Title page
Contents
Letter 7
Enclosure I: Overview of Major Changes in Proposed Standards for Internal Control in the Federal Government 2024 Revision 10
Major Changes in the Proposed Green Book 2024 Revision 10
Enclosure II: Questions for Commenters 18
Discussion Questions for Responses 18
Overview 23
Foreword 23
Planned Effective Date 24
How to Use the Green Book 24
Section 1 - Fundamental Concepts of Internal Control 27
Definition of Internal Control 27
Definition of an Internal Control System 28
Section 2 - Establishing an Effective Internal Control System 29
Presentation of Standards 29
Components, Principles, Attributes, and Documentation Requirements 29
Internal Control and the Entity 33
Roles in an Internal Control System 35
Objectives of an Entity 36
Section 3 - Evaluation of an Effective Internal Control System 39
Factors of Effective Internal Control 39
Evaluation of Internal Control 39
Section 4 - Additional Considerations 42
External Parties 42
Information Technology 43
Large versus Small Entities 45
Benefits and Costs of Internal Control 45
Use by Other Entities 46
Control Environment 47
Principle 1 - Demonstrate Commitment to Integrity and Ethical Values 48
Tone at the Top 48
Standards of Conduct 49
Adherence to Standards of Conduct 49
Principle 2 - Exercise Oversight Responsibility 50
Oversight Structure 50
Oversight for the Internal Control System 52
Input for Remediation of Deficiencies 53
Principle 3 - Establish Structure, Responsibility, and Authority 53
Organizational Structure 53
Assignment of Responsibility and Delegation of Authority 54
Documentation of the Internal Control System 55
Principle 4 - Demonstrate Commitment to Competence 56
Expectations of Competence 56
Recruitment, Development, and Retention of Individuals 57
Succession and Contingency Plans and Preparation 57
Principle 5 - Enforce Accountability 58
Enforcement of Accountability 58
Consideration of Excessive Pressures 59
Risk Assessment 60
Principle 6 - Define Objectives and Risk Tolerances 61
Definitions of Objectives 61
Definitions of Risk Tolerances 62
Principle 7 - Identify, Analyze, and Respond to Risks 63
Identification of Risks 63
Analysis of Risks 65
Response to Risks 66
Principle 8 - Assess Fraud, Improper Payment, and Information Security Risk 68
Identification of Risks Related to Fraud, Improper Payments, and Information Security 68
Types of Fraud and Fraud Risk Factors 69
Types of Improper Payments and Improper Payment Risk Factors 71
Types of Information Security Risk and Information Security Risk Factors 73
Analysis of and Response to Identified Risks 75
Principle 9 - Identify, Analyze, and Respond to Change 76
Identification of Change 76
Analysis of and Response to Change 76
Establishment of a Process for Responding to Change 77
Control Activities 80
Principle 10 - Design Control Activities 81
Response to Risks 81
Design of Appropriate Types of Control Activities 81
Design of Preventive and Detective Control Activities 89
Design of Control Activities at Various Levels 90
Segregation of Duties 92
Principle 11 - Design General Control Activities over Information Technology 93
Response to Risks 93
Design of the Entity's Information Technology 94
Design of Appropriate Types of General Control Activities 95
Principle 12 - Implement Control Activities 99
Documentation of Control Activities through Policies and Procedures 99
Periodic Review of Control Activities 100
Information and Communication 101
Principle 13 - Use Quality Information 102
Identification of Information Requirements 102
Relevant Data from Reliable Sources 102
Data Processed into Quality Information 103
Principle 14 - Communicate Internally 103
Communication throughout the Entity 104
Appropriate Methods of Communication 105
Principle 15 - Communicate Externally 105
Communication with External Parties 105
Appropriate Methods of Communication 107
Monitoring 108
Principle 16 - Perform Monitoring Activities 109
Establishment of a Baseline 109
Internal Control System Monitoring 109
Evaluation of Results 111
Principle 17 - Evaluate Issues and Remediate Deficiencies 112
Reporting of Issues 112
Evaluation of Issues 113
Corrective Actions 113
Appendix I: Requirements 115
Appendix II: Examples of Preventive and Detective Control Activities 118
Appendix III: Additional Resources 127
Fraud Resources 127
Improper Payments Resources 128
Information Security Resources 130
Appendix IV: Acknowledgments 133
Comptroller General's Advisory Council on Standards for Internal Control in the Federal Government (2023-2025) 133
GAO Project Team 134
Staff Acknowledgments 134
Glossary 135
Figure 1. Green Book Sample Page 26
Figure 2. Achieving Objectives through Internal Control 27
Figure 3. The Five Components and 17 Principles of Internal Control 31
Figure 4. The Components, Objectives, and Organizational Structure of Internal Control 34
Figure 5. The 17 Principles Supporting the Five Components of Internal Control 35
Figure 6. Common Categories of Control Activities 82
Figure 7. Common Categories of Information Technology Control Activities and Relationship to Objectives 89