- -

OF 

INSPECTOR GENERAL 

U.S. DEPARTMENT OF THE INTERIOR 

AUDIT

Independent Auditors’ Report on 

the U.S. Department of the

Interior’s Financial Statements 

for Fiscal Years 2020 and 2019

Report No.: 2020-FIN-028 November 2020
 

 

 

 

 

OFFICE OF 

INSPECTOR GENERAL 

U.S. DEPARTMENT OF THE INTERIOR 

Memorandum 

To: Secretary Bernhardt 

From: Mark Lee Greenblatt 

Inspector General 

Subject: Independent Auditors’ Report on the U.S. Department of the Interior’s Financial 

Statements for Fiscal Years 2020 and 2019 

Report No. 2020-FIN-028 

This memorandum transmits the KPMG LLP (KPMG) auditors’ report of the U.S. 

Department of the Interior’s (DOI) financial statements for fiscal years (FYs) 2020 and 2019. 

The Chief Financial Officers Act of 1990 (Public Law 101-576), as amended, requires the DOI 

Inspector General, or an independent external auditor as determined by the Inspector General, to 

audit the DOI’s financial statements. 

Under a contract issued by the DOI and monitored by the Office of Inspector General, 

KPMG, an independent public accounting firm, audited the DOI’s financial statements for the 

FYs that ended September 30, 2020 and 2019. The contract required that the audit be performed 

in accordance with U.S. generally accepted government auditing standards, Office of 

Management and Budget audit guidance, and the Government Accountability Office/Council of 

the Inspectors General on Integrity and Efficiency Financial Audit Manual. 

In its audit, KPMG reported: 

• The financial statements were fairly presented, in all material respects, in accordance

with U.S. generally accepted accounting principles

• One material weakness and four significant deficiencies in internal controls over

financial reporting:

o Material Weakness

1. Controls over financial reporting

o Significant Deficiencies

1. Controls over construction in progress

2. Controls over journal entries

Office of Inspector General | Washington, DC 
 

 

 

 

 

 

3. General information technology controls 

4. Entity-level controls 

• No instances in which the DOI’s financial management systems did not comply 

substantially with the requirements of the Federal Financial Management 

Improvement Act of 1996 (FFMIA) 

• No reportable noncompliance with provisions of laws tested or other matters 

In connection with the contract, we reviewed KPMG’s reports and related documentation 

and inquired of its representatives. Our review, as differentiated from an audit of the financial 

statements in accordance with U.S. generally accepted government auditing standards, was not 

intended to enable us to express, and we do not express, opinions on the DOI’s financial 

statements, conclusions about the effectiveness of internal control over financial reporting, or 

conclusions on whether the DOI’s financial management systems substantially complied with the 

three FFMIA requirements or whether the DOI complied with laws and other matters. KPMG is 

responsible for the attached auditors’ report dated November 16, 2020, and the conclusions 

expressed therein. Our review disclosed no instances where KPMG did not comply, in all 

material respects, with U.S. generally accepted government auditing standards. 

The legislation creating the Office of Inspector General requires that we report to 

Congress semiannually on all audit, inspection, and evaluation reports issued; actions taken to 

implement the recommendations; and recommendations that have not been implemented. 

We appreciate the courtesies and cooperation extended to KPMG and our staff during 

this audit. If you have any questions regarding this report, please contact me at 202-208-5745. 

Attachment 

2 
 

 

 

 

 

KPMG LLP

Suite 12000

1801 K Street, NW

Washington, DC 20006

KPMG LLP, a Delaware limited liability partnership and a member firm of 

the KPMG global organization of independent member firms affiliated with 

KPMG International Limited, a private English company limited by guarantee. 

Independent Auditors’ Report 

Secretary and Inspector General 

U.S. Department of the Interior: 

Report on the Financial Statements 

We have audited the accompanying consolidated financial statements of the U.S. Department of the Interior 

(the Department), which comprise the consolidated balance sheets as of September 30, 2020 and 2019, and 

the related consolidated statements of net cost, changes in net position, and custodial activity, and combined 

statements of budgetary resources for the years then ended, and the related notes to the consolidated financial 

statements. 

Management’s Responsibility for the Financial Statements 

Management is responsible for the preparation and fair presentation of these consolidated financial statements 

in accordance with U.S. generally accepted accounting principles; this includes the design, implementation, and 

maintenance of internal control relevant to the preparation and fair presentation of consolidated financial 

statements that are free from material misstatement, whether due to fraud or error. 

