical thinking, and problem-solving abilities.
expected of all members of an oversight body include integrity and
ethical values, leadership, critical thinking, and problem-solving
abilities.


2.07 Further, in determining the number of members of an oversight body,
==== <span id="2.07"></span>'''2.07''' ====
the entity or applicable body considers the need for members of the
Further, in determining the number of members of an oversight body, the entity or applicable body considers the need for members of the oversight body to have specialized skills to enable discussion, offer constructive criticism to management, and make appropriate oversight decisions.
oversight body to have specialized skills to enable discussion, offer
constructive criticism to management, and make appropriate oversight
decisions.


2.08 If authorized by applicable laws and regulations, the entity may
==== <span id="2.08"></span>'''2.08''' ====
also consider including independent members as part of an oversight
If authorized by applicable laws and regulations, the entity may also consider including independent members as part of an oversight body. Independent members with relevant expertise provide value through their impartial evaluation of the entity and its operations in achieving objectives.
body. Independent members with relevant expertise provide value through
their impartial evaluation of the entity and its operations in achieving
objectives.


Oversight for the Internal Control System  
=== <span id="2.2"></span>2.2 Oversight for the Internal Control System ===


2.09 The oversight body oversees management’s design, implementation,
==== <span id="2.09"></span>'''2.09''' ====
and operation of the entity’s internal control system. The oversight
The oversight body oversees management’s design, implementation, and operation of the entity’s internal control system.
body’s responsibilities for the entity’s internal control system include
the following:


• Control Environment - Establish integrity and ethical values, develop
The oversight body’s responsibilities for the entity’s internal control system include the following:
expectations of competence, and maintain accountability to all members
of the oversight body and key stakeholders.


• Risk Assessment - Oversee management’s assessment of risks to
* '''Control Environment''' - Establish integrity and ethical values, develop expectations of competence, and maintain accountability to all members of the oversight body and key stakeholders.
achieving objectives, including risks related to fraud, improper
* '''Risk Assessment''' - Oversee management’s assessment of risks to achieving objectives, including risks related to fraud, improper payments, information security, identified and potential changes, and management override of internal control.
payments, information security, identified and potential changes, and
* '''Control Activities''' - Provide oversight to management in the development and performance of control activities.
management override of internal control.
* '''Information and Communication''' - Analyze and discuss information relating to the entity’s achievement of objectives.
* '''Monitoring''' - Scrutinize the nature and scope of management’s monitoring activities as well as its evaluation and remediation of identified deficiencies.


• Control Activities - Provide oversight to management in the
==== <span id="2.10"></span>'''2.10''' ====
development and performance of control activities.
These responsibilities are supported by the organizational structure that management establishes. The oversight body oversees management’s design, implementation, and operation of the entity’s organizational structure so that the processes necessary to enable the oversight body to fulfill its responsibilities exist and are operating effectively.


• Information and Communication - Analyze and discuss information
=== <span id="2.3"></span>2.3 Input for Remediation of Deficiencies ===
relating to the entity’s achievement of objectives.


• Monitoring - Scrutinize the nature and scope of management’s
==== <span id="2.11"></span>'''2.11''' ====
monitoring activities as well as its evaluation and remediation of
The oversight body provides input to management’s plans for remediation of deficiencies in the internal control system as appropriate.
identified deficiencies.


2.10 These responsibilities are supported by the organizational
==== <span id="2.12"></span>'''2.12''' ====
structure that management establishes. The oversight body oversees
Management reports deficiencies identified in the internal control system to the oversight body. The oversight body oversees and provides direction to management on the remediation of these deficiencies. The oversight body also provides direction when a deficiency crosses organizational boundaries or units, or when the interests of management may conflict with remediation efforts. When appropriate and authorized, the oversight body may direct the creation of teams to address or oversee specific matters critical to achieving the entity’s objectives.
management’s design, implementation, and operation of the entity’s
organizational structure so that the processes necessary to enable the
oversight body to fulfill its responsibilities exist and are operating
effectively


Input for Remediation of Deficiencies
==== <span id="2.13"></span>'''2.13''' ====
The oversight body is responsible for overseeing the remediation of deficiencies as appropriate and for providing direction to management on appropriate time frames for correcting these deficiencies


2.11 The oversight body provides input to management’s plans for
{{Principles}}
remediation of deficiencies in the internal control system as
appropriate.
 
2.12 Management reports deficiencies identified in the internal control
system to the oversight body. The oversight body oversees and provides
direction to management on the remediation of these deficiencies. The
oversight body also provides direction when a deficiency crosses
organizational boundaries or units, or when the interests of management
may conflict with remediation efforts. When appropriate and authorized,
the oversight body may direct the creation of teams to address or
oversee specific matters critical to achieving the entity’s objectives.
 
