Thomas P. DiNapoli OFFICE OF THE COMPTROLLER STATE COMPTROLLER

DIVISION OF STATE GOVERNMENT ACCOUNTABILITY

Audit Objective...... 2

Audit Results – Summary...... 2 DIVISION OF MILITARY Background...... 2 AND NAVAL AFFAIRS Audit Findings ...... 3

Quality of Internal Control Certification ...... 3

Audit Scope and Methodology...... 5 QUALITY OF INTERNAL

Authority...... 6 CONTROL CERTIFICATION

Reporting Requirements...... 6

Contributors to the Report ...... 6

Appendix A - Auditee Response.... 7 Report 2008-S-112

AUDIT OBJECTIVE together to provide reasonable assurance that the organization will achieve its objectives Our objective was to determine whether the and mission. While the overall purpose of Division of Military and Naval Affairs internal control is to help an organization (DMNA) submitted a quality internal control achieve its mission, internal control also helps certification to the Division of Budget by an organization to promote orderly, April 30, 2008. economical, efficient and effective operations, and produce quality products and services AUDIT RESULTS - SUMMARY consistent with the organization's mission; safeguard resources against loss due to waste, The Division of Budget (DOB) requires abuse, mismanagement, errors and fraud; agencies to certify compliance with the promote adherence to laws, regulations, State’s Internal Control Act annually by contracts and management directives; develop submitting an internal control certification, and maintain reliable financial and which includes both an internal control management data, and accurately present that summary report as well as a signed data in timely reports. certification to attest that they met required internal control provisions. The Division of Budget’s Budget Policy and Reporting Manual Bulletins B-350 and B- We determined DMNA submitted a quality 1177 require the head of each covered State internal control certification to DOB by April agency and public authority to certify 30, 2008. The DMNA certification compliance with the State’s Internal Control addressed all the requirements of Budget Act by April 30 of each year by submitting a Policy and Reporting Manual Item B-350 Certification and Internal Control Summary including a detailed responses to questions in of the internal control activities undertaken the Internal Control Summary that and during the previous year. The current Internal Control Task Force requirements in the BPRM B-350 internal recommendations. During our review, we control certification has been updated with a found adequate support to confirm the list of agencies required to establish and information in the certification was accurate. maintain an internal audit function and also requires agencies identify specific actions This report, dated September 25, 2008, is taken to implement each of the available on our website at: recommendations in the Internal Control Task http://www.osc.state.ny.us. Force report “The New York State Internal Add or update your mailing list address by Control Act Implementation Guide: contacting us at: (518) 474-3271 or Strengthening Compliance with the Act and Office of the State Comptroller Standards.” These recommendations include Division of State Government Accountability specific guidance for agencies, the Internal 110 State Street, 11th Floor Control Task Force, NYS Division of Budget Albany, NY 12236 and the NYS Comptroller’s Office. The recommendations were developed to provide BACKGROUND agencies with an improved level of assurance that an appropriate set of controls are in place Internal controls are the integration of the within the agency and are functioning activities, plans, attitudes, policies, and efforts properly. Recommendations directed toward of the people of an organization working agencies relate to internal control

Report 2008-S-112 Page 2 of 7

coordination, implementation, education and AUDIT FINDINGS training as well as internal audit organization, staffing, processes, and continuing education. Quality of Internal Control Certification The mission of DMNA is to: “Provide forces to execute global missions across full The Division of Budget(DOB) requires spectrum operations as directed in support of agencies to certify compliance with the our communities, civil authority and National State’s Internal Control Act annually by Military and Homeland Security Strategies.” submitting an internal control certification, which includes both an internal control DMNA is a state agency that serves as the summary report as well as a signed headquarters for New York's militia forces certification to attest that they met required (the Army National Guard, the Air National internal control provisions. Guard, the New York Guard and the New York ). In addition, it performs In order to determine if DMNA submitted a federal functions required to support the quality certification, we reviewed the Army and Air National Guard. Division of certification to see if they followed the Military and Naval Affairs personnel, military certification instructions outlined in the and civilian, serve under The Adjutant Budget Policy and Reporting Manual Item B- General, who must be an Army or Air 350, and followed the internal control National Guard commander and who is requirements outlined in the NYS Internal responsible to the Governor for proper Control Act Implementation Guide and the administration and for assuring the New York Internal Control Task Force militia is prepared to perform emergency state Recommendations in the Standards for roles as directed by the Governor. The Internal Control in New York State Adjutant General is also responsible to the Government which are the basis for the Department of Defense for assuring the certification. We also determined a quality military training and preparedness of the certification should show evidence an agency Army and Air National Guard units in New responded to all the questions, provided York. The National Guard is, by national explanation and detail when required, and policy, an integral part of America's military answered the questions accurately. forces. The New York Army National Guard provides combat units of almost all types, To assure accuracy of the information combat support elements, and a variety of reported, we reviewed supporting specialized services. Nonetheless, the Guard documentation, provided by DMNA, for the is a fundamentally a "state" entity. certification submitted for 2007-08.

