PAM 11-2 — Risk Management And Internal Control Program
PAM 11-2 governs planning, documentation, evaluation, remediation, and reporting for the Army Risk Management and Internal Control Program.
- Publication number: PAM 11-2
- Title: RISK MANAGEMENT AND INTERNAL CONTROL PROGRAM
- Date: 07/16/2024
- Proponent: ASA (FM&C)
- Status: ACTIVE
View PAM 11-2 on armypubs.army.mil
Related publications
It covers testing, corrective-action validation, annual assurance reporting, and additional program functions. It specifies evaluation plans, organizational submissions, documentation retention, and data-quality controls.
Applies to: While this pamphlet primarily addresses RMIC functions applicable to all Soldiers (Active, Reserve, and Guard) and Department of the Army (DA) Civilians, it also contains procedures on the management of agency, command, and installation level RMIC functions.
Topics covered
- Internal control evaluation plans
- Risk assessment
- Testing methods
- Corrective action plans
- Annual statements of assurance
- Data quality plans
- Internal control deficiencies
Questions and answers
How often should reporting organizations review corrective action plans?
OASA (FM&C) recommends that ROs review CAPs at least quarterly, ensuring that the corrective actions in process are planned adequately to address root causes and timelines and are practical and achievable. (paragraph 6-3)
What documentation must reporting organizations retain for material weaknesses and control assessments?
ROs must retain documentation on MWs, control deficiencies, and control assessments in accordance with DoD 7000.14 R, Volume 1, Chapter 9, Figure 9 1. (paragraph 1)
Can contract personnel serve as the HRO, SRO, AUM, or ICA?
Contract personnel are prohibited from serving in the role of HRO, SRO, AUM, and ICA. (paragraph 1-6)
What independence is required for internal control roles?
The roles are inherently governmental and must be independent of the function assessed. (paragraph 1-6)
When can a remediated material weakness related to an external audit finding be removed?
If a remediated MW is related to an independent external auditor finding, the MW can only be removed when the independent external auditor concurs with the completion and effectiveness of implemented remediation activities. (paragraph 1)