SECNAVINST 5200 - Navy Issuances

SECNAV M-5200.35JUNE 2008Figure 2 is a decision diagram to better illustrate the three risks. Percentages are usedto distinguish the different risks; however, are not required when preparing the riskassessment.Figure 2: Risk DiagramData entry error2% - Likelihoodof misstatementCombined risk10%Control riskData entry errorControl – Add Reconciliation Totals90%Data entryof invoices20%Inherent riskData entry is correct18% - Correct80%Data entry is correct80% - CorrectWhile required, there is no prescribed format for completing a risk assessment for theMIC program overall. The goal is to maintain documentation that gives managers theinformation they need to establish and improve internal controls to provide reasonableassurance.A command’s risk assessment should be used to support daily management decisions,MIC requirements, and the Naval Inspector General’s (NAVINSGEN) Risk/Opportunitydata call. The risk assessment required by SECNAVINST 5200.35E is not intended toduplicate other risk assessments being conducted at the command level. Figure 3illustrates how a command’s risk assessment can support both the NAVINSGEN datacall and the MIC Certification Statement.Figure 3: Risk Assessment Process FlowNAVINSGENRisk/OpportunityData CallMICCertificationStatementList of Risksgrouped byseverityList ofcontrols tomitigate risksList of controlsthat are notworkingeffectivelyList ofMaterialWeaknessesRiskAssessmentEstablishControl ActivitiesInternal ControlAssessmentIdentify MaterialWeaknesses11