Government financial management connects cash, investments, procurement, systems, analysis, controls, performance, and independent assurance. This guide develops those connections through twenty original multiple-choice questions and sixty substantive concepts with worked examples and misconceptions. Practice includes discounted cash flows, earned value, proposal scoring, service-provider oversight, performance interpretation, and audit responsibilities. It covers CGFM Examination 3 only, using the current 2026 outline as of October 16, 2026, and the issuer's stated beginning-of-2024 regulatory basis. Later regulatory or standards revisions are not silently substituted. The questions form a representative preview, not a full-length examination. Citations establish syllabus relevance; technical explanations apply established subject knowledge rather than claiming the outline supplies every rule.
What this guide covers
Build CGFM Exam 3 skills with 20 original questions and 60 focused lessons in government financial control.
Financial Management Functions
1. Cash forecasts and the true cost of banking
A cash forecast places expected receipts, disbursements, and available balances on a time line so management can fund obligations without holding unnecessary idle cash. Distinguish accounting revenue from actual collection dates and include restricted balances separately. Banking comparisons should include transaction fees, service capability, security, settlement timing, and the opportunity cost of compensating balances. Competition should evaluate equivalent service specifications. Applicable deposit protection, collateral, and cash-management requirements depend on the government's jurisdiction and funds; they should be identified rather than assumed to be uniform.
Worked example: A municipality expects a large quarterly collection after payroll is due. Its forecast identifies a temporary liquidity need. When comparing banks, staff also price a required idle balance by multiplying that balance by the return available on permitted investments.
Common mistake: A low monthly bank fee does not establish low economic cost when compensating balances, settlement delays, or missing services consume resources.
Official syllabus reference: [1]
2. Collection float, lockboxes, and electronic receipts
Collection float is the interval between a payer initiating payment and the government obtaining usable funds. Mail, processing, and bank availability can each contribute delay. Lockboxes shorten mail and processing stages by routing payments to a bank-operated collection point; electronic collections can eliminate paper handling and accelerate settlement. Centralized collections improve visibility but require accurate identification of the receiving program and payer. Evaluate net benefit using incremental processing cost and the value of earlier availability. Faster deposits still require reconciliations, exception handling, and controls over electronic payment instructions.
Worked example: A permit office receives 2,000 mailed checks monthly. A lockbox reduces average availability by two days. Staff compare the interest value of those earlier receipts and reduced handling costs with the bank's fee, while testing whether remittance details reach the permit ledger.
Common mistake: Faster bank settlement does not automatically produce accurate receivables records; payments can remain unapplied without reliable remittance information and reconciliation.
Official syllabus reference: [1]
3. Payment scheduling and improper-payment controls
Effective disbursement management pays valid obligations at the appropriate time while preserving available cash. Warehousing an approved electronic payment allows preparation before its scheduled release date. Early-payment discounts should be compared with financing and opportunity costs, while applicable payment requirements remain controlling. Improper payments include more than fraud: duplicate payments, incorrect amounts, and payments to ineligible recipients can arise from error. Prevention uses eligibility verification, invoice matching, and controlled payment instructions. Detection and recovery require exception analysis, investigation, receivable tracking, and appropriate collection procedures, including for electronic benefit or card programs.
Worked example: An agency schedules an approved invoice for its contractual due date rather than paying immediately. Before release, a duplicate-invoice check identifies an earlier payment with the same vendor, invoice number, and amount, allowing staff to investigate before cash leaves.
Common mistake: A payment is not proper merely because it used an authorized electronic channel; recipient eligibility, amount, timing, and supporting evidence still matter.
Official syllabus reference: [1]
4. Investment policy, liquidity, and fiduciary duty
An investment policy translates legal authority and objectives into permitted instruments, maturity limits, diversification rules, custody arrangements, and approval responsibilities. Operating portfolios emphasize reliable liquidity for expected payments; pension portfolios generally evaluate a longer horizon and obligations to beneficiaries. Yield must be assessed alongside credit, market, liquidity, and concentration risks. Fiduciary loyalty requires decisions for beneficiaries rather than personal advantage, while prudence concerns the decision process and relevant expertise. Diversification reduces concentration risk without eliminating every risk. Manager selection and performance monitoring should use suitable mandates, benchmarks, fees, and risk exposures.
Worked example: A treasury office invests next month's payroll reserve in short maturities, while pension trustees evaluate a diversified long-term allocation. A trustee discloses a personal connection to a proposed manager and follows the plan's conflict procedures before the selection decision.
Common mistake: The highest historical return does not establish fiduciary prudence when liquidity needs, concentration, fees, or conflicts of interest were inadequately evaluated.
Official syllabus reference: [1]
5. Direct loans versus loan guarantees
A direct loan advances government funds to a borrower and creates servicing, collection, and credit-risk responsibilities. A guarantee supports a third-party lender by promising payment under defined default conditions; the absence of an immediate principal advance does not eliminate government exposure. Program design connects public purpose with underwriting, eligibility, pricing, documentation, servicing, and loss management. Performance measures should include access and policy results as well as delinquency and losses. Expected credit loss estimates depend on default probabilities, exposure, recoveries, and timing; the applicable accounting treatment depends on the reporting framework.
Worked example: A development agency can lend $1 million directly or guarantee part of a bank loan. Staff compare cash funding needs, guaranteed exposure, borrower underwriting, expected recoveries, servicing capacity, and the economic-development results each structure is intended to produce.
Common mistake: A guarantee does not become risk-free because a commercial bank initially supplies the cash; default can still create a government payment obligation.
Official syllabus reference: [1]
6. Debt aging, collection tools, and write-offs
An aging schedule classifies receivables by how long they have remained unpaid, helping prioritize collection and estimate collectibility. Delinquency rates need explicit denominators, such as outstanding dollars or borrower accounts, because the measures answer different questions. Collection tools may include notices, negotiated repayment, authorized offsets, or referral to collection agencies, subject to applicable authority and required procedures. Writing off an uncollectible receivable is an accounting action and does not necessarily forgive the legal debt. Distinguish write-off, compromise, termination of collection, and waiver according to the governing program rules.
Worked example: A loan program finds that a small number of older accounts represents most delinquent dollars. Staff prioritize those balances, verify collection authority, and document recovery prospects. An accounting write-off is evaluated separately from any decision to release borrowers from repayment.
Common mistake: A lower delinquent-account count can coexist with higher delinquent dollars, and an accounting write-off does not necessarily extinguish collection rights.
Official syllabus reference: [1]
7. Competitive procurement and contract acceptance
An invitation to bid fits purchases with sufficiently definite specifications where award follows the announced bidding method. A request for proposals supports evaluation of stated factors such as technical approach, past performance, delivery, and price. Fair competition requires accessible opportunities, consistent information, and application of published criteria by authorized officials. Bulk purchases, interagency contracts, and purchase cards may reduce transaction costs but retain authorization and oversight needs. After award, monitoring compares deliverables with contract terms; acceptance should document that goods or services meet specifications before the associated payment approval.
