For Release on Delivery

Expected at

10 a.m.

Tuesday,

June 6, 2000

GAO/T-AIMD-00-178

FINANCIAL

MANAGEMENT

Agencies Face Many

Challenges in Meeting the

Goals of the Federal

Financial Management

Improvement Act

Statement of Jeffrey C. Steinhoff

Assistant Comptroller General

Accounting and Information Management Division

Testimony

Before the Subcommittee on Government Management,

Information and Technology, Committee on Government

Reform, House of Representatives

United States General Accounting Office

GAO
Page 1 GAO/T-AIMD-00-178

Mr. Chairman and Members of the Subcommittee:

I am pleased to be here today to discuss the challenges most of the major

federal departments and agencies face in meeting the basic expectations

laid out in the Federal Financial Management Improvement Act of 1996

(FFMIA). That act, and several before it dating back to 1982, most notably

the Chief Financial Officers (CFO) Act of 1990, have underscored the

importance of improving financial management across the federal

government. As such, FFMIA and predecessor legislation, as well as many

audit reports by our office and the Inspector General (IG) community have

continually pointed out that reliable, useful, and timely information has

not been available across government to ensure financial accountability

and to help improve economy, efficiency, and effectiveness. The central

challenge in generating reliable and timely data throughout the year is

overhauling financial and related management information systems. To

help focus attention on this challenge, 4 years ago the Congress passed

FFMIA, which requires the 24 major departments and agencies1 to

implement and maintain financial management systems that comply

substantially with (1) federal financial systems requirements,

(2) applicable federal accounting standards, and (3) the U.S. Government

Standard General Ledger (SGL) at the transaction level.

Today I will discuss (1) problems with agencies’ systems that prevent

them from meeting the expectations of FFMIA, (2) how agencies are able

to receive a “clean” (unqualified) audit opinion on their financial

statements even though their financial systems do not comply with

FFMIA’s requirements, and (3) key elements in addressing these systems

problems, including the importance of sound information technology

investment and control processes. As required by the act, we plan to issue

our fourth annual report on agency compliance with FFMIA by October 1

of this year.

Mr. Chairman, from the outset today, I want to dispel the notion that this is

merely a compliance issue. The expectations in the CFO Act and FFMIA

are integral to producing the data needed to efficiently and effectively

manage the day-to-day operations of the federal government and provide

accountability to the taxpayers. When federal agencies can meet these

expectations, they will have achieved what the Comptroller General has

referred to as the “end game”—systems and processes that routinely

generate reliable, useful, and timely information the government needs to

1The 24 Chief Financial Officers (CFO) Act agencies are listed in table 1.
Page 2 GAO/T-AIMD-00-178

assure accountability to taxpayers, manage for results, and help

decisionmakers make timely, well-informed judgments.

Aside from poor data and weak assurances regarding accountability, the

issues I will discuss today can result in excessive time spent by staff in

trying to correct data problems and compensate for systems shortcomings.

We recently issued an Executive Guide: Creating Value Through Worldclass Financial Management,

2 which describes some of the best practices

used by effective finance operations to support the mission objectives of

their organizations. They devote an increasingly smaller portion of their

staff resources to routine accounting activities, such as external reporting

and, instead, are able to use reliable and timely financial and other data to

provide products and services that directly support strategic decisionmaking and ultimately improve overall business performance.

FFMIA is part of a series of management reform legislation passed by the

Congress over the past 2 decades. This series of legislation started with

the Federal Managers’ Financial Integrity Act of 1982, which the Congress

passed to strengthen internal control and accounting systems throughout

the federal government, among other purposes. However, as we reported

in 1989,3 7 years after the Financial Integrity Act was passed, agencies had

achieved some success in identifying and correcting material internal

control and accounting system weaknesses, but their efforts to implement

the Financial Integrity Act had not produced the results intended by the

Congress. At that time, we also reported that the government did not have

the internal control systems necessary to effectively operate its programs

and safeguard its assets and that its accounting systems were antiquated

and second-rate.

