Overseeing the FACT process including approving final test plans.

Administering the governance process by chairing the FACT Technical Review Board, providing the status and results of FACT activities to the Management Controls Executive Steering Committee (MC ESC) and the FACT Technical Review Board, and documenting key decisions.

Approving test plans.

Designating a FACT Technical Review Board representative and back-up.

Providing subject matter experts (SMEs) to points of contact (POCs) to review the control design analysis to verify that the transaction lead identified key controls.

Delivering requested internal control documentation stated in the Prepared by Client (PBC) listing timely.

Developing and monitoring corrective action plans (CAPs) for identified weaknesses.

Reviewing and signing the Test Results Spreadsheet (TRS), Combined Issues Report (CIR) and Executive Summary, as applicable.

Signing the Executive Summary to acknowledge test results.

Providing clear and concise communication of FACT assessment objectives throughout the agency.

Approving the FACT assessment methodology and guidance.

Leading the coordination of testing activities and timelines with process owners, Treasury and GAO.

Ensuring the FACT team carries out assessments in a thorough, effective and timely manner.

Communicating the results of testing activities to IRS and agency management.

Collaborating with SMEs and (POCs) to assist in the timely development of the control design analysis (CDA) and test plans timely.

Communicating and coordinating with external oversight groups.

Ensuring FACT documentation meets retention standards.

Determining an appropriate sampling method and size for each control based on frequency.

Using statistical sampling methods to generate samples for testing.

Obtaining and reading applicable IRMs, interim guidance memoranda, standard operating procedures (SOPs), job aids, Servicewide Electronic Research Program (SERP) alerts, IRM Procedural Updates (IPUs), GAO/TIGTA audit reports and other guidance related to assigned test steps.

Completing and reviewing FACT planning, testing, and reporting activities to ensure that all requirements have been satisfied.

Conducting substantive testing of supporting documents received from the process owners.

Communicating exceptions found within the test plan to relevant internal and external stakeholders.

Verifying that all necessary supporting documentation is available for assigned test steps.

Verifying facts with the appropriate process owner (to include the condition, criteria, cause, and effect), when exceptions are identified.

Analyzing test results to determine if internal controls are in place and working effectively.

Reporting test results to the process owners, management, and other relevant stakeholders.

Recommending future test plan updates based on the execution of the test plan and lessons learned.

Providing guidance and support for planning, testing, and reporting activities in order to determine the effectiveness of internal controls over financial reporting, mitigate risk and ensure the quality of IRS data.

Coordinating with internal stakeholders and business units to identify areas of risk related to key internal controls.

Directing test procedures to evaluate whether internal controls are effective at managing and mitigating risk and ensuring data integrity for financial reporting.

Reporting the results of internal control testing and prompting program managers to develop and implement corrective action plans to remediate any control deficiencies and/or weaknesses that were identified during the course of the review.

Directing the entry of resulting findings into the JAMES system, monitoring of open items and review of supporting documentation until closure can be accomplished.

Engaging with external stakeholders, to include the Department of Treasury and GAO, when developing and implementing program guidance, performing assessment activities, determining outcomes and reporting results.

Developing/delivering training and Knowledge Management tools to support operationalization of internal controls activities at the program level.

Supporting team members throughout the FACT review cycle. Team leads serve as the first level of support for questions.

Providing feedback to Transaction Leads and co-Leads throughout the review process. This includes providing guidance, sharing best practices, and identifying opportunities for improvement.

Providing JAMES report of open transaction findings to Transaction Lead and co-Leads during planning stage.

Staying informed on the status of team milestones, deliverables, and issues.

Reviewing and signing-off on transaction steps and work papers in TeamMate.

Providing coaching notes to team members.

Completing assigned deliverables for Treasury and GAO stakeholders.

Providing input on program guidance, staffing, transaction assignments, and relevant timelines and deliverables.

Serving as a subject-matter-expert and providing recommendations and guidance to Section Chiefs, Transaction Leads, and Co-leads.

Helping team members resolve issues or escalate issues, as needed.

Notifying BUs, POCs, SMEs of any changes to the FACT process.

Providing POCs and SMEs to identify and describe applicable internal controls, review the CDA and verify that FACT test plans accurately capture key internal controls related to the process.

Participating in and coordinating FACT interviews and walkthroughs to describe applicable internal controls and to answer any questions.

Communicating existing audit findings or recommendations (noted by GAO or TIGTA), the status of corrective action, and how it relates to processes under review, if applicable.

Gathering and delivering Internal Control documentation that is included in the PBC listing, or has otherwise been requested, by the respective due date.

Evaluating existing management review procedures.

Reviewing and signing the TRS, CIR and Executive Summary, as applicable.

Developing, executing and monitoring CAPs (for reported issues) to meet projected completion date(s).