Worked example: An agency uses an RFP for a complex case-management system and publishes technical and price weights. After award, it tests required interfaces and security functions against the contract rather than accepting the system solely because the vendor delivered software.
Common mistake: A competitive award does not establish satisfactory contract performance; monitoring, inspection, acceptance, and invoice verification remain separate procurement responsibilities afterward.
Official syllabus reference: [1]
8. Property accountability through disposal
Property management links acquisition, identification, custody, location, condition, maintenance, and disposition records throughout an asset's life. Physical inventories test whether recorded assets exist and whether assets on hand are recorded. Custodian assignments establish stewardship, while access controls and maintenance preserve usefulness. Disposal begins with an authorized surplus determination and selection of a permitted transfer, sale, recycling, or destruction method. Financial and property records must then be updated consistently. Equipment containing data requires appropriate sanitization before release, and disposal proceeds should be reconciled to authorized transactions.
Worked example: A department replaces twenty laptops. Staff match serial numbers to custody records, obtain surplus authorization, sanitize storage media, document the approved disposal method, and reconcile proceeds. They then update both the property register and applicable financial asset records.
Common mistake: Removing an asset from an office does not complete disposal; authorization, data protection, custody evidence, record updates, and proceeds accountability still matter.
Official syllabus reference: [1]
9. Reorder points and inventory safeguards
A reorder point identifies the inventory level at which replenishment should begin. A basic model adds expected demand during replenishment lead time to safety stock. Safety stock absorbs uncertainty rather than routine demand, so assumptions about variability and service needs matter. Classification can focus stronger controls on high-value, sensitive, or operationally critical items. Physical access limits, issue records, tagging, RFID, and periodic counts support accountability. Reconcile count differences and investigate causes; a perpetual inventory system or electronic tag supplies information but does not itself prove that stock exists.
Worked example: A maintenance unit uses ten filters daily, expects five days for delivery, and holds twenty filters as scenario-defined safety stock. Its reorder point is seventy filters. Staff also count critical filters periodically because a stockout would interrupt essential vehicle maintenance.
Common mistake: Reordering only when stock reaches zero ignores delivery lead time, while adding safety stock twice can unnecessarily tie up operating funds.
Official syllabus reference: [1]
10. Financial-system architecture and data ownership
An integrated ERP shares processes and data across functions such as purchasing, payables, and the general ledger. Stand-alone and mixed systems depend more heavily on interfaces and reconciliations. CRM manages constituent or customer interactions, while EPM and FP&A tools support planning, forecasting, and performance analysis. Functional requirements describe business results; technical requirements describe capabilities such as interoperability, availability, and security. User requirements address actual work needs. Data owners define meaning and authorized use, while stewards maintain quality. Integration requires consistent identifiers, controlled mappings, and traceable interface totals.
Worked example: A city connects permit software to its ERP. Business staff define when a fee becomes receivable, technology staff specify secure transfer requirements, and data stewards maintain permit identifiers. Reconciliations compare source transactions, interface batches, and posted ledger totals after each transfer.
Common mistake: Buying an integrated platform does not automatically harmonize account definitions, cleanse source data, assign ownership, or reconcile transactions across organizational processes.
Official syllabus reference: [1]
11. Cloud responsibility and automated processing
SaaS provides a managed application, PaaS provides a platform for deploying applications, and IaaS provides infrastructure on which customers manage more of the software stack. On-premise and hybrid arrangements distribute responsibilities differently. Compare COTS, custom development, outsourcing, and cross-servicing against requirements and lifecycle costs. Hosting does not remove agency responsibility for access decisions, data quality, and oversight. RPA automates repeatable rules; machine learning estimates patterns from data. Both require controlled inputs, exception handling, change management, and review appropriate to the consequences of error.
Worked example: An agency selects SaaS for invoice processing and uses RPA to route complete invoices. It retains responsibility for user access and approval rules. A machine-learning duplicate detector flags unusual matches for investigation rather than automatically treating every flagged invoice as fraudulent.
Common mistake: Cloud hosting and artificial intelligence do not transfer all accountability to the vendor or eliminate the need to validate automated outputs.
Official syllabus reference: [1]
12. Shared-service lifecycle costs and service levels
Shared services consolidate support functions across organizations to obtain scale, specialization, or consistent processes. A business case compares retained costs, provider charges, transition work, data conversion, parallel operations, and exit costs with the existing arrangement. Service-level agreements should specify measurable performance, responsibilities, escalation, and reporting. Transition planning includes process mapping, access, data reconciliation, acceptance testing, and continuity. Standardization can reduce local flexibility, while concentration can create common dependencies. Management remains responsible for its objectives and must evaluate provider performance rather than equating outsourcing with transferred accountability.
Worked example: A payroll provider quotes lower annual processing fees. The agency adds conversion, parallel-run, interface, and retained oversight costs before evaluating savings. Its agreement defines payroll deadlines, reconciliation requirements, incident escalation, data ownership, and how records will be returned if service ends.
Common mistake: A lower provider invoice does not establish net savings when transition, retained staffing, interface maintenance, oversight, and exit costs are excluded.
Official syllabus reference: [1]
13. Project constraints, process redesign, and acceptance
Project management coordinates initiation, planning, execution, monitoring, and closure around defined deliverables. Scope, schedule, cost, quality, resources, and risk interact: accelerating delivery may require additional resources or reduced scope. A critical path identifies activities whose delay would delay completion under the current schedule assumptions. Business process reengineering examines how work should flow before automating existing steps. Development methods differ, but requirements traceability, testing, controlled deployment, and acceptance evidence remain important. Changes should be evaluated for their effect on benefits, dependencies, and the approved baseline.
Worked example: A financial-system project discovers that an unnecessary approval loop causes delays. The team redesigns the process before configuration, updates dependencies, and assesses the effect on schedule and controls. Deployment requires documented results showing that approved business and reconciliation requirements were met.
Common mistake: Finishing configuration on schedule does not establish project success when required business outcomes, controls, testing, or user acceptance remain incomplete.
Official syllabus reference: [1]
Financial and Managerial Analysis Techniques
14. Present value and discounted project benefits
Present value converts a future cash flow into an equivalent amount today using PV = cash flow ÷ (1 + rate)^periods. Net present value sums discounted inflows and outflows, including the initial investment at time zero. Discount each amount according to when it occurs; an end-of-year assumption differs from an immediate receipt. Keep nominal cash flows with nominal rates and real cash flows with real rates. Positive NPV indicates financial value under the assumptions, but public projects may also require analysis of service, distributional, and legal objectives.
Worked example: A project costs $10,000 today and saves $6,000 at each of the next two year-ends. At a scenario discount rate of 5%, the savings are worth about $11,156 today, giving an NPV of approximately $1,156 before other effects.
Common mistake: Adding future dollars directly to today's dollars ignores timing, while discounting the initial payment again understates a cost already measured at time zero.