So, in the 1990s, the Congress passed additional management reform

legislation to improve the general and financial management of the federal

government. The combination of reforms ushered in by (1) the Chief

Financial Officers Act of 1990, (2) the Government Management and

Reform Act of 1994, (3) FFMIA, (4) the Government Performance and

Results Act of 1993, and (5) the Clinger-Cohen Act of 1996, if successfully

implemented, provides a basis for improving accountability over

government operations and routinely producing sound cost and operating

2Executive Guide: Creating Value Through World-class Financial Management (GAO/AIMD-00-134,

April 2000).

3Financial Integrity Act: Inadequate Controls Result in Ineffective Federal Programs and Billions in

Losses (GAO/AFMD-90-10, November 28, 1989).

FFMIA Is a Key

Component of the

Management Reform

Framework
Page 3 GAO/T-AIMD-00-178

performance information, thereby making it possible to better assess and

improve the government’s financial condition and operating performance.

In addition, we recently updated our Standards for Internal Control in the

Federal Government,

4 which is issued pursuant to the Financial Integrity

Act to help agency managers implement effective internal control, an

integral part of improving financial management systems.

FFMIA requires auditors performing annual financial statement audits of

the CFO Act agencies to report whether agencies’ financial management

systems comply with the act’s requirements. The act defines financial

management systems as the financial systems and financial portions of

mixed systems5 necessary to support financial management, including

automated and manual processes, procedures, controls, data, hardware,

software, and support personnel dedicated to the operation and

maintenance of system functions. FFMIA also requires agency heads to

determine annually, based on the audit report on the entity’s financial

statements and any other relevant information, whether their agency

financial management systems satisfy the act’s requirements. If the agency

head determines that the systems do not comply, FFMIA requires the

agency head, in consultation with the Director of the Office of

Management and Budget (OMB), to establish a remediation plan to bring

the systems into substantial compliance. FFMIA also contains a

requirement that IGs are to report instances and reasons when an agency

has not met the intermediate target dates established in their remediation

plans.

To develop this testimony, we reviewed fiscal year 1999 audit results for

the 23 CFO Act agencies that had issued audited financial statements as of

June 1, 2000.6 We also relied on our ongoing work on FFMIA, including

reviews of agency remediation plans, federal accounting standards, and

federal financial systems requirements. We did our work from February

through May 2000, in accordance with generally accepted government

auditing standards.

4Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999).

5FFMIA defines mixed systems as information systems that support both financial and nonfinancial

functions of the federal government or components thereof.

6The statutory reporting deadline for audit reports discussing the results of the fiscal year 1999

financial statement audits for the CFO agencies was March 1, 2000. As of June 1, 2000, the Department

of State had not yet issued its fiscal year 1999 audited financial statements.
Page 4 GAO/T-AIMD-00-178

Auditors for 20 of the 23 CFO Act agencies, whose audit reports have been

issued, reported that for fiscal year 1999, the agencies’ systems did not

comply substantially with federal financial systems requirements, federal

accounting standards, and/or the SGL.7 Auditors for three agencies—the

Department of Energy, the National Aeronautics and Space

Administration, and the National Science Foundation—reported the

agencies’ systems to be in substantial compliance. These results were

similar to those for fiscal years 1997 and 1998. Reasons for noncompliance

range from nonintegrated financial management systems to information

security weaknesses. This continuing widespread noncompliance with

FFMIA is indicative of the overall long-standing poor condition of agency

financial systems. Correcting the systems problems that cause

noncompliance with FFMIA is a challenge for many agencies because of

the age and poor condition of their critical financial systems. Some of the

federal government’s computer systems were originally designed and

developed years ago and do not meet current systems requirements and

cannot provide reliable financial information for managing day-to-day

government operations and holding managers accountable. Further, the

inadequacy of federal financial management systems prevents a host of

financial reporting and financial analysis needs from being met.

