Department of Homeland Security 

Office of Inspector General 

Independent Auditors' Report on 
 

Transportation Security Administration's 
 

Consolidated Balance Sheet as of September 30, 2009 
 

OIG-10-78 April 2010 
Office ofInspector General 

U.S. Department of Homeland Security 

Washington, DC 25028 

Homeland 

Security 

APR - 8 2010 

Preface 

The Department of Homeland Security (DHS) Office ofInspector General (OIG) was 

established by the Homeland Security Act of2002 (Public Law 107-296) by amendment 

to the Inspector General Act of1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effectiveness within the department. 

The attached report presents the results of our audit of the Transportation Security 

Administration's (TSA) consolidated balance sheet as of September 30,2009. We 

contracted with the independent public accounting firm KPMG LLP (KPMG) to perform 

the audit. The contract required that KPMG perform its audits according to generally 

accepted government auditing standards and guidance from the Office of Management 

and Budget and the Government Accountability Office. KPMG issued a qualified 

opinion on the balance sheet due to deficiencies related to general property and 

equipment and future mimmum lease payments. KPMG also identified three material 

weaknesses, and one other significant deficiency in internal control. KPMG is 

responsible for the attached report, and the conclusions expressed in the report. We do 

not express opinions on TSA's balance sheet or provide conclusions on compliance with 

laws and regulations. 

The recommendations herein have been discussed in draft with those responsible for 

implementation. We trust this report will result in more effective, efficient, and 

economical operations. We express our appreciation to all of those who contributed to 

the preparation of this report. 

!4u1Z~ Anne L. Richards 

Assistant Inspector General for Audits 
KPMG LLP 

2001 M Street, NW 

Washington, DC 20036 

Independent Auditors’ Report 

Assistant Secretary for the Department of Homeland Security 

Transportation Security Administration, and Inspector General, 

Department of Homeland Security: 

We have audited the accompanying consolidated balance sheet of the U.S. Department of Homeland 

Security (DHS) Transportation Security Administration (TSA) as of September 30, 2009. The objective of 

our audit was to express an opinion on the fair presentation of this consolidated balance sheet. In 

connection with our fiscal year 2009 audit, we also considered TSA’s internal controls over financial 

reporting, and tested TSA’s compliance with certain provisions of applicable laws, regulations, contracts, 

and grant agreements that could have a direct and material effect on the consolidated balance sheet. 

Summary 

As stated in our opinion on the consolidated balance sheet, except for the effects of such adjustments, if 

any, that might have been necessary had we been able to apply sufficient audit procedures to general 

property and equipment, and future minimum lease payments presented in Note 10, the accompanying 

consolidated balance sheet as of September 30, 2009, is presented fairly, in all material respects, in 

conformity with U.S. generally accepted accounting principles. 

As discussed in Note 1, TSA has not presented the consolidated balance sheet and notes thereto in full 

compliance with Office of Management and Budget (OMB) Circular A-136, Financial Reporting 

Requirements, as amended. 

Our consideration of internal control over financial reporting resulted in identifying certain deficiencies 

that we consider to be material weaknesses, and a deficiency that we consider to be a significant 

deficiency, in the following areas: 

A. Financial Management and Reporting 

B. Property and Equipment 

C. Other Liabilities 

D. Information Technology Controls and Financial System Functionality 

We consider significant deficiencies A through C, above, to be material weaknesses. 

The results of our tests of compliance with certain provisions of laws, regulations, contracts, and grant 

agreements disclosed the following instances of noncompliance or other matters that are required to be 

reported under Government Auditing Standards, issued by the Comptroller General of the United States, 

and OMB Bulletin No. 07-04, Audit Requirements for Federal Financial Statements. 

E. Debt Collection Improvement Act of 1996 

F. Federal Employment and Related Laws 

KPMG LLP, a U.S. limited liability partnership, is the U.S. 

member firm of KPMG International, a Swiss cooperative. 
 

 

The following sections discuss our opinion on TSA’s consolidated balance sheet; our consideration of 

TSA’s internal controls over financial reporting; our tests of TSA’s compliance with certain provisions of 

applicable laws, regulations, contracts, and grant agreements; and management’s and our responsibilities. 

Opinion on the Consolidated Balance Sheet 

We have audited the accompanying consolidated balance sheet of the Transportation Security 

Administration as of September 30, 2009. 

TSA was unable to fully support the accuracy and completeness of certain elements of the general property 

and equipment balances in the consolidated balance sheet as of September 30, 2009, prior to completion of 

TSA’s FY 2009 Annual Financial Report. The total balance reported for general property and equipment 

as of September 30, 2009 was $1,010 million. In addition, TSA was unable to provide sufficient 

documentation supporting the accuracy and completeness of future minimum lease payments presented in 

Note 10 of the consolidated balance sheet as of September 30, 2009. It was not practical to extend our 

procedures sufficiently to satisfy ourselves as to the fairness of general property and equipment, and related 

effects on net position, if any, and future minimum lease payments as presented in the consolidated balance 

sheet and Note 10 thereto, respectively, as of September 30, 2009. 

In our opinion, except for the effects of adjustments, if any, that might have been necessary had we been 

able to apply sufficient audit procedures to general property and equipment balances, and future minimum 

lease payments presented in Note 10, as discussed in the preceding paragraph, the consolidated balance 

sheet referred to above presents fairly, in all material respects, the financial position of TSA as of 

September 30, 2009, in conformity with U.S. generally accepted accounting principles. 

As discussed in Note 1, TSA has not presented the consolidated balance sheet and notes thereto in full 

compliance with OMB Circular A-136. 

The information in the Management’s Discussion and Analysis and Required Supplementary Stewardship 

Information sections is not a required part of the consolidated balance sheet, but is supplementary 

information required by U.S. generally accepted accounting principles. We have applied certain limited 

procedures, which consisted principally of inquiries of management regarding the methods of measurement 

and presentation of this information. However, we did not audit this information and, accordingly, we 

express no opinion on it. 

Internal Control over Financial Reporting 

Our consideration of the internal control over financial reporting was for the limited purpose described in 

the Responsibilities section of this report and was not designed to identify all deficiencies in the internal 

control over financial reporting that might be deficiencies, significant deficiencies or material weaknesses. 

A deficiency in internal control exists when the design or operation of a control does not allow 

management or employees, in the normal course of performing their assigned functions, to prevent, or 

detect and correct misstatements on a timely basis. A significant deficiency is a deficiency, or a 

combination of deficiencies, in internal control that is less severe than a material weakness, yet important 

enough to merit attention by those charged with governance. A material weakness is a deficiency, or 

combination of deficiencies, in internal control, such that there is a reasonable possibility that a material 

misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a 

timely basis. 

