Page 1 GAO-17-552R FHFA Fiscal Year 2016 Management Report

441 G St. N.W.

Washington, DC 20548

June 14, 2017

The Honorable Melvin Watt

Director

Federal Housing Finance Agency

Management Report: Opportunities for Improvement in FHFA’s Evaluation of Internal 

Control over Financial Reporting

Dear Mr. Watt:

On November 15, 2016, we issued our report containing our opinion on the fiscal years 2016

and 2015 financial statements of the Federal Housing Finance Agency (FHFA).1 Our report also 

included (1) our opinion on the effectiveness of FHFA’s internal control over financial reporting 

as of September 30, 2016, and (2) our conclusion on FHFA’s compliance during fiscal year 

2016 with selected provisions of applicable laws, regulations, contracts, and grant agreements 

that we tested.

We did not identify and therefore did not report any material weaknesses or significant 

deficiencies in our November 2016 audit report.2 The purpose of this report is to communicate 

other less significant control deficiencies identified during our fiscal year 2016 audit but not 

included in our audit report. There were no prior recommendations outstanding for FHFA related 

to past financial statement audits. 

The Housing and Economic Recovery Act of 2008 (HERA)3 established FHFA as an 

independent agency empowered with supervisory and regulatory oversight of the housingrelated government-sponsored enterprises: the Federal National Mortgage Association (Fannie 

Mae), the Federal Home Loan Mortgage Corporation (Freddie Mac), the 11 Federal Home Loan 

Banks, and the Office of Finance.4 The act requires FHFA to annually prepare financial 

statements and requires GAO to audit these statements.5 It also requires the FHFA Director to 

provide the Comptroller General an annual assertion as to the effectiveness of internal control 

 1

GAO, Financial Audit: Federal Housing Finance Agency’s Fiscal Years 2016 and 2015 Financial Statements, GAO17-139R (Washington, D.C.: Nov. 15, 2016). 

2

A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a 

reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or 

detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in 

internal control that is less severe than a material weakness, yet important enough to merit attention by those 

charged with governance. A control deficiency exists when the design or operation of a control does not allow 

management or employees, in the normal course of performing their assigned functions, to prevent, or detect and 

correct, misstatements on a timely basis. 

3

Pub. L. No. 110-289, 122 Stat. 2654 (July 30, 2008). 

4

The 11 Federal Home Loan Banks and the Office of Finance, whose primary function is to issue and service all debt 

securities for the Federal Home Loan Banks, constitute the Federal Home Loan Bank System.

5

Pub. L. No. 110-289, § 1106, 122 Stat. 2654, 2671 (July 30, 2008), classified at 12 U.S.C. § 4516.
Page 2 GAO-17-552R FHFA Fiscal Year 2016 Management Report

over financial reporting.6 FHFA issues consolidated financial statements that include the 

financial activities and position of FHFA and the FHFA Office of the Inspector General (FHFAOIG) as a single reporting entity. Since FHFA-OIG is material to FHFA’s financial statements, 

the evaluation of its internal control over financial reporting is a key component of FHFA’s 

assertion. While FHFA and FHFA-OIG perform the evaluations of internal control independently,

FHFA is ultimately responsible for consolidating the evaluation results and providing an annual 

assertion as to the effectiveness of internal control over financial reporting for the agency as a 

whole.

Results in Brief

During our audit of FHFA’s fiscal years 2016 and 2015 financial statements, we identified 

deficiencies in FHFA’s evaluation of internal control over financial reporting. This includes 

FHFA-OIG’s evaluation of its own internal control over financial reporting as FHFA-OIG’s 

reported amounts constitute a material portion of the consolidated FHFA financial statements. 

FHFA’s evaluation is used to support its assurance statement on the effectiveness of internal 

control over financial reporting and is essential to the monitoring component of internal control. 

While we did not consider these deficiencies to be material weaknesses or significant 

deficiencies, either individually or collectively, they nonetheless warrant FHFA management’s 

attention. Specifically, we found that during FHFA’s internal control evaluation, FHFA and 

FHFA-OIG did not (1) adequately document their consideration of materiality thresholds and risk 

assessments, (2) adequately document their consideration of all internal control components 

and related principles, and (3) adequately identify and document financial reporting control 

activities. In addition, FHFA did not maintain independent roles in the implementation and 

monitoring of control activities.