Providing timely PCA responses to reported issues through use of the JAMES system.

Communicating changes to relevant processes and internal controls.

Completeness

Existence and occurrence

Accuracy and valuation

Rights and obligations

Presentation and disclosure

Introduction

Scope of the test

Control test

Test objectives

Results of testing

Effectiveness of controls

Test objective (Purpose of the test)

Expected results (What is the expected outcome?)

Controls tested (Identify IRS controls tested in this test plan, and state whether they include all controls in the CDA)

Contact Name (Name of person to contact for explanation of issues/problems)

Delineate the scope of the test based on the control’s nature, frequency and timing (Are all processes being tested or a specific subset? What is the frequency of the testing?)

Identify the resource capabilities required to perform testing (What degree of knowledge is required for performing the test?)

Identify other resources needed to perform the control test (Who and what is needed to perform the testing?)

Determine of the type of relevant reporting assertion(s) provided by the control(s) (What type of assertion(s) are provided? Rights or Obligations; Completeness or Accuracy; Presentation or Disclosure; Existence or Occurrence; and Valuation or Allocation) Determination of the type of relevant reporting assertion provided by the control (What type of assertion do the controls provide?) Rights or Obligations; Completeness or Accuracy; Presentation or Disclosure; Existence or Occurrence; and Valuation or Allocation

Identify the method(s) of testing (Inspection of Documents, Observation, Inquiry or Walkthrough, or Reperformance)

Determine the sample size and basis (Specify the method used to select the sample and sample size.)

Assess QAR to determine if the transaction meets the criteria to be deemed a QAR as discussed in IRM 1.4.31,IRS Quality Assurance Review Program.

Identifies the information needed to conduct the test (List documents required for testing)

Describes the documentation requirements (Describe the documentation process of the test content and results) Steps for testing transaction controls (What are the steps to perform the test against the sample?)

In general, internal control test objectives describe an assessment of one or more aspects of an entity’s internal control system and are designed to provide reasonable assurance of achieving effective and efficient operations, reliability of reporting for internal and external use, or compliance with provisions of applicable laws and regulations.
i.) Test objectives may vary widely (based on the process under review) and are used to verify that internal controls are effective and operating as intended.

Each objective (in the test plan) includes a list of steps that describe the methodology that will be used to accomplish the test objective.

Each test plan includes an objective that addresses the design of the internal control system (under review). The purpose of this objective is to determine if the internal controls in place are designed adequately and to communicate any associated vulnerabilities. Steps (methodology) taken to achieve this objective include:
i.) Reviewing relevant internal control documents (such as operating procedures, manuals, policies, and desk guides);
ii) Conducting interviews and/or walkthroughs;
iii) Assessing risk; and
iv) Reviewing the results of other oversight activity. Relevant sources of information include GAO and TIGTA audit reports GAO Management Report (related to the IRS financial statement audit) GAO audit findings, also called Matters for Further Consideration (MFCs) Internal (IRS) reviews.

In addition, each test plan also includes an objective that verifies the status of prior FACT findings and recommendations to ensure that corrective action (when appropriate) was taken to remediate the issue observed.

Determine whether the controls that were tested are effective, overall.

Determine whether the process owner(s) consistently applied the controls.

Determine the effectiveness of the controls.

Determine if reportable issues are required.
i.) If the process owner disagrees with an issue, obtain written documentation from the process owner that describes the reason for the disagreement.
ii.) In addition, if the process owner chooses to accept the risk identified, in lieu of implementing corrective actions to remediate the finding (control deficiency, significant deficiency, material weakness), obtain written documentation that describes the rationale for doing so.

Determine if corrective action plans are required.

Verifying the entire population is accounted for when the sample is drawn.

Determining the source document or the transaction documents to be tested.

Defining the period covered by the test.

If applicable, identifying significant subsets within the population, such as high dollar value items, and working with SOI to develop an appropriate sampling plan.

The extent of uniformity of the controls and their applications at each location.

Whether the individual locations can make significant changes to the controls or their application of these controls.

The amount and nature of centralized oversight or control over local operations.

Whether there may be a need to develop separate conclusions for each location. If the testers, transaction lead or manager concluded the locations should be separate populations, then transaction leads must select separate samples at each location, and testers and management will evaluate the results of each sample separately.

Reliable: Will the sampling approach produce dependable results?

Consistent: Can the sampling approach be applied uniformly?

Valid: Does the sampling approach adhere to applicable guidance and best practices? Does the test plan measure what it is intended to measure?

Non-statistical sample: A subset of a defined population, selected using judgement, but not valid to make statistical inferences within a defined level of confidence and precision.

Random sample: A subset of a defined population, selected using a statistically valid methodology in which every member of the population has a known, non-zero probability of being selected. With this method, transaction leads can make inferences about the population with a defined level of confidence and precision. The confidence level is fixed, but the precision level can vary. Usually, estimates have more precision as sample size increases.

