A vulnerability assessment is an internal controls assessment performed by the agency’s managers utilizing a process and forms developed by the agency’s management control officers, program coordinators, or program administrators.