Sources of Information. The agency head's assessment of management controls can be performed using a variety of information sources. Management has primary responsibility for monitoring and assessing controls, and should use other sources as a supplement to -- not a replacement for -- its own judgment. Sources of information include:
Use of a source of information should take into consideration whether the process included an evaluation of management controls. Agency management should avoid duplicating reviews which assess management controls, and should coordinate their efforts with other evaluations to the extent practicable.
If a Federal manager determines that there is insufficient information available upon which to base an assessment of management controls, then appropriate reviews should be conducted which will provide such a basis.
Identification of Deficiencies. Agency managers and employees should identify deficiencies in management controls from the sources of information described above. A deficiency should be reported if it is or should be of interest to the next level of management. Agency employees and managers generally report deficiencies to the next supervisory level, which allows the chain of command structure to determine the relative importance of each deficiency.
A deficiency that the agency head determines to be significant enough to be reported outside the agency (i.e. included in the annual Integrity Act report to the President and the Congress) shall be considered a "material weakness." This designation requires a judgment by agency managers as to the relative risk and significance of deficiencies. Agencies may wish to use a different term to describe less significant deficiencies, which are reported only internally in an agency. In identifying and assessing the relative importance of deficiencies, particular attention should be paid to the views of the agency's IG.
Agencies should carefully consider whether systemic problems exist that adversely affect management controls across organizational or program lines. The Chief Financial Officer, the Senior Procurement Executive, the Senior IRM Official, and the managers of other functional offices should be involved in identifying and ensuring correction of systemic deficiencies relating to their respective functions.
Agency managers and staff should be encouraged to identify and report deficiencies, as this reflects positively on the agency's commitment to recognizing and addressing management problems. Failing to report a known deficiency would reflect adversely on the agency.
Role of A Senior Management Council. Many agencies have found that a senior management council is a useful forum for assessing and monitoring deficiencies in management controls. The membership of such councils generally includes both line and staff management; consideration should be given to involving the IG. Such councils generally recommend to the agency head which deficiencies are deemed to be material to the agency as a whole, and should therefore be included in the annual Integrity Act report to the President and the Congress. (Such a council need not be exclusively devoted to management control issues.) This process will help identify deficiencies that although minor individually, may constitute a material weakness in the aggregate. Such a council may also be useful in determining when sufficient action has been taken to declare that a deficiency has been corrected.