QUESTIONNAIRE FOR COMPLETING THE VULNERABILITY RISK ASSESSMENT

The Vulnerability Risk Assessment Criteria and Score Sheet

The Vulnerability Risk Assessment Criteria and Score Sheet is used to complete the vulnerability risk assessment process within your organization. Upon completion of the assessment the organization should be able to determine the status of the general control environment, the degree of inherent risk, and to make a preliminary evaluation of safeguards within the assessed organization. The assessor, is responsible for the accurate completion of the score sheet relating to the identified functions/programs/processes as identified.

Choosing an Answer

The score sheet has a number of possible scores for each question. To determine the score, read the “Considerations” for the question, review the choices, and pick the choice which most closely depicts the status of the function/program/process you are assessing. The choices are designed to that you should be able to make a determination from the examples provided. In any event, you will be able to reduce your choices to two. If in choosing, you can’t determine which of the two most closely depicts the function/program/process you are assessing choose the answer having the higher scores.

Vulnerability and Risk Evaluation

Analyze how the identified vulnerabilities and risks from this assessment might impact your organization. Very high levels of perceived risk are associated with the need to implement actions to reduce risks such as taking precautions, making the necessary improvements, and provide remediation planning. This involves taking measures to determine what strategies are necessary to avoid the risk altogether, reduce the possibility of loss, accept the risk and live with it, or transfer the risk to another party through the outsourcing of certain tasks. This is the first step in developing a remediation plan to address each major risk to your organization and/or expediting recovery.

As you evaluate the scores from this assessment, you will notice that the lower the score the lower the risk. In general, lower risk functions/programs/processes should be tested for quality assurance once every two to three years; medium risk function/programs/processes should be tested for quality assurance annually; and high risk functions/programs/processes should be tested for quality assurance anywhere from once a quarter to twice a year. For the purposes of the scoring for this assessment measure:

1-2 = low risk

3 = medium risk

4-5 = high risk

Role of the Assessor

The assessor should be a person who is independent from the functions/programs/processes that is being evaluated; and who is able to make an unbiased judgement. The assessor should match the evidence collected from interviews, focus groups, surveys, documents, IT systems, etc. to the appropriate outcome and should not be swayed by undue influences.

Question # 1: Newness of Program

Considerations

A program or program-type activity which has been in existence longer can be potentially less vulnerable because procedures for administering its resources have been worked out and in place to a greater degree.

The age of the program or activity refers to the length of time that it has had the same fundamental mission, without major new responsibilities or legislative changes.

Choices and Scores

Over 10 years old	Score 1

6-10 years old	Score 2

3-6 years old	Score 3

1-3 years old	Score 4

Less than 1 year	Score 5

Question #2: Expected Appropriation for the Program in the Immediate Following Year

Considerations

Programs or activities expending large amounts of money are susceptible to greater degrees of fraud, waste, abuse or mismanagement than programs or activities expending small amounts. Accordingly the level of funding should be considered in assessing the vulnerability of a program or activity.

In completing this item, the assessor should consider the President’s Budget Request for the immediate following year as well as the actions that the Congress has taken, particularly in regard to the Continuing Resolution. Score based on the expected appropriation.

Choices and Scores

Zero Funding	Score 1

Up to $5 million	Score 2

$5 - $25 million; includes programs or activities up to $25 million	Score 3

$25 - $100 million; includes programs or activities up to $100 million	Score 4

Over $100 million	Score 5

Question #3: Nature of the Program

Considerations

An important factor in determining the vulnerability and risk of a particular program to waste, fraud, abuse, or mismanagement is the extent to which internal control mechanisms can effectively monitor and influence program operations at the grantee, sub-grantee, or contractor level. The specific type of program (e.g., formula, block or discretionary grant) will dictate the extent to which those program operations may be susceptible to weaknesses in control procedures.

For example, there are more possible weaknesses which could be the responsibility of program managers in the administration of a discretionary grant program -- where program managers must develop criteria for making grant awards, convene a peer review panel for new grants, make recommendations for funding, and assist in the final negotiations with successful applicants – than would be the case of program managers of a block grant or formula grant program where the programmatic role is more limited.

