CMS Pub. 100-06, ch. 7, § 10.1.4

A revised OMB Circular A-123, Management’s Responsibility for Internal Control, issued in December 21,

2004 under the authority of FMFIA, provided specific requirements for assessing and reporting on internal

controls. In July 2016, OMB Circular A-123 was again revised, and the title was changed to Management’s

Responsibility for Enterprise Risk Management and Internal Control. This Circular defines management’s

responsibilities for enterprise risk management (ERM) and internal control. The Circular provides updated

implementation guidance to federal managers to improve accountability and effectiveness of federal

programs as well as mission-support operations through implementation of ERM practices and by

establishing, maintaining, and assessing internal control effectiveness. The Circular emphasizes the need to

integrate and coordinate risk management and strong and effective internal control into existing business

activities and as an integral part of managing an Agency. Pursuant to OMB Circular A-123, agencies are

required to provide an annual assurance statement which represents the agency head’s informed judgment as

to the overall adequacy and effectiveness of internal controls related to operations, reporting, and

compliance.

Appendix A to OMB, Internal Control Over Financial Reporting, was issued in 2004, which required the

heads of certain federal agencies to annually document and assess internal controls over financial reporting

and report the results in a management assurance statement. In June 2018, an updated version of Appendix

A, Management of Reporting and Data Integrity Risk was issued, which among other changes, aligns

Appendix A with the 2014 update to the Government Accountability Office (GAO) Green Book in part, by

expanding the scope from ICOFR to include internal control over reporting (ICOR).

CMS conducts annual A-123 internal control reviews. Contractors will be subject to the annual A-123

internal control review. In lieu of an A-123 internal control review, contractors may be selected for a

Statement on Standards for Attestation Engagements No. 18 (SSAE-18) internal control examination.

End Section 10.1.4 – OMB Circular A-123: Back to Table of Contents