OMB Circular A-123

10.1.4 - OMB Circular A-123 (Rev. 10614, Issued: 03-23-21, Effective: 10-01-20, Implementation: 04-22-21) A revised OMB Circular A-123, Management’s Responsibility for Internal Control, issued in December 21, 2004 under the authority of FMFIA, provided specific requirements for assessing and reporting on internal controls. In July 2016, OMB Circular A-123 was again revised, and the title was changed to Management’s Responsibility for Enterprise Risk Management and Internal Control. This Circular defines management’s responsibilities for enterprise risk management (ERM) and internal control. The Circular provides updated implementation guidance to federal managers to improve accountability and effectiveness of federal programs as well as mission-support operations through implementation of ERM practices and by establishing, maintaining, and assessing internal control effectiveness. The Circular emphasizes the need to integrate and coordinate risk management and strong and effective internal control into existing business activities and as an integral part of managing an Agency. Pursuant to OMB Circular A-123, agencies are required to provide an annual assurance statement which represents the agency head’s informed judgment as to the overall adequacy and effectiveness of internal controls related to operations, reporting, and compliance. Appendix A to OMB, Internal Control Over Financial Reporting, was issued in 2004, which required the heads of certain federal agencies to annually document and assess internal controls over financial reporting and report the results in a management assurance statement. In June 2018, an updated version of Appendix A, Management of Reporting and Data Integrity Risk was issued, which among other changes, aligns Appendix A with the 2014 update to the Government Accountability Office (GAO) Green Book in part, by expanding the scope from ICOFR to include internal control over reporting (ICOR). CMS conducts annual A-123 internal control reviews. Contractors will be subject to the annual A-123 internal control review. In lieu of an A-123 internal control review, contractors may be selected for a Statement on Standards for Attestation Engagements No. 18 (SSAE-18) internal control examination. End Section 10.1.4 – OMB Circular A-123: Back to Table of Contents