MARADMIN 536/26
HEADQUARTERS MARINE CORPS ENTERPRISE-WIDE RISK MANAGEMENT AND INTERNAL CONTROL PROGRAM ANNUAL GUIDANCE FISCAL YEAR 2027
R 281400Z OCT 26 MARADMIN 536/26 MSGID/GENADMIN/CMC WASHINGTON DC PR RFD// SUBJ/HEADQUARTERS MARINE CORPS ENTERPRISE-WIDE RISK MANAGEMENT AND INTERNAL CONTROL PROGRAM ANNUAL GUIDANCE FISCAL YEAR 2027// REF/A/OMB CIRCULAR A-123// REF/B/MCO 5200.24F MARINE CORPS RISK MANAGEMENT AND INTERNAL CONTROL PROGRAM// REF/C/USMC HQMC ENTERPRISE-WIDE RISK MANAGEMENT AND INTERNAL CONTROL PROGRAM ANNUAL GUIDANCE FISCAL YEAR 2027// NARR/REF A ESTABLISHES FEDERAL REQUIREMENTS FOR MANAGEMENT RESPONSIBILITY FOR INTERNAL CONTROL. REF B ESTABLISHES MARINE CORPS POLICY, RESPONSIBILITIES, AND PROCEDURES FOR THE MARINE CORPS RISK MANAGEMENT AND INTERNAL CONTROL PROGRAM. REF C IS THE SOURCE FOR FY27 ENTERPRISE-WIDE RMIC OPERATING GUIDANCE AND DETAILED IMPLEMENTATION REQUIREMENTS.// POC1/THOMAS BIRCHALL/DC, P&R-RFD/TEL: COMM (703) 614-3598/EMAIL: [email protected]// POC2/LTCOL ISAAC BAKER/DC, P&R-RFD/TEL: COMM (703) 693-9823// GENTEXT/REMARKS/1. Purpose. This MARADMIN establishes Fiscal Year 2027 (FY27) priorities, responsibilities, and implementation requirements for the Marine Corps Risk Management and Internal Control (RMIC) Program. Effective internal controls are essential to safeguarding resources, maintaining readiness, improving financial accountability, and sustaining the Marine Corps’ unmodified financial statement audit opinion. 2. Command Accountability. Commanders and directors are responsible for maintaining effective internal controls within their organizations. RMIC is an enterprise-wide leadership responsibility and is not limited to financial management personnel or G-8 organizations. During FY27, certain command-level RMIC administrative requirements are paused as the Marine Corps transitions to a centralized, risk-based assessment approach. This does not relieve commanders, directors, functional advocates, or process owners of their responsibility to maintain controls, identify risks, correct deficiencies, and support enterprise assessments. 3. FY27 Assessment Priorities. P&R RMIC Branch will lead enterprise -wide assessments of internal controls over financial reporting, prioritizing: 3.a. Real Property. 3.b. Environmental Disposal Liabilities. 3.c. Miscellaneous Payments. 4. Previously assessed processes, entity-level controls, and applicable System and Organization Controls (SOC) 1 reports will be monitored using a risk-based approach. Controls may be reassessed based on significant changes, identified deficiencies, remediation status, or other emerging risks. Commands and responsible offices will provide timely access to personnel, documentation, systems, and supporting evidence as directed through ETMS-2 taskers. 5. Corrective Action and Accountability. Responsible HQMC offices, functional advocates, and process owners will ensure identified control deficiencies are supported by corrective action plans that: 5.a. Address underlying root causes. 5.b. Identify accountable owners and achievable milestones. 5.c. Maintain documentation supporting implementation and effectiveness. 5.d. Elevate significant risks, delays, and unresolved deficiencies. 5.e. Will result in demonstrable improvements to control effectiveness, not simply administrative closure. 6. FY27 Key Milestones. 6.a. October 2026–January 2027: Assessment planning and training. 6.b. December 2026–July 2027: Control walkthroughs and testing. 6.c. 30 June 2027: Fraud Risk Impact Memorandums due. 6.d. July 2027: Assessment results and deficiency identification. 6.e. August–September 2027: Corrective action planning and annual Commandant's Certification Statement support. 6.f. 31 August 2027: Final FY28 business process narratives and risk and control matrices due. Detailed requirements, responsible organizations, and submission instructions will be communicated through reference (c) and applicable ETMS-2 taskers. 7. Enterprise Governance, Risk, and Compliance (eGRC). During FY27, P&R RMIC Branch will advance implementation of eGRC to standardize risk assessments, control documentation, deficiency tracking, and corrective action management. Commands and process owners will support this transition, retain required documentation, and prepare for increased responsibility in conducting top-down assessments beginning in FY28. 8. Leadership Expectations. Commanders and directors will ensure their organizations actively support RMIC requirements, address identified deficiencies, and elevate material risks or delays that could affect mission execution, financial accountability, or audit sustainment. 9. Additional Guidance. Reference (c) provides detailed FY27 RMIC requirements, templates, and implementation instructions. P&R RMIC Branch will communicate updates through the RMIC Practitioners Microsoft Teams channel and designated points of contact. 10. Release authorized by Mr. Edward Gardiner, SES, Assistant Deputy Commandant for Programs and Resources.//