We are making nine recommendations pertaining to these identified control deficiencies.

Scope and Methodology 

As part of our audit of FHFA’s fiscal years 2016 and 2015 financial statements, we evaluated 

FHFA’s (including FHFA-OIG’s) internal controls and tested its compliance with selected 

provisions of applicable laws, regulations, contracts, and grant agreements. We designed our 

audit procedures to test relevant controls over financial reporting, including those designed to 

provide reasonable assurance that (1) transactions are properly recorded, processed, and 

summarized to permit the preparation of FHFA’s financial statements in accordance with U.S. 

generally accepted accounting principles, and that assets are safeguarded against loss from 

unauthorized acquisition, use, or disposition, and (2) transactions are executed in accordance 

with provisions of applicable laws, including those governing the use of budget authority;

regulations; contracts; and grant agreements, noncompliance with which could have a material 

effect on the financial statements. As part of our audit, we evaluated the work performed and 

conclusions reached by FHFA management in its internal control evaluation.

7 A full discussion 

of our scope and methodology is included in our November 2016 report on our audit of FHFA’s 

fiscal years 2016 and 2015 financial statements.8

 6

12 U.S.C. § 4516(g)(4).

7

FHFA’s internal control over financial reporting is governed by criteria established under 31 U.S.C. § 3512(c), (d), 

commonly known as the Federal Managers’ Financial Integrity Act. 

8

GAO-17-139R.
Page 3 GAO-17-552R FHFA Fiscal Year 2016 Management Report

We performed our audit in accordance with U.S. generally accepted government auditing 

standards. We believe that our audit provides a reasonable basis for our findings and 

recommendations in this report.

Deficiencies in FHFA’s Evaluation of Internal Control over Financial Reporting

During our fiscal year 2016 audit, we identified deficiencies in FHFA’s evaluation of internal 

control over financial reporting. This includes FHFA-OIG’s evaluation of its own internal control 

over financial reporting as FHFA-OIG’s reported amounts constitute a material portion of the 

consolidated FHFA financial statements. FHFA’s evaluation is used to support its assurance 

statement on the effectiveness of internal control over financial reporting and is essential to the

monitoring component of internal control. Specifically, we found that FHFA and FHFA-OIG did 

not (1) adequately document their consideration of materiality thresholds and risk assessments,

(2) adequately document their consideration of all internal control components and related 

principles, and (3) adequately identify and document financial reporting control activities. In 

addition, FHFA did not maintain independent roles in the implementation and monitoring of 

control activities.

Although FHFA and we concluded that its internal control over financial reporting was effective 

as of September 30, 2016, we noted the following deficiencies. 

Documenting the Consideration of Materiality Thresholds and Risk Assessments 

FHFA and FHFA-OIG utilize a 3-year testing cycle for their evaluations of internal control over 

financial reporting by process area. For example, payroll processing and depreciation are two 

separate process areas (i.e., financial reporting functions) that affect the program costs line item

in the Statement of Net Cost. Each process area is tested at least once during the 3-year cycle, 

and materiality and risk are to be considered when determining which processes to select for 

testing in a given year. FHFA and FHFA-OIG document the processes selected for testing and 

submit them for approval to the Chief Financial Officer and the Deputy Inspector General for 

Internal Controls and Facilities, respectively. FHFA and FHFA-OIG analyze the results of their 

testing and draw conclusions on internal control over financial reporting independently. FHFAOIG then reports its conclusions to FHFA for consideration when forming overall conclusions on 

internal control over financial reporting for the agency as a whole. 