2.13 The oversight body is responsible for overseeing the remediation of
deficiencies as appropriate and for providing direction to management on
appropriate time frames for correcting these deficiencies
 
# [[Principle 1 - Demonstrate Commitment to Integrity and Ethical Values]]
# [[Principle 2 - Exercise Oversight Responsibility]]
# [[Principle 3 - Establish Structure, Responsibility, and Authority]]
# [[Principle 5 - Enforce Accountability]]
# [[Principle 8 - Assess Fraud, Improper Payment, and Information]]
# [[Principle 10 - Design Control Activities]]
# [[Principle 11 - Design General Control Activities over Information]]
# [[Principle 12 - Implement Control Activities]]
# [[Principle 13 - Use Quality Information]]
# [[Principle 14 - Communicate Internally]]
# [[Principle 15 - Communicate Externally]]
# [[Principle 16 - Perform Monitoring Activities]]
# [[Principle 17 - Evaluate Issues and Remediate Deficiencies]]


== Related Story Events ==
== Related Story Events ==
Line 127: Line 64:
* [[2001: The Journey Begins|❓ 2001: The Journey Begins]]
* [[2001: The Journey Begins|❓ 2001: The Journey Begins]]
* [[December 2024: Gaining Support|📋 December 2024: Resolution Submission]]
* [[December 2024: Gaining Support|📋 December 2024: Resolution Submission]]
== Navigation ==
{| class="wikitable" style="width: 100%;"
! colspan="3" | Quick Navigation
|-
| style="width: 33%; text-align: center;" | [[Main Page|🏠 Main Page]]
| style="width: 33%; text-align: center;" | [[The Story|📖 The Story]]
| style="width: 33%; text-align: center;" | [[Governance Analysis|📊 Governance Analysis]]
|}

Latest revision as of 19:49, 13 August 2026

2.0 Exercise Oversight Responsibility

External Link to US GAO Green Book Principle 2

Overview

2.01

The oversight body should oversee the entity’s internal control system.

2.1 Oversight Structure

2.02

The entity determines an oversight structure to fulfill responsibilities set forth by applicable laws and regulations, relevant government guidance, and feedback from key stakeholders. The entity will select, or if mandated by law will have selected for it by an applicable body, an oversight body. When the oversight body is composed of entity management, activities referenced in the Green Book as performed by “management” exclude these members of management when in their roles as the oversight body.

2.03

When the oversight structure of an entity is led by senior management, senior management may distinguish itself from divisional or functional management by establishing an oversight body. An oversight body oversees the entity’s operations; provides constructive criticism to management; and where appropriate, makes oversight decisions so that the entity achieves its objectives in alignment with its integrity and ethical values. Members of an oversight body review management’s activities, present alternative views, and act when faced with actual or suspected wrongdoing.

2.04

In selecting members for an oversight body, the entity or applicable body defines the entity knowledge, relevant expertise, number of members, and possible independence needed to fulfill the oversight responsibilities for the entity.

2.05

Members of an oversight body understand the entity’s objectives, its related risks, and expectations of its stakeholders. In addition to an oversight body, an organization within the federal government may have several bodies that are key stakeholders for the entity, such as the White House, Congress, the Office of Management and Budget, and the Department of the Treasury. An oversight body works with key stakeholders to understand their expectations and help the entity fulfill these expectations if appropriate.

2.06

The entity or applicable body also considers the expertise members need to oversee, question, and evaluate management. Capabilities expected of all members of an oversight body include integrity and ethical values, leadership, critical thinking, and problem-solving abilities.

2.07

Further, in determining the number of members of an oversight body, the entity or applicable body considers the need for members of the oversight body to have specialized skills to enable discussion, offer constructive criticism to management, and make appropriate oversight decisions.

2.08

If authorized by applicable laws and regulations, the entity may also consider including independent members as part of an oversight body. Independent members with relevant expertise provide value through their impartial evaluation of the entity and its operations in achieving objectives.

2.2 Oversight for the Internal Control System

2.09

The oversight body oversees management’s design, implementation, and operation of the entity’s internal control system.

The oversight body’s responsibilities for the entity’s internal control system include the following:

  • Control Environment - Establish integrity and ethical values, develop expectations of competence, and maintain accountability to all members of the oversight body and key stakeholders.
  • Risk Assessment - Oversee management’s assessment of risks to achieving objectives, including risks related to fraud, improper payments, information security, identified and potential changes, and management override of internal control.
  • Control Activities - Provide oversight to management in the development and performance of control activities.
  • Information and Communication - Analyze and discuss information relating to the entity’s achievement of objectives.
  • Monitoring - Scrutinize the nature and scope of management’s monitoring activities as well as its evaluation and remediation of identified deficiencies.

2.10

These responsibilities are supported by the organizational structure that management establishes. The oversight body oversees management’s design, implementation, and operation of the entity’s organizational structure so that the processes necessary to enable the oversight body to fulfill its responsibilities exist and are operating effectively.

