SD 224.3, NNSA Audit Program

CONTROLLED DOCUMENT OFFICE OF PRIMARY INTEREST (OPI): AVAILABLE ONLINE AT: Audits and Internal Affairs https://nnsa.energy.gov/aboutus/ouroperations/managementandbudget/supplementaldirectives printed copies are uncontrolled SUPPLEMENTAL DIRECTIVE Approved: 4-12-17 Certification Due: 4-12-20 NNSA AUDIT PROGRAM NATIONAL NUCLEAR SECURITY ADMINISTRATION Management and Budget NNSA SD 224.3 https://nnsa.energy.gov/aboutus/ouroperations/managementandbudget/supplementaldirectives THIS PAGE INTENTIONALLY LEFT BLANK NNSA SD 224.3 1 4-12-17 NNSA AUDIT PROGRAM 1. PURPOSE. Department of Energy (DOE) Order 224.3, Audit Resolution and Follow-Up Program; DOE Order 221.2A, Cooperation with the Office of Inspector General; and Office of Management and Budget Circular A-50, Audit Follow-up, establish the core roles, responsibilities, and requirements for coordinating Government Accountability Office (GAO) and Office of Inspector General (OIG) activities within DOE. This Supplemental Directive (SD) further describes in what manner these policies are implemented within the National Nuclear Security Administration (NNSA). 2. CANCELLATION. None. 3. APPLICABILITY. a. Federal. This SD applies to all NNSA elements. b. Contractors. Does not apply to contractors. c. Equivalency. In accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 United States Code sections 2406 and 2511, and to ensure consistency through the joint Navy/DOE Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Directive for activities under the Director's cognizance, as deemed appropriate. 4. SUMMARY OF CHANGES. None. 5. REQUIREMENTS. In accordance with DOE Order 224.3, Audit Resolution and Follow- Up Program; DOE Order 221.2A, Cooperation with the Office of Inspector General; and Office of Management and Budget Circular A-50, Audit Follow-up, NNSA must: a. Establish a central point of contact for coordinating all OIG/GAO audits serving as principal advisor to the Administrator on all audit reports and related audit activities; b. Establish and maintain effective processes, procedures, and internal controls for coordinating all OIG/GAO audit activity; c. Establish processes to support submission of responses to all OIG/GAO audit reports and related recommendations in accordance with timelines established in audit procedures and process maps; d. Track and verify (as necessary) corrective actions for all audit findings and related recommendations through closure; e. Establish a process for validating the effectiveness and sustainability of audit corrective actions; and 2 NNSA SD 224.3 4-12-17 f. Cooperate with requests for information and data – including making all records accessible for inspection, audit, and copying – in accordance with DOE Order 221.2A and 48 Code of Federal Regulations (CFR) 970.5204-3. 6. RESPONSIBILITIES. a. Under Secretary for Nuclear Security and NNSA Administrator. The Administrator signs responses to all draft and final audit reports unless that function is otherwise delegated or designated. b. Audits and Internal Affairs (AIA). The Director, AIA, is the lead management official for NNSA and the designated Audit Coordination Officer for all NNSA audits. AIA serves as the primary liaison with the OIG and GAO, and is

responsible for the following activities: (1) Audit Coordination. (a) Serves as the central recipient of, and distribution point for, all OIG/GAO correspondence1 and related activities for audits impacting NNSA; (b) Schedules and facilitates entrance and exit conferences for NNSA- led audits, and attends entrance and exit conferences for DOE-led audits with NNSA equities; (c) Coordinates crosscutting OIG/GAO data calls with headquarters and field office Audit Coordination Officers; (d) Coordinates audits that crosscut DOE and NNSA with the DOE Office of Chief Financial Officer (OCFO) and other offices as appropriate; (e) Approves or disapproves headquarters and field office requests for due date extensions, in coordination with OIG/GAO audit teams; (f) Works with NNSA and OIG/GAO management to resolve significant audit issues or concerns; and (g) Considers, in conjunction with headquarters and field office Audit Coordination Officers, site assessment schedules and plans when coordinating new or proposed OIG/GAO audit starts. 