Condition. We found that FHFA and FHFA-OIG did not adequately document how materiality

thresholds and risk assessments were considered in planning their evaluations of internal 

control over financial reporting. For example, during FHFA’s planning of its internal control 

evaluation, it developed a table that included its explanations for selecting process areas for 

testing. However, the explanations made no explicit reference to the materiality threshold or 

assessed risk. For instance, FHFA changed to a new payroll provider in September 2015, 

shortly before fiscal year 2016 started. FHFA considered this change, which affects risk, when 

selecting processes for testing. However, it did not document the significance of the risk or

assign a risk assessment level for this process area during planning. Furthermore, FHFA did not 

document a risk assessment level for any of the process areas. Similarly, FHFA-OIG’s

memorandum on process areas selected for testing did not explicitly document how it 

considered materiality and risk when obtaining approval for process areas selected for testing. 

We also found that FHFA’s and FHFA-OIG’s documentation did not consider materiality 

thresholds for the agency as a whole or adequately explain the rationale for materiality 

calculations. For example, FHFA and FHFA-OIG calculated materiality thresholds 

independently, using different materiality benchmarks. Specifically, FHFA determined 
Page 4 GAO-17-552R FHFA Fiscal Year 2016 Management Report

Obligations Incurred to be its most significant line item and used that balance as its materiality 

benchmark, while FHFA-OIG used adjusted program costs. However, FHFA and FHFA-OIG did 

not document how they reasonably assured that the different materiality thresholds they 

calculated were appropriate for the agency as a whole, considering FHFA issues consolidated 

financial statements. In addition, FHFA did not explain its rationale for determining Obligations 

Incurred to be its most significant line item, and FHFA-OIG did not explain its rationale for 

excluding certain expenses from program costs when determining the materiality benchmark it 

used. 

Furthermore, although FHFA and FHFA-OIG established materiality thresholds for testing, they 

did not evaluate the aggregate effect of all deficiencies identified at the agency-wide level.

Criteria. Standards for Internal Control in the Federal Government states that management

should establish and operate monitoring activities to monitor the internal control system and 

evaluate the results. Management can use separate evaluations to monitor the design and 

operating effectiveness of the internal control system. The scope and frequency of these 

evaluations depend primarily on the assessment of risks,

9 effectiveness of ongoing monitoring, 

and rate of change within the entity and its environment.

10 Furthermore, Appendix A of the 

Office of Management and Budget’s (OMB) Circular A-123, Management’s Responsibility for 

Enterprise Risk Management and Internal Control,

11 states that an assessment of the potential 

effectiveness of the design of controls for an account or group of accounts should be made 

considering the risk of error, and that materiality should be considered when determining the 

extent of testing or work required to assess internal control over financial reporting as well as 

what deficiencies should be reported. In addition, per the implementation guide for Appendix A

of OMB Circular A-123,

12 management should document the rationale and basis for the 

materiality determination and also decide which reportable conditions, when aggregated, may 

be deemed material weaknesses to the agency as a whole. 

Cause. FHFA and FHFA-OIG did not adequately consider and document materiality thresholds 

and risk when designing the evaluation of internal control over financial reporting because 

neither entity developed a mechanism, such as a template, that captured all of the key aspects 

of the decision-making process. Furthermore, FHFA and FHFA-OIG did not coordinate with 

each other to (1) reasonably assure that the materiality thresholds were appropriate for the 

agency as a whole and (2) assess the aggregate effect of all deficiencies identified at the 

agency-wide level. 

Effect. Without adequately documenting materiality and risk considerations when evaluating 

internal control over financial reporting, FHFA and FHFA-OIG are at increased risk that their

 9

Management defines risk tolerances in specific and measurable terms so they are clearly stated and can be 

measured. Risk tolerance is often measured in the same terms as the performance measures for the defined 

objectives. Financial reporting objectives include judgments about materiality in light of surrounding circumstances, 

involve both qualitative and quantitative considerations, and are affected by the needs of financial report users and 

size or nature of a misstatement. 

10GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: September 

2014).

11Office of Management and Budget, Management’s Responsibility for Enterprise Risk Management and Internal 

Control, OMB Circular A-123 (Washington, D.C.: July 2016). 

12Chief Financial Officer’s Council, Implementation Guide for OMB Circular A-123, Management’s Responsibility for 

Internal Control, Appendix A, Internal Control over Financial Reporting (Washington, D.C.: July 2005).
Page 5 GAO-17-552R FHFA Fiscal Year 2016 Management Report

testing may be insufficient to support the agency’s assertion on the effectiveness of internal 

control over financial reporting.