In our fiscal year 2009 audit, we identified certain deficiencies in internal control over financial reporting 

that we consider to be material weaknesses described in Exhibit I, and another deficiency that we consider 

2
 

 

to be a significant deficiency described in Exhibit II. Exhibit IV presents the status of prior year material 

weaknesses and significant deficiencies. 

As discussed in our opinion on the consolidated balance sheet section of this report, we were unable to 

apply sufficient audit procedures over general property and equipment balances and future minimum lease 

payments, and accordingly, other internal control matters may have been identified and reported had we 

been able to perform all procedures necessary to complete our audit of these balances as presented in the 

consolidated balance sheet, and Note 10 thereto, respectively, as of September 30, 2009. 

We also noted certain additional deficiencies involving internal control over financial reporting and its 

operation that we will report to the management of TSA in a separate letter. 

Compliance and Other Matters 

The results of certain of our tests of compliance as described in the Responsibilities section of this report, 

disclosed two instances of noncompliance or other matters that are required to be reported herein under 

Government Auditing Standards or OMB Bulletin No. 07-04, and are described in Exhibit III. 

The results of our other tests of compliance as described in the Responsibilities section of this report 

disclosed no instances of noncompliance or other matters that are required to be reported herein under 

Government Auditing Standards or OMB Bulletin No. 07-04. 

As discussed in our opinion on the consolidated balance sheet section of this report, we were unable to 

apply sufficient audit procedures over general property and equipment balances, and future minimum lease 

payments, and accordingly, other instances of noncompliance with laws, regulations, contracts, grant 

agreements and other matters may have been identified and reported had we been able to perform all 

procedures necessary to complete our audit of these balances as presented in the consolidated balance 

sheet, and Note 10 thereto, respectively, as of September 30, 2009. 

Responsibilities 

Management’s Responsibilities. Management is responsible for the consolidated balance sheet; 

establishing and maintaining effective internal control; and complying with laws, regulations, contracts, 

and grant agreements applicable to TSA. 

Auditors’ Responsibilities. Our responsibility is to express an opinion on TSA’s consolidated balance sheet 

as of September 30, 2009, based on our audit. Except as discussed in our opinion the balance sheet section 

of this report, we conducted our audit in accordance with auditing standards generally accepted in the 

United States of America; the standards applicable to financial audits contained in Government Auditing 

Standards, issued by the Comptroller General of the United States; and OMB Bulletin No. 07-04. Those 

standards and OMB Bulletin No. 07-04 require that we plan and perform the audit to obtain reasonable 

assurance about whether the consolidated balance sheet is free of material misstatement. An audit includes 

consideration of internal control over financial reporting as a basis for designing audit procedures that are 

appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of 

TSA’s internal control over financial reporting. Accordingly, we express no such opinion. 

An audit also includes: 

�	 

�	 

Examining, on a test basis, evidence supporting the amounts and disclosures in the notes to the 

consolidated balance sheet; 

Assessing the accounting principles used and significant estimates made by management; and 

3
 

 

 

______________________________ 

� Evaluating the overall consolidated balance sheet presentation. 

We believe that our audit provides a reasonable basis for our opinion. 

In planning and performing our audit of TSA’s consolidated balance sheet as of September 30, 2009, we 

considered TSA’s internal control over financial reporting by obtaining an understanding of TSA’s internal 

control, determining whether internal controls had been placed in operation, assessing control risk, and 

performing tests of controls as a basis for designing our auditing procedures for the purpose of expressing 

our opinion on the consolidated balance sheet. We did not test all internal controls relevant to operating 

objectives as broadly defined by the Federal Managers’ Financial Integrity Act of 1982. The objective of 

our audit was not to express an opinion on the effectiveness of TSA’s internal control over financial 

reporting. Accordingly, we do not express an opinion on the effectiveness of TSA’s internal control over 

financial reporting. 

As part of obtaining reasonable assurance about whether TSA’s consolidated balance sheet as of 

September 30, 2009 is free of material misstatement, we performed tests of TSA’s compliance with certain 

provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have a 

direct and material effect on the determination of the consolidated balance sheet amounts, and certain 

provisions of other laws and regulations specified in OMB Bulletin No. 07-04. We limited our tests of 

compliance to the provisions described in the preceding sentence, and we did not test compliance with all 

laws, regulations, contracts, and grant agreements applicable to TSA. However, providing an opinion on 

compliance with laws, regulations, contracts, and grant agreements was not an objective of our audit and, 

accordingly, we do not express such an opinion. 

TSA’s response to the findings identified in our audit is attached to our report. We did not audit TSA’s 

response, and accordingly, we express no opinion on it. 

This report is intended solely for the information and use of TSA’s management, management of DHS, 

DHS’ Office of Inspector General, OMB, the U.S. Government Accountability Office, and the U.S. 

Congress and is not intended to be and should not be used by anyone other than these specified parties. 

March 17, 2010
 


4
 

Independent Auditors’ Report 

Exhibit I – Material Weaknesses 

I-A Financial Management and Reporting 

Background: The Transportation Security Administration (TSA) has had difficulty establishing 

baseline accounting policies, procedures, and processes, with well-designed and effective internal 

controls. In FY 2009, TSA made some progress in reconciling its balance sheet accounts and 

addressed some matters that have led to misstatements in the financial statements in previous 

years. However, this progress was achieved only through the exceptional efforts of a few people 

in the Office of Financial Management – a situation that is unsustainable in the long-run. Entitylevel control weaknesses reported in FY 2008 continued to exist in FY 2009 and had a more acute 

effect on TSA’s financial reporting processes, causing us to elevate some conditions to a material 

weakness. 

Conditions: We noted the following internal control weaknesses related to financial management 

and reporting: 

TSA: 

�	 Does not have a sufficient number of accounting personnel who possess the technical 

accounting proficiencies necessary to: 

-	 

-

-	 

-

Support and perform essential accounting and financial reporting functions; 

Ensure appropriate segregation of duties and supervise and review accounting 

processes throughout the agency; 

Ensure that material financial reporting issues are identified on a timely basis; and 

Ensure that significant events and transactions are properly accounted for and 

financial statements and related disclosures are presented in conformity with generally 

accepted accounting principles (GAAP); 

�	 

�	 

�	 

�	 

�	 

�	 

�	 

Has weaknesses in communication, training, supervision and/or coordination with 

personnel outside of the Office of Financial Management, that contribute to control 

weaknesses in processes dependent on operations; 

Has not maintained adequate documentation of its accounting processes, internal controls, 

transactions, and significant events to support management’s assertions related to key 

processes and financial statement balances and disclosures; 

