Attachment 4 - PWS Reference 003-IPPS-A PMO Internal Control Policy-26 OCT 2023.pdf

U.S. Army

Integrated Personnel and

Pay System–Army (IPPS-A)

Program Management Office

(PMO)

Internal Control Policy

Version 1.4

10 April 2023

Department of the Army

Program Executive Office Enterprise Information Systems

Integrated Personnel and Pay System–Army Program Management Office

2521 South Clark Street

Arlington, VA 22202

IPPS-A PMO Internal Control Policy V1.4 10 April 2023 i

Signature Page

Integrated Personnel and Pay System–Army

Internal Control Policy

Version 1.4

SUBMITTED:

Julius Hammond Date

Audit Lead

Integrated Personnel and Pay System–Army (IPPS-A)

CONCURRENCE:

Eric Bailey Date

Chief, Technical Management Division (TMD)

Integrated Personnel and Pay System–Army (IPPS-A)

APPROVAL:

Michael Van Buskirk Date

Deputy Product Manager

Integrated Personnel and Pay System–Army (IPPS-A)

Increment II ii

Revision History

Version

Number

Date Summary of Changes

1.0 30 July 2021 Initial draft

1.2 9 August 2021 Technical Review

1.3 21 September

DASA-FO Review

1.4 10 April 2023 Annual Review – No Updates iii

Table of Contents

1.0 INTRODUCTION

1.1 Purpose

1.2 Scope

1.3 Changes to This Document

1.4 References

2.0 INTERNAL CONTROL AND INTERNAL REVIEWS

2.1 Internal Control

2.2 Internal Review

2.3 Responsibilities

2.4 Standard Operating Procedure

2.5 Assessable Unit

2.6 Corrective Active Plan

3.0 MONITORING AND REPORTING

4.0 INTERNAL CONTROL REVIEW SCHEDULE

5.0 IPPS-A AUTOMATED INTERNAL CONTROL DATABASE

APPENDIX A ACRONYMS AND ABBREVIATIONS ............................................................. A-1

List of Figures

Figure 1 IPPS-A Automated Internal Control Database (ICDB)

List of Tables

Table 1 IPPS-A Assessable Units

1.0 INTRODUCTION

Internal Controls (IC) are essential risk management processes that safeguard financial integrity, security, and operating effectiveness of systems. ICs accomplish this by continuously monitoring, evaluating, and reporting on the organization’s functional business areas (Assessable Units) through well-established Standard Operating Procedures (SOPs) per the Federal, DOD (Department of

Defense), and Army policies.

1.1 Purpose

The purpose of this policy is to provide the Program Manager (PM) guidance for the IPPS-A Internal

Control Program (ICP)/Commanders’ Internal Control Program. All IPPS-A program personnel, (Service Members, civilians and contractors) shall develop, implement and continuously enforce proper internal controls for IPPS-A PMO functional and technical operations.

1.2 Scope

The policy is applicable to the Program Management Office (PMO), the System Integrator (SI), Functional Management Division (FMD) performance of the Project Management Office (PMO) functional areas for the management and maintenance of IPPS-A, as seen in Table 1. Other IPPS-A functional areas, i.e., Budget, Defense Travel System (DTS), Contracts, Manpower, are covered under the Army’s Risk Management Internal Control (RMIC) Program for the respective functions.

1.3 Changes to This Document

This document will be reviewed and updated (if required) by the PMO Audit team annually (fiscal year) at a minimum and maintained by the PMO configuration management team for version control.

1.4 References

The following documents apply to this Policy:

• Federal Information System Controls Audit Manual (FISCAM)

• The National Institute of Standards and Technology (NIST) 800-53 R4

• AR 11-2 Managers’ Internal Control Program

• AR 11-7 Internal Review Program

• Army Risk Management Internal Control (RMIC) Program

• IPPS-A Internal Control Plan (ICP)

2.0 INTERNAL CONTROL AND INTERNAL REVIEWS

2.1 Internal Control

A strong IPPS-A Internal Control Program (ICP) will contribute to the Army meeting its goal for reliable financial reporting (Military Personnel Appropriation) and will support the Army in achieving an unmodified financial statement audit opinion.

Internal Controls (IC) provide standardized, measurable, and repeatable steps for organizations to take to help reduce risk to a level deemed acceptable, while accomplishing mission goals and objectives.

