Financial - 

DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 

Audit of DHS' Corrective Action Plan 

Process for Reporting 


Report No. 2 


Office of Audits 

September 2006 
Ofice of 

WK 

contribute$ 

Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528 

Homeland 


Security 

September 8,2006 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 

the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 

Act of 1978. This is one of a series of audit, inspection, and special reports published by our office 

as part of our oversight responsibility to promote economy, efficiency, and effectiveness within the 

department. 

This report is the second of a series of OIG performance audit reports intended to provide an 

assessment of planned DHS corrective actions to improve internal control. Improving internal 

control is a critical objective of the DHS Financial Accountability Act (Public Law 108-330). The 

report is based on interviews with employees and officials of relevant agencies and institutions, 

direct observations, and a review of applicable documents. We contracted with the independent 

public accounting firm KPMG LLP to perform the audit. KPMG is responsible for the attached 

auditor's report and the conclusions expressed in it. 

The recommendations herein have been discussed in draft with those responsible for 

implementation. It is our hope that this report will result in more effective, efficient, and economical 

operations. We express our appreciation to all of those who to the preparation of this 

report. 

Richard L. Skinner 

Inspector General 
Accotlntability 

I<PII.iG u S !,ai 1-0 ivabllly p6ilnlisillp ti U S 

maq,bei ilrm uCKP!.!G ;?lern.i!lonal S~ss rooysinl~ve 

KPMG LLP 

2001 M Street, NW 

Washington, DC 20036 

July 7,2006 

Mr. David Zavada 

Assistant Inspector General for Audit 

Department of Homeland Security 

245 Murray Drive, SW Bldg. 410 

Washington, DC 20258 

Mr. David Norquist 

Chief Financial Officer 

Department of Homeland Security 

245 Murray Drive, SW Bldg. 410 

Washington, DC 20258 

KPMG is pleased to submit this performance audit report related to the Department of Homeland 

Security's (the Department's) corrective action plans developed to address the Financial 

Management Oversight, Financial Reporting, Fund Balance with Treasury, and Actuarial Liabilities 

material weaknesses at the Office of the Chief Financial Officer, United States Coast Guard, and 

Immigration and Customs Enforcement components as reported in the Department's independent 

auditors' report in the FY 2005 Performance and Report. This performance audit is 

the second of a series of performance audits that the Department of Homeland Security Office of 

Inspector General has engaged us to perform for fiscal year 2006. This performance audit is 

designed to meet the objectives identified in the Background, Objectives, and Scope section of this 

report. 

We conducted our second performance audit from June 12, 2006 through July 7, 2006, in 

accordance with Government Auditing Standards issued by the Comptroller General of the United 

States. The purpose of this report is to communicate the results of our performance audit and the 

related findings and recommendations. Management concurred with our recommendations and 

prepared a response which is presented at the end of this report. 

Since July 7, 2006, we have not performed any additional procedures with respect to this 

performance audit and have no obligation to update this report or to revise the information 

contained herein to reflect events occurring subsequent to July 7,2006. 

The Department of Homeland Security Office of Inspector General has authorized this report to be 

sent electronically for the convenience of the Department. However, only the final hard-copy report 

should be deemed our work product. 

LLP, a Ins 

a 
successhl 

component, 

Executive Summary 

Overall, the Department of Homeland Security (the Department) is working to identify and develop 

effective Corrective Action Plans (CAPs) to address the four material weaknesses at the Office of 

the Chief Financial Officer (OCFO), United States Coast Guard (Coast Guard), and Immigration 

and Customs Enforcement (ICE) over Financial Management Oversight, Financial Reporting, Fund 

Balance with Treasury, and Actuarial Liabilities (herein referred to as the "material weaknesses"), 

as reported in the Department's independent auditors' report included in the FY 2005 Performance 

and Accountability Report (herein referred to as the "FY 2005 independent auditors' report"). The 

OCFO, Coast Guard, and ICE have drafted CAPs intended to address their respective sections of the 

material weaknesses. The Department deems these CAPs as critical steps towards its objective of 

obtaining an unqualified audit opinion on its consolidated financial statements, as well as on its 

internal controls over financial reporting. Our performance audit was limited to a review of the 

CAPs themselves and not the outcomes achieved as a result of the execution of the procedures 

outlined in the CAPs. 

Findings and Recommendations 

KPMG identified several opportunities for management's consideration to improve the 

effectiveness of the Department's CAPs. KPMG has classified each of these observations into one 

of the following four broad categories representing phases which are generally performed to 

develop and implement an effective CAP: 

Identification of the underlying root cause, 

Development of an effective remediation plan, 

Accountabilitv for establishment and successful implementation of the CAP, and 

Validation of the implementation of the CAP. 

The recommendations needed, which we identified in relation to the CAPs for these material 

weaknesses, vary depending on the and in some cases on the material weakness itself. 
(ePMO), 

ePMO 

Background, Objectives, and Scope 

Background 

Office of Management and Budget (OMB) Circular A-123, Management's Responsibility for 

Internal Control, states "Federal agencies are subject to numerous legislative and regulatory 

requirements that promote and support effective internal control. Effective internal control is a key 

factor in achieving agency missions and program results through improved accountability. 

Identifying internal control weaknesses and taking related corrective actions are critically important 

to creating and maintaining a strong internal control infrastructure that supports the achievement of 

agency objectives." 

OMB Circular A-123 builds upon the internal control framework within the Standards for Internal 

Control in the Federal Government (Green Book), issued by the Government Accountability Office 

(GAO), which defines internal control as "an integral component of an organization's management 

that provides reasonable assurance that the following objectives are being achieved: 

effectiveness and efficiency of operations, 

reliability of financial reporting, and 

compliance with applicable laws and regulations." 

Ten material weaknesses associated with internal controls were reported in the Department's 

independent auditors' report included in the FY 2005 Performance and Accountability Report. The 

Department has undertaken an initiative to develop and implement a formal corrective action plan 

process. Under this initiative, the Department issued various guidance and also deployed a webbased software application, Electronic Program Management Office to manage the 

collection and reporting of CAP information for the Department and its components. Under this 

initiative, the Department's intent is to develop effective CAPs and position itself to move forward 

in its objective of obtaining an unqualified audit opinion on its consolidated financial statements, as 

well as on its internal controls over financial reporting. 

The first key milestone in the Department's CAP process was May 31, 2006, whereby all 

components were required to develop CAPs for each material weakness under the new format for 

input into by the Department's OCFO. The second key milestone will be the submission of 

revised CAPs as of June 30,2006, by July 12,2006. The revised CAPs are outside the scope of this 

performance audit. 

Objectives 

The objective of this performance audit is to report and evaluate the status and effectiveness of the 

CAPs for four of the ten material weaknesses that the Department has identified as their areas of 

CAP focus for FY 2006. The four material weaknesses are: Financial Management Oversight, 

Financial Reporting, Fund Balance with Treasury, and Actuarial Liabilities. Our audit was 

conducted in accordance with Government Auditing Standards issued by the Comptroller General 

of the United States, specifically, the standards for performance audits. 

Our objective is to report on the status of CAP implementation, as of May 3 1, 2006, and evaluate 

the effectiveness of the Department's CAPs developed by the OCFO, Coast Guard, and ICE to 

address their respective sections of the four material weaknesses. 
CAPS 

CAPS 

CAPS 

timeline 

FieldworkIReporting 

Initiation 

I1 

(i.e., ePMO. 

ePMO. 

CAPS 

(i.e. 