Based on our review of fiscal year 1999 audit reports for the 20 agencies

reported to be noncompliant, we identified five primary reasons:

• nonintegrated financial management systems,

• inadequate reconciliation procedures,

• noncompliance with the SGL,

• lack of adherence to federal accounting standards, and

• weak security over information systems.

Table 1 shows the 20 noncompliant agencies and problems reported by

their auditors.

7Management of 3 of the 20 agencies—the Federal Emergency Management Agency, the Social

Security Administration, and the Office of Personnel Management (OPM)—determined that their

agencies’ systems did comply substantially with FFMIA’s requirements. Management of these three

agencies acknowledged that the weaknesses identified by the auditors exist, but did not agree that the

weaknesses caused “substantial noncompliance.” (In the case of OPM, management determined that

the systems for the Retirement, Health Benefits Insurance, and Life Insurance programs did comply

substantially with FFMIA. For the Revolving Fund and Salaries and Expenses, OPM management

agreed with its auditors that the systems did not comply substantially with FFMIA.)

Widespread

Noncompliance

Indicates Serious

Systems Problems
Page 5 GAO/T-AIMD-00-178

Table 1: Problems Reported by Auditors in Fiscal Year 1999

Agency Nonintegrated

financial

management

systems

Inadequate

reconciliation

procedures

Noncompliance

with the

SGL

Lack of

adherence

to federal

accounting

standards

Weak

security

over

information

systems

Department of

Agriculture

√ √ √√√

Department of

Commerce

√ √√ √

Department of

Defense

√ √ √√√

Department of

Education

√ √ √√

Department of

Health and Human

Services

√√ √

Department of

Housing and

Urban

Development

√ √ √√√

Department of the

Interior

√ √

Department of

Justice

√ √ √√

Department of

Labor

√ √ √√√

Department of

Transportation

√ √√√

Department of the

Treasury

√ √ √√√

Department of

Veterans Affairs

√ √ √√√

Agency for

International

Development

√ √ √√√

Environmental

Protection Agency

√ √√

Federal

Emergency

Management

Agency

√√ √

General Services

Administration

√

Nuclear

Regulatory

Commission

√

Office of

Personnel

Management

√ √√√

Small Business √ √√√
Page 6 GAO/T-AIMD-00-178

Agency Nonintegrated

financial

management

systems

Inadequate

reconciliation

procedures

Noncompliance

with the

SGL

Lack of

adherence

to federal

accounting

standards

Weak

security

over

information

systems

Administration

Social Security

Administration

√

Totals 14 14 11 15 19

Source: GAO analysis of agency audit reports for fiscal year 1999.

To understand how these weaknesses affect agencies’ financial

management efforts and to bring about any lasting improvements, it is

important to understand what these weaknesses mean and their impact on

the government’s operations. The following sections describe the five

types of weaknesses and provide examples identified by the agencies’

auditors.

One of the federal financial systems requirements is that agencies’

financial management systems must be integrated.8 According to the CFO

Act, agencies are to develop and maintain an integrated accounting and

financial management system that complies with federal systems

requirements and provides for (1) complete, reliable, consistent, and

timely information that is responsive to the financial information needs of

the agency and facilitates the systematic measurement of performance,

(2) the development and reporting of cost information, and (3) the

integration of accounting, budgeting, and program information. In this

regard, OMB Circular A-127, Financial Management Systems, requires

agencies to establish and maintain an integrated financial management

system that conforms with the Joint Financial Management Improvement

Program’s (JFMIP)9 functional requirements.

8Federal financial system requirements define an integrated financial system as one that coordinates a

number of previously unconnected functions to improve overall efficiency and control. Characteristics

of such a system include (1) standard data classifications for recording financial events, (2) common

processes for processing similar transactions, (3) consistent internal controls over data entry,

transaction processing, and reporting, and (4) a system design that eliminates unnecessary duplication

of transaction entry.

9JFMIP is a cooperative undertaking of OMB, the Department of the Treasury, the Office of Personnel

Management (OPM), and GAO working with operating agencies to improve financial management

practices throughout the government. The program was initiated in 1948 by the Secretary of the

Treasury, the Director of the Bureau of the Budget (now OMB), and the Comptroller General and was

given statutory authorization in the Budget and Accounting Procedures Act of 1950. The Civil Service

Commission, now OPM, joined JFMIP in 1966.