Auditors’ Responsibility 

Our responsibility is to express an opinion on these consolidated financial statements based on our audits. We 

conducted our audits in accordance with auditing standards generally accepted in the United States of America, 

in accordance with the standards applicable to financial audits contained in Government Auditing Standards 

issued by the Comptroller General of the United States, and in accordance with Office of Management and 

Budget (OMB) Bulletin No. 19-03, Audit Requirements for Federal Financial Statements. Those standards and 

OMB Bulletin No. 19-03 require that we plan and perform the audits to obtain reasonable assurance about 

whether the consolidated financial statements are free from material misstatement. 

An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the 

consolidated financial statements. The procedures selected depend on the auditors’ judgment, including the 

assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud 

or error. In making those risk assessments, the auditor considers internal control relevant to the entity’s 

preparation and fair presentation of the consolidated financial statements in order to design audit procedures 

that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness 

of the entity’s internal control. Accordingly, we express no such opinion. An audit also includes evaluating the 

appropriateness of accounting policies used and the reasonableness of significant accounting estimates made 

by management, as well as evaluating the overall presentation of the consolidated financial statements. 

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our 

audit opinion. 

Opinion 

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, 

the financial position of the U.S. Department of the Interior as of September 30, 2020 and 2019, and its net 

costs, changes in net position, budgetary resources, and custodial activity for the years then ended in 

accordance with U.S. generally accepted accounting principles. 
 

 

 

 

 

 

 

 

 

 

 

Other Matters 

Interactive Data 

Management has elected to reference to information on websites or other forms of interactive data outside the 

Agency Financial Report to provide additional information for the users of its financial statements. Such 

information is not a required part of the basic consolidated financial statements or supplementary information 

required by the Federal Accounting Standards Advisory Board. The information on these websites or the other 

interactive data has not been subjected to any of our auditing procedures, and accordingly we do not express 

an opinion or provide any assurance on it. 

Required Supplementary Information 

U.S. generally accepted accounting principles require that the information in the Management’s Discussion and 

Analysis and Required Supplementary Information sections be presented to supplement the basic consolidated 

financial statements. Such information, although not a part of the basic consolidated financial statements, is 

required by the Federal Accounting Standards Advisory Board who considers it to be an essential part of 

financial reporting for placing the basic consolidated financial statements in an appropriate operational, 

economic, or historical context. We have applied certain limited procedures to the required supplementary 

information in accordance with auditing standards generally accepted in the United States of America, which 

consisted of inquiries of management about the methods of preparing the information and comparing the 

information for consistency with management’s responses to our inquiries, the basic consolidated financial 

statements, and other knowledge we obtained during our audits of the basic consolidated financial statements. 

We do not express an opinion or provide any assurance on the information because the limited procedures do 

not provide us with sufficient evidence to express an opinion or provide any assurance. 

Other Information 

Our audits were conducted for the purpose of forming an opinion on the basic consolidated financial statements 

as a whole. The Introduction, Office of Inspector General’s Transmittal, Other Information, and We Would Like 

to Hear From You sections are presented for purposes of additional analysis and are not a required part of the 

basic consolidated financial statements. Such information has not been subjected to the auditing procedures 

applied in the audits of the basic consolidated financial statements, and accordingly, we do not express an 

opinion or provide any assurance on it. 

Other Reporting Required by Government Auditing Standards 

Internal Control over Financial Reporting 

In planning and performing our audit of the consolidated financial statements as of and for the year ended 

September 30, 2020, we considered the Department’s internal control over financial reporting (internal control) 

as a basis for designing procedures that are appropriate in the circumstances for the purpose of expressing our 

opinion on the consolidated financial statements, but not for the purpose of expressing an opinion on the 

effectiveness of the Department’s internal control. Accordingly, we do not express an opinion on the 

effectiveness of the Department’s internal control. We did not test all internal controls relevant to operating 

objectives as broadly defined by the Federal Managers’ Financial Integrity Act of 1982. 

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was 

not designed to identify all deficiencies in internal control that might be material weaknesses or significant 

deficiencies and therefore, material weaknesses or significant deficiencies may exist that have not been 

identified. However, as described in the accompanying Exhibit I, we did identify certain deficiencies in internal 

control that we consider to be a material weakness and significant deficiencies. 