Scope 

The scope of this performance audit includes the Department's CAPs, as of May 31, 2006, 

developed to address the Financial Management Oversight, Financial Reporting, Fund Balance with 

Treasury, and Actuarial Liabilities material weaknesses at the OCFO, Coast Guard, and ICE 

components as reported in the FY 2005 independent auditors' report. Our scope did not include 

procedures on any of the associated with the remaining six material weaknesses cited in the 

Department's FY 2005 independent auditors' report. 

The Department is in the early stages of its CAP development and implementation process, and 

accordingly, management has represented that its will continue to be modified throughout the 

year. Our performance audit was limited to a review of the noted above as of May 31, 2006. 

Revised CAPs as of June 30,2006, due by July 12, 2006, to the OCFO are outside the scope of this 

performance audit. Furthermore, our performance audit was limited to a review of the CAPs 

themselves and not the outcome being achieved as a result of the procedures outlined in the CAPs. 

The for this performance audit was as follows: 

-June 12,2006 through July 7,2006 

Draft Report -July 17,2006 

Final Report -September 6,2006 

Performance Audit Approach 

We performed a variety of performance audit procedures over the CAPs for the four material 

weaknesses. Our methodology consisted of the following four-phased approach: 

Phase I -Project and Planning 

To initiate and focus the performance audit approach, we conducted a kick-off meeting with the 

Department's OIG, OCFO, Coast Guard, and ICE components to review the objectives, scope of the 

project, and the collaboration among participants. 

Phase -Determine the CAP Status of the Four Material Weaknesses 

OCFO, Coast Guard and ICE Interviews 

We interviewed personnel from the OCFO, Coast Guard and ICE components on their 

understanding and implementation of their respective components' CAPs as of May 3 1, 2006, 

including, but not limited to, the root cause analysis performed, the critical milestones chosen 

for measurement, and mechanisms to monitor progress in meeting the milestones. 

CAPs and Related Supporting Documentation Reviews 

- The CAPs the detail and summary report) contained within 

- The underlying Excel and Word templates submitted to the Department's OCFO to 

populate 

- If applicable, the prepared prior to the implementation of the Department's fiscal 

year 2006 CAP process ICE Financial Action Plans (FAPS)). 
(NFRs) 

111 

CAPS 

111, 

- Notice of Findings and Recommendations issued during the fiscal year 2005 

financial statement audit utilized to generate the FY 2005 independent auditors' report. 

Phase -Evaluate CAP Effectiveness 

We reviewed the DHS Corrective Action Plan Process Guide (CAP Guide), dated April 28, 2006, 

and existing internal control monitoring practices and guidance for practices that would serve as our 

evaluation criteria. We then compared our understanding of the Department's existing to 

these practices to identify potential areas for improvement. These findings reflect situations that 

could negatively impact the Department's remediation of the material weaknesses if additional 

corrective action is not taken. 

The internal control monitoring practices and guidance we reviewed included: 

OMB Circular A-123. 

CAP guides published by other Federal agencies. 

OMB Executive Branch Management Scorecard. 

We categorized the areas for improvement into one of the four broad phases generally found in an 

effective CAP process: 

Identification of the underlying root cause is an important action step in the CAP process. 

Accurate identification of the root cause mitigates the chances of recurrence. Often merely the 

symptoms of the deficiency are identified rather than the root cause. By identifying only the 

symptoms, it is difficult to develop an effective CAP that will successfully resolve the 

deficiency. 

Development of an effective remediation plan is an appropriate way to cure an internal control 

deficiency. A key component of an effective plan is the inclusion of both attainable and 

measurable milestones to allow both the Department and the component to effectively monitor 

the remediation process. 

Accountability is vital to the CAP process because it necessitates the establishment of an 

individual CAP owner who is responsible for its successful implementation. The owner's 

responsibilities include ensuring that milestones are achieved and that the validation phase is 

completed. 

Validation is important in order to verify that the CAP has been successfully completed. The 

CAP should include activities that will provide evidence to support the closure of the CAP. 

These activities should include documentation reviews, work observations, and performance 

testing. 

Phase IV -Conclusions and Recommendations 

After conducting our analysis in Phase we formulated our findings and recommendations for 

each potential area of improvement identified. 
CAPS 

(ePMO) 

OCFO's 

andlor 

Findings and Recommendations 

Office of the Chief Financial Officer (OCFO) 

The OCFO has drafted intended to address its respective sections of the two material 

weaknesses on Financial Management Oversight and Financial Reporting reported in the FY 2005 

independent auditors' report. 

Financial Management Oversight 

Background: 

The Financial Management Oversight material weakness relates to the overall management, 

personnel, and infrastructure of the OCFO. The OCFO initiated the Department-wide CAP process 

in early 2006. A crucial step in remediation of this material weakness was the successful 

confirmation by the U.S. Senate of the Department's Chief Financial Officer in May 2006. As part 

of the CAP process, the OCFO has led the Department in drafting guidance and providing the DHS 

components with tools to utilize during their respective CAP implementations. The OCFO has led 

'CAP Workshops' with representatives from the Department components so that an adequate, 

uniform approach to performing root cause analyses and implementing corrective actions is taken 

Department-wide. The OCFO also developed the Electronic Program Management Office 

system enabling the Department and the components to track the corrective actions being 

undertaken at the component level to ensure a coordinated Department-wide response to auditor 

findings and recommendations. The OCFO has issued a CAP Guide and is currently in the 

developmental stages of creating an Internal Controls over Financial Reporting (ICOFR) Playbook 

for the components. Furthermore, these actions reflect the recognition that the CAP 

process at DHS is an integral part of its preparation for OMB A-123 implementation. 

The leadership provided by the Department in setting a positive 'tone-at-the-top,' and actively 

monitoring progress in implementing the CAP process has shown to be integral to the success 

achieved at the Department thus far and will be critical to resolving the material weaknesses at the 

Department. 

Identification: 

The OCFO has drafted a CAP to address the material weakness on Financial Management 

Oversight, as it relates to the OCFO. The CAP includes an analysis of root cause issues, key success 

factors and performance measures, resources required, and an analysis of the risks and impediments 

as seen by management. In addition, management has developed a timetable for corrective actions, 

and assigned specific tasks with due dates to individuals. Management emphasizes the evolutionary 

nature of the CAP, including their intent to modify add actions as needed to fully correct the 

identified internal control weaknesses in financial management oversight, within the timetable 

specified by Department leadership (September 30, 2006). As the work progresses, management 

may identify additional root causes and will update the CAP accordingly in order to keep the CAP 

current and a useful management plan. 

One of the key inputs used by the Department in the development of the OCFO CAP addressing the 

Financial Management Oversight internal control weaknesses was a self assessment using the GAO 

Internal Control Management and Evaluation Tool (GAO Evaluation Tool). Completion of a self 

assessment using the GAO Evaluation Tool was a Departmental mandate to support compliance 

with the Department of Homeland Security Financial Accountability Act, the Federal Managers' 

Financial Integrity Act (FMFIA), and implementation of OMB Circular A-123, Management's 

Responsibility for Internal Controls in FY 2006. 
fbnctioning 

OCFO's 

ePMO) 

identi% 

hlly 

made CAPs 

CAPs 

The OCFO, under the direction of the Acting Chief Financial Officer (CFO), began its self 

assessment of its control environment in FY 2006, and completed a thorough introspective review 

over several months. Department management views the control environment as the foundation for 

good financial management. 