The purpose of (IC) is to enable organizations to achieve their goals and missions while reducing unnecessary risk. Managers and team leads are responsible for the design, implementation, and maintenance of all internal controls within their daily business operations. The Audit Team is responsible for the overall oversight of the control environment.

Strong internal controls allow organizations to achieve four main objectives, which are:

• Accurate and reliable financial reporting

• Compliance with laws and regulations

• Effectiveness and efficiency of the organization’s operations

• Contributes to an Unmodified' financial statement audit opinion

In order to achieve these objectives, the IPPS-A ICP must be applied and followed throughout the organization.

2.2 Internal Review

The IC review provides IPPS-A leaders, managers, and supervisors with reasonable assurance about the appropriateness of the design, and operating effectiveness of the IC environment.

IPPS-A IC review is an overall assessment of an organization’s internal control system across each business area. This review determines if the business activity is functioning as intended and if it is able to manage the risks that the system may face in its day-to-day or sustainment operations. The IC review provides IPPS-A leaders, managers, and supervisors with reasonable assurance about the appropriateness of the design, and operating effectiveness of the IC environment. The best way for

IPPS-A to ensure that its internal control system is operating efficiently is with continuous IC assessments and monitoring per the Program’s ICP. These reviews highlight vulnerabilities in IPPS-

A’s IC environment and identify processes that can be strengthened to reduce unnecessary risk.

2.3 Responsibilities

Everyone is responsible for IC. All Service Members, civilians, and contractors must ensure that

IPPS-A daily operations are carried out with the highest level of professionalism and integrity to maintain the operational effectiveness and efficiency of the system. Division Chiefs and Leads are especially responsible for the monitoring, reporting, and continuous evaluation of business processes under their control that contributes to the overall operational effectiveness of IPPS-A. Furthermore, everyone must ensure that IPPS-A’s operations are compliant per applicable Federal, DoD, and Army policies. The following are specified responsibilities for IPPS-A internal controls owners:

Product Manager (PdM): Publish IPPS-A Internal Control Policy. Review IPPS-A IC report at least annually to support the Army’s Risk Management Internal Control (RMIC) Program.

Division Chiefs: Ensure that business processes are supported by reliable, accurate, and complete SOPs that incorporate proper ICs. Ensure that leads understand their IC responsibilities and are performing periodic reviews of their SOPs. Support the Audit Team’s request for information (RFI) for internal assessments and external audits. Periodically review reports and metrics to ensure IC compliance within their area of responsibility.

Government Leads: Accountable for IC within their designated business areas. Ensure all business processes are supported by SOPs that correctly address IC. Review and evaluate business outputs such as reports and metrics on a standard periodic review frequency. Supervise the creation of Corrective

Action Plans (CAPs) for IC assessment findings. Review the internal control metrics based on operational requirements to ensure IC compliance. Provide timely responses to the Audit Team’s RFI to support internal and external audits, and work with the audit team to correct IC deficiencies.

System Integrator (SI): Responsible for delivering and implementing internal controls for audit compliance following the Program policies per the requirements of their contract. Internal control processes and procedures for managing, conducting and monitoring compliance requirements must be included within operational SOPs and other relevant Program documents. The SI conducts the monthly

ICP assessments under PMO oversight and is responsible for developing and managing ICP CAPs for their operational areas of responsibility.

Audit Team: Oversees the ICP. Create and maintain the IPPS-A IC plan and Audit SOP. Perform periodic internal assessments for functional and technical business process controls. Assist divisions to correct IC deficiencies and the monitoring of CAPs until complete. Provide IC metrics to report on the auditability and compliance of the program.

2.4 Standard Operating Procedure

SOPs are essential to IPPS-A’s daily operations. An SOP is “a clearly written set of instructions for methods detailing the procedures for carrying out a routine or recurring task.” An SOP enables the following:

1. Compliance to laws, regulations, and policies

2. Internal controls validation

3. Standard business operations

4. Continuity of operations

5. Internal reviews

6. External audits

Each IPPS-A business activity must document their IC and audit compliance processes and procedures, as appropriate, within operational SOPs where necessary to supplement other Program operational documents. All Program SOPs addressing IC processes and procedures must be reviewed at a minimum annually by the document owner(s) or as required in response to business process changes and updates.