Nonintegrated Financial

Management Systems
Page 7 GAO/T-AIMD-00-178

When agencies do not have an integrated financial management system—

which includes a budget system and program systems that maintain

financial information, such as logistics, personnel, and acquisition

systems—they are often forced to rely on ad hoc programming or analysis

or actions, such as taking physical inventories to determine what assets

they have on hand, in order to satisfy financial reporting and analysis

responsibilities. In these situations, agencies must expend major effort and

resources, and some agencies rely heavily on external consultants to

develop information that their systems should be able to provide on a daily

or recurring basis. In addition, opportunities for errors are significantly

increased when agencies’ systems are not integrated.

Modern, integrated financial systems rely on transaction-based entries to

update all relevant accounts, be they for budgetary control, proprietary

accounting objectives, or program management. In these modern,

integrated systems, financial data is carried in a common format, and the

effects of financial transactions in one application are accurately

transmitted to other affected applications. Accordingly, aside from the

timeliness in recording transactions, the use of integrated systems largely

negates the risk of out-of-balance situations and data entry errors. Thus,

agencies can have at their disposal information that can quickly provide

year-to-date balances, but more importantly, can be used for analysis

throughout the year.

A continuing, serious problem is that agencies lack modern, integrated

financial management systems. As shown in table 1, auditors for 14 of the

20 noncompliant agencies reported this as a problem. For example, as we

testified before this Subcommittee this February,10 the Internal Revenue

Service (IRS) had to focus substantial efforts on developing compensating

processes to work around its serious systems and internal control

weaknesses to derive year-end balances for its financial statements.11

Because IRS’ aging financial management systems have not been

redesigned to meet current systems requirements and financial reporting

standards, IRS’ approach to preparing financial statements relied heavily

on costly, time-consuming processes, statistical projections, and external

consultants to derive year-end balances. For instance, IRS has pervasive

10Internal Revenue Service: Results of Fiscal Year 1999 Financial Statement Audit (GAO/

T-AIMD-00-104, February 29, 2000).

11The Department of the Treasury is one of the 20 noncompliant agencies. IRS’ systems problems were

one of the main reasons for Treasury’s noncompliance with FFMIA.
Page 8 GAO/T-AIMD-00-178

problems in managing and reporting unpaid assessments.12 IRS does not

have a subsidiary ledger that tracks and accumulates unpaid assessments

and their status on an ongoing basis. The absence of the subsidiary ledger

adversely affects IRS’ ability to effectively manage and accurately report

these assessments. Typically, an entity’s accounts receivable balances

would be supported by detailed records, listings, or a subsidiary ledger of

individual amounts, which are all part of an integrated financial

management system. To compensate for the lack of an unpaid assessment

subsidiary ledger, IRS uses ad hoc programs that extract data from the tax

master files—its database of taxpayer information. However, as in past

years, the results still required significant adjustments totaling tens of

billions of dollars before taxes receivable can be reliably reported on the

balance sheet. IRS top management recognizes this and has demonstrated

a strong commitment to developing an integrated system as part of tax

systems modernization.

As we testified before this Subcommittee last month,13 the Department of

Defense (DOD) lacks integrated accounting systems. DOD relies on an

inventory of 168 systems—consisting of 98 finance and accounting

systems and 70 critical feeder systems—to carry out its financial

management responsibilities. These critical feeder systems provide about

80 percent of the data needed for sound financial management. Because

DOD lacks the integrated systems needed to properly control assets and

accumulate costs, millions of transactions are keyed and then re-keyed

into a vast number of systems. To illustrate the degree of difficulty faced

by DOD, figure 1, which we included in our earlier testimony, shows for

one business area—contract and vendor payments—the number of

systems involved and their relationships to one another.