The GAO Evaluation Tool is intended to help managers determine how well the Department's 

control environment is designed and and to help identify and develop actions to 

improve internal controls. Many of the financial management oversight weaknesses, as highlighted 

in the FY 2005 independent auditors' report, are synonymous with weaknesses in the overall control 

environment, and consequently, the GAO Evaluation Tool provided a starting point for 

identification and analysis of the root causes of the weakness. 

The OCFO concluded that only two of the seven control environment objectives from the GAO 

Evaluation Tool are fully met by the Department. Commitment to competence, management 

philosophy, organizational structure, assignment of responsibilities and human resource practices 

are aspects of the control environment that require improvement. This self-assessment served as the 

Department's principle source of information to identify the root cause of the contribution 

to the material weakness on financial management oversight and as input to the CAP. By itself, 

however, completion of the GAO Evaluation Tool does not substitute for a comprehensive root 

cause analysis. 

Development: 

Using the information gathered through the self-assessment, the OCFO prepared its CAP to address 

weaknesses in the control environment. The CAP is in the early stages of development and 

approval, yet several significant steps have already been taken. One such step is the drafting and 

release of the CAP Guide, and a formal process of reporting and monitoring (using 

corrective actions planned by the Department and its components. Another recent action is 

management's approval to initiate a workforce study to human resource gaps and skill sets 

needed to perform the financial reporting functions of the OCFO. 

The initial draft of the CAP, based on the results of the self assessment of the control environment, 

including the assigned tasks and timetable for completion, was recently completed -within the past 

45 days. Management will require more time to develop all of the corrective tasks and critical 

milestones; specifically, further developing certain missing elements (described below), to make the 

plan comprehensive. Until management addresses the missing elements, the effectiveness of the 

CAP is diminished. 

The OCFO also sponsors periodic "CAP Workshops" attended by the Department's components, to 

help ensure continued progress is in regards to throughout the Department. In addition, 

the OCFO is developing an Internal Control Over Financial Reporting (ICOFR) Playbook which, 

when completed, is intended to link the component to management's implementation of 

OMB A-123 and ultimately with management's assertions related to internal controls over financial 

reporting. 

The OCFO presented us with several updates, not yet incorporated into the CAP, that are currently 

under development and review by Department leadership, which partially address some of our 

findings presented below: 

The Department has a limited number of employees, with necessary skill sets, particularly in 

OCFO financial management positions, which causes the current managers to prioritize 

workload, and postpone or defer work on critical projects such as policies, procedures, internal 

control improvements, etc. As a result, management has hired three full-time employees in 

fiscal year 2006 and has budgeted for an additional 13 full time equivalents over the next two 

of 
hlly 

Istmcture, (e.g., 

e.g., CAPS, 

(e.g., I 

years. In addition, management has identified the need for an organizational staffing and 

human resource needs study. A summary level document of the objectives for such a study has 

been prepared and approval for further development and engagement of a contractor to perform 

the study was recently obtained from the Department's Deputy CFO. Management, however, 

has not yet developed and documented a detailed approach to the organizational needs 

assessment in the CAP, or prepared a Statement of Work, or engaged a contractor with the 

necessary expertise. 

The Department must overcome organizational structure issues that may impede the 

effectiveness of the Department's CFO and those in the OCFO for two primary reasons: (1) 

since its inception, the Department has operated under a matrix management philosophy 

with Chief CFO, Chief Information Officer, Chief Procurement Officer, etc.. .) 

management and administrative responsibilities that cross-cut component operation at a 

Department level. Historically, the Department's CFO has seldom exercised his authority to 

implement policy and procedures, including, and most importantly, financial reporting controls 

across the Department. 

The CAP does not include a review of position descriptions for all current OCFO management 

and staff, to identify corrective actions necessary to better align job responsibilities with 

available human resources. In addition, the CAP does not address the linkage of annual goal 

setting and performance appraisals for managers and staff in the OCFO with specific OCFO 

objectives, implementation of improvement in internal controls, etc. 

The Department has identified the need for an additional senior management official in the area 

of financial management,, however, a CAP has not been developed to include steps to actively 

recruit for this position posting the job announcement or advertising interviewing for the 

position). 

The CAP lacks procedures to identify weaknesses in management and staff training 

requirements. For example, the training programs attended by managers and staff have not been 

identified based on a critical needs and core competency assessment of training programs to 

improve essential skills. 

Clear internal reporting relationships within the Department have not been established, defining 

OCFO and component responsibilities for CAP development and implementation especially in 

areas of overlap. 

Accountability: 

Until the matters mentioned above are fully developed and addressed, key areas of authority and 

responsibility for the CAP implementation cannot be adequately defined and communicated 

throughout the Department, especially as they relate to the interaction between the OCFO and 

component financial and reporting operations. The assignment of accountability for improvements 

has occurred, but due to the pace of CAP development the improvements brought about by the 

assignment have yet to take full effect. 
CAPs. 

e.g., 

updates/modifications 

CAPs 

CAPs 

Financial Reporting 

Background: 

The Financial Reporting material weakness is focused specifically on the reliability and timeliness 

of the interim and year-end consolidated financial statements. The OCFO, and in particular the 

financial reporting functions, have undergone substantial change in FY 2006, due to staff turnover, 

restructuring of the office, and a reallocation of roles and responsibilities. The OCFO lost one key 

manager to an internal transfer in FY 2006. The office was restructured into four functional areas 

each lead by a Director -Financial Reporting, Financial Systems and Administration, Policy, and 

Internal Control. Three staff personnel have been hired to fill vacancies identified at the beginning 

of the year, which has helped with the distribution of workload. However, some accounting 

personnel vacancies still remain, and management asserts that at least one key managerial position 

remains unfilled. To supplement expertise and distribute workload, the OCFO has hired an outside 

contractor to assist with the preparation of periodic financial statements and the FY 2006 

Performance and Accountability Report, and performance of The Policy branch is in the 

very early stages of development, has a target date of August 2006, for issuance of its own 

Charter and assignments to working group members. 

Identification: 

Upon review of the financial reporting CAP, we observed an analysis of root cause issues, key 

success factors and performance measures, resources required, and an analysis of the risks and 

impediments as seen by management. However, as explained below, the CAP is a mixture of typical 

financial reporting roles and responsibilities and corrective actions. It is not clearly written to focus 

on the information necessary to identify root causes, detailed listings of task, and assignments of 

responsibility that will ultimately lead to the correction of the Financial Reporting material 

weakness. The CAP is designed to accommodate periodic as necessary to 

keep the CAP current and a useful management plan. As the work progresses, management may 

identify additional root causes and will update accordingly. 

Management's root cause analysis, conducted in FY 2006, shows that many of the conditions 

identified and reported by the independent auditor stem from challenges associated with the set-up 

of a new Federal department. Staffing decisions, allocation of limited resources, the need for new 

policies and procedures, internal controls, integration of financial processes and systems, to name a 

few conditions noted in the FY 2005 independent auditors' report, are typically multi-year projects 

to set-up organizations the size of the Department. 

Development: 

When the OCFO completes its identification of the underlying root causes of the financial reporting 

weakness, including management's response to the findings noted above, will need to be 

developed and implemented, together with specific milestones and assignment tasks and oversight 

to individuals. 

The development and implementation of the CAP tasks have not been coordinated with the 

from the other Department components or with the Department's OMB Circular A-123 

implementation - two closely related aspects of financial reporting and internal control 

improvements. 