Choices and Scores

Not Applicable - this would include program type activities (e.g., a data, evaluation, or information clearinghouse) which do not involve the awarding of funds – Score 0

Block Grants	Score 1

Formula Grants	Score 2

Loans/Grants in Aid	Score 3

Contracts	Score 4

Discretionary Grants/Training Grants/Fellowships – Includes cooperative agreements – Score 5

Question #4: Recent Changes in Resource Levels

Considerations

A program or program activity which has had a funding or staff increase in the last year could be less vulnerable because there are additional resources to carry out the internal control objectives. Conversely, a funding or staff decrease could reduce the amount of effort devoted to internal control objectives.

Choices and Scores

Program reassignment in last 18 months	Score 1

Funding or staff increase 0-6% from last year	Score 2

Funding or staff increase over 6% from last year	Score 3

Funding or staff decrease from 0-6% from last year	Score 4

Funding or staff decrease more than 6% from last year	Score 5

Question #5: Impact or Sensitivity of the Program on Persons or Organizations External to the Agency

Considerations

Federal agency programs and functions often have considerable financial and non-financial impact on persons and organizations external to the agency. Other programs may not involve any monetary award, but can still command significant and widespread interest by the general public and special interest groups. When a program has such impact, it is likely to be subjected to external pressures which may circumvent systems of internal control.

The existence of special interests or extraordinary oversight is also a sign of program impact or sensitivity. Therefore, consideration should be given to whether the program activity has been the focus of special attention from any of the following:

The President, OMB, or Congress

Legislative mandates or deadlines

Media attention

Litigation

Special interest groups

Information concerning potential impacts can usually be obtained from such sources as internal planning or budget documents, Congressional hearing reports, program descriptions, and media and public interest reports.

Choices and Scores

No Impact or Sensitivity or Not Applicable	Score 0

Low Level of Impact or Sensitivity – Total number of individuals or

organizations affected are relatively small and special interest groups

are nonexistent or have little political leverage.	Score 1

Moderate Level of Impact or Sensitivity – The program serves moderately

sizable numbers of individuals or organizations, and, while special interests

may be active, they are not a pressing concern for program managers.	Score 3

High Level of Impact or Sensitivity – Significant impact or sensitivity due to

high degree of interest and potential influence of program beneficiaries or their

special interest groups. This situation exists when program managers must

continuously consider the impact of the program activity on outside entities

or individuals.	Score 5

Question #6:	Appreciation for Effective Internal Controls.

Considerations

It is important that organization and personnel involved in a transaction cycle have an understanding of the roles they play in the cycle, the reasons for the rules they follow, and the necessity for considering those rules in both planning and executing operations. Where there is little appreciation for effective internal control, the likelihood of waste, fraud abuse, and mismanagement increases.

Among the thing an assessor must consider are:

Does the organizational structure have an appropriate grouping of activities and reporting relationships?

Is top management assured of the competence and integrity of the organization’s personnel?

Are there appropriate delegations and limitations of authority?

If any of the above questions cannot be answered in a positive manner, the existing controls are not particularly effective.

Choices and Scores

Major Factor	Internal Controls operate at a high level in planning and	Score 1

operations at all organizational levels.

Moderate Factor	Internal Controls considered in on or more of the following: Score 3

Evaluation of operations

Performance appraisals

External requirements.

Minor Factor	Little to no appreciation of Internal Controls at most levels.	Score 5

Question #7:	Assumed Effectiveness of Existing Controls

Considerations

The existence of Internal Controls by themselves does not guarantee protection from waste, fraud, abuse, and mismanagement. The controls must be reviewed and improved periodically.

The assessor should be able to estimate the effectiveness and the need for review and improvement of internal controls.

Choices and Scores

Highly Effective	Controls not likely to required revision.	Score 1

Moderately Effective	Controls require updating, but revisions	Score 2

not likely.

Effective	Controls could benefit from minor	Score 3

improvements and revisions.

Less Than	Controls in need of more than minor	Score 4

Effective	revisions and improvements.

No Existing Controls	Need for establishment of a system of	Score 5

Internal Controls.

Question #8:	The Interval Since the Most Recent Evaluation or Audit

Considerations

The longer the interval between systematic operational reviews, the greater the likelihood that system or operational errors will go undetected. It is important, therefore, that all control systems undergo periodic audits/reviews/evaluations to detect errors and initiate improvements.

When was the last GAO, OIG, or other review of this operation conducted?

Choices and Scores

Within the last 6 months	Score 1

Between 6 and 12 months	Score 2

Between 12 and 18 months	Score 3

Between 18 and 24 months	Score 4

More than 2 years ago	Score 5

Question #9:	Recent Instances of Error or Irregularities

Considerations

Recent errors or irregularities are indications of either a lack of internal controls or ineffectiveness of existing ones. Further, the speed with which these errors are corrected can be an indication of management commitment to minimizing opportunities for fraud, waste, abuse, and mismanagement.