12Unpaid assessments consist of amounts for which (1) IRS can support the existence of a receivable

through taxpayer agreement or a favorable court ruling (federal taxes receivable), (2) neither the

taxpayer nor the court has affirmed that the amounts are owed (compliance assessments), and (3) IRS

does not expect further collections due to factors such as the taxpayer’s death, bankruptcy, or

insolvency (write-offs).

13Department of Defense: Progress in Financial Management Reform (GAO/T-AIMD/NSIAD-00-163,

May 9, 2000).
Page 9 GAO/T-AIMD-00-178

Figure 1: DOD’s Current Systems Environment for the Contract and Vendor

Payment Process

Source: Department of Defense.

In addition to the 22 financial systems involved in the contract payment

process that are shown in figure 1, DOD has identified many other critical

acquisition systems used in the contract payment process that are not

shown on this diagram. To further complicate the processing of these

transactions, each transaction must be recorded using a nonstandard,

complex line of accounting that accumulates appropriation, budget, and

management information for contract payments. For example, the

following line of accounting is used for the Army’s Operations and

Maintenance appropriation.

2162020573106325796.BD26FBQSUPCA200GRE12340109003AB22WORNAAS34030

As we previously testified, because DOD’s financial management systems

are not integrated and payment and accounting processes are complex

and generally involve separate functions carried out by separate offices

using different systems, each line of accounting must be manually entered

multiple times, compounding the likelihood of data entry errors. Billions

of dollars of adjustments are made to correct transactions processed for

SRD1

ADS

IPC

IAPS

CAPS

DJAS

1 Bill

Pay

MOCAS

DPPS

DSDS

SABRS

GAFS

STARS

STANFINS

BCAS

APADE

ITIMP

SAACONS

SPS

CEFT Debt

Mgt

Prevalidation
Page 10 GAO/T-AIMD-00-178

functions such as inventory and contract payments. During fiscal year

1999, almost one of every three dollars in contract payment transactions

was made to adjust a previously recorded transaction. In addition, DOD’s

IG found that $7.6 trillion of adjustments to DOD’s accounting transactions

were required last year to prepare DOD’s financial statements. As with

IRS, DOD’s top management recognizes the severity of the problems and

has several actions planned and underway to address these problems.

A reconciliation process, even if performed manually, is a valuable part of

a sound financial management system. In fact, the less integrated financial

management systems are, the greater the need for adequate reconciliations

because data for the same transaction may be separately entered in

multiple systems. Reconciliation of records from the multiple systems

would ensure that transaction data was entered correctly in each one.

Reconciliation is also an important control for establishing agreement

between two sets of independently maintained but related records

because it helps to ensure the integrity of the underlying accounting data

supporting the financial statements. For example, in a private company,

the ledger account for Cash in Bank is reconciled with the bank statement

received from the bank, and the home office record of shipments to a

branch office is reconciled with the record of receipts maintained by the

branch. Our recently updated Standards for Internal Control in the Federal

Government highlight reconciliation as a key control activity.

As shown in table 1, auditors for 14 of the 20 noncompliant agencies

reported that the agencies had reconciliation problems, including difficulty

reconciling their Fund Balance with Treasury accounts (that is, their cash

accounts) with the Department of the Treasury’s records. Treasury policy

requires agencies to reconcile their accounting records with Treasury

records monthly, which is comparable to individuals reconciling their

checkbooks to their monthly bank statements.

For example, the Department of Education’s auditors reported14 that

Education did not perform proper or timely reconciliations of its financial

accounting records throughout fiscal year 1999. And, at fiscal year-end, the

balance in Education’s Fund Balance with Treasury account varied

14The U.S. Department of Education, Audited Financial Statements, Year Ended September 30, 1999,

Report of Independent Auditors, Ernst & Young LLP, February 2, 2000. Also see Financial

Management: Financial Management Weaknesses at the Department of Education (GAO/T-AIMD-00-50,

December 6, 1999), Financial Management: Education Faces Challenges in Achieving Financial

Management Reform (GAO/T-AIMD-00-106, March 1, 2000), and Financial Management: Education’s

Financial Management Problems Persist (GAO/T-AIMD-00-180, May 24, 2000).