1 Correspondence includes, among other things: audit notification letters; OIG coordination drafts and GAO statements of fact (generally referred to as "coordination drafts" in this SD); formal draft and final reports; and entrance and exit conference notifications. NNSA SD 224.3 3 4-12-17 (2) Audit Report Coordination. (a) Establishes form and content standards and technical review standards for review of and comment on OIG/GAO reports; (b) Prepares proposed responses to draft and final audit reports (based on coordination with and input from subject matter experts), and distributes for headquarters and field office review and concurrence; (c) Provides final review and approval for all proposed responses to draft and final reports, in coordination with External Affairs, prior to review by the Administrator or Principal Deputy Administrator; (d) Obtains concurrence on proposed responses by the General Counsel, External Affairs, and through the NNSA Executive Secretariat, the Associate Principal Deputy Administrator, and the Principal Deputy Administrator; (e) Establishes timelines for responding to coordination draft, formal draft, and final audit reports, in accordance with DOE Order 224.3, DOE Order 221.3A, Establishment of Management Decisions on Office of Inspector General Reports, and OMB Circular A-50; (f) Coordinates with DOE OCFO on audit reports involving the Department as appropriate; and (g) Protects coordination draft, formal draft, and final reports from disclosure outside of DOE/NNSA until the final reports are available on the OIG or GAO public websites. (3) Corrective Action Tracking. (a) Obtains quarterly updates from responsible headquarters and field offices on the status of open audit recommendations; (b) Reviews quarterly status updates for quality assurance purposes and provides feedback to headquarters and field offices as appropriate; (c) Approves or disapproves all recommendations proposed for closure by responsible headquarters and field offices, prior to acceptance for formal closure in the Departmental Audit Report Tracking System (DARTS); and (d) Certifies closure of audit recommendations in DARTS. 4 NNSA SD 224.3 4-12-17 (4) Corrective Action Effectiveness. (a) Conducts risk-based analyses (i.e., considering likelihood and impact of control failure or recurrence) of closed audit recommendations to identify those that will be subject to follow-up

review; (b) Schedules and performs follow-up reviews to validate the effectiveness and sustainability of corrective actions; and (c) Re-opens and resumes tracking of recommendations for further corrective action if prior actions are deemed insufficient, ineffective, or not sustainable. (5) Other Audit Activities. Provides periodic audit coordination training to Audit Coordination Officers, NNSA management, and other NNSA personnel. c. Headquarters and Field Offices. Headquarters and field offices will designate at least two individuals to serve as primary and backup Audit Coordination Officers to support NNSA's audit program. These individuals should have a broad understanding of their organization's mission and functions, and should be positioned to provide time- and subject-sensitive information directly to senior management. Headquarters and field offices, led by their Audit Coordination Officers, are responsible for the following activities: (1) Audit Coordination. (a) Serves as the central contact for all OIG/GAO audit activities within their respective organizations, and attends weekly Audit Coordination Officer meetings; (b) Identifies subject matter experts and managers that should be involved in each audit and ensures they understand AIA audit response requirements; (c) Coordinates with and ensures that Management and Operating contractors cooperate fully with the auditors – including making all records accessible for inspection, audit, and copying pursuant to 48 CFR 970.5204-3 – and adhere to audit process standards; (d) Keeps Heads of Elements and their Deputies, Field Managers, and other management officials apprised of audit activities impacting their organizations; (e) Attends entrance conferences for NNSA-led audits and DOE-led audits with NNSA equities; NNSA SD 224.3 5 4-12-17 (f) Notifies AIA regarding any concerns with