2.3 Input for Remediation of Deficiencies

2.11

The oversight body provides input to management’s plans for remediation of deficiencies in the internal control system as appropriate.

2.12

Management reports deficiencies identified in the internal control system to the oversight body. The oversight body oversees and provides direction to management on the remediation of these deficiencies. The oversight body also provides direction when a deficiency crosses organizational boundaries or units, or when the interests of management may conflict with remediation efforts. When appropriate and authorized, the oversight body may direct the creation of teams to address or oversee specific matters critical to achieving the entity’s objectives.

2.13

The oversight body is responsible for overseeing the remediation of deficiencies as appropriate and for providing direction to management on appropriate time frames for correcting these deficiencies

Assessment Observations Compared to Green Book Components, Principles, & Attributes

Control Environment

Component: Control Environment - The foundation for an internal control system. It provides the discipline and structure to help an entity achieve its objectives.

  • Principle 3 - Establish Structure, Responsibility, and Authority
    • Attributes (3.01, 3.02, 3.03, 3.04, 3.05, 3.06, 3.07, 3.08, 3.09, 3.10, 3.11, 3.12)
  • Principle 4 - Demonstrate Commitment to Competence
    • Attributes (4.01, 4.02, 4.03, 4.04, 4.05, 4.06, 4.07, 4.08)
  • Principle 5 - Enforce Accountability
    • Attributes (5.01, 5.02, 5.03, 5.04, 5.05, 5.06, 5.07, 5.08)
Risk Assessment

Component: Risk Assessment - The identification and analysis of risks facing the entity as it seeks to achieve its objectives. This assessment provides the basis for developing appropriate risk responses.

  • Principle 6 - Define Objectives and Risk Tolerances
    • Attributes (6.01, 6.02, 6.03, 6.04, 6.05, 6.06, 6.07, 6.08, 6.09, 6.10)
  • Principle 7 - Identify, Analyze, and Respond to Risks
    • Attributes (7.01, 7.02, 7.03, 7.04, 7.05, 7.06, 7.07, 7.08, 7.09, 7.10, 7.11, 7.12, 7.13, 7.14, 7.15)
  • Principle 8 - Assess Fraud, Improper Payment, and Information
    • Attributes (8.01, 8.02, 8.03, 8.04, 8.05, 8.06, 8.07, 8.08, 8.09, 8.10, 8.11, 8.12, 8.13, 8.14, 8.15, 8.16, 8.17, 8.18, 8.19, 8.20)
  • Principle 9 - Identify, Analyze, and Respond to Change
    • Attributes (9.01, 9.02, 9.03, 9.04, 9.05, 9.06, 9.07, 9.08, 9.09, 9.10, 9.11, 9.12, 9.13)
Control Activities

Component: Control Activities - The actions management establishes through policies and procedures to mitigate risks to achieving the entity's objectives to acceptable levels.

  • Principle 10 - Design Control Activities
    • Attributes (10.01, 10.02, 10.03, 10.04, 10.05, 10.06, 10.07, 10.08, 10.09, 10.10, 10.11, 10.12, 10.13, 10.14, 10.15, 10.16, 10.17, 10.18, 10.19, 10.20, 10.21, 10.22, 10.23)
  • Principle 11 - Design General Control Activities over Information
    • Attributes (11.01, 11.02, 11.03, 11.04, 11.05, 11.06, 11.07, 11.08, 11.09, 11.10, 11.11, 11.12, 11.13, 11.14, 11.15, 11.16, 11.17)
  • Principle 12 - Implement Control Activities
    • Attributes (12.01, 12.02, 12.03, 12.04, 12.05)
Information and Communication

Component: Information and Communication - The quality information management and other personnel communicate and use to support the internal control system.

  • Principle 13 - Use Quality Information
    • Attributes (13.01, 13.02, 13.03, 13.04, 13.05, 13.06, 13.07)
  • Principle 14 - Communicate Internally
    • Attributes (14.01, 14.02, 14.03, 14.04, 14.05, 14.06, 14.07, 14.08)
  • Principle 15 - Communicate Externally
    • Attributes (15.01, 15.02, 15.03, 15.04, 15.05, 15.06, 15.07, 15.08, 15.09)
Monitoring

Component: Monitoring - Activities management establishes and operates to assess the quality of performance over time and promptly resolve the findings of audits and other reviews.

  • Principle 16 - Perform Monitoring Activities
    • Attributes (16.01, 16.02, 16.03, 16.04, 16.05, 16.06, 16.07, 16.08, 16.09, 16.10)
  • Principle 17 - Evaluate Issues and Remediate Deficiencies
    • Attributes (17.01, 17.02, 17.03, 17.04, 17.05, 17.06, 17.07, 17.08)

Index of Attributes

Related Story Events

Retrieved from "https://arizonacitizenvoice.com/index.php?title=Principle_2_-_Exercise_Oversight_Responsibility&oldid=299"