Has conducted an annual risk assessment; however, the risk assessment did not identify 

all matters that could have a material impact on the financial statements, and did not result 

in an effective internal control structure for the entire year; 

Does not have policies and procedures to ensure that leases are accounted for and 

disclosed properly in accordance with the standards; 

Has not maintained adequate documentation and support for the review and approval of 

journal vouchers; 

TSA has not implemented a formal agency-wide policy to appropriately address 

intervention for management override of internal controls; 

Is not fully compliant with the United States Government Standard General Ledger 

(USSGL) requirements at the transaction level. For example, TSA did not record 

property-related adjustments into the applicable general ledger accounts at the appropriate 

I.1
 

 

Independent Auditors’ Report 

Exhibit I – Material Weaknesses 

fund account symbol to provide an audit trail at the transaction level. In addition, 

proprietary to budgetary account imbalances were created due to advance adjustments 

recorded without the corresponding budgetary effects; 

�	 

�	 

Is unable to fully identify and present its intragovernmental balances and transactions by 

trading partner; and 

Has weaknesses in its review conducted to assist the Department with its compliance with 

the Federal Manager Financial Integrity Act of 1982 (FMFIA). In addition, TSA’s OMB 

Circular A-123, Management’s Responsibility for Internal Control, assessment did not 

identify all of the material weaknesses that we identified during our audit, as described 

above and in Comment I-B General Property and Equipment. Generally, management’s 

assessment, for purposes of reporting under FMFIA and OMB A-123 should result in 

identification of similar, if not the same, control deficiencies over financial reporting, as 

identified by the external financial statement auditors. 

Cause/Effect: TSA has devoted substantial resources to the development of its initial balance 

sheet. This effort involves many one-time efforts that will not need to be repeated in future years. 

At times, the effort has also commanded more resources than TSA was able to provide. Financial 

reporting and management control deficiencies are caused primarily by a lack of personnel who 

have the necessary technical accounting skills to perform essential financial reporting functions, 

including the development and implementation of processes to ensure that all relevant financial 

statement assertions are considered when preparing financial statements. In some cases, account 

adjustments were recorded without appropriate supporting analysis and documentation. In 

addition, accounting personnel did not consider all relevant assertions, such as completeness, or 

consider relevant technical accounting standards before representing to the auditor that balances 

were correct. Consequently, numerous errors were discovered by the external auditor in FY 2009, 

including differences between subsidiary records and the general ledger, unrecorded liabilities, 

misclassified assets, and various over and understatements of other balance sheet account 

balances. This deficiency is also related to the conditions described in Comment II-D, 

Information Technology Controls and Financial System Functionality. 

Criteria: OMB Circular No. A-123, Management’s Responsibility for Internal Control, defines 

management’s responsibilities related to internal control and provides guidance to Federal 

managers on improving the accountability and effectiveness of Federal programs and operations 

by establishing, assessing, correcting, and reporting on internal control. In particular, 

management is responsible for establishing and maintaining internal control to achieve the 

objectives of effective and efficient operations, reliable financial reporting, and compliance with 

applicable laws and regulations. The documentation for internal control, all transactions, and 

other significant events should be readily available for examination. Further, relevant, reliable, 

and timely information should be communicated to relevant personnel at all levels within an 

organization. It is also crucial that an agency communicate with outside organizations. In 

addition, the Circular states that management should identify both internal and external risks, and 

analyze those risks for their potential effect on the entity. 

OMB Circular No. A-50, Audit Follow-Up, states that corrective action taken by management on 

resolved findings and recommendations is essential to improving the effectiveness and efficiency 

of Government operations. Each agency shall establish systems to assure the prompt and proper 

resolution and implementation of audit recommendations. These systems shall provide for a 

complete record of action taken on both monetary and nonmonetary findings and 

recommendations. 

I.2
 
Independent Auditors’ Report 

Exhibit I – Material Weaknesses 

The Treasury Federal Intragovernmental Transactions Accounting Policies Guide, dated August 

6, 2009, and OMB Circular No. A-136, Financial Reporting Requirements, as revised, require 

Federal CFO Act and non-CFO Act entities identified in the Treasury Financial Manual (TFM) 

2009, Vol. I, Part 2, Chapter 4700, Agency Reporting Requirements for the Financial Report of 

the United States Government, to perform quarterly reconciliations of intragovernmental 

activity/balances. TFM, Section 4706.20, Intragovernmental Fiduciary Confirmation System and 

OMB Circular No A-136, Financial Reporting Requirements, require reporting agencies to 

reconcile and confirm intragovernmental activity and balances quarterly for specific reciprocal 

groupings. TFM Bulletin 2007-03, Intragovernmental Business Rules, also provides guidance to 

Federal agencies for standardizing the processing and recording of intragovernmental activities. 

Recommendations: We recommend that TSA: 

a.	 	Perform a review of its financial and accounting infrastructure and human resource 

needs, including job responsibilities, functions, and defined tasks and skill sets needed to 

support essential accounting and financial reporting functions throughout the agency. 

This may involve restructuring and hiring additional personnel to fill identified gaps, realign personnel to fill the gaps, and properly utilize and assign personnel with 

responsibilities that best match their expertise; 

b.	 Adopt procedures to ensure that relevant financial reporting issues are identified on a 

timely basis and to ensure that events and transactions are properly accounted for, and 

financial statements and related disclosures are presented in conformity with GAAP; 

c.	 	 Improve communication, training, supervision and/or coordination with personnel outside 

of the Office of Financial Management to ensure that necessary transactional inputs and 

information are received accurately and timely; 

d.	 Ensure that the annual risk assessment process is considered in updating accounting 

processes and implementing internal controls; 

e.	 	Develop policies and procedures to ensure that leases are accounted for and disclosed 

properly in accordance with the standards; 

f.	 	 Adopt procedures to ensure proper documentation and support for journal vouchers and 

that the review of journal vouchers is maintained; 

g.	 	 Develop policies that describe when intervention or management override of controls is 

appropriate and what authorizations are required if any; 

h.	 Work with its accounting service provider to ensure that the proper trading partner code 

is recorded for each intragovernmental transaction. Until such time, TSA should 

continue to perform its manual process for the identification and reporting of 

intragovernmental activities and balances; 

i.	 	 Develop policies and procedures to ensure compliance with the USSGL requirements at 

the transaction level. Specifically the procedures should ensure that adjustments to the 

general ledger system are recorded at the appropriate fund account symbol and include 

the correct budgetary and proprietary entries; and 

j.	 	Improve its assessment procedures to assist the Department with its compliance with 

FMFIA and OMB Circular A-123 to ensure that all control deficiencies that could be 

considered a material weakness are identified and reported to the Department. 