Inadequate Reconciliation

Procedures
Page 11 GAO/T-AIMD-00-178

considerably from the related balance reported by Treasury. In order to

make the account balances agree, Education made an unsupported

adjustment of a net amount of about $244 million to its Fund Balance with

Treasury account. This means that Education simply changed its records

to agree with Treasury balances without determining the causes of the

differences and without modifying the underlying transactions or accounts

giving rise to the discrepancies. Because Education had not been

performing periodic reconciliations and discerning reasons for differences

on an ongoing basis, it could not determine which records, if any, were

correct and accordingly, relied on Treasury’s records, not its own.

In another example, the Department of Housing and Urban Development’s

(HUD) IG reported15 that HUD fell behind schedule in its reconciliation

processes to identify discrepancies with Treasury because of the

implementation of a new core accounting system. As a result, HUD made

many adjustments to make its Fund Balance with Treasury accounts agree

with Treasury records. HUD made 42 adjustments totaling about

$17.6 billion to adjust fiscal year 1998 ending balances and 242

adjustments totaling about $59.6 billion to adjust fiscal year 1999 activity.

Therefore, on a day-to-day basis, HUD’s decisionmakers cannot be assured

that the information in its financial systems is reliable. In addition, the

reconciliation problems delayed closing of the general ledger and

preparation of the financial statements which in turn contributed to the

IG’s disclaimer of opinion16 on HUD’s fiscal year 1999 financial statements.

Implementation of the SGL at the transaction level is one of the major

requirements of FFMIA. However, as shown in table 1, auditors for 11 of

the 20 noncompliant agencies reported that the agencies’ systems did not

comply with SGL requirements. The SGL was established by an

interagency task force through the direction of OMB and mandated for use

by OMB and Treasury regulations in 1986. The SGL promotes consistency

in financial transaction processing and reporting by providing a uniform

chart of accounts and pro forma transactions that are to be used to

standardize federal agencies’ financial information accumulation and

processing, enhance financial control, and support budget and external

15Report on Efforts to Audit the U.S. Department of Housing and Urban Development’s Fiscal Year

1999 Financial Statements (00-FO-177-0003, March 1, 2000).

16A disclaimer of opinion means the auditors are unable to determine the overall fairness of the

financial statements. This type of result might occur if the audit revealed the system of internal control

to be grossly inadequate or if the auditors for any reason did not or could not perform sufficient work

to have a basis for an opinion.

Noncompliance With the

SGL
Page 12 GAO/T-AIMD-00-178

reporting, including financial statement preparation. The SGL is intended

to improve data stewardship throughout the government, enabling

consistent reporting at all levels within the agencies, and providing

comparable data and enabling financial analysis at the governmentwide

level. By not implementing the SGL, agencies are challenged to provide

consistent financial information across their component entities and

functions. The effect of such differences is further compounded at the

governmentwide level and contributed to our disclaimer of opinion on the

U.S. government’s consolidated financial report for fiscal years 1997, 1998,

and 1999 because the government could not ensure that that the

information in its financial statements was properly and consistently

compiled.17

A Treasury official stated in testimony before this Subcommittee on

March 31,18 that the federal government needs to increase the use of the

SGL in agency accounting systems to improve the reliability and accuracy

of financial information. The official continued by stating

Our ability to prepare the consolidated financial report using SGL

data so that it is consistent with data in agency statements is

hampered by the fact that a large number of agencies do not

properly use the SGL. In many instances, agencies cannot

adequately produce and send the SGL data to Treasury because

their systems do not record accounting events using the SGL at

the transaction level as mandated by the FFMIA. This results in

additional workload and processes to ensure that amounts are

recorded in the proper accounts. Additionally, this frustrates

attempts to maximize efficiency through the creation of

automated analytical tools.