Recommendations for Executive Action. We recommend that you take the following three 

actions: 

• Direct the Chief Financial Officer to develop a mechanism that captures all of the key factors 

to be considered, such as materiality and risk, when designing the evaluation of internal 

control over financial reporting and collaborate, as appropriate, with the Inspector General to 

develop a similar mechanism for use by FHFA-OIG.

• Direct the Chief Financial Officer to coordinate with the Inspector General, as appropriate, 

when calculating materiality thresholds to reasonably assure that materiality determinations 

are appropriate for the agency as a whole and rationale is adequately documented. 

• Direct the Chief Financial Officer to coordinate with the Inspector General, as appropriate, to 

assess and document the aggregate effect of all deficiencies identified at the agency-wide 

level during the evaluation of internal control over financial reporting.

Documenting the Consideration of Internal Control Components and Related Principles

In addition to its annual assertion on internal control, FHFA also issues an annual statement of 

assurance in accordance with the Federal Managers’ Financial Integrity Act.

13 As part of this

process, the FHFA and FHFA-OIG program offices complete Internal Control Assessment forms 

based on the five components of internal control and 17 related principles outlined in Standards 

for Internal Control in the Federal Government. FHFA’s and FHFA-OIG’s program offices 

assess and conclude on the internal control principles assigned to them based on the controls 

designed and implemented in their offices.

Condition. We found that FHFA and FHFA-OIG did not adequately document how they 

considered the components of internal control and related principles from the perspective of 

internal control over financial reporting. FHFA and FHFA-OIG relied significantly on the

assessments completed by the program offices to support their conclusions on the components 

of internal control and related principles for financial reporting. While it is acceptable to leverage 

the work of the program offices, the results of these assessments cover controls beyond those 

within the scope of financial reporting, as not all program offices play a major role in designing

and implementing key internal controls related to financial reporting. Therefore, it was unclear 

what specific information within these assessments FHFA and FHFA-OIG used to support their 

conclusions on internal control over financial reporting. 

Although FHFA attempted to summarize the results of these assessments within a table 

included in its results document, it did not consolidate the work of the program offices in 

sufficient detail, by internal control principle, to support its conclusion on internal control over 

financial reporting. For instance, FHFA included in its table the assessment form completed by 

FHFA’s Office of Minority and Women Inclusion. However, it was unclear what information from 

this assessment FHFA used that would have been within the financial reporting scope to 

support its conclusion on internal control over financial reporting. 

 1331 U.S.C. § 3512(c), (d).
Page 6 GAO-17-552R FHFA Fiscal Year 2016 Management Report

In addition, FHFA-OIG did not summarize the results of the program office assessments within 

its conclusion on internal control over financial reporting. Therefore, FHFA-OIG did not 

adequately explain in its documentation how it considered all internal control components and 

related principles, as they relate to financial reporting, when arriving at its conclusion.

Criteria. HERA requires FHFA to provide an assertion on the effectiveness of internal control 

over financial reporting using Standards for Internal Control in the Federal Government. 

Standards for Internal Control in the Federal Government states that management should 

establish and operate monitoring activities to monitor the internal control system and evaluate 

the results.14 The five components of internal control must be effectively designed, 

implemented, and operating, and operating together in an integrated manner, for an internal 

control system to be effective. The 17 principles support the effective design, implementation, 

and operation of the associated components and represent requirements necessary to establish 

an effective internal control system. For each principle, management makes a summary 

determination as to whether the principle is designed, implemented, and operating effectively. 

Furthermore, the implementation guide for Appendix A of OMB Circular A-123 states that 

management should determine the scope of the internal control assessment, specifically the 

breadth and depth of financial reporting, and maintain documentation of the assessment 

process and methodology used to support its assertion as to the effectiveness of the internal 

control over financial reporting.