A deficiency in internal control exists when the design or operation of a control does not allow management or 

employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, 

misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in 

internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial 

2 
 

 

 

 

 

 

 

statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies 

described in the accompanying Exhibit I as item A to be a material weakness. 

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe 

than a material weakness, yet important enough to merit attention by those charged with governance. We 

consider the deficiencies described in the accompanying Exhibit I as items B, C, D and E to be significant 

deficiencies. 

Compliance and Other Matters 

As part of obtaining reasonable assurance about whether the Department’s consolidated financial statements 

as of and for the year ended September 30, 2020 are free from material misstatement, we performed tests of 

its compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance 

with which could have a direct and material effect on the financial statements. However, providing an opinion 

on compliance with those provisions was not an objective of our audit, and accordingly, we do not express such 

an opinion. The results of our tests disclosed no instances of noncompliance or other matters that are required 

to be reported under Government Auditing Standards or OMB Bulletin No. 19-03. 

We also performed tests of its compliance with certain provisions referred to in Section 803(a) of the Federal 

Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with FFMIA was 

not an objective of our audit, and accordingly, we do not express such an opinion. The results of our tests 

disclosed no instances in which the Department’s financial management systems did not substantially comply 

with the (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, 

and (3) the United States Government Standard General Ledger at the transaction level. 

Department’s Responses to Findings 

The Department’s responses to the findings identified in our audit are described as a separate attachment titled 

Management's Response to Independent Auditors' Report for Fiscal Year (FY) 2020 (Assignment No. 2020-

FIN-028). The Department’s responses were not subjected to the auditing procedures applied in the audit of the 

consolidated financial statements and, accordingly, we express no opinion on the responses. 

Purpose of the Other Reporting Required by Government Auditing Standards 

The purpose of the communication described in the Other Reporting Required by Government Auditing 

Standards section is solely to describe the scope of our testing of internal control and compliance and the 

results of that testing, and not to provide an opinion on the effectiveness of the Department’s internal control or 

compliance. Accordingly, this communication is not suitable for any other purpose. 

Washington, D.C. 

November 16, 2020 

3 
 

 

 

 

Exhibit I 

Internal control is a dynamic process used by management to achieve its objectives and an effective internal 

control system helps an entity adapt to shifting environments, evolving demands, changing risks, and new 

priorities. As programs change and entities strive to improve operational processes and implement new 

technology, management must identify the potential risks that would prevent them from achieving their 

objectives and continually evaluate its internal control system so that it is effective and updated when 

necessary. As such, management is expected to perform ongoing monitoring activities as part of the normal 

course of operations to ensure the controls are continuing to operate to mitigate the identified risks. 

During fiscal year (FY) 2020, the Department initiated the implementation of corrective action plans to address 

internal control weaknesses and strengthen internal control. Although the Department made some progress in 

certain financial management and reporting areas, deficiencies remain in certain areas of financial reporting, 

construction in progress, journal entries, general information technology controls, and entity level controls that 

highlighted the need for improved financial management and reporting review at the Department. Additional 

remediation efforts are scheduled to continue in FY 2021. 

MATERIAL WEAKNESS 

A. Controls over Financial Reporting 

Conditions 

The Department’s controls over the preparation and compilation of its financial statement disclosures were not 

designed, implemented or operating effectively to appropriately prevent, or detect and correct misclassification 

errors in certain financial statement disclosures. The Department needs to strengthen controls surrounding the 

implementation of new disclosure requirements issued by the Office of Management and Budget (OMB). 

Specifically, the following controls were not designed, implemented or operating effectively: 

• The configuration of the financial reporting module in the financial management system was not initially 

designed to ensure the Department had all the data attributes needed to respond to new OMB disclosure 

requirements; 

• Controls over validity and completeness of certain data attributes, input at the bureau level into the financial 

management system, were not operating effectively; and 

• Review controls over the preparation of the Department’s financial statements and related disclosures were 

not operating effectively. 

These control weaknesses resulted in a misclassification error of approximately $2.35 billion in the allocation of 

eliminations included in the Reclassification of Balance Sheet, Statement of Net Cost, and Statement of 

Changes in Net Position for FR Compilation Process note disclosure. 