Since the CAP was only recently drafted and management has not had enough time to fully and 

completely identify and develop the CAP tasks, we noted several critical elements missing from the 

CAP that should be considered for inclusion. Without the addition of the critical missing elements 

(described below), the plan is not comprehensive, which could diminish the ultimate effectiveness 
e.g., 

(i.e., hard3," MD&A 

(i.e., 

of the CAP. In some cases, the OCFO was able to demonstrate that the missing elements are 

dependent on the outcome of the Financial Management Oversight CAP, organizational and 

workforce study, and consequently there is a natural lag in the identification and development of the 

Financial Reporting CAP. The critical missing elements are as follows: 

The list of critical milestones and detailed tasks in the CAP are not comprehensive, and do not 

clearly show linkage to the weaknesses being corrected or the root cause issues. For example, 

management's root cause analysis indicates that OFM roles and responsibilities are not clearly 

defined, including insufficient back-up role planning. It is not clear which, if any, of the detailed 

tasks will address this issue. 

Many of the tasks listed in the CAP appear to be ordinary, routine responsibilities of the OCFO, 

rather than tasks meant to investigate and correct the root cause issues "compile a 

close June 30, 2006 PAR Section "compile Section of the PAR," and to "compile 

September 30 financial statements"). All of these tasks are normal operational responsibilities 

of the OCFO and are not corrective actions. In addition, a disproportionate number of tasks 

appear to be administrative tasks that are not substantial actions to correct issues "establish 

Department FMPIP subcommittee of working groups to evaluate policy and directives (an 

action with a due date of June 15, 2006, and labeled as "not started")). 

The CAP lacks procedures to identify the root cause underlying the reason why polices and 

procedures require excessive time to develop, approve and issue. In some cases, draft OCFO 

policies have been pending approval for more than a year - with no clear time-line for 

management approval and issuance. Despite the establishment of a Policy branch, no policies 

and procedures (by official Management Directive) have been issued in FY 2006. Policy 

issuance has been hindered by limited resources and a lack of coordination between the 

Department's operating components. For example, seven policies are in process but all have 

stalled or been held up from issuance, in some cases for more than a year. 

Accountability: 

We observed that the OCFO has hired a reputable outside contractor to assist with financial 

reporting functions and CAP related tasks, as needed. However, as of May 3 1, 2006, the contractor 

hired to support the OCFO is limited to only two full-time professionals, and consequently, is 

dedicated to important, but narrowly focused, periodic financial reporting roles. 

Implementation of the financial reporting CAP has been divided among several OCFO managers 

who do not have sufficient time to commit to the project, and therefore must delegate most of the 

tasks. Accountability for the financial reporting CAP is not clearly defined or tracked. Further, the 

financial reporting CAP is not managed or monitored by a senior executive, and other priorities of 

the OCFO have slowed progress. These conditions appear to have slowed progress -only 9 of the 

55 tasks are shown as complete (many of which are routine operations or administrative functions 

as mentioned above). 

Recommendations 

OCFO -Financial Management Oversight 

We recommend that: 

1. 	 Corrective actions be added to the CAP to identify weaknesses in management and staff 

training policies, and to then develop and document corrective actions in the CAP. 
CAPS 

study 

(i.e., 

(i.e. 

CAPs OCFO's 

CAPs 

financial 

2. 	 Management should engage an outside independent contractor that specializes in this subject 

matter to perform its recently approved organizational workforce and human resource needs 

study. When the study is complete, will need to be developed and implemented, together 

with specific milestones and assignment of tasks and accountability to individuals. The 

should provide management with: 

A critical assessment of the knowledge, skills, and abilities needed to perform the functions 

of the OCFO, and identify technical and experience gaps, so that recruiting, hiring, training 

and role definition can be adjusted if necessary; and 

A review of position descriptions for all current OCFO management and staff, to identify 

corrective actions necessary to better align job responsibilities with skill sets and available 

human resources, and to clarify reporting responsibilities that overlap within the OCFO, and 

to make recommendations to better align annual goal setting and performance appraisals 

with OCFO objectives. 

3. 	 The agency continue its recruitment of an additional senior manager who has extensive 

experience with department level consolidated financial reporting, to serve in a senior 

management position in the area of financial management posting or advertising the job 

announcement, interviewing and hiring for the position). 

4. 	 Define the exact criteria which will be used to ascertain when the corrective action has been 

successfully completed, as well as the method for testing against such criteria as part of OMB 

A-123 implementation steps tests of design and tests of operating effectiveness of internal 

controls). Additionally, integrate the with the plan for OMB A-123 

implementation and annual FMFIA assurance statement. Management's plan for validation of 

corrective actions should be closely integrated with their controls test work conducted to 

comply with OMB A-123. 

OCFO -Financial Reporting 

We recommend that management: 

5. 	 Identify a list of detailed tasks and critical milestones in the CAP to identify the root causes of 

the material weakness. When the OCFO completes its identification of the underlying root 

cause of the financial reporting weakness, including management's response to the conditions 

noted in the FY 2005 independent auditors' report, management should develop and implement 

that include specific milestones and assignment of tasks and oversight to appropriate 

individuals. 

6. 	 Amend the CAP to include only root cause investigation, or corrective actions, designed to 

mitigate or eliminate the reporting material weakness. Ordinary, routine, 

responsibilities of the OCFO, such as "compiling September 30 financial statements", should be 

removed as they are not corrective actions developed in response to a root cause analysis. 

7. 	 Include procedures in the CAP to assess the reasonableness of the time to develop, approve and 

issue appropriate corrective actions regarding policies and procedures. This recommendation 

may be dependent on the outcome of improvements to the control environment, discussed 

previously. 

8. 	 Coordinate the development and implementation of the CAP tasks with the corrective actions 

from the other Department components and with the Department's OMB Circular A-123 

implementation. 
(i.e. 

OCFO's 

ePMO 

OF 

cause(s) 

personnelttraining 

not 

9. 	 Assign the implementation of the financial reporting CAP to a manager who is principally 

responsible and accountable for fulfillment of the CAP. Presently, the tasks are split between 

managers who may not have sufficient time to commit to the project, and are delegating most of 

the tasks. Management should clearly define and track accountability. In addition, a senior 

executive should routinely monitor and manage the progress on the financial reporting CAP. 

10. Define the exact criteria which will be used to ascertain when the corrective action has been 

successfully completed, as well as the method for testing against such criteria as part of OMB 

A-123 implementation steps tests of design and tests of operating effectiveness of internal 

controls). Additionally, integrate the CAPs with the plan for OMB A-123 

implementation and annual FMFIA assurance statement. Management's plan for validation of 

corrective actions should be closely integrated with their controls test work conducted to 

comply with OMB A-123. 

United States Coast Guard (Coast Guard) 

The Coast Guard has drafted CAPs intended to address its respective sections of the four material 

weaknesses on Financial Management Oversight, Financial Reporting, Fund Balance with Treasury, 

and Actuarial Liabilities, reported in the FY 2005 independent auditors' report. 

Background: 

The CAPs contain a description of the known issues and root causes, management's key success 

factors and performance measures, general resources required, and in some cases, time milestones 

for corrective actions. It is acknowledged that the Coast Guard has attended a CAP workshop 

sponsored by the OCFO on June 26, 2006, where the CAP approach, future actions and milestones 

were discussed. Additionally, the Coast Guard was instrumental in assisting the Department in the 

pilot implementation. 

The CAPs for the four material weaknesses consist primarily known conditions, previously 

identified by the financial statement auditors, and lack evidence of a detailed review to identify the 

underlying root cause of the four material weaknesses. 

