NASA Procedures and Guidelines
This Document is Obsolete and Is No Longer Used. Check the NODIS Library to access the current version: http://nodis3.gsfc.nasa.gov
NPR 9010.3 Eff. Date: September 30, 2008 Cancellation Date:	Financial Management Internal Control
| TOC | Preface | Chapter1 | Chapter2 | Chapter3 | Chapter4 | Chapter5 | AppendixA | AppendixB | ALL |

Appendix A. Definitions

A.1 Deficiencies.

a. Control Deficiency. An identified weakness in the design or operation of a control that precludes management or employees, in the normal course of operations, from preventing or detecting misstatements on a timely basis. Control deficiencies are categorized as material and reportable or non-reportable depending upon the severity and potential impact if the control fails.

(1) Design Deficiency. A control deficiency that results when a control necessary to meet the control objectives is missing or an existing control is not properly designed, so that even if the control objective operates as designed, the objective may not be met.

(2) Operation Deficiency. A control deficiency that results when a properly designed control does not operate as designed or when the person performing the control is not qualified or properly skilled to perform the control effectively.

b. Simple Deficiency. A deficiency in the design or operation of a control that is not considered to be a reportable deficiency or a material weakness.

c. Reportable Deficiency (also called Significant Deficiency). A control deficiency, or combination of control deficiencies, that adversely affects NASA's ability to initiate, authorize, record, process, or report external financial data reliably in accordance with generally accepted accounting principles such that there is more than a remote likelihood that a misstatement in the financial statements, or other significant financial reports, will not be detected or prevented.

d. Material Weakness. A reportable condition, or combination of reportable conditions, that results in more than a remote likelihood that a material misstatement of the financial statements, or other significant financial reports, will not be prevented or detected.

A.2 Entity-level Assessment. A self-assessment questionnaire based upon the internal control standards completed by selected NASA management and staff on the five standards for internal control: control environment, risk assessment, control activities, information and communications, and monitoring. The questionnaire is intended to assist management in identifying areas of potential internal control weakness for further review.

A.3 Financial Management Cycles. The major business processes of an organization that have been established for internal control review and evaluation purposes and that define the complete process to ensure a common understanding and the work activities involved in accomplishing the function through the process.

A.4 Financial Reporting. An Agency's annual financial statements and other significant internal and external financial reports that could have a material effect on significant spending, budgetary, or other financial decision of the Agency or that are used to determine compliance with laws and regulations.

A.5 Improper Payment Information Act (IPIA) Review. A review of Agency disbursements for a defined period to determine whether payments are in compliance with rules, regulations, and federal requirements.

A.6 Internal Control (also referred to as management internal control). Policies and procedures instituted by management to provide reasonable assurance of the effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations.

A.7 Internal Control Review. An in-depth examination of an entity's system of internal controls at the transaction or process-level that documents, assesses, and tests the operational effectiveness of internal controls over operations to identify internal control gaps or deficiencies that could adversely impact the ability of the organization to achieve mission or goals.

A.8 Quality Assurance Review. A review conducted to evaluate compliance with financial, legal, regulatory, policy; and control monitoring program requirements, and special reviews directed by OCFO management.

A.9 Recovery Audit. An assessment of payments for a defined period conducted to identify and collect erroneous payments (i.e., duplicate payments or overpayments) as prescribed by OMB Circular No. A-123.

A.10 Reportable Deficiency. A significant deficiency.

A.11 Risk Assessment. The identification, measurement, and analysis of risks or vulnerabilities, internal and external, controllable and uncontrollable, at individual business levels and for NASA as a whole.

A.12 Statement of Assurance. A certification included in the annual Performance and Accountability Report (PAR) that represents the Administrator's informed judgment as to overall adequacy and effectiveness of internal control. The Administrator will provide either an unqualified (an effective and efficient system of internal controls exists) or a qualified (an overall sound system of internal control exists but one or more material weaknesses have been identified) statement of assurance, or a statement of no assurance on the system of internal control.

DISTRIBUTION:
NODIS