Official syllabus reference: [1]
15. Future value and compounding conventions
Future value accumulates current funds through reinvestment: FV = principal × (1 + periodic rate)^number of periods. The rate and period count must use the same compounding convention. Multiple deposits require separate accumulation periods, and beginning-of-period deposits earn one more period than otherwise identical end-of-period deposits. Compound growth differs from simple interest because returns themselves earn returns. Forecasts should distinguish an assumed accumulation rate from a guaranteed yield and should not treat nominal investment growth as equivalent to growth in purchasing power.
Worked example: A reserve holds $20,000 and earns an assumed 4% annually for three years with no withdrawals. Its projected balance is $22,497.28. If the reserve must purchase equipment whose price also rises, staff compare the projected balance with the equipment's future cost.
Common mistake: Applying an annual rate separately every month without conversion exaggerates growth, and treating assumed investment returns as guaranteed conceals forecast uncertainty.
Official syllabus reference: [1]
16. Cash-flow analysis versus operating results
Cash-flow analysis tracks actual expected receipts and payments rather than recognition of revenue and expense. A government can report favorable operating results yet face a cash shortage because collections arrive after obligations. Begin with available cash, add receipts by period, subtract disbursements, and compare ending balances with explicitly defined liquidity needs. Identify restricted cash and financing separately so unavailable resources do not conceal a shortage. Scenario analysis can vary collection timing, payment dates, or volume to reveal how sensitive liquidity is to uncertain assumptions.
Worked example: A grant reimbursement is earned in March but expected in May, while payroll must be paid in April. The cash forecast shows April's temporary gap even though the program's revenue and expense report appears balanced over the full project period.
Common mistake: A balanced annual budget does not prove that cash is available each month, especially when reimbursements, taxes, and major payments occur unevenly.
Official syllabus reference: [1]
17. Payback and its decision boundaries
The payback period measures how long cumulative net cash inflows take to recover an initial investment. With equal annual inflows, divide initial cost by annual net inflow; with uneven inflows, accumulate them period by period. A fractional year assumes an appropriate pattern of receipts within that year. Ordinary payback ignores the time value of money and cash flows after recovery. Discounted payback addresses the first limitation but still ignores later value. Payback can inform liquidity and exposure decisions, but it should not substitute for a complete project-value analysis.
Worked example: A project costs $90,000 and generates $30,000 in annual net savings. Its simple payback is three years. A competing project repays in four years but produces substantially larger later savings, so management also compares discounted lifecycle benefits before choosing.
Common mistake: The shortest payback does not necessarily identify the most valuable project because benefits after recovery and the timing of money can change rankings.
Official syllabus reference: [1]
18. Trend percentages and comparable ratios
Trend analysis compares amounts across periods, while ratio analysis relates one quantity to another. Percentage change equals the difference divided by the base-period amount; a trend index instead expresses each period as a percentage of a selected base. Ratios need consistent definitions, periods, and accounting bases. Changes in prices, population, service mix, or recognition policies can alter interpretation. A ratio identifies a relationship rather than a cause. Comparing federal and state or local information requires attention to framework and reporting differences rather than assuming similarly named amounts are interchangeable.
Worked example: Inspection spending rises 12%, but inspections rise 20%. Dividing spending by inspection count shows lower nominal cost per inspection. Before declaring improved efficiency, the analyst checks whether inspection complexity, cost allocation, and the definition of a completed inspection remained comparable.
Common mistake: A rising total does not necessarily indicate worsening efficiency, and a ratio's apparent precision does not compensate for inconsistent numerator or denominator definitions.
Official syllabus reference: [1]
19. Strategic sourcing and total ownership cost
Strategic sourcing analyzes spending patterns, requirements, supplier markets, and acquisition alternatives to improve overall value. Total ownership cost includes acquisition, implementation, operation, maintenance, support, and disposal or exit costs. Consolidating demand can improve pricing but may increase supplier concentration or reduce flexibility. Compare alternatives over equivalent service levels and time horizons, discounting material timing differences when appropriate. Supplier performance, continuity, competition, and transition risks belong in the analysis. Savings should be measured against a credible baseline rather than a supplier's unsupported list price.
Worked example: Two equipment bids differ in purchase price and annual maintenance. The lower-priced unit requires costly proprietary supplies. Analysts compare five years of supplies, service, training, and disposal using the same workload assumptions, then assess whether a single supplier creates continuity risk.
Common mistake: The lowest purchase price does not establish the lowest lifecycle cost, and combining purchases does not automatically justify reduced supplier competition.
Official syllabus reference: [1]
20. Regression coefficients and forecast limits
Regression estimates how a dependent variable varies with one or more explanatory variables. In a linear cost model, the intercept is the fitted constant and a slope estimates the change associated with one unit of a predictor, holding other included predictors constant. R² summarizes explained sample variation, not causal proof or a forecast guarantee. Residual patterns can reveal misspecification, and omitted variables can distort interpretation. Predictions outside the observed range require particular caution. Use units explicitly and assess whether historical relationships remain plausible for the proposed decision.
Worked example: An analyst models processing cost using application volume and case complexity. A positive volume coefficient estimates the additional cost associated with one application at a fixed complexity level. Before forecasting a new digital process, the analyst considers whether automation changes that historical relationship.
Common mistake: A high R² does not prove causation, ensure an unbiased model, or guarantee accurate forecasts after workloads and business processes change.
Official syllabus reference: [1]
21. Earned value separates spending from progress
Earned value management compares planned value, earned value, and actual cost using a consistent approved baseline. Earned value is the budgeted value of work actually completed. Cost variance equals earned value minus actual cost; schedule variance equals earned value minus planned value. CPI is earned value divided by actual cost, while SPI is earned value divided by planned value. Spending below plan can coexist with poor performance if little work is complete. Forecast formulas depend on assumptions about remaining work, and schedule variance measured in dollars is not directly a calendar delay.
Worked example: A project planned $200,000 of work but completed only $150,000 of budgeted work while spending $180,000. It is behind its value-based schedule and cost-inefficient, even though spending is below plan. CPI is approximately 0.83 and SPI is 0.75.
Common mistake: Comparing actual spending with planned spending alone cannot distinguish savings from unfinished work, and earned-value schedule variance is not measured in days.
Official syllabus reference: [1]
22. Flowcharts expose handoffs and control gaps
A flowchart represents activities, decisions, records, and movement through a process. Swimlanes can identify which person, unit, or system performs each action, making incompatible duties and unclear handoffs visible. Decision branches should show meaningful alternatives, including exceptions and rejected transactions. Document both the intended process and verified practice; a diagram copied from policy may omit workarounds. Link control points to risks and supporting evidence. Flowcharts support redesign and audit understanding, but their existence does not establish that depicted controls operate effectively.
Worked example: A purchasing flowchart shows the same employee creating vendors, entering invoices, and resolving bank changes. Adding swimlanes makes the concentration visible. Staff then design independent bank-change verification and trace actual transactions to confirm how the revised process works.
