OMB revised Circular A-123 on March 10, 2026. This is what it changes for your FY2026 assurance.
I read the 35 pages and turned them into two working documents for the people who actually run the assessment. Leave your e-mail and you get both, plus a short note from me if the circular or its appendices change again. Nobody will call you.
-
The 32-point checklist (PDF, 5 pages)
What is no longer required, what the risk assessment now has to cover, how deficiencies and corrective actions are reported, and what the assurance statement looks like. Every point carries its section number, so you can check it against the circular yourself.
-
The Quick Check workbook (Excel)
A risk register with the new Section IV.A tags, a self-check on the seventeen principles as they are worded in 2026, the FMFIA calendar for the year, and the list of changes with their references.
Both are summaries of the March 2026 text. They are not OMB guidance, and they do not replace the circular or its appendices.
Download the checklist (PDF, 5 pages)
Download the Quick Check workbook (Excel)
If you need the whole cycle, the full A-123 Assurance Kit adds the fraud module, the control matrix with evidence of outcome, the test plan, the deficiency log with the Table 2 severity rules, corrective action plans, the principle and component evaluation, the three statement templates and a user guide. See the kit and pre-order it.
Six of the thirty-two points
Enterprise risk management is no longer a required framework. It only appears under “Other Considerations and Best Practices” (Section VII).
Every documented risk gets a tag: fraud, improper payments, information security, significant change, or a combination (Section IV.A).
Deficiencies now go to the Inspector General as well as up the line (Section IV.C).
If a relevant principle is not achieved, that is a material weakness (Table 2). The seventeen principles have become the severity test.
Each deficiency needs a root-cause analysis, done by management. The circular says plainly that this is not the auditors' job (Section IV.E).
There is a single annual report with a fixed label, “Analysis of Entity's Systems, Controls and Legal Compliance,” and it should carry only essential information (Section V).
I am Madogal Tall. I led the internal control over financial systems program for the U.S. Marine Corps under OMB A-123, with a team of ten: service-provider control assessments, mapping of IT general and application controls, and the remediation of deficiencies. Before that I led the Oracle financial system migration at the U.S. Treasury, and I have worked with the Department of Justice and NIH through IBM, Booz Allen Hamilton and MIL Corporation. Today I advise the DoD Office of Inspector General's CIO office on IT demand and requirements management. I hold the PMP and the CISA.