Seasonal fluctuations (such as periods of limited availability), due to the nature of an activity, may necessitate multiple samples that cover several periods throughout the year to ensure a representative sample. The transaction lead should fully disclose seasonal fluctuations and other noteworthy conditions to SOI so that they can make an informed recommendation for an appropriate sample methodology.

In some instances, transaction leads may find that one or more of the sample items selected for testing cannot be reviewed (for example, the transaction was reversed and is no longer there). In these circumstances, the transaction lead should work with SOI to identify a replacement sample for testing and clearly document the need for this approach. As a precaution, transaction leads may ask SOI to identify additional sample items which can be used to test a control when a sample item cannot be tested. In this scenario, the transaction lead would test the next sample item identified in the sample selection list.

Documented procedures that guide the SMR.

Reviews performed at regular intervals.

Documented and independent review of results.

Documented processes to resolve noted deficiencies.

Objectives, scope and methodology for each transaction, including the testing period, a description of the sampling methodology, and if the team deviated from the approved sampling methodology, the rationale for such actions.

Support for each test conducted, including the copies of documents examined and the rationale for key decisions and any deviations made from approved guidance.

Testing results, analysis and conclusions that provide a clear and concise summary of results cross-referenced to supporting documents and resolution of exceptions or other issues.

Evidence of transaction lead and/or supporting team member review and sign-off of workpapers and steps (as prepared) prior to supervisory review.

Evidence of FACT section chief, team lead or senior team member review of the work performed that supports conclusions about the controls tested.

Plans for the review, including the test plans.

Examination and the evaluation of the adequacy and effectiveness of the systems of internal control.

Test procedures followed, the information obtained and the conclusions reached.

Management reviews.

Audit reports.

Issues.

A lead sheet identifying all items, attributes and findings (i.e., x = exception, check mark = no exception).

For one sample, the workpapers must include one complete example that clearly identifies and documents all attributes tested.

For samples that contain exceptions, the workpapers must include all supporting documents.

Documents that may not be retrievable in their exact form at a later date. For example, if a screen print is necessary to support a number or dollar amount that may change in the future, that screen print should be retained to verify that figure as of the test date.

Planning documents and review plans.

Control questionnaires, flowcharts, checklists and the results of control evaluations.

Documentation of walkthroughs and interviews.

Organization charts, policy and procedures statements and job descriptions.

Copies of important contracts and agreements.

Letters of confirmation and representation.

Photographs, diagrams and other graphic displays.

Results of analytical review procedures.

Audit reports and management replies.

Emails, memos and other relevant correspondence.

CAPs, if appropriate and available.

Obtained guidance to understand the internal control, plan the testing and determine the nature, timing and extent of the tests performed.

Adequately planned and supervised work.

Observed standards of test work.

Obtained sufficient and appropriate documentation to support a reasonable conclusion.

Notation: Highlight or identify the specific attribute in the workpapers that the team member verified, such as a signature indicating managerial approval.

Indexing: Workpapers will be automatically indexed once loaded into TeamMate to verify test plan results are properly referenced and can be easily traced to supporting documentation. When referring to reports in TeamMate, use the reference number and page number. Based on the associated test objective to the workpapers, TeamMate will automatically assign each workpaper a reference number.

Sources of data: Clearly identify the source of any information appearing in workpapers. An independent reviewer should be able to retrace the reviewer’s steps, from basic schedules to summaries and comments. Worksheets should be cross-referenced to other related workpapers and to the test plans. Effective cross-referencing often reduces the need to duplicate data.

Workpaper summaries: The process of summarizing provides an objective overview and puts findings in perspective. The team’s summary should focus on key information and data. Do not include trivial information or editorial comments not supported by testing. Periodically summarizing findings helps verify firm control over the test.

Record Key Meetings and Interviews: Record all key discussions (meetings and interviews) used as support for key decisions (testing decisions/conclusions) and understanding the subject matter or test evidence and include the notes in the workpapers. Key decisions and conclusions are often a result of meetings and interviews. Without a record, important information will be lost. Use the format below.

Keep the Writing Simple: Workpapers should be clear and concise to an uninitiated reviewer. Avoid jargon and explain all technical terms and acronyms in a separate part of the workpapers (glossary of terms).

Keep Workpapers Understandable: Workpapers should be clear, concise and must stand on their own. They should not need any supplementary information. Anyone reading the papers should be able to determine what the team member set out to do, what they did, what they found, and what they concluded.

Safeguard PII: Some workpapers and documentation contain PII (taxpayer, employee, vendor data, etc.) based on the type of review being performed. All PII must be protected according to the guidelines in 1.4.18.12.4, Personally Identifiable Information (PII).