Common mistake: A neat process diagram is not evidence that staff follow it; exception paths, informal workarounds, and actual responsibility assignments require verification.
Official syllabus reference: [1]
23. Data provenance and fit-for-purpose reliability
Reliable analysis begins with knowing where data originated, how they were transformed, and what they represent. Evaluate completeness, accuracy, validity, timeliness, and consistency for the intended use. Reconcile extracts to source totals, inspect definitions, test unusual values, and examine access or change controls where relevant. Accounting records, performance systems, financial statements, and census data may use different populations and periods. A source can be authoritative yet unsuitable for a particular question. Document limitations so users understand what conclusions the evidence can reasonably support.
Worked example: An analyst compares service cost with neighborhood population. The cost file covers the fiscal year, but census estimates use a different reference date. Staff reconcile expenditure totals, confirm geographic boundaries, and explain the timing limitation before publishing per-resident comparisons.
Common mistake: An official source is not automatically fit for every analysis; population, timing, definitions, extraction errors, and transformations can still undermine conclusions.
Official syllabus reference: [1]
24. Forensic anomalies are leads, not proof
Forensic techniques examine transactions and relationships to investigate suspected misconduct or unusual patterns. Useful methods include duplicate testing, vendor-employee matching, sequence analysis, document inspection, and tracing funds through records. Data preservation, reproducible procedures, and controlled evidence handling matter when findings may support investigation. An anomaly is a lead requiring corroboration, not proof of fraud. For example, shared addresses can reflect legitimate relationships, and digit-pattern tests are inappropriate for many assigned or constrained numbers. Distinguish error, policy violation, and intentional deception using evidence rather than pattern alone.
Worked example: A vendor file and employee file share a bank account. Investigators preserve the original extracts, verify matching logic, examine ownership and payment documents, and assess authorization. They do not label the match fraudulent before excluding legitimate explanations and corroborating the relationship.
Common mistake: A duplicate flag, unusual digit pattern, or shared address does not establish intent; weak data matching can also create false allegations.
Official syllabus reference: [1]
25. Descriptive through prescriptive analytics
Descriptive analytics summarizes what happened; diagnostic analytics investigates plausible reasons; predictive analytics estimates future outcomes; prescriptive analytics compares or recommends actions under objectives and constraints. These categories differ in purpose rather than simply software sophistication. Prediction quality depends on representative data, validation, and changing conditions. Prescriptive models also require defensible objectives and constraints, such as capacity or service requirements. A dashboard does not establish causation, and an optimized recommendation can be inappropriate if important public values or legal restrictions were omitted from the model.
Worked example: A dashboard shows growing permit backlogs, analysts examine workload changes, a model forecasts next month's arrivals, and a scheduling model compares staffing assignments. Management checks that the recommended assignment respects required skills and service priorities before using the result.
Common mistake: A predictive score does not explain why an outcome occurs, and a mathematically optimal recommendation can fail when objectives or constraints are incomplete.
Official syllabus reference: [1]
Internal Control
26. COSO's five interacting components
COSO organizes internal control into control environment, risk assessment, control activities, information and communication, and monitoring activities. The components operate together rather than as independent checklists. Ethical expectations and accountability support the environment; risk assessment identifies threats; activities address risks; information enables action; monitoring evaluates continued functioning. A sound transaction approval cannot compensate for every weakness in governance or information quality. Evaluate whether relevant principles are present and functioning and whether components operate together for the selected objectives, rather than counting policies as evidence of effectiveness.
Worked example: A grant office adds approval checklists but continues using incomplete recipient data, and managers disregard repeated exceptions. The checklist addresses a control activity, while information quality, accountability, and monitoring remain weak. The office evaluates the interacting components before concluding that controls are effective.
Common mistake: Implementing one strong approval control does not establish an effective system when unreliable information, weak oversight, or ignored deficiencies undermine its operation.
Official syllabus reference: [1]
27. Reasonable assurance across three objective categories
Internal control supports operations, reporting, and compliance objectives. Operations include effective service delivery and safeguarding resources; reporting concerns reliable information; compliance concerns applicable requirements. Controls provide reasonable assurance because judgment errors, collusion, management override, and changing conditions can defeat even well-designed systems. Cost-benefit analysis compares expected risk reduction with implementation and operating costs, including service burden. It does not justify knowingly disregarding binding requirements. The appropriate control intensity depends on likelihood, impact, and the importance of the objective, rather than the transaction amount alone.
Worked example: An agency considers reviewing every low-value supply purchase. It compares the expected reduction in error with review cost and delay, then uses targeted reviews and spending limits. Legally required approvals remain in place even where their administrative cost is inconvenient.
Common mistake: Reasonable assurance does not mean accepting every inexpensive risk response or promising that controls will prevent all error, fraud, and disruption.
Official syllabus reference: [1]
28. GAO standards and OMB management requirements
GAO's Green Book provides standards for internal control in the federal government and aligns its structure with COSO concepts. OMB guidance, including Circular A-123, addresses federal management responsibilities for risk management and internal control. Distinguish a control framework from the reporting and implementation requirements applicable to a specific entity. State and local governments may adopt relevant frameworks, but federal executive-branch requirements should not automatically be treated as universally binding. For this examination, apply the supplied beginning-of-2024 regulatory basis rather than silently substituting subsequent revisions.
Worked example: A federal finance office maps controls to Green Book components and prepares management assessments under applicable OMB requirements. A city uses the same component structure voluntarily, but its reporting obligations are established separately through its own governing requirements and adopted policies.
Common mistake: A federal framework's usefulness to another government does not by itself make every associated federal management-reporting requirement legally applicable there.
29. Fraud risk assessment and override opportunities
Fraud risk assessment identifies plausible schemes, affected objectives, opportunities, incentives or pressures, and potential rationalizations. The fraud triangle helps organize thinking but does not diagnose an individual's intent. Assess both employee misconduct and management override, including privileged access, unusual adjustments, and collusion. Connect each significant scenario to preventive and detective responses, considering what an informed perpetrator could bypass. Update the assessment when programs, technology, or payment methods change. Evidence of a risk factor calls for proportionate analysis and controls rather than an unsupported accusation.
Worked example: A benefit program introduces urgent electronic enrollment. Staff identify a scheme involving fabricated applicants and shared bank accounts, then assess identity verification, override access, and postpayment matching. They test legitimate reasons for shared accounts before referring suspicious patterns for further investigation.
Common mistake: Financial pressure or unusual behavior alone does not prove fraud, and assessing only frontline employees can leave management override risks unexamined.
Official syllabus reference: [1]
30. Segregation of authorization, custody, and records
Segregation of duties separates functions that could allow one person to commit and conceal an error or unauthorized transaction. Authorization, custody of assets, recordkeeping, and reconciliation are common functions to distinguish. Evaluate actual system permissions and practice rather than job titles alone. When staffing limits separation, a compensating control should independently address the same risk with sufficient precision and frequency. A broad budget review may not detect altered bank details, whereas independent verification of changes can. Collusion and shared credentials can defeat otherwise sensible assignments.
