AR 11-2: Assurance Statements, DA Form 11-2, and Material Weaknesses

Army Regulation 11-2 is the Army’s policy for the Managers’ Internal Control Program, and it makes every commander and manager personally responsible for the controls that protect the resources and operations under their authority. If you run an Army program, oversee a financial system, or supervise people who do, AR 11-2 requires you to identify what could go wrong in your operation, put controls in place to prevent it, test those controls on a set schedule, and certify the results in writing each year.¹

The regulation is the Army’s implementation of a federal requirement. The Federal Managers’ Financial Integrity Act of 1982, at 31 U.S.C. § 3512, obligates every executive agency to maintain internal controls that keep obligations lawful, protect assets from waste and misappropriation, and record revenues and expenditures properly, and to report annually on how well those controls are working.² AR 11-2 pushes that obligation down to the level where the work actually happens.

Who Is Covered

The regulation applies to the active Army, the Army National Guard and the Army National Guard of the United States, and the U.S. Army Reserve, along with all subordinate commands and organizations.¹ The scope is deliberately wide. Internal control is not something the finance office does on your behalf; it is an individual responsibility that follows the position. Civilian employees and contractors performing functions under Army command supervision are bound by the same principles.

What the Program Requires You to Do

The core duty under AR 11-2 is to know your risks and control them. Managers use risk assessment to identify the key internal controls in their functional area, weighing the likelihood and potential severity of errors, fraud, or noncompliance, and then designing controls that target the highest-risk areas.¹ That assessment feeds an annual Internal Control Evaluation Plan.

Key controls come from two directions. Headquarters-level proponents determine baseline key controls in coordination with the U.S. Army Audit Agency, so audit expectations stay consistent across the Army. Local organizations then add their own areas of vulnerability, including issues flagged by higher headquarters, the DoD Inspector General, or external auditors.¹

The controls themselves are practical safeguards: separating financial duties so no single person handles a transaction from start to finish, physically securing sensitive assets, reconciling accounts on a regular schedule, and similar measures fitted to the operation.

The Five-Year Evaluation Cycle

Every key internal control must be formally evaluated at least once every five years.¹ Commanders and managers can and should evaluate more often when circumstances warrant, such as heavy personnel turnover, audit findings, or a change in mission. If the underlying internal control assessment changes, the evaluation clock resets regardless of when the last evaluation occurred.

Evaluation methods include document analysis, direct observation, and random sampling. The purpose is to confirm the control actually works, not just that it exists on paper.

DA Form 11-2 and What It Certifies

Each completed evaluation is documented on DA Form 11-2, the Internal Control Evaluation Certification. Block 7 captures the method used to test compliance, a summary of results, any deficiencies (or a statement that none were found), and the corrective actions taken or pending. The assessable unit manager certifies the form in block 8a(2), and electronic signatures are accepted.¹

A common misunderstanding is worth flagging. The DA Form 11-2 certifies that the evaluation was performed and documented. It does not stand in place of the underlying work. Supporting materials used to reach conclusions must be referenced on the form and either attached or kept available for review.¹

The Annual Statement of Assurance

At the close of each fiscal year, senior Army leaders sign and submit an Annual Statement of Assurance for their organization. The statement reports on the effectiveness of internal controls over nonfinancial operations, financial reporting, and financial systems.¹ Evaluations you complete during the year roll up into this statement.

An unmodified assurance means controls are operating effectively with no material weaknesses. If one or more material weaknesses exist, the organization cannot claim an unmodified assurance and must disclose each weakness with a corrective action plan.³ The Army’s statement feeds directly into the annual compliance report that 31 U.S.C. § 3512 requires the agency head to submit to the President and Congress.²

Handling a Material Weakness

A material weakness is a significant deficiency in internal controls serious enough to report to the next higher level of command. When you identify one, AR 11-2 requires a corrective action plan with achievable milestones. The final milestone has to validate that the corrective actions actually resolved the problem. Until that validation happens, the weakness stays open.¹

Weaknesses submitted up the chain from Army Commands, Army Service Component Commands, and Direct Reporting Units go to the HQDA functional proponent, which provides written feedback within 10 business days recommending whether the issue is monitored at a lower level, accepted without Army-wide reporting, or adopted as an HQDA-level material weakness for inclusion in the Secretary of the Army’s own statement of assurance. If it becomes an HQDA-level weakness, a corrective action plan is developed within 30 days.¹

Record Retention

Documentation must be kept under the Army Records Information Management System. Annual Statement of Assurance records are retained for three fiscal years after submission. If a material weakness was reported, the records are held for three years after the weakness is resolved and HQDA no longer requires status reports on it. Assessable units also retain the documentation from their most recent internal control evaluation.¹

Why a False Certification Is a Serious Problem

AR 11-2 is a management regulation, and most failures produce management consequences: adverse attention from leadership, poor inspection results, and in serious cases relief from duty. One risk sits in a different category. Signing a false DA Form 11-2 or a false Annual Statement of Assurance can expose you to prosecution.

For military personnel, Article 107 of the Uniform Code of Military Justice (10 U.S.C. § 907) covers anyone subject to the UCMJ who, with intent to deceive, signs any false record, return, regulation, order, or other official document knowing it to be false. Punishment is as a court-martial may direct.⁴ Certifying that an evaluation was performed when it was not, or that controls are effective when you know they are deficient, sits squarely within that statute. For civilian employees, knowingly submitting a false certification can result in adverse personnel action and potential criminal liability under 18 U.S.C. § 1001 for false statements to a federal agency.

The practical point is straightforward. The DA Form 11-2 and the Annual Statement of Assurance are legal certifications, not box-checking paperwork, and the signatures on them carry real weight.

1
Department of the Army. Army Regulation 11-2 – Managers’ Internal Control Program
2
Office of the Law Revision Counsel. 31 U.S. Code 3512 – Executive Agency Accounting and Other Financial Management Reports and Plans
3
Office of Management and Budget. OMB Circular No. A-123 – Management’s Responsibility for Enterprise Risk Management and Internal Control
4
Office of the Law Revision Counsel. 10 USC 907 – Art. 107. False Official Statements; False Swearing