As a result of our observations, the Department made the necessary corrections to its year-end financial 

statement to ensure the disclosure noted above was presented fairly, in all material respects, and in 

accordance with all applicable OMB requirements. We consider these deficiencies to be a material weakness in 

internal control. 

Criteria 

• Government Accountability Office (GAO) Standards for Internal Control in the Federal Government (Green 

Book) Principle 9, 12, 16, 17 – Identify, Analyze, and Respond to Change; Implement Control Activities; 

Perform Monitoring Activities; and Evaluate Issues and Remediate Deficiencies. 

• OMB Circular No. A-136, Financial Reporting Requirements 

I-1 
 

 

 

 

 

 

Exhibit I 

Cause and Effect 

In FY 2020, OMB issued new reporting disclosure requirements, which became effective late in the fiscal year. 

The lack of appropriate risk assessment procedures in place to timely identify, analyze, and respond to 

significant changes to OMB Circular No. A-136 Financial Reporting Requirement coupled with a limitation in 

the financial management system configuration forced the Department to heavily rely on extensive manual 

processes to comply with some of the new OMB disclosure requirements. This took a significant level of effort 

and inevitably resulted in misclassification error to the Reclassification of Balance Sheet, Statement of Net 

Cost, and Statement of Changes in Net Position for FR Compilation Process note disclosure that were not 

detected during internal control reviews. 

Without financial reporting controls designed, implemented and operating effectively, the Department is 

exposed to an increased risk that material misstatements in its financial statements and related note 

disclosures would be neither prevented nor detected and corrected, in a timely manner. 

Recommendations 

We recommend that the Department and the bureaus enhance internal control over financial reporting as 

follows: 

1. Strengthen the process for analyzing changes in accounting standards, financial reporting requirements, 

laws and regulations, and appropriately respond to ensure effective steps and controls over financial 

reporting are implemented and documented in a timely manner. 

2. Based on analysis of the changes in accounting standards; financial reporting requirements; laws and 

regulations, implement modifications to the financial management and reporting systems, as appropriate. 

3. Bureaus should develop and implement controls to ensure all data attributes needed to comply with OMB, 

Treasury and other regulatory guidance are accurately captured in the financial management system. 

4. Bureaus should develop and implement monitoring controls to ensure the validity, accuracy and 

completeness of relevant data attributes to comply with OMB, Treasury and other regulatory guidance. 

5. Perform proper monitoring procedures to ensure that Department-wide controls over financial reporting are 

effective. 

6. Strengthen review controls over financial disclosure packages. 

SIGNIFICANT DEFICIENCIES 

B. Controls over Construction in Progress 

During fiscal year 2020, the Department continued implementing corrective action plans to address longstanding internal control weaknesses by strengthening internal controls over Construction in Progress (CIP). 

Although the Department made progress, an internal control deficiency remains in certain areas of accounting 

and reporting of CIP, as outlined below. The Department indicated that additional remediation is scheduled to 

continue in FY 2021. 

Condition 

The Department reported $2.5 billion as CIP, as of September 30, 2020. Controls were not properly designed, 

implemented or operating effectively to ensure that completed CIP projects were transferred to property, plant, 

and equipment (PP&E) in a timely manner. Specifically, we noted approximately $14.5 million of completed 

projects were not transferred from CIP into the associated completed PP&E account in a timely manner. 

I-2 
 

 

 

 

 

 

 

Exhibit I 

Criteria 

• GAO Green Book Principle 4 and 10 – Demonstrate Commitment to Competence and Design Control 

Activities. 

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal

Control, Section IV, Assessing Internal Control. 

• Reclamation Manual Directives and Standards FIN 07-24, Assets Under Construction. 

Cause and Effect 

Bureaus within the Department often construct assets on behalf of another bureau and, upon completion, 

transfer the asset to the bureau who will retain the asset’s title. Existing accounting processes and

procedures rely on timely acceptance by the receiving bureau. When common operational acceptance 

delays occured, the Department did not have accounting processes and procedures in place to properly 

account for the transfer of completed and operable assets from CIP to PP&E, which resulted in 

presentation errors in the consolidated financial statements. Additionally, Project Managers (PMs) were 

not held accountable to accurately report on the status of construction projects and, as such, were not 

providing consistent and timely updates as to a project’s status. If left un-remediated, these conditions 

continue to present an increased risk that errors in PP&E will not be prevented, or detected and corrected, 

by the Department’s management in the normal course of performing their assigned functions. 