Worked example: A small office cannot separate invoice entry from vendor maintenance. A manager independently verifies all bank changes through established contacts and reviews change logs. The control targets payment redirection more directly than reviewing only the monthly total of payments.
Common mistake: Two different job titles do not establish segregation when one person has both permissions, shares credentials, or can override the second person's approval.
Official syllabus reference: [1]
31. Preventive, detective, and corrective control layers
Preventive controls act before an unwanted event, detective controls identify events that occurred, and corrective actions address causes or consequences. Authorization before payment is preventive; reconciliation after payment is detective; recovery and process repair are corrective. Classification depends on the objective and timing, not the control's label. A layered system recognizes that prevention can fail and that detection without follow-up leaves exposure unresolved. Specify who investigates exceptions, how quickly action occurs, and what evidence supports closure. Control frequency should match how rapidly harm could accumulate.
Worked example: A payment system blocks exact duplicate invoice numbers, a weekly analysis identifies near-duplicate payments, and staff investigate confirmed duplicates for recovery. Management also corrects inconsistent invoice-number entry rules that allowed variants to bypass the preventive check in the first place.
Common mistake: Detecting an exception does not correct it, and a preventive system rule does not eliminate the need for detective review and resolution.
Official syllabus reference: [1]
32. IT general controls support automated reliance
IT general controls govern the environment in which applications operate, including access administration, program changes, and technology operations. Least privilege limits access to job needs, while periodic reviews and timely removal address changes in employment or duties. Controlled development, testing, approval, and deployment reduce unauthorized program changes. Operations controls address scheduling, incidents, backups, and recovery. Weak general controls can undermine confidence that automated checks remained unchanged and consistently available. However, conclusions should connect the specific weakness to affected applications and risks rather than assuming every system output is wrong.
Worked example: An invoice application rejects payments above an approved limit. Auditors discover that developers can alter production rules without review. They investigate changes and access logs before relying on the automated rejection control, because its configuration may not have remained stable.
Common mistake: A successful demonstration of an automated check does not establish year-long reliability when unauthorized users could change its configuration without detection.
Official syllabus reference: [1]
33. Reporting assertions, interfaces, and reconciliations
Financial reporting controls address whether transactions and balances are complete, valid, accurate, appropriately valued, and recorded in the proper period and classification. Interface reconciliations compare source records, transferred batches, and ledger postings to identify omissions or duplication. Reconciliation is incomplete until differences are investigated and resolved. Controls must reflect the applicable reporting framework: FASAB addresses federal accounting, while GASB addresses state and local governmental accounting. A control that accurately transfers data cannot itself establish that recognition or classification follows the correct framework; both processing and accounting judgments require attention.
Worked example: A state agency reconciles grant payments from its program system to the ledger and resolves a missing batch. It separately reviews whether the entries use the appropriate state and local governmental reporting treatment, rather than importing a federal accounting rule.
Common mistake: A ledger that balances can still contain omitted, duplicated, misclassified, or incorrectly recognized transactions; mathematical agreement does not establish faithful reporting.
Official syllabus reference: [1]
34. Compliance matrices turn requirements into controls
A compliance matrix links an applicable requirement to the responsible process, risk, control, evidence, and reporting obligation. Begin by determining which requirements actually apply to the entity, program, award, or transaction. Translate them into operational actions, such as eligibility checks, procurement approvals, or reporting deadlines. Assign ownership and retain evidence that actions occurred. Changes in award terms or governing requirements should trigger updates. A generic policy statement is weaker than a precise control tied to a requirement, but the matrix itself does not prove that staff performed the control.
Worked example: A grant requires specified recipient eligibility documentation and quarterly reporting. The program maps eligibility to a preapproval checklist, reporting to a calendar and reviewer, and both to retained evidence. Staff update the matrix when a new award changes required supporting documents.
Common mistake: Listing a law or award clause does not establish compliance unless the entity identifies its applicability and performs controls that address its requirements.
Official syllabus reference: [1]
35. SOC 1, SOC 2, and complementary user controls
SOC 1 addresses service-organization controls relevant to user entities' internal control over financial reporting. SOC 2 addresses controls against applicable trust services criteria. A Type 1 report addresses design at a specified date; a Type 2 report also addresses operating effectiveness over a period. Read the actual system description, scope, opinion, exceptions, and treatment of subservice organizations. Complementary user entity controls remain the customer's responsibility. Report coverage may not match the government's year-end, requiring additional evaluation of the gap period rather than automatic reliance on the report title.
Worked example: A payroll provider supplies a SOC 1 Type 2 report ending in September. The agency evaluates exceptions, obtains appropriate information about the remaining quarter, and tests its own required access reviews. It also checks whether a critical subcontractor was included in scope.
Common mistake: A clean service auditor opinion does not establish that customer controls operated, excluded subcontractors were tested, or uncovered months had no changes.
Official syllabus reference: [1]
36. Management ownership and internal-audit assurance
Management establishes objectives, designs and operates controls, evaluates results, remediates deficiencies, and makes required reports or assertions. It also establishes processes for detecting and reporting suspected fraud, waste, and abuse under applicable requirements. Internal auditors provide independent evaluations and advice, but should not assume management's control ownership. External auditors evaluate controls to the extent required by their engagement objectives and standards. Outsourcing processing or obtaining an audit does not transfer management responsibility. Clear reporting lines and escalation procedures support action when control failures or suspected misconduct are identified.
Worked example: An internal audit identifies weak access reviews. Management assigns a system owner to redesign and operate the review, establishes deadlines, and reports progress. Internal audit later evaluates implementation rather than approving individual users itself and then auditing its own approvals.
Common mistake: An internal or external audit does not relieve management of responsibility for control operation, deficiency correction, or appropriate reporting of suspected misconduct.
Official syllabus reference: [1]
37. Design, implementation, and operating effectiveness
Design evaluation asks whether a control, if performed as intended, could address the identified risk. Implementation asks whether the control exists and is being used. Operating-effectiveness testing asks whether it functioned consistently, with appropriate authority and competence, over the relevant period. Walkthroughs help trace transactions and confirm understanding, but one successful transaction rarely proves sustained operation. Inspection, observation, reperformance, and inquiry provide different evidence. Identify the population, timing, exceptions, and underlying causes before reaching conclusions. A written policy alone establishes neither implementation nor effective operation.
Worked example: A policy requires monthly reconciliations and independent review. A walkthrough confirms the process is implemented, but inspection finds missing reviews in four months. The design may be appropriate even though the evidence does not support consistent operating effectiveness during the year.
Common mistake: A well-written procedure and one successful walkthrough do not demonstrate that the control operated consistently across the entire assessment period.