I.3
 

Independent Auditors’ Report 

Exhibit I – Material Weaknesses 

I-B General Property and Equipment 

Background: TSA manages passenger and baggage X-ray, explosives detection, and other 

equipment as part of its mission. This equipment, which is in every major U.S. airport, is owned 

and maintained by TSA. The processes required to procure, ship, temporarily store, install, 

operate, and maintain this equipment are substantial and consume a large portion of TSA’s annual 

operating budget. Unique accounting processes and systems are necessary to track the status and 

accumulate costs, and to accurately value, account for, and depreciate the equipment. In FY 

2008, in response to auditor inquires, TSA initiated various reviews of its Property, Plant, and 

Equipment (PP&E) and identified errors in its accounting for equipment used in airports that 

required a number of restatements and current year corrections. These conditions continued into 

FY 2009 and prevented TSA from fully asserting that its PP&E balances at September 30, 2009, 

are fairly stated prior to the completion of the TSA’s FY2009 Annual Financial Report. 

Conditions: We noted the following internal control weaknesses related to property and 

equipment: 

TSA: 

�	 Does not have documented policies and procedures in place to properly account for, 

monitor, and report: 

-

-

-

-

Internal use software balances, including the application of Statement of Federal 

Financial Accounting Standards (SFFAS) No. 10, Accounting for Internal Use 

Software, identification and allocation of direct and indirect costs to long-term 

projects, and capitalization of multiple unit and/or multi-year installations; 

Other direct costs incurred to transport, store, and install screening equipment at 

airports; 

Idle or impaired assets consistent with applicable accounting standards, or to ensure 

that disposed assets are properly accounted for in the financial statements; and 

Purchased assets that are under the capitalization threshold, such as peripheral 

equipment and bulk purchases; 

�	 Does not have documented policies and procedures in place to ensure that: 

-	 

-

-

-	 

Assets are recorded, depreciated, and disposed of on a timely basis; 

Documentation supporting asset transactions, including purchase, transfer, 

maintenance, installation and disposal or impairment is maintained and readily 

available for audit; 

The subsidiary ledger is reconciled on a regular basis and net book value is correct 

and supported on an asset-by-asset basis; and 

Heritage assets are properly identified, tracked, and reported; 

�	 Does not always adhere to its policy requiring timely updates to the capital asset 

subsidiary ledger after assets are transferred between locations. 

Cause/Effect: TSA devoted substantial time and resources, including contractor assistance, in FY 

2009 in an attempt to retroactively correct and restate opening balance sheet values and to 

properly account for PP&E prospectively. Management was not able to fully complete the work 

prior to the completion of the DHS 2009 AFR. In some cases, TSA was dependent on input and 

I.4
 

 

 

Independent Auditors’ Report 

Exhibit I – Material Weaknesses 

feedback from the auditor for interpretation and application of accounting standards and 

recommendations to resolve difficult accounting issues related to the development of its opening 

balance sheet. This deficiency is also related to the conditions described in Comment I-A, 

Financial Management and Reporting. 

Criteria: SFFAS No. 10 provides requirements for the capitalization and reporting of internal use 

software development costs. According to paragraph 16, the capitalizable cost should include 

“....the full cost (direct and indirect costs) incurred during the software development stage.” Per 

SFFAS No. 10, paragraphs 18-20, “For COTS [commercial off-the-shelf] software, capitalized 

cost should include the amount paid to the vendor for the software. For contractor-developed 

software, capitalized cost should include the amount paid to a contractor to design, program, 

install, and implement the software. Material internal cost incurred by the federal entity to 

implement the COTS or contractor-developed software and otherwise make it ready for use 

should be capitalized...Costs incurred after final acceptance testing has been successfully 

completed should be expensed.” 

SFFAS No. 6, Accounting for Property, Plant, and Equipment, paragraph 17, states, “Property, 

plant, and equipment consists of tangible assets, including land, that meet the following criteria: 

they have estimated useful lives of 2 years or more; they are not intended for sale in the ordinary 

course of operations; and they have been acquired or constructed with the intention of being used, 

or being available for use by the entity.” Per paragraph 26, “All general PP&E shall be recorded 

at cost. Cost shall include all costs incurred to bring the PP&E to a form and location suitable for 

its intended use.” Paragraph 34 requires, “In the case of constructed PP&E, the PP&E shall be 

recorded as construction work in progress until it is placed in service, at which time the balance 

shall be transferred to general PP&E.” Per paragraph 35, “Depreciation expense is calculated 

through the systematic and rational allocation of the cost of general PP&E, less its estimated 

salvage/residual value, over the estimated useful life of the general PP&E. Depreciation expense 

shall be recognized on all general PP&E, except land and land rights of unlimited duration.” 

GAO’s Standards for Internal Control in the Federal Government (Standards) requires that 

internal control and all transactions and other significant events be clearly documented and 

readily available for examination. The Financial Systems Integration Office, Property 

Management Systems Requirements, state that the agency’s property management system must 

create a skeletal property record or have another mechanism for capturing information on 

property in transit from the providing entity (e.g., vendor, donator, lender, grantor, etc.). 

Recommendations: We recommend that TSA: 

a.	 	Develop and implement policies and procedures to properly account for, monitor, and 

report internal use software balances; other direct costs incurred to transport, store, and 

install screening equipment at airports; idle, impaired and disposed assets; and assets and 

bulk purchases that are under the capitalization threshold, consistent with applicable 

accounting standards; 

b.	 Improve training and communication to ensure that TSA’s policies regarding updates to 

the capital asset subsidiary ledger after assets are transferred between locations are 

consistently followed; 

c.	 	Develop policies and procedures to ensure assets values are properly recorded, 

depreciated, disposed of, sub-ledgers reconciled to the general ledger on a timely basis, 

and that documentation supporting the transactions are maintained and available for 

audit; and 

I.5
 
Independent Auditors’ Report 

Exhibit I – Material Weaknesses 

d.	 Develop policies and procedures to ensure heritage assets are properly identified, tracked, 

and reported. 

I-C Other Liabilities 

Background: TSA has numerous types of accounts payable and accrued liabilities that affect its 

balance sheet, including the Other Transactions Agreement (OTA) and Letters of Intent (LOI) 

programs. The OTA and LOI programs have grown substantially in recent years and function 

similar to grants, whereby TSA provides funding to airport recipients for various security 

improvements and construction. For this reason, TSA must estimate its accrued liability for 

expenditures incurred but not reported by OTA and LOI recipients when preparing financial 

statements. The OTA activity increased significantly in FY 2009, requiring TSA to develop new 

accounting processes to support this function. 