Recommendations: 

We continue to recommend that the Department and bureaus enhance internal control over general property, 

plant, and equipment as follows: 

1. Develop procedures for circumstances where bureaus are unable to transfer a completed asset due to 

delays in acceptance. 

2. Develop a resolution process for any completed asset transfer disputes between bureaus to ensure key 

data elements of the PP&E note disclosure are complete and accurate. 

3. Develop and implement oversight processes to ensure that PMs are adequately documenting the status of 

construction projects and are adhering to accounting policies and procedures. 

4. Improve training and supervision for all PMs and property accountants on matters affecting the financial 

statements, including adhering to accounting policies and procedures. 

5. Improve quarterly communication within the Department when transfer scenarios involving completed 

assets impact the PP&E note disclosure. 

C. Controls over Journal Entries 

Conditions 

To support financial reporting operational requirements across all bureaus, the Department established an 

internal control framework over the review, aggregation and posting of journal entries. This framework consists 

of a combination of configuration controls embedded in the Department’s financial management reporting

system and a Department-wide policy for dealing with manual journal entry policies to ensure the proper level 

of segregation of duties. Although the Department established the framework noted above, controls over the 

design of the Department-wide policy over manual journal entries still need to be strengthened. Specifically, we 

noted the following weaknesses in the design and implementation of the Department-wide policy over manual 

journal entries: 

I-3 
 

 

 

 

 

Exhibit I 

• The policy did not describe the Department-wide risks that need to be addressed by each bureau; 

• The policy delegated the responsibility to each bureau to determine which transactions are manual in 

nature. As a result, each bureau defined manual journal entries differently; and 

• Bureaus did not apply the appropriate segregation of duties requirements outlined in the Department’s

policy in a consistent manner. 

Criteria 

• GAO Green Book Principles 10, 13, 16 and 17 – Design Control Activities; Use Quality Information; 

Perform Monitoring Activities; and Evaluate Issues and Remediate Deficiencies, respectively. 

Cause and Effect 

The Department had not fully completed and documented a comprehensive risk assessment surrounding 

different types of journal entries, the completeness and accuracy of manual journal entries, and bureau 

requirements for addressing identified risks. To ensure that the risk assessment referred to above is 

comprehensive, the Department planned for certain system configuration changes to its financial 

management system; however, these changes were not planned to be completed until fiscal year 2021. 

Insufficiently designed, implemented and operated journal entry policies increase the risk that manual 

entries are not be appropriately prepared, reviewed, approved and/or recorded within the Department’s

financial management system. 

Recommendations 

We recommend that the Department enhance internal controls over manual journal entries as follows: 

1. Perform a root cause analysis to determine how deficiencies in the manual journal entry process occurred 

and perform proper monitoring procedures to fully implement the corrective action plans developed and 

ensure issues are fully remediated within six months of the issuance of the final auditor’s report.

2. Complete documentation surrounding the risk assessment over the system document types and to 

help determine which document types are manual entries versus automated transactions. 

3. Within the financial management reporting system, correct areas where automated entries and 

manual entries are not configured properly and/or overlap. 

4. Enable system segregation of duty capabilities for all identified manual journal entries and implement 

system configuration changes timely. 

5. Develop formal communication of the Department’s risk assessment over journal entries and 

requirements for bureaus to address the risks identified. 

6. Issue an updated journal entry policy standardizing the manual journal entry process across the entire 

Department. 

We recommend that bureaus enhance internal controls over manual journal entries as follows: 

1. Provide sufficient training and resources to employees involved in the manual journal entry control process. 

2. Implement more robust processes for tracking and properly documenting the preparation and posting of 

manual journal entries that align with the Department’s journal entry policy to ensure segregation of duties 

are completed in the correct order and in a timely manner. 

3. Implement and enforce a more detailed periodic review over manual journal entry logs. 

I-4 
 

 

 

 

 

 

 

 

Exhibit I 

D. General Information Technology Controls 

Effective controls over access to programs and system data are implemented to prevent unauthorized users 

from performing tasks not assigned to them and to log and monitor unscrupulous, unauthorized, or 

inappropriate activity that could compromise the confidentiality, integrity, and availability of the data residing in 

information systems. 