In order to develop a meaningful actionable CAP that includes identification of resource needs, 

milestones, performance indicators and accountability, the root of the issue must be 

determined. As written, the CAPs do not extend beyond a general discussion of the problems or 

approach to correction, and the underlying causes of the conditions are not described in sufficient 

detail to allow development of specific actions and milestones. For example, the Coast Guard cites a 

lack of investment in 	 as a root cause in the Financial Management Oversight 

CAP. However, the CAP does contain any further analysis of personnel deficiencies -such as 

which positions, roles and responsibilities, processes, locations, number of personnel, etc. 

Consequently, the associated action plan is limited to a general statement that "adequate personnel 

and financial resources must be made available in order to address root-cause issues and help ensure 

long-term sustainable success." 

The causes that have been identified have not been categorized, cross-referenced to problems 

identified by management, and prioritized for correction. In addition, the CAPs lack specific 

identification of financial systems and processes that require corrective actions, and an approach to 

correction. 
hrther 

." 

further 

Financial 

I 

..." 

." 

problem(s) 

hndamental I 

e.g., 

Likewise, the key success factors and performance measures identified consist primarily of an array 

of policies and procedures typically found in a reliable financial reporting process, without specific 

application to the Coast Guard financial reporting systems and processes. In some cases, possible 

corrective actions have been deferred, pending review to identify issues and develop a full 

CAP at a future date. For example, the Financial Management Oversight CAP contains a critical 

milestone of "not later than February 15, 2007, issue report from the financial management 

transformation team containing a comprehensive, integrated plan and milestones.. The CAP is a 

plan to develop a plan, and is, therefore, incomplete, and would be ineffective without 

development. 

The CAPs focus almost exclusively on audit finding recommendations categorized by material 

weakness in outline format with columns displaying status, percent complete, due date and 

individuals responsible for action. However, the reports do not contain a rationale for the due date, 

the detail steps planned or executed or how percentage of completion was determined or tested. 

The CAPs are incomplete as they only include audit recommendations which are only a small 

fraction of the total number of issues or root causes that Coast Guard must identify and address. The 

high level root causes identified in the CAPs appear to be the initial steps in that effort. 

In addition, the CAPs contain errors. For example, the resources required to correct Fund Balance 

with Treasury and Financial Reporting material weaknesses are identical, and the auditor 

recommendations in the CAP do not match the auditors' recommendation in the FY 2005 

independent auditors' report. 

Development and Accountability: 

Management Oversight 

Management has identified four broad categories of issues that cause the Financial Management 

Oversight material weakness; (1) personnel training, (2) organization, (3) [financial] systems, and 

(4) [personnel and budget] resources. The CAP, as written, is evidence that management recognizes 

the deep-rooted structural (organization, personnel and system) issues, and that full correction is a 

multi-year effort, and that a restructuring of the Coast Guard's financial management function may 

be needed to realign financial reporting processes with the optimal mix of civilian vs. military and 

centralized vs. decentralized responsibilities. In addition, the Coast Guard has vacant key financial 

positions. The Financial Management Oversight CAP, which is currently under review by the Coast 

Guard's interim CFO, calls for the creation of a "Financial Management Transformation Team," 

and for a "comprehensive, integrated plan of action and milestones by February 15, 2007. The 

Financial Management Oversight CAP is therefore incomplete, pending further development as 

planned by Coast Guard management. 

Financial Reporting 

The Financial Reporting CAP states that "There are many errors within the general ledger posting 

logic. Most of these are due to inherent systems' deficiencies.. However, it is not clear from the 

Financial Reporting CAP what steps will be taken to investigate these systems issues or when 

management expects to have the resolved. In addition to financial systems problems, the 

Financial Reporting CAP identifies many structural issues that are preventing the 

Coast Guard from preparing reliable financial data for submission to the OCFO, lack of 

policies, procedures, controls, personnel, training, inefficient and error prone processes. The 

Financial Reporting CAP lacks a detailed listing of tasks to investigate these fundamental issues, 

identify the root cause, and then develop corrective actions and assign responsibilities. Regarding 

resource requirements, management's assessment of the resources required to investigate and 

resolve these issues is limited to five staff (GS-12) personnel and unspecified funding for 
." 

"cumbersome/complex 

i.e., 

e.g., 

multiple/inadequate/non-unified 

/ 

Q 

Q 

fully / 

/ e.g. 

metrics / 

"modifications to the Core Accounting System". Yet full implementation of an auditor 

recommendation to "conduct an assessment of the current financial reporting process, including a 

review of the three general ledger systems.. will require the commitment of considerably more 

experienced supervisors, as well as expert systems personnel and/or contractors for identification 

and correction of posting logic problems. 

Fund Balance with Treasury 

Management has identified a number of issues that led to the material weakness in Fund Balance 

with Treasury accounts. Some issues appear to identify potential root causes, such as 

systems and processes and poor process design and systems integration". 

However, most of the issues are symptomatic in nature, "inability to provide audit 

disbursement, collection, and adjustment populations, number of suspense transactions is excessive, 

missing some signed backup obligation documents," etc. The Fund Balance with Treasury CAP 

lacks evidence of a detailed investigation to identify the root cause and then to develop specific 

corrective actions. Further, the extent of IT system deficiencies that may be causing or contributing 

to the material weakness is not clear in the Fund Balance with Treasury CAP. Some steps could be 

taken immediately to improve the reliability of the Fund Balance with Treasury account balances. 

However, the Fund Balance with Treasury CAP lacks a separation of short and long term actions 

and a time-line for correction. 

Actuarial Liabilities 

The CAP includes a description of the underlying issues causing the material weakness in actuarial 

liabilities, and the majority of the issues appear to be potential root causes, 

financial accounting systems, weak program oversight 

accountability, organizational structure, poor data integrity, etc. The due date for correction is 

December 2007. The Actuarial Liabilities CAP lacks interim milestones to make measure 

incremental temporary improvements that will allow actuarial balances to be accurately stated in the 

financial statements in FY 2006. The resources required do not address the cost for system 

upgrades, reorganization, or process changes. For example, the Actuarial Liabilities CAP states that 

it lacks "input from CG-842 (FINCEN) and CG-841 (IT systems)" and is therefore not fully 

developed. 

Overall, the CAPs for each of the four material weaknesses lack important details necessary to be an 

effective plan. Specifically, we found that the Coast Guard CAPs lack: 

Linkage or cross-reference to the material weakness conditions being corrected. Presently, the 

CAPs refer generally to the group of auditor findings by area, and it is difficult to determine if 

all of the conditions identified by the auditor are adequately addressed in the CAP; 

Evidence of review and approval by management, together with a description of periodic 

progress reports to be provided to Coast Guard and OCFO management on progress; 

A developed detailed listing of the tasks to be performed, and identification of system 

deficiencies and corrective actions and who is accountable for their completion; 

The detailed time-frame (milestones) that corrective actions are to occur, other than general 

months years for a few actions, including the protocol of correction, systems before 

processes, etc.; 

Performance measures for use by management to determine that corrective actions are 

on track or require modification, and to assign accountability; 
financial 

(i.e., 

i.e., 

i.e., 

15. 

(i.e. 

A thorough evaluation of the resources needed -both personnel and funding, and the source of 

those resources once determined; 

Identification and dedication of resources including supervisors and contract assistance. 

Presently, everyone associated with the CAP process already has other full-time job 

responsibilities within the Coast Guard. The corrective actions are of a scale that dedicated 

personnel, including management, are necessary for the plan to be effective in the near-term; 

A description of how the Coast Guard will verify and validate that corrective actions are 

complete and effective in correcting the conditions that lead to material weaknesses; and 

Integration with the Coast Guard's OMB A-123 implementation process. 