Conditions: We noted the following internal control weaknesses related to other liabilities: 

TSA: 

�	 

�	 

Has not developed policies and procedures to accurately estimate its OTA accrued 

liability at year-end. The OTA liability was substantially understated in the draft 

financial statements until questioned by the auditor, which prompted TSA to consider the 

need for an accrual related to the incurred but unreported expenditures. This resulted in 

the discovery of an additional liability of approximately $50 million at year-end; 

Does not have documented policies and procedures to ensure that accounts payable 

accruals are complete and accurate, controls over the procurement process, including asset 

purchases, are effective, and documentation supporting transactions are available for 

audit. For example, we noted that: 

-

-

-

-

-

-

-

Controls including supervisory reviews are not always effective in identifying 

material errors in accounts payable and related accruals; 

The accounts payable sub-ledger is not routinely reconciled to the accounts payable 

general ledger (CAS). Specifically, it was noted that TSA was unable to provide a 

detail of open invoices as of the balance sheet date; 

Invoices are not always coded correctly as either expense or capitalizable 

expenditures; 

Evidence supporting the procurement and receipt of goods, and review and approval 

of transactions was not always available for audit; 

Controls to ensure the completeness of the data provided from contracting officers 

and information on outstanding invoices for asset purchases, used to calculate the 

accounts payable accruals, were not always operating effectively; 

Controls to ensure amounts recorded as part of system accounts payable are excluded 

from the manual accrual calculations were not always operating effectively; and 

Controls to ensure the accuracy of queries used to calculate the accounts payable 

accruals were not always operating effectively; 

�	 Does not perform an independent analysis of vendor confirmation data on which the LOI 

accrual is based to determine the accuracy of the confirmations. Further, TSA does not 

I.6
 

Independent Auditors’ Report 

Exhibit I – Material Weaknesses 

have documented policies and procedures in place to ensure that unconfirmed balances 

are properly stated; and 

�	 Has not properly designed its internal controls over the data collected and used for the 

statistical calculation of the non-fed accounts payable accrual at year-end. 

Cause/Effect: TSA’s risk assessment process at the transaction level is not fully developed or 

implemented to identify points at which a significant error could occur. As a result, accounts 

payable and unexpended appropriations may not be properly stated in the financial statements. In 

addition, when the OTA activity became material in FY 2009, TSA did not have adequate risk 

assessment processes to identify OTAs as a significant new process, requiring management to 

perform additional steps to estimate the accrued liability. This deficiency is also related to the 

conditions described in Comment I-A, Financial Management and Reporting. 

Criteria: OMB Circular No. A-123, Management’s Responsibility for Internal Control, states, 

“Management is responsible for developing and maintaining effective internal control. Effective 

internal control provides assurance that significant weaknesses in the design or operation of 

internal control, that could adversely affect the agency’s ability to meet its objectives, would be 

prevented or detected in a timely manner. Management should identify internal and external risks 

that may prevent the organization from meeting its objectives. When identifying risks, 

management should take into account relevant interactions within the organization as well as with 

outside organizations. 

Recommendations: We recommend that TSA: 

a.	 	 Develop policies and procedures to accurately estimate its OTA accrued liability at yearend; 

b.	 Develop policies and procedures to ensure that accounts payable accruals are complete 

and accurate, controls over the procurement process, including asset purchases, are 

effective, and documentation supporting transactions are available for audit; 

c.	 	 Perform an independent analysis of vendor confirmation data on which the LOI accrual is 

based to determine the accuracy of the confirmations. Develop policies and procedures 

to ensure that unconfirmed balances are properly stated; and 

d.	 Develop adequately designed internal controls over the data collected and used for the 

statistical calculation of the non-fed accounts payable accrual at year-end. 

I.7
 

Independent Auditors’ Report 

Exhibit II – Significant Deficiencies 

(See Exhibit I for Comments A – C) 

II-D Information Technology Controls and Financial System Functionality 

Background: The U.S. Coast Guard’s Finance Center (Coast Guard or FINCEN) hosts key 

financial accounting applications for TSA. Our audit procedures over information technology (IT) 

general controls for TSA included testing of the Coast Guard’s FINCEN and TSA Headquarters IT 

policies, procedures, and practices. Information Technology (IT) general and application controls 

are essential for achieving effective and reliable reporting of financial and performance data. IT 

general controls (ITGC) are tested using the objectives defined by the GAO’s Federal Information 

System Controls Audit Manual (FISCAM), in five key control areas: security management, access 

control, configuration management, segregation of duties, and business continuity. Our audit 

included a review of the Coast Guard’s and TSA’s key ITGC environments. 

We also considered the effects of financial systems functionality when testing internal controls 

since key Coast Guard financial systems are not compliant with FFMIA and are no longer supported 

by the original software provider. Functionality limitations add to the challenge of addressing 

systemic internal control weaknesses, and strengthening the control environment at Coast Guard. 

In FY 2009, TSA was able to remediate several IT findings we reported in previous years. 

Conditions: Our findings related to IT controls and financial system functionality follow: 

Related to IT Controls: 

In FY09, we identified two new findings and note that certain IT deficiencies that exist at the Coast 

Guard also impact TSA financial data. Those include 1) inadequately designed and operating IT 

script change control policies and procedures, 2) unverified access controls through the lack of user 

access privilege re-certifications, 3) entity-wide security program issues involving civilian and 

contractor background investigation weaknesses, 4) physical security and security awareness, and 5) 

role-based training for individuals with elevated responsibilities. We noted that Coast Guard’s core 

financial system configuration management process controls are not operating effectively, and 

continue to present risks to TSA financial data confidentiality, integrity, and availability. Financial 

data in the general ledger may be compromised by automated and manual changes that are not 

adequately controlled. In addition, TSA has not fully developed and implemented their own 

monitoring controls over Coast Guard to ensure that the IT scripting controls are properly designed 

and operating effectively. 

All of our ITGC findings are described in detail in a separate Limited Official Use (LOU) letter 

provided to TSA and DHS management. 

Related to financial system functionality: 

We noted that financial system functionality limitations are contributing to control deficiencies 

reported elsewhere in Exhibit I, and inhibiting progress on corrective actions impacting TSA. 

These functionality limitations are preventing the TSA from improving the efficiency and reliability 

of its financial reporting processes. Some of the financial system limitations lead to extensive 

manual and redundant procedures to process transactions, verify accuracy of data, and to prepare 

financial statements. Systemic conditions related to financial system functionality include: 

II.1
 

 

Independent Auditors’ Report 

Exhibit II – Significant Deficiencies 

�	 

�	 

�	 

The Coast Guard’s core financial system configuration management process is not operating 

effectively due to inadequate controls over IT script process. The IT script process was 

instituted as a solution primarily to compensate for system functionality and data quality issues; 

Annual financial system account recertifications are not being performed due to limitations in 

the systems; and 

The production version of the core financial system is outdated and is not supported by a vendor 

for necessary system updates, and does not provide all necessary functional capabilities (e.g. 

automated reports to reconcile the general ledger to subsidiary ledgers). 