In FY 2020, we continued to note weaknesses in information technology (IT) controls designed to protect the 

Department’s financial management systems, as required by OMB Circular No. A-130 (Revised), Management 

of Federal Information Resources. Although the Department made progress in certain areas relating to IT 

controls over financial management systems, deficiencies remain in IT controls over access to programs and 

data. 

Conditions 

The Department did not properly address previously identified system control deficiencies to ensure they were 

remediated in FY 2020. Specifically, the Department did not adequately document and properly implement key 

control activities in the operating system layer related to system account access and segregation of duties. 

Additionally, terminated users’ system access privileges were not consistently disabled and/or removed prior to

the off-boarded employees’ last day at the Department. 

Furthermore, the Department was unable to provide sufficient audit documentation to support the performance 

of control activities over the review of system application security audit logs and operating system patch testing. 

Criteria 

• GAO Green Book Principles 3, 5, 6, 10, 11, 14 and 16 – Establish Structure, Responsibility, and Authority; 

Enforce Accountability; Define Objectives and Risk Tolerances; Design Control Activities; Design Activities 

for the Information System; Communicate Internally; and Perform Monitoring Activities, respectively. 

• Department of the Interior Security Control Standard, Audit and Accountability, version 4.1 (September 

2016) 

• OMB Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal

Control, provides specific requirements for assessing and reporting on controls in the federal government 

Cause and Effect 

The Department did not properly communicate protocols to accurately delineate responsibilities and ensure 

control activities, such as the periodic review for conflicts with segregation of duties and least privilege 

review, were appropriately performed. Furthermore, Department policies and procedures requiring timely 

removal of terminated users from the Department’s network and financial system access were not routinely 

followed. The Department also did not design a process with a sufficient audit trail to document the reviews 

of security audit log. Additionally, while the Department developed corrective action plans to address prior 

year control findings, the plans were not adequately designed to fully remediate deficiencies. Inadequately 

designed, implemented, and documented system controls increase the risk of inappropriate access to 

system infrastructure and financial data integrity. 

Recommendations 

We recommend that the Department increase its emphasis on formally developing and maintaining effective IT 

controls to reduce the risks posed to the integrity of the Department’s financial information. Specifically, the

Department should: 

I-5 
 

 

 

Exhibit I 

1. Perform a root-cause analysis to determine why certain prior year control deficiency conditions were 

overlooked during the corrective action plan development process to remediate prior year control 

findings. 

2. Sufficiently document IT control activities to clearly articulate roles and responsibilities of control owners. 

3. Review and strengthen the process documentation to ensure operating system access controls are 

properly designed and ensure such documentation addresses how controls mitigate related risks. 

4. Enforce policies and the timeline by which a terminated user’s access is removed, including collection of 

Personal Identity Verification (PIV) and/or laptop collection and removal of access within the system. 

5. Revise and implement procedures to generate and retain appropriate documentation to support the 

consistent performance of control activities and maintain an appropriate audit trail. 

6. Formalize communications across the Department and implement adequate monitoring procedures to 

ensure that control responsibilities are discharged properly and consistently. Monitoring procedures 

should also verify that control activity documentation is created and properly retained. 

E. Entity-Level Controls 

Conditions 

The control environment sets the tone of an organization by influencing the control consciousness of its 

personnel. It is also the foundation for all components of internal control, providing discipline and structure. The 

GAO Standards of Internal Control for Federal Government state that an effective internal control system 

requires each of its five components, including control environment; risk assessment; control activities; 

information and communications; and monitoring to be effectively designed, implemented, and operating 

together in an integrated manner. 

During fiscal year 2020, the Department worked on implementing corrective action plans to address internal 

control weaknesses and strengthen its entity level controls. Although the Department made progress, the 

Department needs to continue to address deficiencies in its entity-wide control environment components of 

Risk Assessment and Monitoring. As we reported in the previous fiscal year, we continued to observe entitywide control environment conditions, which contributed to the deficiencies noted above, as follows: 

• The Department did not appropriately identify, analyze, and respond to significant changes in applicable 

financial reporting requirements which impacted its’ internal control system and resulted in significant 

misstatements as outlined in our finding A above (Risk Assessment). 

• The Department operated with several outdated policies and procedures related to financial reporting and 

accounting operations (Risk Assessment). 

• The Department failed to monitor key controls to ensure effectiveness throughout the financial reporting 

process including reviews of journal vouchers, property, plant, and equipment (PP&E), and general 

information technology (IT) controls as outlined in our findings B, C and D above (Monitoring). 

