Attachment_D.9_-_Risk_Assessment_Checklist.xlsx
XLSX spreadsheet 27 KB Posted
- Solicitation number
- SOL-620-16-000001
About this file
ATTACHMENT D.9 - Risk Assessment Checklist
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Ammendment_1_-_SOL-620-16-000001.pdf | ||
| Attachment_D.3_Price_Worksheet.xls | XLS spreadsheet | |
| Attachment_D.2_-_BPA_Call_Order_02__RFQ_-_STEER.pdf | ||
| Attachment_D.1_-_BPA_Call_Order_01_RFQ_-_SMILE.pdf | ||
| Attachment_D.13_-_Contractor_Bio_Data_Sheet.doc | DOC document | |
| Attachment_D.6_-_Contract_Performance_Report_Short_Form.docx | DOCX document | |
| Attachment_D.12-_Implementation_Matrix.xlsx | XLSX spreadsheet | |
| Attachment_D.8_-_Branding_and_Marking_Requirements_Waiver.pdf | ||
| Attachment_D.4_-_Financial_review_format.doc | DOC document | |
| Attachment_D.11_-_Questionable_Cost_Matrix.xlsx | XLSX spreadsheet | |
| Attachment_D.7_-_SF-LLL.pdf | ||
| SOL-620-16-000001_-_Audit_and_Financial_Review_Services.pdf | ||
| Attachment_D.5_-_Intenal_Control_Env._Checklist.xlsx | XLSX spreadsheet | |
| Attachment_D.10_Internal_Control_questionnaire.xls | XLS spreadsheet |
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Risk Assessment ATTACHMENT D.9 RISK ASSESSMENT CHECKLIST (ref. ADS 591, last revised 01/09/02)
| Organization: ___________________________________ |
| Award No.: ___________________________________ |
| Effective Date: ___________________________________ |
| Award Amount: ___________________________________ |
| Type of Organization: ___________________________________ |
| Assessment Conducted by: ___________________________________ |
| Period of Assessment: ___________________________________ |
| Once the reviewer has developed a reasonable understanding of the organization's control environment, the following risk assessment checklist should be completed. The checklist details the specific control techniques that should be reviewed in order to determine the risk level for each recipient of USAID funds that expends less than $300,000 per fiscal year and is not required to have an annual audit. The checklist should be completed for each applicable recipient and updated on a periodic basis. | ||||||||
| CONTROL TECHNIQUES | ANSWER | Answer Based On: | Doc. | |||||
| Yes | No | N/A | Inquiry | Observation | Test | Reference | REMARKS |
I AUTHORIZATION
| Authorization controls are designed to provide reasonable assurance that transactions, events from which they arise and procedures under which they are processed are authorized in accordance with laws, regulations and management policy. Typical authorization controls include: | |
| 1 | Documented policies establish events or transactions that the organization is authorized to engage in by law, regulation or management policy. |
| 2 | Documented policies and procedures exist for processing transactions in accordance with laws, regulations or management policy. |
| 3 | Master files include only authorized employees, customers or suppliers. |
II APPROVAL
| Approval controls are designed to provide reasonable assurance that appropriate individuals approve recorded transactions in accordance with management's general or specific criteria. Typical approval controls include: | |
| 1 | Specific transactions are approved by persons having the authority to do so in accordance with established policies and procedures. |
| 2 | Transactions are compared with predetermined expectations and exceptions are reviewed by someone authorized to approve them. |
| 3 | Transactions are compared with approved master files before approval or acceptance, and exceptions are reviewed by someone authorized to approve them. |
| 4 | Key records are matched before a transaction is approved (matching purchase order, receiving report and vendor invoice before the invoice is approved for payment). |
| 5 | Prior to acceptance, changes to data in existing files are independently approved, evidenced by documentary approval of input before processing. |
III SEGREGATION OF DUTIES
| Segregation of duties controls are designed to reduce the opportunities for someone to perpetrate and/or conceal errors or irregularities in the normal course of their duties. Typical segregation of duties controls include: | |
| 1 | The individual responsible for the cash receipts function does not sign checks or reconcile the bank accounts, and is not responsible for noncash accounting records such as accounts receivable, the general ledger or the general journal. |
| 2 | The person receiving cash does not have the authority to sign checks and reconcile bank accounts and does not have access to accounting records other than cash receipts. |
| 3 | Different individuals are responsible for purchasing merchandise or services, receiving merchandise or services and approving vouchers. |
| 4 | Different persons prepare checks, sign checks, reconcile bank accounts and have access to cash receipts. |
IV. DESIGN AND USE OF RECORDS
| The purpose of controls over the design and use of records is to help provide reasonable assurance that transactions and events are properly recorded. | |
| 1 | Pre-numbered forms are used to record all of an organization's transactions, and accountability is maintained for the sequence of all numbers used. |
| 2 | Receiving reports, inspection documents, etc. are matched with billing notices or other documents used to record delivered orders and related liabilities to provide assurance that only valid transactions are recorded. |
| 3 | Transaction documents, such as vendor invoices and shipping documents, are date stamped and tracked to ensure that they are recorded on a timely basis. |
| 4 | Source documents are canceled after processing to provide assurance that the same documents will not be reused and will not result in recording transactions more than once. Also, only original documents are used to process transactions. |
V SAFEGUARDS OVER ACCESS TO AND USE OF ASSETS AND RECORDS
| Access controls are designed to protect assets and records against physical harm, loss, misuse, or unauthorized alteration. These controls restrict unauthorized access to assets and records. Typical access controls are: | |