Keep Workpapers Relevant: Workpapers should be restricted to relevant and material matters; they should directly relate to the review’s objectives. Well-organized test plans, execution of FACT procedures and workpaper reviews help verify the inclusion of relevant documents only. Do not include editorial comments and observations not supported by testing. It is important that all conclusions are in context and related to specific evidence.

When exceptions are noted, the transaction lead should, in consultation with the team lead and section chief, determine the impact of the exception and the likelihood that the entity’s controls will fail to prevent, or detect and correct, misstatements in financial information.

When making this determination, the FACT team should consider a number of factors, to include: the frequency of errors, compliance with laws and regulations, materiality, impact to financial reporting, and if compensating controls are in place to reduce or address the impact and likelihood of the exception(s) noted, among other things.
i) In this context, a compensating control is a technique or other effort(s) designed to mitigate a control design deficiency, or ineffective operation or implementation of a control, or the simple lack of control over a financial process or program.

Test exceptions may result in audit findings which could involve deficiencies in internal control; noncompliance with provisions of laws, regulations, contracts, and operating procedures (among other things); or instances of fraud.
i) If fraud is suspected, the FACT team will pause testing, promptly notify TIGTA, and wait for instructions on how to move forward.

Control Deficiency: Exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.
i) A simple deficiency is an internal control deficiency that creates minimal exposure for management and is generally an anomaly. Examples could include missing initials indicating a supervisor’s review on 1 of 26 reconciliations sampled, or the slight delay of an internal control activity.

Significant Deficiency: A significant control deficiency, or combination of internal control deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process or report external financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the entity’s financial statements, or other significant financial reports, that is more than inconsequential will not be prevented or detected.
i) The term “remote” is defined as the chance of the future event, or events, occurring is slight.
ii) A misstatement is “inconsequential” if a reasonable person would conclude, after considering the possibility of further undetected misstatements, that the misstatement, either individually or when combined with other misstatements, would clearly be immaterial to the financial statements. If a reasonable person could not reach such a conclusion regarding a particular misstatement, that misstatement would be more than inconsequential.
iii) Significant deficiencies are reportable conditions that warrant the attention of the Management Controls Executive Steering Committee.

Material Weakness: A reportable condition, or combination of reportable conditions, that results in more than a remote likelihood that a material misstatement of the financial statements, or other significant financial reports, will not be prevented or detected. Material weaknesses are reportable conditions that warrant the attention of the Management Controls Executive Steering Committee.

Classification: The type of issue observed (Control Deficiency, Significant Deficiency, Material Weakness or MIO).

Condition: A description of the situation in which the exception or issue was observed, along with any other pertinent information.

Criteria: Criteria may include the laws, regulations, contracts, standard operating procedures, IRMs, standards, measures, expected performance, defined business practices and benchmarks against which performance is compared or evaluated.
i) Criteria identify the required or desired state or expectation with respect to the program or operation.
ii) Criteria provide a context for evaluating evidence and a basis for understanding the findings, conclusions and recommendations that are being reported.

Cause: The cause is the factor or factors responsible for the difference between the condition and the criteria. The cause may also serve as a basis for recommendations for corrective actions.
i) Common factors include poorly designed policies, procedures, or criteria; inconsistent, incomplete or incorrect implementation; unintentional oversights, or factors beyond the control of program management. Auditors may assess whether the evidence provides a reasonable and convincing argument for why the stated cause is the key factor contributing to the difference between the condition and the criteria.
ii) The FACT team should follow-up with the process owner to make sure that they have a clear understanding of the root cause.

Effect or potential effect: The effect or potential effect is the outcome or consequence resulting from the difference between the condition and the criteria. It describes the impact or potential impact associated with the deficiency observed.
i) Effect or potential effect may be used to demonstrate the need for corrective action in response to identified problems or relevant risks and should consider materiality, impact to financial reporting and compensating controls, among other things.

Recommendation: A recommendation is the FACT team’s proposed solution to address the deficiency observed and root cause.

Responsible Entity: The finding should indicate the responsible entity and process owners and/or manager(s).

Owner Response with Corrective Action Plan: After the information listed above has been prepared the FACT team issues the finding to the process owner and asks for their response. An owner response should describe management’s position on the issue and include a description of the corrective action that is planned to address the issue(s) observed. Corrective action should seek to address the root cause of the issue, correct past deficiencies (if possible) and prevent reoccurrence.
i) If, for some reason, the process owner disagrees with the FACT team’s finding and recommendation, they should include a description for the basis of their disagreements and planned action when moving forward.
ii) This also applies to situations where the process owner chooses to accept the risk associated with the deficiency. If the process owner chooses to accept the risk the FACT team will follow-up to request documentation in the form of an executed Risk Acceptance Form and Tool.

Estimated Completion Date for Corrective Action: The Owner’s Response should include an estimated completion date for the corrective action plan.