For example, the Agency for International Development’s (AID) IG

reported19 that AID did not record accounts receivable in accordance with

17Financial Audit: 1997 Consolidated Financial Statements of the United States Government

(GAO/AIMD-98-127, March 31, 1998), Financial Audit: 1998 Financial Report of the United States

Government (GAO/AIMD-99-130), and Financial Audit: 1999 Financial Report of the United States

Government (GAO/AIMD-00-131, March 31, 2000).

18Are the Financial Records of the Federal Government Reliable?, Testimony of Donald V. Hammond,

Fiscal Assistant Secretary, Department of the Treasury, March 31, 2000.

19Reports on USAID’s Consolidated Financial Statements, Internal Controls, and Compliance For

Fiscal Year 1999 (Report No. 0-000-00-006-F, February 18, 2000).
Page 13 GAO/T-AIMD-00-178

the SGL at the transaction level. AID relied on data calls20 to obtain the

total amount of outstanding accounts receivable because it did not have

integrated financial management systems. These data calls were posted to

the general ledger at the summary level as opposed to the transaction level

as required. According to the IG, by using data calls to determine

outstanding accounts receivable, AID is at risk that the information

obtained is not accurate or complete.

One of FFMIA’s requirements is that agencies’ financial management

systems comply with applicable federal accounting standards, which are

developed by the Federal Accounting Standards Advisory Board

(FASAB).21 Currently, there are 17 statements of federal financial

accounting standards (SFFAS) and 3 statements of federal financial

accounting concepts.22 FASAB continues to deliberate on new and

emerging accounting issues that could result in the issuance of additional

standards; therefore, agencies’ systems must be able to accommodate any

new standards that may be issued in the future.

As shown in table 1, auditors for 15 of the 20 noncompliant agencies

reported that the agencies had problems complying with one or more

federal accounting standards. Some agencies have experienced difficulty

implementing these standards because their financial management

systems are not capable of producing the financial data needed.

For example, the processes and procedures used by the Department of

Agriculture’s (USDA) lending agencies to estimate and reestimate loan

subsidy costs do not comply with SFFAS No. 2, Accounting for Direct

Loans and Loan Guarantees. SFFAS No. 2, which generally mirrors the

requirements of the Federal Credit Reform Act of 1990, contains guidance

20“Data calls” is a term used to describe the process of requesting various offices to provide

outstanding balances as of year-end. The resulting reports are prepared from data contained outside

the formal accounting system.

21In October 1990, the Secretary of the Treasury, the Director of OMB, and the Comptroller General

established FASAB to recommend a set of generally accepted accounting standards for the federal

government. FASAB develops accounting standards after considering the financial and budgetary

information needs of the Congress, executive agencies, other users of federal financial information,

and comments from the public. FASAB forwards the standards to the three principals—the

Comptroller General, the Secretary of the Treasury, and the Director of OMB—for a 90-day review. If

there are no objections during the review period, the standards are considered final and FASAB

publishes them on its website and in print.

22Accounting standards are authoritative statements of how particular types of transactions and other

events should be reflected in financial statements. Statements of Federal Financial Accounting

Concepts explain the objectives and ideas upon which FASAB develops the standards.

Lack of Adherence to

Federal Accounting

Standards
Page 14 GAO/T-AIMD-00-178

for agencies to estimate the cost of direct and guaranteed loan programs

when preparing their annual budgets. The data used for these budgetary

estimates are generally reestimated after the fiscal year-end to reflect any

changes in actual loan performance since the budget was prepared. SFFAS

No. 2 also contains guidance for recording the reestimated cost of direct

loans and the reestimated liability for loan guarantees in the agency’s

financial statements. Further, SFFAS No. 2 states that agencies should use

historical experience as a primary factor upon which estimates of future

loan performance should be developed.