Cause/Effect: The current IT configurations of many Coast Guard financial systems cannot be 

easily reconfigured to meet new DHS security requirements. The existence of this IT weaknesses 

leads to added dependency on the other mitigating manual controls to be operating effectively at all 

times. Because mitigating controls often require more human involvement, there is an increased 

risk that human error could materially affect the financial statements. In addition, the Coast Guard’s 

core financial systems are not FFMIA compliant with the Federal Government’s Financial System 

Integration Office (FSIO) requirements. This deficiency is also related to the conditions described 

in Comment I-A, Financial Management and Reporting. 

Criteria: The Federal Information Security Management Act (FISMA) passed as part of the 

Electronic Government Act of 2002, mandates that Federal entities maintain IT security programs in 

accordance with National Institute of Standards and Technology (NIST) guidance. 

OMB Circular No. A-130, Management of Federal Information Resources, describes specific 

essential criteria for maintaining effective general IT controls. 

FFMIA sets forth legislation prescribing policies and standards for executive departments and 

agencies to follow in developing, operating, evaluating, and reporting on financial management 

systems. The purpose of FFMIA is to (1) provide for consistency of accounting by an agency from 

one fiscal year to the next, and uniform accounting standards throughout the Federal Government, 

(2) require Federal financial management systems to support full disclosure of Federal financial 

data, including the full costs of Federal programs and activities, (3) increase the accountability and 

credibility of federal financial management, (4) improve performance, productivity, and efficiency 

of Federal Government financial management, and (5) establish financial management systems to 

support controlling the cost of Federal Government. 

OMB Circular No. A-123, Management’s Responsibility for Internal Control, states, “Agency 

managers should continuously monitor and improve the effectiveness of internal control associated 

with their programs. This continuous monitoring, and other periodic evaluations, should provide 

the basis for the agency head's annual assessment of and report on internal control, as required by 

FMFIA.” This Circular states, “control weaknesses at a service organization could have a material 

impact on the controls of the customer organization. Therefore, management of cross-servicing 

agencies will need to provide an annual assurance statement to its customer agencies in advance to 

allow its customer agencies to rely upon that assurance statement. Management of cross-servicing 

agencies shall test the controls over the activities for which it performs for others on a yearly basis. 

These controls shall be highlighted in management’s annual assurance statement that is provided to 

its customers. Cross-servicing and customer agencies will need to coordinate the timing of the 

assurance statements.” 

II.2
 

Independent Auditors’ Report 

Exhibit II – Significant Deficiencies 

DHS’ Sensitive Systems Policy Directive, 4300A, as well as the DHS’ Sensitive Systems Handbook 

documents policies and procedures adopted by DHS intended to improve the security and operation 

of all DHS IT systems including the Coast Guard IT systems that service TSA data. 

The GAO’s Federal Information System Controls Audit Manual (FISCAM) provides a framework 

and recommended audit procedures that are used to conduct the IT general control test work. 

Recommendations: We recommend that TSA: 

a.	 	Work with the DHS Office of Chief Information Officer (OCIO) to ensure that the Coast 

Guard/FINCEN complete the agreed-upon corrective actions in FY 2010; 

b.	 Implement the recommendations in our LOU letter provided to TSA, to effectively address 

the deficiencies identified above and described in greater detail in the LOU report; and 

c.	 	Continue to develop and implement monitoring controls over the Coast Guard IT scripting 

process for the scripts that impact TSA. Additionally, ensure that the TSA policies and 

procedures include detailed guidance over the requirements for TSA’s own monitoring and 

review of the scripts, including associated test plans to ensure that the appropriate TSA 

financial impact of the script is evaluated and reviewed by the appropriate personnel, tested 

in an appropriate environment prior to being put into production, and documented prior to 

execution. 

II.3
 

Independent Auditors’ Report 

Exhibit III – Compliance and Other Matters 

(See Exhibit I for Comments A – C, and Exhibit II for Comment D) 

III-E Debt Collection Improvement Act of 1996 (DCIA) 

The DCIA of 1996 (DCIA) is intended to significantly enhance the Federal Government’s ability to 

service and collect debts. Our tests of compliance disclosed instances where TSA was not in 

compliance with certain provisions of the DCIA. Specifically, we noted that due process is not 

performed in a timely manner to ensure that all eligible debts are forwarded to the Treasury for 

cross-servicing or the offset program within the timeframes established by DCIA. 

Recommendation: We recommend that TSA develop policies and procedures to ensure full 

compliance with the DCIA in FY 2010. 

III-F Federal Employment and Related Laws 

As a Federal entity, TSA is required to be in compliance with the Federal Employees’ Group Life 

Insurance (FEGLI) Act, the Federal Employees’ Health Benefits (FEHB) Act, the Fair Labor 

Standards Act, and Pay and Allowance System for Civilian Employees including the Civil Service 

Retirement Act and the Federal Employees’ Retirement System Act. 

While performing testwork procedures over the Federal Employment Laws listed in the paragraph 

above, in FY09, we identified the following instances of non-compliance: 

�	 

�	 

�	 

We noted an incorrect FELGI deduction on the employee’s Statement of Earnings and 

Leave. The deduction taken for the pay periods selected did not match the enrollment form 

in the official personnel file; 

We noted an instance where the employee changed coverage during an “Open Enrollment” 

period and the supporting documentation was not in the employee’s OPF; and 

We noted instances of non compliance with the FLSA. In each of these instances, TSA was 

unable to support the amounts paid to their employees for FLSA compensation. 

Recommendations: We recommend that in fiscal year 2010, TSA: 

a.	 	Investigate each of the instances of non-compliance described above, to determine the 

cause of the issue, and whether these instances of non-compliance are systemic, or isolated 

occurrences, or a combination; 

b.	 If the issues are isolated, determine if additional training, improvement in policies, or 

procedures, or enhanced management monitoring controls would help prevent similar 

occurrences in the future; and 

c.	 	If systemic, develop a corrective action plan to identify the cause and implement corrective 

actions. 

