OMB Circular No. A-123

Management controls, in the broadest sense, include the plan of organization, methods and procedures adopted by management to ensure that its goals are met. Management controls include processes for planning, organizing, directing, and controlling program operations. A subset of management controls are the internal controls used to assure that there is prevention or timely detection of unauthorized acquisition, use, or disposition of the entity's assets.

Developing Management Controls. As Federal employees develop and execute strategies for implementing or reengineering agency programs and operations, they should design management structures that help ensure accountability for results. As part of this process, agencies and individual Federal managers must take systematic and proactive measures to develop and implement appropriate, cost-effective management controls. The expertise of the agency CFO and IG can be valuable in developing appropriate controls.

Management controls guarantee neither the success of agency programs, nor the absence of waste, fraud, and mismanagement, but they are a means of managing the risk associated with Federal programs and operations. To help ensure that controls are appropriate and cost-effective, agencies should consider the extent and cost of controls relative to the importance and risk associated with a given program.

Standards. Agency managers shall incorporate basic management controls in the strategies, plans, guidance and procedures that govern their programs and operations. Controls shall be consistent with the following standards, which are drawn in large part from the "Standards for Internal Control in the Federal Government," issued by the General Accounting Office (GAO).

General management control standards are:

• Compliance With Law. All program operations, obligations and costs must comply with applicable law and regulation. Resources should be efficiently and effectively allocated for duly authorized purposes.

• Reasonable Assurance and Safeguards. Management controls must provide reasonable assurance that assets are safeguarded against waste, loss, unauthorized use, and misappropriation. Management controls developed for agency programs should be logical, applicable, reasonably complete, and effective and efficient in accomplishing management objectives.

• Integrity, Competence, and Attitude. Managers and employees must have personal integrity and are obligated to support the ethics programs in their agencies. The spirit of the Standards of Ethical Conduct requires that they develop and implement effective management controls and maintain a level of competence that allows them to accomplish their assigned duties. Effective communication within and between offices should be encouraged.

Specific management control standards are:

• Delegation of Authority and Organization. Managers should ensure that appropriate authority, responsibility and accountability are defined and delegated to accomplish the mission of the organization, and that an appropriate organizational structure is established to effectively carry out program responsibilities. To the extent possible, controls and related decision-making authority should be in the hands of line managers and staff.

• Separation of Duties and Supervision. Key duties and responsibilities in authorizing, processing, recording, and reviewing official agency transactions should be separated among individuals. Managers should exercise appropriate oversight to ensure individuals do not exceed or abuse their assigned authorities.

• Access to and Accountability for Resources. Access to resources and records should be limited to authorized individuals, and accountability for the custody and use of resources should be assigned and maintained.

• Recording and Documentation. Transactions should be promptly recorded, properly classified and accounted for in order to prepare timely accounts and reliable financial and other reports. The documentation for transactions, management controls, and other significant events must be clear and readily available for examination.

• Resolution of Audit Findings and Other Deficiencies. Managers should promptly evaluate and determine proper actions in response to known deficiencies, reported audit and other findings, and related recommendations. Managers should complete, within established timeframes, all actions that correct or otherwise resolve the appropriate matters brought to management's attention.

Other policy documents may describe additional specific standards for particular functional or program activities. For example, OMB Circular No. A-127, "Financial Management Systems," describes government-wide requirements for financial systems. The Federal Acquisition Regulations define requirements for agency procurement activities.