Cause. FHFA management stated that they consider the evaluation of internal control over 

financial reporting to be low risk given the ongoing monitoring performed by the agency. As a 

result, it allocates limited resources to the separate evaluation performed for internal control 

over financial reporting. However, per Appendix A of OMB Circular A-123, management should 

ensure that adequate funding and resources are made available for the evaluation of internal 

control over financial reporting. In addition, FHFA-OIG stated that it did not fully understand the 

need to document how it considered all internal control components and related principles, as 

they relate to financial reporting, based on the standards when arriving at its conclusion. 

Effect. Without adequate documenting of their consideration of all internal control components

and related principles within the scope of financial reporting, there is an increased risk of FHFA 

and FHFA-OIG inaccurately concluding, or inadequately supporting their conclusions, on the 

effectiveness of internal control over financial reporting. 

Recommendation for Executive Action. We recommend that you direct the Chief Financial 

Officer to (1) summarize in sufficient detail by internal control principle those activities from the 

program offices that have an effect on internal control over financial reporting to reasonably 

assure the consideration of all internal control components and related principles;

(2) collaborate, as appropriate, with the Inspector General to implement corresponding actions 

at FHFA-OIG; and (3) document how that information is used to conclude on the internal control 

components and related principles for financial reporting. 

Identifying and Documenting Financial Reporting Control Activities 

To support the assurance statement on the effectiveness of internal control over financial 

reporting, FHFA and FHFA-OIG, among other things, are to assess key control activities related 

to key process areas, service providers, and information systems. Furthermore, they are to 

 14GAO-14-704G.
Page 7 GAO-17-552R FHFA Fiscal Year 2016 Management Report

assess key control activities to reasonably assure compliance with laws and regulations. FHFA 

and FHFA-OIG categorize their internal control over financial reporting into 32 and 27 process 

areas, respectively. Examples of some process areas include payroll processing, invoice 

processing, and depreciation. 

In addition, FHFA and FHFA-OIG contract with several service providers for specific services. 

For accounting and reporting services, they both contract with the Department of the Treasury’s 

Bureau of the Fiscal Service (Fiscal Service). Fiscal Service undergoes an annual examination 

on the suitability of the design and operating effectiveness of its controls, and the results of the 

examination are issued in a Statement on Standards for Attestation Engagements (SSAE) No. 

16 report.15 The SSAE No. 16 report also includes complementary user entity controls, which 

are controls to be implemented by user entities (i.e., FHFA and FHFA-OIG) to achieve the 

control objectives stated in the SSAE No. 16 report. FHFA and FHFA-OIG rely on the control 

testing results documented in the SSAE No. 16 reports of their service providers. 

Similarly, in addition to SSAE No. 16 examinations, FHFA and FHFA-OIG rely on work 

performed by other auditors for their evaluation of information system controls, such as the 

annual Federal Information Security Management Act audit. Furthermore, FHFA and FHFA-OIG 

implement controls to reasonably assure compliance with those laws and regulations that have 

an impact on material amounts and disclosures in the financial statements. 

Condition. As part of their evaluation, FHFA and FHFA-OIG did not adequately identify or 

document all key financial reporting control activities related to key process areas, service 

providers, information systems, and compliance with laws and regulations. 

FHFA did not identify all key control activities or process areas for testing. For example, FHFA 

did not identify all key control activities for fixed assets and year-end accruals. Also, in its list of 

process areas containing key controls, FHFA did not identify the preparation of the financial 

statements, which should include key control activities such as management approval of the 

year-end financial statements. 

In addition, FHFA’s and FHFA-OIG’s reviews of Fiscal Service’s SSAE No. 16 report did not 

identify all applicable control objectives and key control activities at Fiscal Service relevant to

FHFA’s financial reporting. For example, Fiscal Service processes manual journal entries on 

behalf of both FHFA and FHFA-OIG. However, neither entity identified this objective as

applicable to it and, as a result, did not identify any key control activities for the objective. In 

addition, FHFA’s documentation of the SSAE No. 16 control activities was not sufficiently 

detailed to determine which control activities FHFA took into consideration to support its overall 

evaluation. Furthermore, while FHFA and FHFA-OIG implemented complementary user entity

controls as documented in the SSAE No. 16 report, neither entity adequately documented how it 

evaluated these controls as part of its internal control evaluation. 