Recommendations: 

We recommend that Coast Guard: 

11. Perform a thorough root cause analysis to identify the underlying causes of the four material 

weaknesses, including a review of IT systems, processes and human resources. Coast 

Guard should not rely on the financial statement audit to identify all of the significant causes of 

control weaknesses, and should only use the audit to corroborate management's findings. 

12. Develop CAPs to mitigate and ultimately correct control deficiencies, based on management's 

own assessment of the issues. The CAPs should include a description of the detailed tasks and 

milestones, key success and performance metrics, and a designated person who is primarily 

accountable for completion of the effort. The identified root causes should be cross-referenced 

to the weakness identified by management (as well as those identified by the financial statement 

auditor). The CAPs should be prioritized for correction, to minimize duplication of effort where 

corrective actions overlap correction of IT system posting logic errors may resolve 

multiple issues, or mitigate the need for process changes). 

13. Make a realistic assessment of the resource requirements, human and financial, needed to 

perform the investigations to identify the root causes of material weaknesses, develop and 

execute thorough CAPs, and then to verify correction. This assessment should include input 

from all affected areas, CG-842 (FINCEN) and CG-841 (IT systems). In filling key 

financial management vacancies, the Coast Guard should ensure that the position holders have 

the necessary skills and experience to successfully execute the CAPs. 

14. Obtain support from executive leadership, since effective correction will at times compete with 

other mission priorities, and progress could falter without continuous reinforcement from 

leadership. 

Define the exact criteria which will be used to ascertain when the corrective action has been 

successfully completed, as well as the method for testing against such criteria as part of OMB 

A-123 implementation steps tests of design and tests of operating effectiveness of internal 

controls). Additionally, integrate the CAPs with the Coast Guard's plan for OMB A-123 

implementation and annual FMFIA assurance statement. Management's plan for validation of 

corrective actions should be closely integrated with their controls test work conducted to comply 

with OMB A-123. 
ICE'S 

Fund 

CAPS 

ePMO 

CAPS ICE'S 

ePMO 

Immigration and Customs Enforcement (ICE) 

ICE has drafted CAPs intended to address their sections of the three material weaknesses on 

Financial Management Oversight, Financial Reporting, and Fund Balance with Treasury, reported 

in the FY 2005 independent auditors' report. 

Background: 

ICE established the Program Management Office (PMO), which reports to CFO, to develop 

and implement a three-year Financial Action Plan (FAP) to manage and monitor efforts to improve 

ICE's financial management. The FAP addresses the material weaknesses as they relate to ICE 

which includes the material weaknesses in Financial Management Oversight, Financial Reporting 

and Balance with Treasury. 

In the establishment of the PMO, ICE contracted with a consulting firm to not only provide 

expertise but also manpower. The primary responsibilities of the PMO are to (1) provide program 

management infrastructure to ensure successful FAP execution, (2) provide guidance and support to 

staff developing initiative project plans and implementing them, and (3) resolve issues and mitigate 

risks that may hinder the FAP implementation effort. By February 2006, ICE issued its FAP and the 

process of implementing the corrective actions was launched. Each initiative in the FAP is 

supported by a Detailed Project Plan that outlines the tasks and milestones to be achieved. 

When the Department initiated its Department-wide CAP process in April 2006, ICE was already in 

the midst of its FAP implementation. In order to comply with the Department's CAP process, ICE 

fashioned its CAPs based on the information in its existing FAP. These summarizing the FAP 

initiatives were provided to the Department for uploading to the Department's database. 

While the and the FAP are similar, the FAP contains information regarding corrective 

actions in much greater detail than the summary-level information provided in the CAPs. For 

purposes of this performance audit, KPMG evaluated the corrective actions as detailed in ICE's 

FAP and supporting documentation. However, the FAP data was also compared with the 

information in ICE's CAPs within for consistency purposes. 

The FAP includes an analysis of root cause issues, potential effects of the deficiency, corrective 

actions and their foreseen impact. In addition, management has developed a timetable for corrective 

actions, and assigned specific tasks with due dates to specific individuals. 

When developing the FAP, ICE management indicated that it considered the FAP to be an 

evolutionary document that would be periodically updated as needed to consider new facts and 

circumstances, and to ensure continuous progress is made. Further, a decision was made to focus on 

deploying ICE's resources on the area of Fund Balance with Treasury with the goal of resolving this 

material weakness in FY 2006. Management decided that this measured, focused approach was the 

best way to fully rectify the issue, as opposed to attempting to work on all deficiencies 

simultaneously and spreading its resources too thin. While ICE wants to see positive progress in the 

remediation for each of the material weaknesses, it has only committed to fully remediate the Fund 

Balance with Treasury material weakness during FY 2006. 

The leadership provided by the ICE CFO in setting a positive 'tone-at-the-top,' and actively 

monitoring ICE's progress in implementing the FAP has shown to be integral to the success 

achieved at ICE thus far. The ICE's CFO continued commitment to the FAP effort is instrumental 

to resolving the material weaknesses at ICE. 
subtasks 

tasklsubtask. 

ePMO. 

tasks/critical 

ePMO; (i.e., 

ePMO 

(i.e., 

ePMO 

CAPs CAPs 

Financial Management Oversight 

Management has segregated the Financial Management Oversight material weakness into three 

primary areas: Workforce Strategy, Financial Systems, and Management Oversight. When 

developing the FAP, the PMO performed a root cause analysis which consisted primarily of 

conducting interviews with personnel and leveraging institutional knowledge of the ICE personnel 

in the PMO. The root cause analysis initially focused on the conditions cited by the auditors during 

the FY 2005 audit. The PMO categorized Financial Management Oversight within the FAP into 

two primary areas: Workforce Strategy and Financial Systems. Subsequent to the development of 

the FAP, the PMO expanded its initial root cause analysis which resulted in Management Oversight 

also being identified as one of three primary areas. To ensure that the FAP, at a minimum, 

addressed each of the auditor findings cited during the FY 2005 audit, the FAP contains an 

appendix which crosswalks each of the auditor findings to the task within each initiative designed to 

correct the material weakness. Additionally, as the work progresses, management may identify 

additional root causes and will update accordingly. 

Development: 

ICE developed and documented its corrective actions in a two-tiered approach. The first tier is the 

FAP itself which is at the highest level and can be described as more of a summary level. Each 

initiative within the FAP contains a brief background section as well as the following sections: 

Cause, Effect, Corrective Actions, and Impact of Corrective Actions. Within the Corrective Actions 

section, the primary tasks to be completed are listed along with a task description, milestone, and 

estimated date of completion (month and year). The second tier is the Detailed Project Plan which is 

at a more detailed level. The Detailed Project Plan contains the following sections: Project 

Summary, Key Team Roles and Responsibilities, Business Issues and Challenges, Project Plan, and 

Key Outputs. Within the Key Outputs section, the primary tasks to be completed are listed along 

with the key output description and the estimated date of completion (month, day, and year). 

The Project Plan, maintained in Microsoft Project, lists the primary tasks and the along 

with the number of days the tasklsubtask should take to complete as well as the start date and the 

end date for the The intent is that the FAP would be a static document while the 

Detailed Project Plan and the accompanying Microsoft Project Plan would be updated as needed. 