In addition to formal finding by GAO, OIG, etc., recent instances of bad publicity (newspaper articles) or other criticism (Congress, consumer, or client) should also be considered in completing this item.

Choices and Scores

No instances in the last 18 months.	Score 1

Minor findings or known errors, fully corrected (Non-monetary findings)	Score 2

Major finding or known errors, fully corrected (Monetary or major	Score 3

System findings)

Minor findings or known errors, outstanding	Score 4

Major findings or known errors, outstanding	Score 5

Question #10:	Status of Authorizing Legislation

Considerations

The status of the authorizing legislation often had an impact on program stability. Situations involving expiration, reauthorization or a sunset review can expose the program in question to risk of fraud, waste, or abuse in its operation.

Choices and Scores

Not Applicable to this Assessable Unit.	Score 0

Relatively Stable	Score 1

Covered by Sunset	Score 3

Reauthorization within 2 years	Score 4

Expiration within 2 years	Score 5

Question #11:	Scope of Written Authority

Considerations

The written authority under which a program or function operated is important from two perspectives:

The specific authority delegated in writing controls the amount of authority vested in the program’s manager(s).

The legislative or regulatory authority under which the program operates is a limit on agency freedom to administer the program.

Choices and Scores

Limited and Precise	Score 1

Broad and Precise	Score 2

Limited and Vague	Score 3

Broad and Vague	Score 4

No Written Authority	Score 5

Question #12: Type of Administration

Considerations

How a program is administered often affects the types of control which the federal government can impose. Generally, the more third party involvement, the greater the risk.

Choices and Scores Government Only	Score 0

Equal Government and Third Party	Score 1

Mostly Third Party	Score 3

All Third Party	Score 5

Question #13:	Administrative Resource – Staff

Considerations

Are the staff resources authorized to accomplish the assigned mission sufficient to do the job? This question is not asked in order to have each manager decry the amount of staff resources assigned (compared to some ideal they would like have,) but rather to elicit how the level impacts on the operation of internal controls in the assessable unit.

Choices and Scores

Ample	Score 1

Adequate	Score 3

Insufficient	Score 5

Question #14: Administrative Resources – S&E Dollars

Considerations

Often administration of a program/function depends not only on sufficient staff to do the job but on non-program dollars used to administer the program. This is often in the form of travel money, money for contracts, etc., which are allocated separate from either appropriated progress dollars or staffing levels.

Choices and Scores

Ample	Score 1

Adequate	Score 3

Insufficient	Score 5

Question #15: Operational Coverage by Written Procedures

Considerations

To the degree that operational procedures are written, distributed to employees and enforced, the possibilities of mismanagement are reduced. Are routine operations covered by written procedures which are monitored and enforced?

Choices and Scores

Extensive and Detailed	Score 0

Essentials Only	Score 1

Partial Coverage	Score 3

No Written Procedures	Score 5

Question #16: Potential for Conflicts of Interest

Considerations

This is an area which has received significant attention in recent years. The potential for conflicts of interest on the part of program administrators is one which must be carefully monitored, or program participants and/or the public may lose faith in the fair and impartial administration of government programs/functions.

Choices and Scores

Negligible	Score 0

Limited	Score 1

Moderate	Score 3

Substantial	Score 5

Question #17: Adequacy of Checks and Balances

Considerations

Checks and balances are utilized so that authority for certain functions is diffused to minimize the potential for waste, fraud, abuse or mismanagement. The assessor, in answering this question, should try to determine, first if checks and balances are appropriate, and if so, are they adequate to protect the resource from manipulation, etc.

Choices and Scores

Not Appropriate	Score 0

Adequate	Score 1

Insufficient	Score 3

Required but Totally Lacking	Score 5

Question #18: Personnel Considerations

Considerations

One of the most important factors in the successful operation of a system of internal/management control is personnel. If the operating personnel are not qualified and properly trained for the functions they are to execute, the best-designed system of internal/management control may not function in the manner intended. The question speaks only to the qualifications and training of the personnel assigned, not the numbers of personnel assigned.

Choices and Scores

Fully Trained and Qualified	Score 1

Qualified but require Training	Score 3

Unqualified	Score 5

Question #19: Adequacy of Reports (Particularly Financial Reports)

Considerations

The accuracy and timeliness of normal recurring reports (particularly financial reports) are good indicators of a well-run operation.