Although FHFA and FHFA-OIG considered information systems control activities in evaluating

internal control over financial reporting and reviewed the testing results of separate evaluations 

performed for their information systems, they did not identify a complete list of the specific 

control activities tested in those audits and examinations that were key to financial reporting. For 

 15The examination is performed by an independent service auditor in accordance with generally accepted 

government auditing standards and the American Institute of Certified Public Accountants’ SSAE No. 16, Reporting 

on Controls at a Service Organization. The Department of the Treasury’s Office of Inspector General issued the 

SSAE No. 16 report on September 1, 2016, covering the period July 1, 2015, through June 30, 2016. SSAE No. 16 

was superseded by SSAE No.18, Attestation Standards: Clarification and Recodification, effective May 1, 2017.
Page 8 GAO-17-552R FHFA Fiscal Year 2016 Management Report

instance, during planning, FHFA and FHFA-OIG stated that they would rely on SSAE No. 16 

reports and other audit results for their evaluation of information systems control activities; 

however, they did not identify the specific information systems control activities key to financial 

reporting. After reviewing the SSAE No. 16 reports and other audit results, neither entity 

developed a complete list of the specific information systems control activities that were key to 

financial reporting. They also did not document whether the testing that other auditors

performed was sufficient to meet the objectives of internal control over financial reporting. 

Moreover, although FHFA-OIG considered compliance with laws and regulations as part of its 

evaluation of internal control over financial reporting, it did not clearly link the control activities 

being tested within a process area to the specific law or regulation being evaluated. For 

instance, for the payroll disbursements process area, FHFA-OIG indicated in its internal control 

assessment document that compliance with laws and regulations was applicable. However, 

FHFA-OIG did not specify in that document the applicable provision of law or regulation that 

was considered when testing the control activities implemented to reasonably assure

compliance. 

Criteria. HERA requires FHFA to provide an assertion on the effectiveness of internal control 

over financial reporting using Standards for Internal Control in the Federal Government.

Standards for Internal Control in the Federal Government states that management should 

establish and operate monitoring activities to monitor the internal control system and evaluate 

the results.16 Management can use separate evaluations to monitor the design and operating 

effectiveness of the internal control system, which includes control activities, at a specific time or 

of a specific function or process. This may include responsibility for monitoring the effectiveness 

of internal control over the assigned processes performed by service organizations to obtain 

reasonable assurance of the operating effectiveness of the service organization’s internal 

controls. It may also include responsibility for the entity’s information system as part of the 

internal control system. Furthermore, the standards state that external financial reporting 

objectives include objectives related to releasing the entity’s financial performance in 

accordance with applicable laws and regulations. The standards also require that management 

document the results of separate evaluations.

Cause. FHFA and FHFA-OIG did not adequately identify and document financial reporting 

control activities for several reasons. First, FHFA management stated that they consider the 

evaluation of internal control over financial reporting to be low risk given the ongoing monitoring 

performed by the agency. As a result, it allocates limited resources to identify and document 

control activities for key financial reporting processes and service providers. However, per 

Appendix A of OMB Circular A-123, management should ensure that adequate funding and 

resources are made available for the evaluation of internal control over financial reporting. 

FHFA-OIG stated that while it considered service provider controls as part of its internal control 

evaluation, it did not fully understand the extent to which it should have documented all control 

activities implemented by its service provider, including its evaluation of complementary user 

entity controls. 

In addition, FHFA and FHFA-OIG did not clearly define and document an approach that 

identified which information systems are key to financial reporting and which business 

processes these systems support which would enable them to identify specific control activities

and explain how these control activities are evaluated as part of the internal control over 

financial reporting assertion. 

 16GAO-14-704G.
Page 9 GAO-17-552R FHFA Fiscal Year 2016 Management Report

Lastly, FHFA-OIG has not developed a complete list of the specific provisions of laws and 

regulations that may have an effect on material amounts and disclosures in the financial 

statements to clearly link the key control activities tested to reasonably assure compliance.