2.5 Assessable Unit

For the Program, an Assessable Unit (AU) is major functional area within IPPS-A PMO. For example, Cyber Security, Access Control, Configuration Management, and Infrastructure are AUs. Each AU contains several business activities that makes up the total AU. These activities comprise internal controls, and each activity is reviewed by the audit team for compliance and operational effectiveness.

The following table shows IPPS-A AUs (functional areas) within IPPS-A ICP.

Table 1 IPPS-A Assessable Units

Assessable Unit

Access Control

Business Process

Change Management

Configuration Mgt.

Contingency Planning

Cybersecurity/Security Mgt

Data Management & Interfaces

Segregations of Duties

2.6 Corrective Action Plan

A Corrective Action Plan (CAP) is a plan for remediating or correcting an IC issue that cannot be corrected within the review period. A CAP will be created for each failed business process that cannot be corrected within 30 days following the end of the assessment and remediation period. CAPs are also created for all official external audits resulting in a Notice of Finding (NFR). It is the responsibility of each lead or control owner to create and complete CAPs for issues under their control. The Audit Team will provide the CAP template, instructions for creating CAPs, review the drafted CAPs for accuracy and perform the validation to confirm the CAP addresses the required corrective actions. The Audit team is also responsible for reviewing and closing CAPs to ensure the issue was appropriately resolved.

3.0 MONITORING AND REPORTING

Successful business activities have effective monitoring processes. Monitoring is an automated and/or manual “check-check” control that ensures functional and technical business processes are operating as designed and are operating effectively. This is accomplished by periodically reviewing reports and metrics for compliance to set standards. All IPPS-A PMO functional and technical business activities will have an appropriate monitoring process. Business process outputs such as metrics and reports will be readily available for internal IC reviews and external audits.

4.0 INTERNAL CONTROL REVIEW SCHEDULE

The IPPS-A ICP review schedule is the IPPS-A PMO annual internal testing cycle that looks at a subset of IPPS-A internal controls each month. The review frequency is set on a monthly, quarterly, semi-annual, or annual cycle. All controls are tested within the calendar year based on the annually schedule. The testing frequency for each control is determined by the risk that each control poses to

IPPS-A, as determined by the Program Audit Triad; the higher the risk the more frequent the review.

The SI Audit Team is responsible for developing and maintaining the schedule, and the PMO Audit

Lead is responsible for approving the schedule. The SI team will inform control owners one month prior to the testing event based on the schedule. If the control owner cannot accommodate the testing date based on a greater priority, they must inform the SI audit lead with the reason for the delay and propose an alternate date 14 days in advance. Personnel are the first line of defense for the operating environment who support the second line of defense in the form of Internal Controls. The third line of defense is the ICRs which provide reasonable assurance that the first and second lines of defense are operating as intended. Therefore, everyone will make the best effort to comply with the Internal

Review Schedule.

5.0 IPPS-A AUTOMATED INTERNAL CONTROL DATABASE

The Internal Control Database (ICDB) is the automated internal control assessment tool that contains the catalog of IPPS-A business process controls. IPPS-A SI and PMO audit teams operate and maintain the ICDB. The database is used to maintain, test, and report on the effectiveness and compliance of

IPPS-A PMO business activities (please see the IPPS-A PMO Internal Audit Plan for more information about the ICDB). The ICDB features are as follows:

• IC (Metrics) Dashboard

• Process Controls Catalog

• Process Control Tests

• Test Results

• Controls Statuses

• ICR Schedule

• Corrective Active Plans

• Audit Issue Tracker

• IPPS-A Compliance Audit Report

Figure 1 IPPS-A Automated Internal Control Database (ICDB)

IPPS-A PMO Internal Control Policy V1.4 4 April 2023

A-1

APPENDIX A ACRONYMS AND ABBREVIATIONS

The following acronyms are found in the document. This table serves as a quick reference for acronym definitions

AU Assessable Unit

CAP Correction Action Plan

DoD Department of Defense

DASA-FO Deputy Assistant Secretary of the Army Financial Operations

IC Internal Control

DTS Defense Travel System

FMD Functional Management Division

ICDB IPPS-A (Automated) Internal Control Database

ICP Internal Control Program

ICP Internal Control Policy

ICR Internal Control Review

MILPERS Military Personnel

NFR Notice of Finding

PBC Provided by Client

PdM Product Manager

PM Program Manager

PMO Program Management Office

RFI Request for Information

RMIC Risk Management Internal Control

SI System Integrator

SOP Standard Operating Procedures