Official syllabus reference: [1]
38. Deficiency severity and bounded control reporting
A control deficiency arises when design or operation does not adequately support an objective. Its significance depends on likelihood, potential magnitude, affected objectives, compensating controls, and qualitative considerations. Financial-reporting terms such as significant deficiency and material weakness have definitions under applicable standards; they should not be assigned using an invented universal dollar cutoff. Management reports its assessment according to applicable requirements, while auditors report conclusions within their engagement scope. An audit report describing controls considered during a financial audit does not automatically express an opinion on control effectiveness.
Worked example: An agency finds that a reviewer missed one unusual adjustment. Evaluators examine the adjustment's potential consequences, recurrence risk, and other review controls before classifying the deficiency. The auditor's report clearly states whether control effectiveness was actually an opinion objective.
Common mistake: A small observed error does not necessarily mean a small control risk, and every auditor communication about controls is not an effectiveness opinion.
Official syllabus reference: [1]
39. ERM appetite, tolerance, and residual risk
Enterprise risk management integrates risk with strategy, objectives, and performance across the organization. Risk appetite expresses the broad amount and type of risk the organization is willing to accept; tolerance translates acceptable variation into more specific boundaries. Inherent risk is assessed before responses, while residual risk remains after responses. Internal control is an important means of managing risk, but ERM also addresses strategic choices and interactions among risks. Responses can include avoidance, reduction, sharing, or acceptance. Sharing financial consequences does not necessarily remove operational or accountability exposure.
Worked example: An agency accepts limited delays in routine reporting but has little tolerance for interrupted emergency payments. It prioritizes resilience accordingly and evaluates remaining disruption risk after safeguards. Buying insurance covers some losses but does not restore payment processing or satisfy service objectives.
Common mistake: Risk transfer does not erase every consequence, and residual risk cannot be evaluated solely by counting controls without assessing their actual effect.
Official syllabus reference: [1]
40. COOP recovery objectives and human dependencies
A continuity of operations plan identifies essential functions, dependencies, alternate arrangements, authority, communications, and recovery procedures. Recovery time objective concerns how quickly a function or system should resume; recovery point objective concerns acceptable data loss measured backward in time. These are planning targets set for the scenario, not universal standards. Backups require restoration testing and protection from shared failures. Human capital planning addresses cross-training, succession, staffing availability, and access during disruption. Exercises should test combined dependencies, because functioning technology is insufficient if personnel or critical suppliers are unavailable.
Worked example: An agency sets a scenario-specific four-hour recovery target and one-hour data-loss target for emergency payments. It tests restoration, alternate connectivity, delegated authority, and cross-trained staff. The exercise reveals that the backup site and primary office depend on the same unavailable specialist.
Common mistake: Possessing backups does not prove recoverability, and a secondary site provides limited resilience when people, communications, or suppliers share the same failure point.
Official syllabus reference: [1]
Performance Measurement/Metrics/Service Efforts and Accomplishments (SEA)
41. The input-output-outcome logic chain
A logic chain connects resources to activities, delivered services, and resulting changes. Inputs include spending, staff hours, and equipment; outputs count goods or services produced; outcomes describe effects on people or conditions. Intermediate outcomes can precede ultimate results. The chain helps determine whether a measure reflects effort, production, or accomplishment and whether the program's assumptions are plausible. Outputs may be easier to attribute to the agency than outcomes, which often depend on external conditions. Reporting both avoids treating high activity volume as sufficient evidence of public benefit.
Worked example: A road-safety program reports inspector hours as inputs, inspections completed as outputs, and fewer serious vehicle defects as an intermediate outcome. Reduced crashes are a later outcome influenced by drivers, weather, enforcement, and other factors beyond the inspection program alone.
Common mistake: More services delivered do not necessarily establish improved outcomes, and an outcome measure does not by itself prove the program caused the change.
Official syllabus reference: [1]
42. Efficiency ratios need consistent cost and quality
Efficiency relates resources to outputs or outcomes, such as cost per inspection or cost per successful placement. Specify whether costs include direct expenses, allocated support, capital use, or other components, then apply the definition consistently. The denominator should reflect the intended service and quality standard. A low cost per processed application may conceal rework or poor accuracy. Productivity can also be expressed as outputs per staff hour, the inverse orientation of a resource-per-output measure. Comparisons require attention to case complexity, service scope, and differences in cost allocation.
Worked example: Office North spends $120,000 to complete 6,000 applications, but only 5,000 meet the accuracy standard. Its cost is $20 per completion and $24 per accurate completion. Management reports both to show how quality changes the interpretation of apparent efficiency.
Common mistake: Lower cost per transaction can reflect incomplete work or reduced quality, and inconsistent allocation of support costs can distort comparisons between offices.
Official syllabus reference: [1]
43. Baselines, targets, and benchmarks serve different roles
A baseline records the starting condition against which change is measured. A target states the desired result for a defined period, while a benchmark supplies a comparison such as a peer, prior best performance, or recognized practice. These roles should not be conflated: a peer's result is not automatically an appropriate target. Comparable service definitions, populations, quality, and measurement periods are essential. Changes in methods can break the time series, requiring restated data or clear disclosure. Explain why a benchmark is relevant before using it to judge performance.
Worked example: A permit office's baseline median processing time is eighteen days. It sets a fifteen-day target and compares with a peer reporting twelve days. Staff discover that the peer excludes incomplete applications, so they align definitions before interpreting the gap or revising their target.
Common mistake: A benchmark does not become a valid performance target merely because another organization reports it; workload and measurement definitions may differ materially.
Official syllabus reference: [1]
44. Operational definitions make performance data verifiable
Useful performance data are relevant, understandable, comparable, reliable, timely, verifiable, actionable, and worth their collection cost. An operational definition specifies the population, numerator, denominator, exclusions, timing, source, and calculation. Verifiability requires a traceable path from reported results to underlying evidence. Timeliness and precision may trade off, so preliminary estimates should be labeled and revised transparently. A highly reliable measure can still be irrelevant to an objective. Select a manageable set that supports decisions rather than maximizing the number of indicators on a dashboard.
Worked example: A service center defines an answered call as one connected to an employee within thirty scenario-defined seconds, excluding abandoned calls only under a disclosed rule. Source logs and calculation code are retained so another reviewer can reproduce the monthly percentage.
Common mistake: A precise percentage is not inherently reliable or comparable when offices use different exclusions, clocks, populations, or definitions of successful completion.
Official syllabus reference: [1]
45. Case-mix adjustment and outcome attribution
Aggregate performance can change because service quality changes, because the population changes, or both. Stratification compares results within meaningful groups, while standardization applies common group weights to improve comparability. A favorable overall trend can coexist with deterioration in every group when workload composition shifts. Even adjusted outcome differences do not automatically establish causation. External conditions, selection, and unmeasured characteristics may remain. Use appropriate evaluation designs when attributing effects, and disclose what routine performance measurement can and cannot establish about a program's contribution to observed results.
Worked example: An office's overall timely-resolution rate rises after complex cases become a smaller share of work. Within both routine and complex categories, timeliness falls. Staff publish stratified rates and a constant-weight comparison so readers can distinguish workload composition from actual processing performance.