Effect. Without adequate identifying and documenting of all relevant financial reporting control 

activities related to key process areas, service providers, and information systems, there is an 

increased risk that FHFA and FHFA-OIG will not have adequate support for their evaluations of 

internal control over financial reporting. Furthermore, by not adequately documenting its

evaluation of control activities over compliance with laws and regulations, FHFA-OIG is at 

increased risk of not having adequate support for its statement that transactions are executed in 

accordance with applicable laws and regulations, noncompliance with which could have a 

material effect on the financial statements.

Recommendations for Executive Action. We recommend that you take the following four 

actions: 

• Direct the Chief Financial Officer to enhance the evaluation of internal control over financial 

reporting by identifying and testing all key control activities, including those related to the 

preparation of the financial statements.

• Direct the Chief Financial Officer to (1) thoroughly document FHFA’s review of SSAE No. 16 

reports issued for the period under evaluation by reasonably assuring that all applicable 

control objectives and related control activities are clearly identified and described and the 

evaluation of user entity controls is adequately explained and (2) collaborate, as 

appropriate, with the Inspector General to implement corresponding actions at FHFA-OIG.

• Direct the Chief Financial Officer to (1) clearly define and document an approach that

identifies the information systems that are key to financial reporting, the process areas these 

information systems support, the key control activities for each information system, and how 

the key control activities are evaluated and (2) collaborate, as appropriate, with the 

Inspector General to implement corresponding actions at FHFA-OIG.

• Direct the Chief Financial Officer to collaborate, as appropriate, with the Inspector General 

to (1) develop a complete list of the specific provisions of laws and regulations that may 

have an effect on material amounts and related disclosures in the financial statements that 

are applicable to FHFA-OIG and (2) prepare documentation that clearly links each 

applicable provision of law or regulation to the key control activities tested. 

Independent Roles in the Implementation and Monitoring of Control Activities

FHFA’s Office of Budget and Financial Management (OBFM) contains a sub-division comprising

three employees who have primary responsibility for the preparation of FHFA’s financial 

statements. These individuals play a significant role in the implementation of control activities 

over financial reporting. Two employees within this sub-division also oversee the monitoring of 

internal control over financial reporting, which assesses the effective implementation of these 

control activities. Specifically, they develop an overall approach, conduct the testing of key 

internal control activities, report the evaluation results to senior management, and monitor the 

correction of identified deficiencies.

Condition. During our audit of FHFA, we found that FHFA’s structure for its evaluation of 

internal control over financial reporting did not reasonably assure that independent roles were 
Page 10 GAO-17-552R FHFA Fiscal Year 2016 Management Report

assigned for the implementation and monitoring of control activities. Specifically, we found 

instances in which the individual implementing the control activity was the same individual 

monitoring the control activity. For example, as mentioned above, FHFA contracts with Fiscal 

Service for accounting and reporting services. In the areas of accrued annual leave and imputed 

financing costs, the Fiscal Service supervisory accountant performs a review of these journal 

entries. However, FHFA OBFM’s review and approval is required for these journal entries to be 

recorded in the general ledger; thus, we considered this to be the key control activity. The FHFA 

OBFM staff member responsible for reviewing and approving these journal entries was the 

same staff member responsible for monitoring and assessing the effectiveness of this control. 

Therefore, FHFA OBFM’s role as monitor was not independent. 

Criteria. HERA requires FHFA to provide an assertion on the effectiveness of internal control 

over financial reporting using Standards for Internal Control in the Federal Government.

Standards for Internal Control in the Federal Government states that management should 

establish and operate monitoring activities to monitor the internal control system and evaluate 

the results.17 Management can monitor the internal control system through ongoing monitoring 

and separate evaluations. Separate evaluations may be used periodically and may provide 

feedback on the effectiveness of ongoing monitoring. In addition, separate evaluations provide 

greater objectivity when performed by reviewers who do not have responsibility for the activities 

being evaluated. 

Cause. FHFA management considers the separate evaluation performed for the monitoring 

component of internal control to be low risk for the agency primarily because FHFA conducts

ongoing monitoring. Therefore, FHFA did not allocate additional resources to perform the 

separate evaluation to monitor FHFA’s internal control over financial reporting. However, per 

Appendix A of OMB Circular A-123, management should ensure that adequate funding and 

resources are made available for the evaluation of internal control over financial reporting.