III.1
 

Independent Auditors’ Report 

Exhibit IV – Status of Prior Year Findings Summary of Conditions Fiscal Year 2009 As Reported in 2008 TSA Audit Report Status/ 

Disposition 

A.	 	 Financial Reporting – TSA has not always followed its policies and procedures that require supervisory reviews of 

financial statements and supporting documentation, and supervisory reviews performed have not been effective in identifying some material errors in the financial statements. Additionally, TSA does not have effective procedures over the review and approval of accounting data provided to and/or received from contractors or outside specialists retained by TSA to support the financial statement audit. TSA has not developed and implemented procedures to fully analyze the effects of its current and newly adopted accounting policies to ensure full compliance with generally accepted accounting principles (GAAP). Further TSA did not fully reconcile its intragovernmental balances with trading partners. Lastly, TSA’s review conducted to assist the Department with its compliance with the Federal Manager Financial Integrity Act of 1982 (FMFIA) and OMB Circular A-123, Management’s Responsibility for 

Internal Control, did not identify all of the material weaknesses. 

B.	 	 Property and Equipment – TSA does not have adequate policies and procedures in place to properly account for and 

report some equipment and internal use software balances in its financial statements. In 2008 TSA did not adopt an appropriate asset capitalization dollar threshold (where asset purchases above a certain dollar value are capitalized, and below which are expensed). The dollar threshold used during FY 2008 and prior years was set too high, resulting in a material understatement of capitalized asset balances. In FY 2009 TSA reduced the capitalization threshold to resolve this matter. 

Repeated 

(Exhibit I-A) 

Partially 

Repeated 

(Exhibit I-B) 

IV.1
 

Independent Auditors’ Report 

Exhibit IV – Status of Prior Year Findings Summary of Conditions Fiscal Year 2009 As Reported in 2008 TSA Audit Report Status/ 

Disposition 

C.	 	 Financial Systems Security - Coast Guard/FINCEN reported the correction of weaknesses identified by periodic 

scans of its network for security weaknesses. However, system configurations and the application of required patches are not consistently monitored as application changes are implemented to ensure that they remain in compliance with DHS and Federal guidance. In addition, financial system functionality weaknesses in various processes can be attributed to non-integrated legacy financial systems that do not have the embedded functionality called for by Office of Management and Budget (OMB) Circular No. A-127, Financial Management Systems. Further, TSA, Coast Guard, 

and the DHS Chief Information Officer do not consistently test and monitor IT controls to identify and mitigate weaknesses. 

D.	 	 Entity Level Controls – TSA lacks a sufficient number of accounting staff in the proper positions in the Office of 

Financial Management (OFM) to ensure that accounting policies, procedures, and internal controls over financial reporting are appropriate, and continuously effective; and to ensure that accounting principles are correctly applied in a timely manner. The organizational structure in finance and accounting, including an understanding and assignment of roles and responsibilities for financial oversight, supervision, and review may not be optimally aligned with its resources. TSA did not provide contractors, retained to prepare materials for the balance sheet audit, with adequate management direction, supervision, and review, resulting in substantial rework, and delays in completion of the balance sheet audit. TSA has weaknesses in communication, instruction, training, supervision and/or coordination with personnel outside of the OFM, that contribute to control deficiencies in processes dependent on operations. For example, idle assets maintained in an off-site warehouse by operational personnel may not be accounted for properly, due to a lack of understanding of, or willingness to follow, TSA Standard Operating Procedures. TSA lacks sufficient oversight of financial reporting functions and consequently errors or misapplication of GAAP may go undetected, in some cases for several years, or until questioned by an auditor. 

Partially 

Repeated 

(Exhibit II-D) 

Repeated 

(Exhibit I-A) 

IV.2
 

Independent Auditors’ Report 

Exhibit IV – Status of Prior Year Findings Summary of Conditions Fiscal Year 2009 As Reported in 2008 TSA Audit Report Status/ 

Disposition 

E.	 	 Debt Collection Improvement Act of 1996 – TSA was not in full compliance of DCIA in FY2008. Repeated 

(Exhibit III-E) 

F.	 	 Payroll-related Laws - During fiscal year 2008, TSA’s management did not provide sufficient information regarding Repeated 

certain payroll transactions in order for us to determine TSA’s compliance with the payroll-related laws identified 

(Exhibit III-F) 

IV.3
 

V.S. Department of Homeland Security 

Office ofFinance and Administration 

601 South 12'h Street, TSA·14 

Arlington, VA 20598-6014 

•

J ,

/;~YP.R~~

ka~~~~ f:::i ",1

\:1:' ::' :t; ,

..~._,;;;.,p

TransportatIon S . ecurIty

Administration 

MAR 1a 2010 

.

Anne L. Richards 

Assistant Inspector General for Audits 

Department of Homeland Security 

Office ofInspector General 

245 Murray Lane, SW 

Building 410 

Washington, DC 20528 

Dear Ms. Richards: 

Thank you for the opportunity to comment on the Draft Independent Auditors' Report on 

TSA's Consolidated Balance Sheet as ofSeptember 3D, 2009. We concur with the report and its 

recommendations. 

The attachment describes in more detail many ofthe corrective actions in process and those 

that have been implemented. Our FY 2010 Management Action Plans (Corrective Action Plans) 

have been finalized, submitted to the DHS Chief Financial Officer, and can be shared with your 

staff upon request. 

I offer my thanks for the efforts of the Inspector General and KPMG personnel for their 

efforts during the FY 2009 audit. We look forward to working with your team and 

demonstrating continuous improvement in the upcoming FY 2010 audit. 

Sincerely, 

4IfY~
 David R. Nicholson 

Assistant Administrator and Chief Financial Officer 

Office ofFinance and Administration 

Attachment 

File: 1000.2.1-a www.tsa.gov 
Discussion of TSA Corrective Actions 

Independent Auditors' Report on TSA's Consolidated Balance Sheet as ofSeptember 30, 2009 

Responses to Material Weaknesses and Other Conditions 

I-A Financial Management and Reporting 

The report highlights a need for more accounting personnel, a lack of written policies and 

procedures in certain key areas, and certain other internal control shortcomings. During 

FY 2009, TSA began addressing many of these issues, with remediation expected to continue 

through FY 2010. Some ofthe notable actions taken to date are described in the following 

paragraphs. 

•	 Accounting Personnel. TSA conducted a reorganization of its Office of Financial 

Management, establishing 10 new positions, three of which are supervisory. The 

additional personnel will provide additional focus and oversight in high-risk accounting 

areas, such as budgetary to proprietary account reconciliations and compliance with 

federal accounting standards. TSA also has been evaluating the use of contract 

employees to perform financial management functions and converting some contract 

positions to federal positions. 

Furthermore, TSA established a Financial Audit Policy Branch and recruited an 

experienced senior manager to head that organization. The focus of this organization will 

be to remediate existing audit findings, facilitate communication between TSA and the 

auditors, and improve coordination and management of audit activities. 

