SECNAVINST 5200 - Navy Issuances

SECNAV M-5200.35JUNE 2008Significant control deficiencies should be reported to the next higher level assessableunit as either a reportable condition or material weakness, based on managementjudgment.While internal control assessment documentation is required, there is no prescribedformat for completing an internal control assessment for the MIC program overall. Thegoal is to maintain internal control assessment documentation that gives managers theinformation they need to establish and improve internal controls within their command.Some form of an internal control assessment table (Example 4) is necessary todocument the internal control assessment required by SECNAVINST 5200.35E. Datafrom the Risk Assessment Table should be carried over to the internal controlassessment for the following columns: Control Number, Risk, and Internal ControlCurrently in Place.The numbers in the columns of the Internal Control Assessment Table correlate to theinstructions below:(1) Identify the control test objective to validate the assumed level of control risk.(2) Describe the design of the control, which will be tested.(3) Answer if the design of the control is effective based upon the testingperformed. (Choose either “Yes” or “No”)(4) Describe how the control operation was tested.(5) Answer if the control operation is effective based upon the testing performed.(Choose either “Yes” or “No”)(6) New level of control.Determine the new level of control risk based on the control design test and the controloperation test. For example, if the initial control risk was “Low” and was tested to beineffective for both the design and control operation tests, the new control risk levelwould be elevated to “High”. However, if the initial control risk was “Low” and both thedesign and control operation tests were effective, the control risk level would stayclassified as “Low.”Example 4: Control Assessment TableControl AssessmentCommand:Preparer:Process:ControlNumberASN(FM&C) FMOJane DoeTime and AttendanceInternal ControlCurrently in PlaceControl TestObjectiveDescription of Design TestControlDesignEffective?Description of TestControlOperationEffective?NewControlRiskLevel1Supervisor reviewsemployee’s timesheetand approves hoursworkedTo ensure supervisorsare accuratelyreviewing timesheetsReview existence ofapproved timesheetsYesCompare employee’s time withapproved timesheetYesLow2Employee reviewstime account withtimekeeper andvalidates information iscorrectTo ensure employeereview effectivelyreduces inaccuracieson recordedtimesheetsReview existence ofverification formsYesCompare approved timesheetswith timesheets recorded in theT&A systemYesLow15