Common mistake: An improving aggregate rate does not prove within-group improvement, and statistical adjustment alone does not establish that the program caused an outcome.
Official syllabus reference: [1]
46. Linking strategy, budgets, and marginal results
Performance-informed budgeting connects strategic objectives with activities, resources, expected outputs, and outcomes. The connection helps decision makers ask what additional resources might accomplish and what tradeoffs reductions create. Historical average cost is not automatically the marginal cost of expanding service because fixed capacity, congestion, or economies of scale may change the relationship. Measures inform allocation but do not mechanically determine it; legal commitments, equity, and uncertain outcomes also matter. Track financial and nonfinancial results together so spending execution is not mistaken for mission accomplishment.
Worked example: A library proposes evening hours to improve working residents' access. Its budget identifies staffing and security costs, expected visits, and access measures. Decision makers compare alternatives and recognize that existing building costs do not all increase when one additional evening is added.
Common mistake: Spending the full budget does not establish strategic success, and multiplying average historical cost by added workload may misstate the resources expansion requires.
Official syllabus reference: [1]
47. Stakeholder input, transparency, and gaming risks
Stakeholders help identify which outcomes matter, how service is experienced, and whether measures omit important groups. Public accountability requires understandable results, methods, limitations, and explanations of significant changes. Disaggregate appropriate measures to reveal unequal access or results while protecting sensitive information. Targets can influence behavior, including selecting easier cases, shifting timing, or narrowing service to improve reported scores. Balanced measures of volume, quality, timeliness, and outcomes reduce single-indicator distortions. Input should inform measure design without allowing convenience or popularity to replace the organization's lawful mission.
Worked example: Residents identify appointment availability as a larger problem than average counter wait. The agency adds access measures and reports results by service area. It also checks whether staff improve wait statistics by discouraging difficult appointments or moving unresolved requests outside the measured queue.
Common mistake: A favorable headline indicator can conceal excluded clients, shifted work, or unequal access, especially when incentives reward the number without examining behavior.
Official syllabus reference: [1]
48. Federal performance requirements versus SEA guidance
Federal performance management includes statutory planning and reporting structures associated with GPRA and its modernization, linking agency goals, performance plans, and reported results. Applicability and specific duties depend on the entity and requirement. State and local governments operate under their own legal and policy structures; service efforts and accomplishments reporting provides a way to communicate resources, services, and results. Guidance is not automatically a legal mandate. For this examination, distinguish the supplied beginning-of-2024 regulatory basis from later developments and avoid assuming a uniform performance-reporting law for every government.
Worked example: A federal agency aligns its annual performance information with applicable federal planning requirements. A county separately publishes SEA information on road maintenance under its adopted reporting policy. Both explain resources and results, but their legal authority and required reporting structures differ.
Common mistake: Federal performance legislation does not automatically impose identical planning documents, reporting deadlines, or metrics on every state, county, city, or public authority.
Auditing
49. Financial, performance, and attestation objectives
A financial statement audit seeks reasonable assurance about whether statements are free of material misstatement and supports an opinion under the applicable reporting framework. Performance audits evaluate specified aspects such as economy, efficiency, effectiveness, or compliance. Attestation engagements address defined subject matter or assertions under applicable attestation standards; their assurance and reporting depend on engagement type. An agreed-upon procedures engagement reports procedures and findings rather than an assurance opinion. Choose the engagement from the user's information need, then define criteria and scope instead of assuming every government audit has identical objectives.
Worked example: A council asks whether a transit maintenance program can meet service needs more economically. A performance audit fits that question. An opinion on the transit entity's financial statements would answer a different question, even though the auditors may examine some of the same spending records.
Common mistake: An audit opinion on financial statements does not establish that every program is efficient, and agreed-upon procedures findings are not an assurance opinion.
Official syllabus reference: [1]
50. AICPA and GAO standards can apply together
Auditing standards define responsibilities for performing and reporting an engagement. AICPA Auditing Standards Board standards address relevant nonissuer financial audits and attestation work. GAO's Government Auditing Standards, often called GAGAS or the Yellow Book, add governmental requirements and include standards for performance audits. A governmental financial audit may require both applicable AICPA standards and GAGAS rather than choosing one exclusively. Determine requirements from law, regulation, agreement, and engagement terms. Identify the version applicable to the examination's regulatory basis instead of treating later revisions as automatically governing every tested scenario.
Worked example: A local government's engagement requires a financial audit under generally accepted auditing standards and Government Auditing Standards. The audit team plans for both sets of applicable responsibilities and reporting requirements, rather than assuming the financial statement opinion alone satisfies the entire engagement.
Common mistake: Government ownership does not make every engagement identical, and applying one standards source does not necessarily satisfy additional standards required by law or agreement.
51. Independence threats and management participation
Auditor independence includes both the ability to exercise objective judgment and the appearance of impartiality to informed users. Financial interests, close relationships, self-review, undue influence, and management participation can create threats. Evaluate their significance and whether appropriate safeguards reduce them to an acceptable level under applicable standards. Some services involve assuming management responsibility and cannot be made acceptable merely by obtaining a general acknowledgment letter. Advice differs from deciding, authorizing, or operating a management function. Management must have suitable capability to oversee permissible assistance and accept responsibility.
Worked example: An auditor explains alternative accounting treatments, while the finance director selects and approves the treatment. If the auditor instead authorizes entries and releases them into the ledger, the auditor assumes management authority and creates a different independence problem from providing technical advice.
Common mistake: A separate engagement letter or management acknowledgment does not cure the auditor's actual performance of management decisions or authorization functions.
Official syllabus reference: [1]
52. Competence, judgment, and engagement quality
Professional judgment applies relevant knowledge and experience to decisions about objectives, risks, evidence, and conclusions. Competence includes the collective skills needed for the work, including specialists when necessary. Quality controls or quality-management processes support appropriate acceptance, staffing, supervision, consultation, review, and reporting under the applicable standards version. Review should challenge whether evidence supports conclusions, rather than merely confirm that forms are complete. Independence and competence are complementary: an objective team still needs technical capability, and a technically skilled team still requires freedom from inappropriate influence.
Worked example: A team auditing a complex information system uses a qualified technology specialist and documents how the specialist's work supports the audit objective. Supervisory review challenges unsupported assumptions and resolves conflicting evidence before the team finalizes its conclusions and report.
Common mistake: Completing every checklist does not establish audit quality when the team lacks needed expertise or fails to challenge whether evidence supports its conclusions.
Official syllabus reference: [1]
53. Materiality combines magnitude and public significance
Materiality concerns whether information could influence users' decisions, individually or in combination with other information, within the engagement's context. Amount matters, but nature and circumstances can also matter, especially in government. Sensitive transactions, compliance implications, concealment, or effects on important programs may warrant attention even when dollars are modest. Materiality is not a universal fixed percentage and differs from a payment authorization limit. Auditors use materiality in planning and evaluating results while considering applicable standards, audit objectives, aggregation, and qualitative factors.
