text: Chapter 7
  ASSESSMENTS AND CORRECTIVE ACTIONS
  7-30. Key aspects of management internal controls are the actual assessments and the necessary corrective
  actions that need to take place. The Integrity Act and all applicable laws and regulations require
  commanders and managers to identify weaknesses through continuous assessments, document any
  weakness, and most importantly, take the necessary steps to ensure the weakness is corrected.
  7-31. Another required aspect of the program is the sharing and reporting of information. As weaknesses
  are reported through higher headquarters, commands are encouraged to share results of the reviews with
  other subordinate units and commands to determine if similar weaknesses apply to their operations. Ideally,
  the Army will develop management controls that will significantly reduce the findings and
  recommendations from external reviews and audits. In order to accomplish this, the Army must approach
  management controls aggressively and conduct thorough assessments. This section will give an overview
  of the principles associated with assessments and the required corrective actions.
  RISK ASSESSMENT AND CONTROL ACTIVITIES
  7-32. In order to perform the required assessments, a determination of risk and a review of the control
  activities in place have to be made.
  Risk Assessment
  7-33. Risk assessment is the identification and analysis of relevant risks of the functional area in order to
  form a basis for determining how risks should be managed. Commanders and managers have to assess the
  risk associated with the function and determine an appropriate level of control to ensure the function
  operates as intended. The higher the level of risk, the more controls are required to ensure a level of
  reasonable assurance. PAs and disbursing operations have a high level of risk that requires a high level of
  control, as compared to routine supply requisitions that do not warrant as much control. In the ICEP five
  year plan, higher risk areas are assessed more frequently.
  Control Activities
  7-34. Control activities are the policies, procedures, techniques, and mechanisms that enforce management
  directives. Control activities help ensure that actions are taken to address or reduce risks. Control activities
  include a wide range of activities such as approvals, authorizations, verifications, reconciliations, physical
  security, and performance reviews. Records that document evidence of executing these activities need to be
  created and maintained. Examples of control activities are:
  * Reviews of performance by management.
  * Information processing controls.
  * Physical control of assets.
  * Establishing and review of performance measures and indicators.
  * Separation of duties.
  * Complete, accurate, and timely execution of transactions and events.
  Internal control evaluations
  7-35. Internal control evaluations are detailed, systematic, and comprehensive reviews of management
  controls to determine whether or not controls are in place, being used as intended, and effective in
  achieving its purpose.
  7-36. Formal control evaluations of key management controls must be conducted at least once every five
  years. Any identified “high risk” area requires more frequent evaluations. The Assistant Secretary of the
  Army (Financial Management & Comptroller) (ASA [FM&C]) through the DASA-(FO) will publish an
  annual listing of areas that are to be reviewed that year along with a suggested or required method of
  conducting the evaluation. The AUM certification will be documented on DA Form 11-2 (Internal Control
  Evaluation Certification).