•	 

•	 

Coordination with Non-Financial Organizations. TSA's Office of Financial Management 

has worked closely with other organizations whose functions most directly impact the 

financial statements to improve their internal controls. Key actions include: 

The Office of Acquisition established a Contract Closeout Branch to ensure that expired 

contracts are closed and unused residual funds are taken off the contract in a timely 

manner, so as not to understate available budgetary resources. 

The Office of Security Technology (which is responsible for the procurement and 

installation of airport screening equipment) paItnered with the Office of Financial 

Management and the Office of Property Management to establish an Integrated Project 

Team to improve overall accountability for security equipment. The accomplishments of 

this team are discussed later in this letter (Section I-B). 

In FY 2010, we are continuing our coordination and outreach efforts to include periodic 

meetings with the Office of Security Technology, the Office of Acquisition and the 

Office of Human Capital to improve communication to produce accurate financial 

statements and address the audit findings. The new Financial Audit Policy Branch is 

playing a key role in the coordinating activities with non-financial organizations. 

Policies and Procedures. TSA conducted a comprehensive review of its accounting 

policy framework, with the objective of updating existing guidance and developing new 

Attachment, Page 1 
guidance to fill gaps. During FY 2009,56 new or updated policy and procedure 

documents were issued and many more are in progress for FY 2010 completion. 

•	 Internal Control Review Program. TSA's Internal Control Branch established a formal 

internal review program in FY 2009, focusing on key financial and accounting processes, 

including the weaknesses identified by the auditors. Reviews are designed to verify the 

effectiveness ofthe controls noted in a written standard operating procedure or directive. 

For FY 2010, a total of 219 reviews are planned. Reviews will target key risk areas such 

as Monitoring of Scripts in the U.S. Coast Guard Financial System (used by TSA), 

Acquisition Contract Closeout Processes, Compliance with the U.S. Standard General 

Ledger, Warehouse Management Procedures, Processing of Journal Vouchers, Debt 

Collection, Capitalizing Assets Timely, Property Reconciliation, and Accruals. All key 

elements ofthe DHS Internal Control over Financial Reporting process have been 

incorporated into the review program. 

I-B Property, Plant, and Equipment (PP&E) 

Thereport highlights a need for improved policies, procedures, and controls over PP&E and 

more timely updates of the property system as assets are transferred or taken out of service. The 

following paragraphs discuss FY 2009 accomplishments and FY 2010 planned activities. 

•	 

•	 

•	 

•	 

Warehouse Management. TSA's Logistics Center warehouse facility temporarily stores 

new screening equipment prior to deployment to airports and used equipment pending 

redeployment or disposal. Prior audit reports highlighted warehouse management 

shortcomings and potential financial reporting problems due to excessive inventory levels 

and idle/inactive equipment not being removed from the financial records timely. During 

FY 2009, TSA established an Integrated Project Team (lPT) consisting of financial and 

program staff. The IPT established a series of warehouse management procedures, 

including a requirement for a quarterly assessment of inventory levels. At year-end, a 

wall-to-wall physical inventory of the warehouse was performed. Necessary accounting 

adjustments were made as part of our effort to properly report warehouse inventory at the 

end of FY 2009. 

PP&E Valuation. TSA completed a validation and verification of documentation 

(invoices, receiving reports, etc.) to support the purchase cost of over 12,000 capital 

assets. Purchase cost of equipment makes up 69% ofTSA's total PP&E balance. 

Other Direct Costs. "Other Direct Costs" consist of items such as shipping, installation, 

rigging, and testing charges associated with equipment. In FY 2009, a significant effort 

was made to provide the audit team with historical documentation to support these costs, 

but it was not completed before the end ofthe audit. Our review of "Other Direct Costs" 

is ongoing and results will be presented during the FY 2010 audit. 

Internal Use Software. TSA completed its analysis of major software investments, and 

processed appropriate restatements to prior year balances. This analysis included major 

Attachment, Page 2 
investment programs such as Secure Flight and Electronic Time, Attendance, and 

Scheduling (eTAS). The analysis required extensive review of historical program data 

such as project plans, contracts, invoices, budget documents. With the historical analysis 

behind us, in FY 2010 TSA will focus on hardening processes and controls to identify 

and track software investments and ensure that balances are properly reported. 

I-C Other Liabilities 

The report points out a need for improved controls over development ofAccounts Payable 

estimates, particularly related to Letters of Intent (LOI) and Other Transaction Agreements 

(OTA). While the auditor's opinion was not qualified in this area, control weaknesses were 

identified. TSA is taking corrective action and will issue formal policies and procedures over all 

types of accounts payable, including payables associated with LOI and OTA, in FY 2010. 

I-D Information Technology General and Application Controls 

The report considers this to be a significant deficiency, an improvement from the material 

weakness reported in FY 2008. The report identifies deficiencies in the USCG Financial System 

used by TSA, including excessive reliance on scripts in lieu of front-end business processes. 

During FY 2009 TSA and USCG undertook a major initiative to reduce the use of scripts and 

implement strong monitoring controls where scripts are required. TSA developed formal 

procedures which require USCG to provide a weekly report of one-time scripts processed for 

review by TSA functional experts. Those procedures also require a quarterly review of recurring 

scripts. While these procedures were not in place for all ofFY 2009, they provide a strong 

control framework on which TSA will continue to build in FY 2010. 

I-E Debt Collection Improvement Act 

The report states that TSA was not in compliance with the Debt Collection Improvement Act 

of1996, with the primary cause of non-compliance being untimely referral of aged debts to the 

U.S. Treasury for collection action. This statement was true for much ofFY 2009, however by 

year-end TSA had cleared its backlog and all eligible debts over 180 days old had been referred 

to Treasury. TSA also issued a Management Directive establishing a formal debt collection 

program and implementing procedures during the year. In FY 2010, TSA will monitor 

compliance with the newly established procedures. This will be a focus area for the Internal 

Control Review Program, with the objective of full compliance throughout the year. 

I-F Federal Employment and Related Laws 

The report states that TSA was not in complete compliance with certain federal employment 

and related laws. The issues identified by the auditors are incorrect payroll deductions for 

insurance, untimely filing of documentation in personnel files, and questions about calculation of 

certain overtime compensation. In FY 2009, TSA transitioned to a new Human Resources 

support services contractor. That contractor experienced difficulties during the transition phase 

resulting in processing delays and backlogs. Those difficulties are being addressed and TSA will 

implement the audit recommendations in FY 2010. 

Attachment, Page 3 
Appendix A 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chiefs of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

Chief Information Officer 

Transportation Security Administration 

Assistant Secretary for Transportation Security Administration 

Chief Financial Officer 

Chief Information Officer 

OIG Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 
ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 

fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 

misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigations - Hotline, 

245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.