OIG/GAO audit activities that require management attention; (g) Requests due date extensions (for data calls, all types of reports, etc.) from AIA, if necessary; and (h) Considers, in conjunction with AIA, site assessment schedules and plans when coordinating new or proposed OIG/GAO audit starts. (2) Audit Report Coordination (a) Reviews and comments on coordination draft, formal draft, and final audit reports for the headquarters or field office, in accordance with timelines established by AIA; (b) Adheres to AIA form and content standards and technical standards in reviewing and providing comments on audit reports; (c) Attends meetings with the auditors to resolve audit issues and report comments; (d) Obtains Head of Element or Field Manager signature on action memos by due dates established by AIA, as required; (e) Attends Administrator briefings on draft and final reports, as required; and (f) Protects coordination draft, formal draft, and final reports from disclosure outside of DOE/NNSA until the final reports are available on the OIG or GAO public websites. (3) Corrective Action Tracking (a) Provides quarterly status updates for open recommendations (to include addressing any AIA feedback) in accordance with AIA reporting standards, by the established due dates; and (b) Verifies completion of corrective actions consistent with NNSA’s original planned actions prior to proposing closure. (4) Corrective Action Effectiveness. Supports effectiveness reviews by working with subject matter experts and others to provide

information requested by AIA in a timely manner. (5) Other Audit Activities. Attends periodic audit program training. 6 NNSA SD 224.3 4-12-17 d. Special Provisions for Financial Statement Audits. (1) AIA is responsible for establishing processes and procedures for coordinating financial statement audit findings that impact NNSA, in accordance with OCFO established requirements. (2) Responsibility for coordinating and signing responses to financial statement audit findings is delegated to the Director, Office of Field Financial Management. (3) Reporting on and closure of findings is to be coordinated through the Director, AIA. e. Special Provisions for Information Technology Audits. (1) AIA is responsible for establishing processes and procedures for coordinating FISMA2-related information technology (IT) audit findings that impact NNSA. (2) Responsibility for coordinating and signing responses to financial statement IT findings is delegated to the impacted field offices in coordination with the NNSA Chief Information Officer and DOE OCFO. (3) Reporting on and closure of findings is to be coordinated through the Director, AIA. 7. REFERENCES. a. Federal Information Security Management Act of 2002 b. Federal Information Security Modernization Act of 2014 c. 48 CFR 970.5204-3, Access To and Ownership of Records d. OMB Circular No. A-50 (revised), Audit Follow-up e. DOE Order 221.2A, Cooperation with the Office of Inspector General, dated 2- 25-08 f. DOE Order 221.3A, Establishment of Management Decisions on Office of Inspector General Reports, dated 4-19-08 g. DOE Order 224.3, Audit Resolution and Follow-Up Program, dated 1-24-05 2 Including audits under the Federal Information Security Management Act of 2002 and the Federal Information Security Modernization Act of 2014. NNSA SD 224.3 4-12-17 h. DOE Order 2340.1, Coordination of General Accounting Office Activities, dated 6-8-92 8. CONTACT. Audits and Internal Affairs, NA-MB-1.1, 301-903-1341. BY ORDER OF THE ADMINISTRATOR: ~~Kl~·~ Administrator 7 1. PURPOSE. 2. CANCELLATION. 3. APPLICABILITY. a. Federal. b. Contractors. c. Equivalency. 4. SUMMARY OF CHANGES. 5. REQUIREMENTS. 6. RESPONSIBILITIES. a. Under Secretary for Nuclear Security and NNSA Administrator. b. Audits and Internal Affairs (AIA). (1) Audit Coordination. (2) Audit Report Coordination. (3) Corrective Action Tracking. (4) Corrective Action Effectiveness. (5) Other Audit Activities. c. Headquarters and Field Offices. (1) Audit Coordination. (2) Audit Report Coordination (3) Corrective Action Tracking (4) Corrective Action Effectiveness. (5) Other Audit Activities. d. Special Provisions for Financial Statement Audits. e. Special Provisions for Information Technology Audits. 7. REFERENCES. 8. CONTACT.