Effect. By not maintaining independent roles between the implementation and monitoring of 

control activities, FHFA cannot reasonably assure that it is receiving objective evaluations on

the effectiveness of its controls, which could lead to inaccurately concluding, or inadequately 

supporting its conclusions, on the effectiveness of internal control over financial reporting. 

Recommendation for Executive Action. We recommend that you direct the Chief Financial 

Officer to design an evaluation process that reasonably assures assignment of independent 

roles between the implementation and monitoring of control activities that are significant to the 

evaluation of internal control over financial reporting. 

Agency Comments and Our Evaluation

We provided a draft of this report to FHFA for comment. In its written comments, reprinted in 

enclosure I, FHFA stated that it agreed with the nine recommendations we made in the report 

and described actions it is taking or plans to take to address each recommendation. Such 

actions include enhancing the documentation of its internal control evaluation and hiring an 

independent contractor to aid in the evaluation process for fiscal year 2017. We will evaluate 

FHFA’s actions for addressing the deficiencies identified in this report as part of our audit of 

FHFA’s fiscal year 2017 financial statements. 

* * * * *

 17GAO-14-704G.
Page 11 GAO-17-552R FHFA Fiscal Year 2016 Management Report

This report contains recommendations to you. As you know, 31 U.S.C. § 720, as recently 

amended, requires the head of a federal agency to submit a written statement on actions taken 

or planned on these recommendations. You should submit your statement to the Senate 

Committee on Homeland Security and Governmental Affairs, the House Committee on 

Oversight and Government Reform, the congressional committees with jurisdiction over the 

programs and activities that are the subject of our recommendations, and GAO within 60 days 

of the date of this report. A written statement must also be sent to the House and Senate 

Committees on Appropriations with the agency’s first request for appropriations made more 

than 60 days after the date of this report. Please send your statement of actions to me at 

malenichj@gao.gov and Nina M. Rostro, Assistant Director, at rostron@gao.gov. 

We are sending copies of this report to the Secretary of the Treasury, the Secretary of Housing 

and Urban Development, the Chairperson of the Securities and Exchange Commission, the 

Director of the Office of Management and Budget, and other interested parties. In addition, the 

report is available at no charge on the GAO website at http://www.gao.gov. 

We acknowledge and appreciate the cooperation and assistance provided by FHFA officials and 

staff during our audit of FHFA’s fiscal years 2016 and 2015 financial statements. If you or your 

staff have any questions about this report, please contact me at (202) 512-3406 or 

malenichj@gao.gov. Contact points for our Offices of Congressional Relations and Public 

Affairs may be found on the last page of this report. GAO staff who made major contributions to 

this report are listed in enclosure II. 

Sincerely yours,

J. Lawrence Malenich

Director 

Financial Management and Assurance

Enclosures – 2
Page 12 GAO-17-552R FHFA Fiscal Year 2016 Management Report

Enclosure I: Comments from the Federal Housing Finance Agency
Page 13 GAO-17-552R FHFA Fiscal Year 2016 Management Report
Page 14 GAO-17-552R FHFA Fiscal Year 2016 Management Report
Page 15 GAO-17-552R FHFA Fiscal Year 2016 Management Report
Page 16 GAO-17-552R FHFA Fiscal Year 2016 Management Report
Page 17 GAO-17-552R FHFA Fiscal Year 2016 Management Report

Enclosure II: GAO Contact and Staff Acknowledgments

GAO Contact

J. Lawrence Malenich, (202) 512-3406 or malenichj@gao.gov

Staff Acknowledgments

In addition to the contact named above, Nina M. Rostro (Assistant Director), Megan McGehrin, 

and Daniel Flavin made key contributions to this report.

(101293)
This is a work of the U.S. government and is not subject to copyright protection in the United States.

The published product may be reproduced and distributed in its entirety without further permission

from GAO. However, because this work may contain copyrighted images or other material,

permission from the copyright holder may be necessary if you wish to reproduce this material

separately.
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.