| 1 | Cash receipt totals are recorded before cash is transmitted for deposit. |
| 2 | Secured facilities are used when appropriate, and access to critical forms and equipment is limited to authorized personnel. |
| 3 | Access to programs and data files is restricted to authorized personnel. |
| 4 | Assets and records are protected against physical harm. |
| 5 | Incoming and outgoing assets are counted, inspected and received or given up on the basis of proper authorization in accordance with established procedures. |
| 6 | Procedures are established to provide reasonable assurance that current files can be recovered in the event of a computer failure. |
| 7 | Access to critical forms and records is restricted. |
VI INDEPENDENT CHECKS
| Controls in this category are designed to provide independent checks on the validity, accuracy and completeness of processed data. The following procedures are typical of this category of controls: | |
| 1 | Calculations, extensions, additions and accounting classifications are independently reviewed. |
| 2 | Assets on hand are periodically inspected and counted, and the results are compared with asset records. |
| 3 | Subsidiary ledgers and records are reconciled to the general ledger. |
| 4 | The organization promptly follows-up on complaints from vendors, customers, employees and others. |
| 5 | Management reviews performance reports. |
| 6 | Data from different sources are compared for accuracy and completeness (the cash journal entry is compared with the authenticated bank deposit slip). |
| 7 | Actual operating results are compared with approved budgets, and variances are explained. |
VII VALUATION OF RECORDED AMOUNTS
| Controls in this category are designed to provide assurance that assets are valued at appropriate amounts. Typical valuation controls are: | |
| 1 | Periodically, the condition and marketability of assets are evaluated (for example, accounts receivable are periodically evaluated for collectibility). |
| 2 | Recorded data are compared with information from an independent third party (for example, recorded cash is reconciled to bank statements). |
| 3 | Assessed values, such as independent appraisals of assets, are compared with the accounting records. |
VIII SUMMARIZATION OF ACCOUNTING DATA
| Controls in this category are designed to provide assurance that transactions are accurately summarized and that any adjustments are valid. Typical controls in this category include: | |
| 1 | The sources of summarized data are compared with the underlying subsidiary records and/or documents before the data are accepted for inclusion in summarized records and reports. |
| 2 | Procedures are followed to check the completeness and accuracy of data summarization, and exceptions are reviewed and resolved by authorized persons. |
IX ASSETS AND LIABILITIES
| Controls in this category are designed to provide assurance that (1) the organization owns recorded assets, with the ownership supported by appropriate documentation; (2) the organization has the rights to its assets at a given date; and (3) recorded liabilities reflect the organization's legal obligations at a given date. The following procedures are typical for this category of controls: | |
| 1 | Policies and procedures are documented for initiating transactions and for identifying and monitoring those transactions and amounts requiring attention relative to ownership issues. |
| 2 | Policies and procedures are documented for initiating and monitoring transactions and amounts related to liabilities. |
| 3 | Significant transactions require the approval of senior management. |
| 4 | Reported results and balances are compared with plans and authorizations. |
X PRESENTATION AND DISCLOSURE
| Controls in this category are designed to provide assurance that (1) accounts are properly classified and described in the financial statements; (2) the financial statements are prepared in accordance with applicable accounting principles; and (3) footnotes contain all information to be disclosed. The following procedures are typical of this category of controls: | |
| 1 | Policies and procedures are documented for accumulating and disclosing financial information in the financial statements by appropriate personnel and in accordance with the terms of the agreement. Responsibility is assigned to specific individuals. |
| 2 | Policies and procedures are documented for preparing financial statements by authorized personnel having sufficient experience and expertise to ensure compliance with applicable accounting principles. |
| 3 | Policies and procedures are documented for properly classifying and describing financial information in the financial statements. |
| 4 | Reports are periodically substantiated and evaluated by supervisory personnel. Procedures have been implemented to detect errors and omissions and to evaluate recorded balances. |
| 5 | A written chart of accounts containing a description of each account is used. Journal entries are prepared, reviewed, compared with supporting details where necessary and approved each accounting period. |
| 6 | Appropriate processing procedures are used including control or batch totals; written cutoff and closing schedules are also used. |
| 7 | The same chart of accounts is used for both budgeting and reporting, and variances between actual and planned results are analyzed. |
Overall Risk Level Suggested Actions
| High | A full scope Annual |
| Recipient Audit until the risk | |
| is reduced. |
| Medium | A full scope recipient audit on |
| 30% of this category every | |
| 3 years and interim reviews as | |
| deemed necessary. |
| Low | Interim reviews as deemed |
| necessary |
Based on a percentage of "NO" Answers to the checklist questions, a "suggested" determination of risk level would be as follows:
High 70% to 100% of answers are NO
Medium 31% to 69% of answers are NO
Low 0% to 30% of answers are NO
Appendix 2
File details come from the government source that posted it. Updated .