The information contained in the Corrective Action section of the FAP should be consistent with the 

information in the Key Outputs section of the Detailed Project Plan which, in turn, should be 

consistent with the Critical Milestones in the CAP within 

Upon comparison of the milestones and the corresponding due dates in the FAP, dated 

February 2006; the Detailed Project Plan for Workforce Strategy and the Detailed Project Plan 

Financial Systems, dated May 31, 2006 and April 18, 2006, respectively; and the CAP Detail 

Report as of May 31, 2006 from we noted a couple of minor inconsistencies due dates, 

description of tasks, and number of tasks) between the various documents. In addition, we noted 

that the CAP within did not contain information on the Key Performance Measures, Risks 

and Impediments, and Resources Required. All of the inconsistencies between the various 

documents appear to be attributable to timing the date each of the documents was prepared and 

the frequency with which was updated). 

ICE attended the Department's OCFO-sponsored CAP Workshop for Financial Management 

Oversight where the corrective action approach, future actions and milestones were discussed. ICE 

represented that the CAP Workshop was beneficial and provided ideas for revisions to its FAP. We 

understand that revised are due to the Department by July 12, 2006. These are outside 
(e.g., 

ePMO. 

taskslcritical 

task/critical 

taskslcritical 

tasks/critical 

the scope of this performance audit. ICE further represented that the revisions would not be 

considered significant but would be adding specificity to the existing data tasks and 

milestones) and revising expected completion dates for select milestones, as well as providing 

information for the sections of the CAP which were not previously submitted for input into 

Within the Management Oversight area, none of the milestones, with the exception of 

the task to "Establish Financial Action Plan Program Management Office", is considered to have a 

'true' completion date as the tasks are considered to be on-going. Other tasks lack exact criteria 

which will be used to ascertain when the corrective action has been successfully completed, as well 

as the method for testing against such criteria. Similarly, within Workforce Strategy, the PMO 

represented that the success criteria and validation criteria cannot be determined until the Workforce 

Transition Plan has been developed and implemented. 

The PMO has established a FAP Executive Dashboard which is updated at least monthly to provide 

a snapshot of the progress and status of each FAP Initiative. For each milestone within 

each FAP Initiative, a color coding is used to identify whether the task is complete (blue), on track 

(green), moderately delayed (yellow), significantly delayed (red) or not started (white). The FAP 

Dashboard does not reflect and track the progress for the area of Management Oversight and most 

of the tasks in this area are all considered to be on-going tasks as only one of the 

milestones in this area has a 'true' completion date. 

Of the ten and six milestones within the areas of Workforce Strategy and Financial 

Systems, respectively, ICE indicated in its FAP Dashboard as of June 30, 2006, that five and one, 

respectively, have been completed. 

Accountability: 

As previously mentioned, the PMO has established a FAP Executive Dashboard, which is updated 

at least monthly and provides a snapshot of the progress and status of each FAP Initiative. 

Additionally, the percentage of completion is presented at the overall FAP Initiative level. 

For each material weakness initiative included in the FAP, an ICE initiative owner has been 

assigned, as well as a PMO liaison. Additionally, ICE senior leadership also has a role in the FAP 

initiative. 

The PMO, in conjunction with the initiative owner, completed a resource template for each FAP 

Initiative which identified the resource name, skill set needed by the resource, and the number of 

hours per week by month for each resource. The resources were categorized as Executive Sponsor, 

Initiative Owner, or Staff. We noted that the resource template included both ICE employees and 

contracted personnel. 

As represented to us by the PMO, the responsibility for reporting on the task status and 

documenting evidence to support such status rests with the ICE initiative owner and not the PMO. 

However, we were informed that the PMO is in the process of gathering such evidence for 

completed tasks from each of the ICE initiative owners for its own records. 

Financial Reporting 

When developing the FAP, the PMO performed a root cause analysis which consisted primarily of 

conducting interviews with personnel and leveraging the institutional knowledge of the ICE 

personnel in the PMO. The root cause analysis initially focused on the conditions cited by the 

auditors during the FY 2005 audit. The analysis performed by the PMO team resulted in two 
tasks/critical 

(i.e., 

(i.e., 

CAPs 

CAPs 

(i.e., 

(i.e., 

datalprocess 

(i.e., 

tasks/critical 

tasks/critical 

categories being identified: Lack of Policies and Process Needs Improvement. To ensure that the 

FAP, at a minimum, addressed each of the auditor findings cited during the FY 2005 audit, the FAP 

contains an appendix which crosswalks each of the auditor findings to the task within each initiative 

designed to correct the material weakness. Subsequent to the development of the FAP, the PMO 

expanded its initial root cause analysis which resulted in additional causes being identified. 

Development: 

As previously discussed under the corresponding section under Financial Management Oversight, 

ICE developed and documented its corrective actions in a two-tiered approach. 

Upon comparison of the milestones and the corresponding due dates in the FAP, dated 

February 2006, the Detailed Project Plan dated June 15, 2006, and the CAP Detail Report as of May 

31, 2006 from ePMO, we noted a couple of minor inconsistencies due dates, description of 

tasks, and number of tasks) between the various documents. In addition, we noted that the CAP 

within ePMO did not contain information on Key Performance Measures, Risks and Impediments, 

and Resources Required. Furthermore, all of the inconsistencies between the various documents 

appear to be attributable to timing the date each of the documents was prepared and the 

frequency with which ePMO was updated). 

We understand that revised as of June 30, 2006, are due to the Department by July 12, 2006. 

ICE represented that it would be submitting a revised CAP to the Department. These revised 

are outside the scope of this performance audit. ICE further represented that the revisions would not 

be considered significant but would be adding specificity to the existing data tasks and 

milestones) and revising expected completion dates for select milestones, as well as providing 

information in the sections of the CAP that were not previously submitted for input into ePMO. 

Abnormal balances, 'free-form' general journal entries, and accurate and timely submission of 

financial reports are considered to be significant problem areas within Financial Reporting. 

Although the PMO developed a metric to track and monitor the total amount and number of 

abnormal balances over $1 million, as well as the categorization researched transactions 

causing abnormal balances, identified root cause, and identified owner) of the amount 

and number of these abnormal balances, we noted no such similar metric to monitor and track the 

volume and reason of 'free-form' general journal entries. As such, it would appear that ICE w-ill be 

relying on the occurrence of high-level branch director) approval of 'free-form' general 

entries, as required by the newly developed standard operating procedures, to test the success in this 

area. Further, we noted no mechanism to track and monitor the volume and type of 'warning' errors 

received upon submission of the monthly financial data into TIER. As such, it would appear that 

ICE will be relying only on the fact that the monthly financial data is submitted to the Department 

by its stipulated deadlines and that the financial data is accepted and processed in TIER without 

'fatal' errors. 

Of the eight milestones within Financial Reporting ICE indicated it its FAP Dashboard 

as of June 30,2006, three milestones have been completed. 

Based on the progress being made on the task related to the research and resolution of abnormal 

balances, ICE updated the Detailed Project Plan for Financial Reporting on June 15,2006 which 

extended the estimated completion dates for this task. 

Lastly, ICE is scheduled to attend the Department's OCFO-sponsored CAP Workshop for Financial 

Reporting on August 7,2006. 
tasks/critical 

(i.e., 

(i.e., 

CAPs 

CAPs 

(i.e., 

Accountability: 

Refer to the corresponding section under Financial Management Oversight for a discussion of the 

roles of personnel with ICE, the completion of resource templates, the responsibility for supporting 

the progress made and the reporting of corrective action status via the FAP Dashboard. 