Worked example: An unauthorized payment is small relative to total expenditures but involves a senior official and concealed approval records. Auditors consider the transaction's nature and implications for oversight rather than dismissing it solely because its amount falls below a planning benchmark.
Common mistake: A transaction below a numerical benchmark is not automatically immaterial, and a government authorization threshold is not interchangeable with audit materiality.
Official syllabus reference: [1]
54. Sufficient, appropriate, and protected audit evidence
Sufficiency concerns evidence quantity, while appropriateness concerns relevance and reliability for the audit objective. More weak evidence does not necessarily compensate for poor quality. Inspection, confirmation, observation, reperformance, inquiry, and analytical procedures contribute differently; inquiry alone often needs corroboration. Evaluate contradictory evidence and document the link from procedures to findings. Government audits can involve taxpayer records, informant payments, health information, and other personal data. Collect and retain only necessary information, use authorized access and secure handling, and tailor public reporting so conclusions remain understandable without improper disclosure.
Worked example: An auditor testing recipient eligibility compares program records with authorized supporting documents rather than relying only on staff interviews. Working papers retain the necessary evidence securely, while the public report describes the error pattern without exposing recipients' identifying or sensitive health details.
Common mistake: Large volumes of irrelevant records do not establish persuasive evidence, and including sensitive personal details in a public report is not required for transparency.
Official syllabus reference: [1]
55. Risk-based planning and sampling boundaries
Audit planning connects objectives, criteria, risks, scope, and procedures. Understand the entity and relevant controls before deciding where evidence is most needed. Sampling examines less than the full population and therefore requires attention to population completeness, selection, sample purpose, and evaluation. Statistical and nonstatistical approaches can both be appropriate, but conclusions must respect the design. A targeted sample of high-risk items can identify important problems without supporting an unbiased population error estimate. Even testing every recorded item does not establish that the recorded population includes every required transaction.
Worked example: Auditors select unusually large adjustments to investigate override risk. They report the exceptions found but do not describe the targeted sample's error percentage as the department-wide rate. A separate representative design would be needed for a defensible population estimate.
Common mistake: A high-risk sample's exception rate cannot automatically be projected to all transactions, and full-file testing does not prove the source file is complete.
Official syllabus reference: [1]
56. Performance findings link criteria, condition, cause, and effect
A well-supported performance finding compares criteria, describing what should occur, with condition, describing what evidence shows. Cause explains why the gap occurred when adequately established; effect describes actual or potential consequences relevant to the objective. Not every engagement requires every element to the same extent, but unsupported causal claims weaken recommendations. Develop recommendations that address demonstrated causes and desired results without unnecessarily assuming management's operational role. Report scope, methodology, limitations, and management's views as applicable so users can assess the strength and boundaries of the conclusions.
Worked example: An audit finds late grant closeouts against the agency's established deadline. Records show unclear task ownership and unresolved reconciliation queues. The report links these supported causes to delayed release of funds and recommends accountable assignments and queue controls rather than merely demanding faster work.
Common mistake: A difference from criteria does not automatically establish its cause, and recommending more training is weak when evidence identifies a system or ownership problem.
Official syllabus reference: [1]
57. Auditee preparation and representation letters
The auditee prepares reliable records and financial information, supports access to relevant evidence, coordinates requests, and retains responsibility for its statements and controls. Procuring audit services requires a scope, applicable standards, qualifications, independence considerations, deliverables, and an appropriate selection process. Management representation letters confirm specified representations to the auditor, including responsibilities and relevant disclosures under the engagement's requirements. They complement rather than replace other audit evidence. Signing a letter does not transfer ownership of the financial statements to the auditor or resolve contradictory records discovered during testing.
Worked example: A finance office prepares reconciled schedules, assigns knowledgeable contacts, and tracks audit requests. Near completion, authorized management signs the required representation letter. When an unresolved liability contradicts a representation, the auditor investigates the evidence rather than accepting the signature as conclusive.
Common mistake: A management representation letter is not a substitute for reconciliations or supporting evidence, and hiring an auditor does not transfer statement-preparation responsibility.
Official syllabus reference: [1]
58. Audit committees provide oversight without operating controls
An audit or audit advisory committee supports governance by overseeing financial reporting, audit arrangements, independence, significant findings, and corrective-action progress within its authority. Effective oversight includes direct communication with auditors and attention to unresolved disagreements or resource constraints. The committee should understand the scope and limitations of each engagement rather than treating every clean opinion as assurance over all operations. It does not ordinarily replace management's responsibility to prepare records and operate controls. Clear mandates, relevant expertise, and appropriate independence strengthen its ability to challenge both management and auditors constructively.
Worked example: A committee asks why a recurring reconciliation finding remains open, reviews management's corrective plan, and seeks the auditor's assessment of progress. It holds management accountable without taking over daily reconciliation work or directing the entries that staff should post.
Common mistake: Oversight does not require the committee to operate management controls, and an unmodified financial statement opinion does not resolve every operational finding.
Official syllabus reference: [1]
59. Corrective-action follow-up tests results
Audit follow-up evaluates whether management addressed findings and recommendations through appropriate corrective action. A useful plan identifies accountable owners, specific actions, target dates, and evidence of completion. Distinguish issuing a policy, implementing a process, and demonstrating effective operation. Follow-up procedures should match the original risk and may inspect later transactions, reperform controls, or evaluate changed outcomes. Management may address the underlying issue through an alternative action rather than the auditor's exact wording. Closure should be supported by evidence and should clearly state any limits on the period or scope tested.
Worked example: After an approval finding, management issues a new policy and trains employees. Follow-up examines subsequent transactions to determine whether independent approvals actually occurred before payment. The finding remains open if the policy exists but staff continue approving their own transactions.
Common mistake: A completed training session or signed action plan does not demonstrate that the underlying control deficiency was corrected in actual operations.
Official syllabus reference: [1]
60. Single Audit reporting and OMB's coordinating role
The Single Audit framework combines entity-level financial audit work with federal-award compliance auditing for qualifying recipients. OMB's applicable Uniform Guidance structures requirements, while major-program selection focuses compliance work using prescribed risk-based concepts. Reporting includes financial statement results, reporting on internal control and compliance, major-program compliance opinions, a schedule of findings and questioned costs, and reporting associated with the schedule of expenditures of federal awards. Auditees prepare corrective actions and address prior findings. Applicability thresholds and effective dates can change, so use the examination's stated regulatory basis rather than importing later rules.
Worked example: A county already determined to require a Single Audit prepares its federal-award expenditure schedule and prior-finding information. Auditors evaluate major programs and report compliance results. Management then prepares corrective actions for findings instead of assuming the financial statement opinion resolves award compliance.
Common mistake: A Single Audit does not inspect every award transaction or replace management's compliance responsibilities, and later threshold changes should not be assumed applicable.
Official syllabus sources
- AGA 2026 CGFM: Governmental Financial Management and Control
- Current AGA CGFM programme and tested regulation basis
- Historical AGA format description: question-type corroboration only