• The Department continued to experience repeat control deficiencies, highlighting the need to strengthen 

controls over the preparation and evaluation of corrective action plans to ensure the successful evaluation 

and remediation of control deficiencies (Monitoring). 

• Controls over the planning and execution of Department-wide monitoring control program and processes 

needed to be strengthen (Monitoring). 

I-6 
 

 

 

 

Exhibit I 

Criteria 

• GAO Green Book Principles 7, 9, 16 and 17- Identify, Analyze, and Respond to Risks; Identify, Analyze, 

and Respond to Change; Perform Monitoring Activities; and Evaluate Issues and Remediate Deficiencies, 

respectively. 

Recommendations 

We continue to recommend that the Department perform an assessment of its entity level controls, and improve 

controls over risk assessment and monitoring as follows: 

1. Timely update Department policies, procedures and guidance to effectively address changes to standards, 

laws and regulations. 

2. Implement key monitoring controls to ensure control effectiveness throughout the financial reporting 

process and develop robust policies and procedures to increase oversight, review, and accountability of 

accounting events at the bureau level to ensure the successful implementation of an effective internal 

control environment. 

3. Continually monitor and reevaluate whether corrective action plans applied were effective. The Department 

should consider whether implementing financial auditors’ recommendations is enough to close a corrective 

action plans, or if there is a need to employ additional remedies to fix a control deficiency. As such, the 

Department should perform an independent root cause analysis during the corrective action plans 

development process to gain an in-depth understanding of what caused the control deficiency and to 

ensure corrective actions are complete and will fully remediate the issues. Furthermore, require CAPs to 

assist in tracking, evaluating, and correcting internal control findings and recommendations from all audits 

and reviews (i.e., from the OIG, GAO or their own internal control monitoring framework). 

4. Perform an evaluation of the Department’s entity level controls and determine if each of the GAO Green 

Book components and principles have been addressed by the entity level controls that have been put in 

place by the Department. 

I-7 
Acting Assistant Secretary for Policy, Management and 

Digitally signed by TONYA 

JOHNSON 

Date: 2020.11.10 16:31:30 -05'00' 

Digitally signed by 

SCOTT CAMERON 

Date: 2020.11.10 

16:34:38 -05'00' 

United States Department of the Interior 

OFFICE OF THE SECRETARY 

Washington, DC 20240 

Memorandum 

To: Mr. Mark Lee Greenblatt 

Inspector General 

U.S. Department of the Interior 

Office of 1nspector General 

1849 C Street, NW 

Washington, DC 20240 

From: Scott J. Cameron, 

Budget (PMB) 

Tonya R. Johnson TONYA JOHNSON 

Deputy Chief Financial Officer (DCFO) and 

 Director, Office of Financial Management (PFM) 

Subject: Management's Response to Independent Auditors' Report for Fiscal Year 

(FY) 2020 (Assignment No. 2020-FIN-028) 

The Department of the Interior (DOI) reviewed the Auditor’s Report prepared by KPMG LLP. 

We are proud of the Department’s success in achieving an unmodified audit opinion for our FY 

2020 consolidated financial statements. 

For FY 2020, the Department received a material weakness related to the Office of Management 

and Budget (OMB) A-136, Financial Reporting Requirements, Note 44. We also acknowledge 

four significant deficiencies. We agree with your recommendations and will focus on necessary 

corrective actions to address each of the issues. 

In closing, we would like to thank your office for providing critical information needed for the 

DOI to improve and sustain a strong internal control environment. We are committed to the 

continuous improvement of our financial management activities, and your efforts are directly in 

support of that commitment. 
Report Fraud, Waste,

and Mismanagement

Fraud, waste, and mismanagement in

Government concern everyone: Office 

of Inspector General staff, departmental 

employees, and the general public. We 

actively solicit allegations of any 

inefficient and wasteful practices, fraud, 

and mismanagement related to 

departmental or Insular Area programs 

and operations. You can report 

allegations to us in several ways.

 By Internet: www.doioig.gov

 By Phone: 24-Hour Toll Free: 800-424-5081

Washington Metro Area: 202-208-5300

 By Fax: 703-487-5402

 By Mail: U.S. Department of the Interior

Office of Inspector General

Mail Stop 4428 MIB

1849 C Street, NW.

Washington, DC 20240