Fund Balance with Treasury (FBWT) 

Identification: 

When developing the FAP, the PMO performed a root cause analysis which consisted primarily of 

conducting interviews with personnel and leveraging the institutional knowledge of the ICE 

personnel in the PMO. The root cause analysis initially focused on the conditions cited by the 

auditors during the FY 2005 audit. The analysis performed by the PMO team resulted in three 

categories being identified: Untimely Clearing and Recording of Items, Lack of Policies, and 

Process Needs Improvement. The PMO categorized Fund Balance with Treasury within the FAP 

into four primary areas as follows: 

Cash Reconciliation 

Statement of Differences 

Suspense 

Non-224 Transactions 

To ensure that the FAP, at a minimum, addressed each of the auditor findings cited during the FY 

2005 audit, the FAP contains an appendix which crosswalks each of the auditor findings to the task 

within each initiative designed to correct the material weakness. Subsequent to the development of 

the FAP, the PMO expanded its initial root cause analysis which resulted in additional causes being 

identified. Additionally, as the work progresses management may identify additional root causes 

and will update accordingly. 

Development: 

As previously discussed under the corresponding section under Financial Management Oversight, 

ICE developed and documented its corrective actions in a two-tiered approach. 

Upon comparison of the milestones and the corresponding due dates in the FAP, dated 

February 2006, the Detailed Project Plan dated April 4, 2006, and the CAP Detail Report as of May 

31, 2006 from ePMO, we noted a couple of minor inconsistencies due dates, description of 

tasks, and number of tasks) between the various documents. In addition, we noted that the CAP 

within ePMO did not contain information on Key Performance Measures, Risks and Impediments, 

and Resources Required. Furthermore, all of the inconsistencies between the various documents 

appear to be attributable to timing the date each of the documents was prepared and the 

frequency with which ePMO was updated). 

We understand that revised as of June 30, 2006, are due to the Department by July 12, 2006. 

ICE represented that it would be submitting a revised CAP to the Department. These revised 

are outside the scope of this performance audit. ICE further represented that the revisions would not 

be considered significant but would be adding specificity to the existing data tasks and 

milestones) and revising expected completion dates for select milestones, as well as providing 

information in the sections of the CAP that were not previously submitted for input into ePMO. 
ICE'S 

for 

(i.e. 

ICE's 

18. 

ICE's 

turn 

'warning' 

Standard operating procedures were issued for each of the identified four areas. In addition, within 

the areas of Statement of Differences and Suspense, the tasks reflected as complete include the 

reconciling and clearing of all FY 2005 transactions and FY 2006 transactions greater than 60 days 

for both ICE and each of the Components. 

ICE is scheduled to attend the Department's OCFO-sponsored CAP Workshop for Fund Balance 

with Treasury on August 16,2006. 

Accountability: 

Refer to the corresponding section under Financial Management Oversight for a discussion of the 

roles of personnel with ICE, the completion of resource templates, the responsibility for supporting 

the progress made and the reporting of corrective action status via the FAP Dashboard. 

Recommendations: 

We recommend that ICE: 

16. Ensure that revisions and updates to the FAP and supporting documentation are made to 

CAPs maintained in ePMO. Since the CAPs maintained in ePMO are the basis for the 

Department-wide CAP and ePMO is the system of record for the Department for corrective 

actions, it is imperative that the CAP data in ePMO be current. 

17. Within the area of Management Oversight, define the exact criteria which will be used to 

ascertain when the corrective action has been successfully completed, as well as the method 

testing against such criteria as part of OMB A-123 implementation steps tests of design and 

tests of operating effectiveness of internal controls). Additionally, integrate the CAPs with 

plan for OMB A-123 implementation and annual FMFIA assurance statement. 

Management's plan for validation of corrective actions should be closely integrated with their 

controls test work conducted to comply with OMB A-123. 

Include completion of the GAO Evaluation Tool as a critical milestone in its Financial 

Reporting CAP. 

19. Within the area of Workforce Strategy, define the success and validation criteria in conjunction 

with the development and implementation of the Workforce Transition Plan. 

20. Enhance its understanding and working knowledge of ePMO to ensure that CAP data in 

ePMO is portraying an accurate picture. As previously stated, the CAPs maintained in ePMO 

are the basis for the Department-wide CAP and ePMO is the system of record for the 

Department for corrective actions. 

21. Reduce the volume of 'free-form' general journal entries that are recurring in nature. This would 

reduce the need for the entry to be made as a 'free-form' general journal entry which in 

would reduce the risk of an inappropriate entry being recorded. 

22. Develop a mechanism to track and monitor the volume and type of errors received 

upon submission of the monthly financial data into TIER. This would effectively limit the 

number of 'warning' errors received by being proactive in researching and resolving the 

underlying cause. 
Departn~cst tlomelitnd 

Security 

ifCA Homeland 

% 

"P SEP 7 -.C?5~ s€' 

0fficW 

DHS' 

DHS' 

undemay 

(CAPs). 

actioils 

CAPs 

U.S. of 

Washington, DC 20528 

2006 Security 


MEMORANDUM FOR: Richard L. Skinner, Inspector General 

FROM: David L. Norquist, Chief Financial 

SUBJECT: Audit of Corrective Action Plan Process for Financial 

Reporting -Report No. 2 

Thank you for the opportunity to comment upon the Audit of Corrective Action Plan 

Process for Financial Reporting -Report No. 2. We concur with the report's recommendations 

and are pleased to report that actions are already to address the issues raised in the 

report. The report highlights valuable best practices and lessons learned. For example, ICE is 

improving the internal control environment through establishing a strong "tone at the top" and 

Coast Guard is piloting an automated corrective action planning tracking system for managing 

Department-wide corrective action plans Most significantly, throughout the summer the 

Department sponsored a series of CAP workshops designed to help identify crosscutting root 

causes of internal control deficiencies focusing on the areas of people, policies, processes, and 

systems. The workshops set clear expectations for integrating test of design and operating 

effectiveness requirements of DHS policy and OMB Circular No. A-123, Management's 

Responsibility for Internal Controls into our corrective action plans. The workshops were well 

attended and supported by all DHS Components and we are developing stronger corrective 

as a result. 

After the are updated, the next step will be the implementation of the DHS Internal 

Controls over Financial Reporting (ICOFR) Playbook. The ICOFR Playbook will act as a 

single, comprehensive, and integrated plan to organize and focus corrective action and 

assessment efforts across the Department. 

We appreciate the positive comments about our developing corrective action planning process. 

In closing, we look forward to continue our partnership in implementing corrective actions and 

most importantly the DHS Financial Accountability Act. 
Securitv 

GAOtOIG 

Report Distribution 

Department of Homeland 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Chief Privacy Officer 

Under Secretary for Management 

Assistant Secretary for Policy 

Assistant Secretary for Public Affairs 

Assistant Secretary for Legislative and Intergovernmental Affairs 

Chief Financial Officer 

Chief Information Officer 

DHS Audit Liaison 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as appropriate 
www.dhs.gov/oig. 

Hotline 

Hotline GeneraljMAIL 

Hotline, 

email 

Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General (OIG) at 

(202) 254-4100, fax your request to (202) 254-4285, or visit the OIG web site at 

OIG 


To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 

or noncriminal misconduct relative to department programs or operations, call the 

OIG at 1-800-323-8603; write to DHS Office of Inspector 

STOP 2600, Attention. Office of Investigations - 245 Murray Drive, SW, 

Building 410, Washington, DC 20528, fax the complaint to (202) 254-4292; or 

DHSOIGHOTLINE@dhs.gov The OIG seeks to protect the identity of each writer 

and caller.