The current DMNA Internal Control Officer We determined DMNA submitted a quality (ICO) has been in her position since March internal control certification to DOB by April 2008. The previous ICO coordinated the 30, 2008. The DMNA certification implementation of an enhanced risk addressed all the requirements of Budget assessment program and designed a formal Policy and Reporting Manual Item B-350 presentation program for reporting the status including detailed responses to questions in of DMNA internal control program to The the Internal Control Summary and Internal Adjutant General. Control Task Force recommendations. During our review, we found adequate

Report 2008-S-112 Page 3 of 7

support to confirm the information in the process for identifying improvement areas, certification was accurate. corresponding corrective actions and implementation status of all corrective Certification actions. DMNA responded to this recommendation that they implemented the The internal control summary report asks use of a standardized form. The new form is agencies to respond to a series of questions to provide a medium for unit managers to regarding the agency’s internal control system identify areas that require improvement and and also requests information on the specific propose corrective actions. Proposed actions taken by the agency to implement the corrective actions are tracked internally by recommendations made by the Internal Assessable Unit Managers and by the ICO via Control Task Force. Most of the questions the Management Control Plan (MCP). require the agency to provide detailed responses. Supporting Documentation

The responses provided by DMNA on the We found DMNA had adequate internal control summary were detailed and documentation to support their certification. offered specific information relating to the questions. For example, when asked to For example, DMNA provided a copy of their Describe the measures instituted to sustain Internal Control Program (PAM 11-2) which the effectiveness of the internal control provides a step by step outline of the DMNA program during 2007-08., DMNA responded: internal control process.

“During reporting year 2007-08 DMNA Also, during reporting year 2007-08 DMNA commenced a 100% re-evaluation of its commenced a 100% re-evaluation of its State Internal Control Program using a four step Internal Control Program. The revised process to (1) facilitate the identification of program calls for the Directors to routinely agency functions and objectives, (2) assess evaluate their programs and conduct formal agency risks and vulnerabilities, (3) review annual evaluations. To accomplish this task existing controls and (4) take appropriate and as recommended by the Internal Control steps to correct weaknesses. DMNA adopted Task Force, DMNA adopted two new internal two new internal reporting forms to assist reporting forms to assist the Directors and managers in conducting their department’s respective Assessable Unit Manager in annual self-evaluation. Beginning SFY08, the conducting annual self-evaluations at the agency established a full-time Internal functional level. The new forms require Control Specialist position to refine, enhance detailed descriptions of functions, associated and validate their commitment to DMNA’s risks and vulnerabilities, along with program for internal controls.” appropriate supervisory signoffs. The Assessable Unit Managers also verify that In another example, DMNA submitted a fully control procedures outlined on the documented road map outlining required standardized forms are operational and modifications and respective status for each functioning as intended in actual practice. An recommendation made by the Internal Control independent review process of the Task Force. Specifically, one risk/vulnerability assessments and internal recommendation stated that the DMNA control evaluations is then conducted by the internal control program should establish a ICO based on the Management Control Plan

Report 2008-S-112 Page 4 of 7

(MCP) report. A five-year MCP report, listing read and review. After reviewing this each proponent and respective functions document, employees indicate their evaluation schedule, is maintained for internal understanding of the program by signing a control purposes. written statement. DMNA provided a copy of both the management standards statement and To determine if DMNA could support its the employee signed written statements. certification, we requested documentation reflecting the current five-year MCP. We DMNA also supplied a copy of a tone at the found the MCP report contained a list of top letter issued by The Adjutant General. In proponents and functions, the schedule for the memorandum, The Adjutant General their review and statements regarding states the commitment that DMNA has corrective actions plans. Also the MCP toward the implementation of an effective indicates that based on the determined level of system of internal controls to accomplish the risk, a high risk function will receive annual mission of the Agency. review, medium risk every other year, and low risk will be reviewed every third year. AUDIT SCOPE AND METHODOLOGY

In addition to meeting with Directors and We conducted our performance audit in using the MCP in the independent review accordance with generally accepted process, the prior ICO reported the results of government auditing standards. We audited his review to The Adjutant General using a the quality of DMNA’s 2007-08 B-350 power point presentation. We reviewed the Internal Control Certification. To do our audit presentations slides and found the we interviewed agency officials to learn about presentation to be effective in stating the their control activities and reviewed all requirements of the Internal Control documentation of internal controls provided Certification and the information reported by by DMNA to support their certification. DMNA for the 2007-08 certification. In addition to being the State Auditor, the We also reviewed the completed standardized Comptroller performs certain other forms used to identify primary unit functions, constitutionally and statutorily mandated objectives, risks, vulnerabilities and existing duties as the chief fiscal officer of New York controls forms. We found these forms to be State. These include operating the State’s detailed and thoroughly documented accounting system; preparing the State’s including appropriate signatures indicating financial statements; and approving State supervisory review. contracts, refunds, and other payments. In addition, the Comptroller appoints members As part of its internal control program, to certain boards, commissions and public DMNA requires each employee, on an annual authorities, some of who have minority voting basis, to sign a statement stating that they rights. These duties may be considered understand their role and responsibility management functions for purposes of regarding the DMNA Internal Control evaluating organizational independence under Program. The DMNA Directors and generally accepted government auditing Assessable Unit Managers are responsible for standards. In our opinion, these management providing each employee with copies of the functions do not affect our ability to conduct Internal control Program including a independent audits of program performance. “Statement of Management Standards” to

Report 2008-S-112 Page 5 of 7

AUTHORITY CONTRIBUTORS TO THE REPORT

The audit was performed pursuant to the State Major contributors to this report include Comptroller’s authority as set forth in Article David R. Hancox, Walter Irving, Melissa V, Section 1 of the State Constitution and Little, Thalia Melendez, Sally Perry and Article II, Section 8 of the State Finance Law. Constance Walker.

REPORTING REQUIREMENTS

Draft copies of this report were provided to DMNA officials for their review and comment. Their comments were considered in preparing this report and are included as Appendix A.

Report 2008-S-112 Page 6 of 7

APPENDIX A - AUDITEE RESPONSE

Report 2008-S-112 Page 7 of 7