Choices and Scores

Accurate & Timely	Score 0

Accurate but Usually Late	Score 1

Less Than Accurate and/or Incomplete	Score 3

Usually Inadequate & Late	Score 5

Question #20: Information Technology (IT) Considerations

Considerations

Many activities are highly dependent on IT for either operations or providing data or information on which management decisions are made. While use of IT can save time there are issues of reliability and security which are particularly important when the use of automated equipment is involved.

Choices and Scores

IT is not a significant factor in this function	Score 0

IT used for up to 10% of reporting or operational data	Score 1

IT used for 10% to 50% of reporting or operational data	Score 3

IT used for more than 50% of reporting or operational data	Score 5

Question #21: Employee Standards

Considerations

Both performance and conduct standards are extremely important as control systems themselves. These systems establish rules of performance or conduct expected of employees. If employees are not aware of or do not adhere to these standards, organizational performance may deteriorate and/or conduct expected in certain circumstances cannot be assured.

Choices and Scores

Standards are disseminated and followed.	Score 0

Standards are disseminated but adherence is not reviewed.	Score 1

Standards are disseminated but adherence is spotty.	Score 3

Standards are not disseminated in a manner designed to assure adherence.	Score 5

Question #22: Budgetary and Organization Goals

Considerations

The establishment of both budgetary and organization goals provide employees with benchmarks by which they can measure accomplishment and also set individual goals for personal accomplishment. Where these goals are not established, reviewed periodically, updated and disseminated to employees, successful achievement is less likely.

Choices and Scores

Budgetary and Organization Goals are established, reviewed

periodically, updated and disseminated to employees.	Score 1

Goals are established and disseminated but not reviewed and

updated periodically.	Score 3

Goals have not been established.	Score 5

Question #23: Time Constraints

Considerations

In many activities the requirement to produce under deadline imposes severe time constraints. These can reduce the ability to produce work of consistent quality and also generates a powerful inducement to end run systems of internal control because of time constraints.

Choices and Scores

Time constraints are not a significant factor in operations.	Score 1

Time constraints are a factor but only moderately so.	Score 3

Time constraints are a significant daily fact of life.	Score 5

Question #24: Classified Material

Considerations

The handling of classified material imposes special controls on an operation. The safeguarding of such material requires more than ordinary precautions on the part of element employees.

Choices and Scores

The activity generally does not handle classified material.	Score 1

The activity handles classified material and there have been

no security violations in the past year.	Score 2

There have been minor security violations in the past year.	Score 3

There have been more than minor violations, but practices

have been instituted to prevent recurrence.	Score 4

There have been more than minor violations and practices to

prevent recurrence have not been instituted.	Score 5

Question #25: Costs Versus Benefits of Existing Control System

Considerations

In some cases there is question as to whether the cost of a control exceeds the benefit. An example would be the potentially high cost of 100% audit of travel vouchers which result in significantly less saving per voucher than the cost of audit. The assessor should determine if the cost of an existing control system is worth the benefits obtained.

Choices and Scores

The costs of the system are well worth the benefits.	Score 1

There is a question as to whether the costs outweigh the benefits.	Score 3

The costs do outweigh the benefits and the system should be reviewed.	Score 5

Answer Sheet for Vulnerability Risk Assessment

Title of Unit:

Assessor: Organization/Component:

Date: 1/8/2016

No.	Subject	Score
Answer these questions for program or program-type activities:	NA	1	2	3	4	5
1.	Newness of Program
2.	Expected appropriation for the program in immediate year following
3.	Nature of the Program
4.	Recent Changes in resource levels
5.	Impact or sensitivity of the program on persons or organizations external to the agency
Answer these questions for administrative-type activities:	0	1	2	3	4	5
6.	Appreciation for effective internal controls
7.	Assumed effectiveness of existing internal controls
8.	The interval since most recent evaluation or audit
9.	Recent instances of errors or irregularities
10.	Status of authorizing legislation
11.	Scope of written authority
12.	Type of administration
13.	Administrative resources – Staff
14	Administrative resources – S&E Dollars
15.	Operational coverage by written procedures
16.	Potential for conflicts of interest
17.	Adequacy of checks and balance
18.	Personnel consideration
19.	Adequacy of reports (Financial reports)
20.	IT consideration
21.	Employee standards
22.	Budgetary and organization goals
23.	Time Constraints
24.	Classified materials
25.	Costs versus benefits of exiting control systems