We testified before this Subcommittee in March23 that USDA was unable to

develop reasonable estimates of the costs of its loan programs because its

financial systems were not able to capture the data needed to make these

estimates. Also, USDA lacked historical information on borrower

behavior, such as how many borrowers will pay early, pay late, or default

on their loans and at what point in time. As a result, Congress and other

decisionmakers do not know whether they can rely on the agencyreported costs of USDA’s loan programs included in the agency’s budget

request and in its annual financial statements—estimated to be in excess

of $27.3 billion as of September 30, 1999—for programmatic and budgetary

decision-making. Cost estimates based on unreliable data can affect the

availability of credit programs to potential borrowers because changes in

these estimates can affect the number and amount of loans and guarantees

that can be made.

The Department of Transportation (DOT) also has had difficulty

implementing federal accounting standards. DOT’s IG reported24 that DOT

did not comply with SFFAS No. 4, Managerial Cost Accounting Concepts

and Standards for the Federal Government, because its accounting system

cannot capture costs by major program. According to SFFAS No. 4, federal

agencies must provide reliable and timely information on the full costs of

their programs, activities, and outputs. The CFO Act also calls for the

development of cost information and the systematic measurement of

performance. Agencies need this cost information to successfully

23Financial Management: USDA Faces Major Financial Management Challenges (GAO/T-AIMD-00-115,

March 21, 2000).

24Office of Inspector General Audit Report, Fiscal Year 1999 Consolidated Financial Statements,

Department of Transportation, Report No. FE-2000-062, March 8, 2000.
Page 15 GAO/T-AIMD-00-178

implement the Government Performance and Results Act (GPRA),25 which

seeks to shift the focus of federal management and decision-making from

a preoccupation with the number of tasks completed or services provided

to a more direct consideration of the results of programs—that is, the real

differences the tasks or services make to the nation or individual taxpayer.

The lack of cost accounting information limits an agency’s ability to

meaningfully evaluate performance in terms of efficiency and costeffectiveness. Agency cost accounting information can be used by the

Congress and federal managers to make decisions about allocating federal

resources, authorizing and modifying programs, and evaluating program

performance, as called for in GPRA. However, without relevant and

reliable cost accounting information, which is a governmentwide problem,

federal managers cannot be sure that resources are spent to achieve

expected results and outputs and that waste and inefficiency are

minimized.

Information security weaknesses are one of the primary causes of

noncompliance with FFMIA and a huge concern for federal agencies and

the general public. As we recently testified,26 hacker attacks have shown

just how quickly computer viruses—such as Melissa and ILOVEYOU—can

spread and just how vulnerable federal information systems are to such

computer attacks. These viruses have clearly highlighted the urgent and

serious need for stronger agency and governmentwide protection over

agency data.

As shown in table 1, auditors for 19 of the 20 noncompliant agencies

reported information security weaknesses as a problem in fiscal year 1999.

Further, our analyses as well as those of agency inspectors general show

that virtually all of the largest federal agencies have significant computer

security weaknesses.27 These weaknesses, which we designated as a

25GPRA requires agencies to set multiyear strategic goals in their strategic plans and corresponding

annual goals in their performance reports, measure performance toward the achievement of those

goals, and report on their progress in their annual performance reports. These reports are intended to

provide important information to agency managers, policymakers, and the public on what each agency

accomplished with the resources it was given.

26Information Security: The Melissa Computer Virus Demonstrates Urgent Need for Stronger

Protection Over Systems and Sensitive Data (GAO/T-AIMD-99-146, April 15, 1999) and Information

Security: “ILOVEYOU” Computer Virus Emphasizes Critical Need for Agency and Governmentwide

Improvements (GAO/T-AIMD-00-171, May 10, 2000).

27Critical Infrastructure Protection: Comments on the National Plan for Information Systems

Protection (GAO/T-AIMD-00-72, February 1, 2000) and Federal Information Security: Actions Needed

to Address Widespread Weaknesses (GAO/T-AIMD-00-135, March 29, 2000).

Weak Security Over

Information Systems
Page 16 GAO/T-AIMD-00-178

governmentwide high-risk area in 1997 and 1999,28 are placing enormous

amounts of federal assets at risk of inadvertent or deliberate misuse,

financial information at risk of unauthorized modification or destruction,

sensitive information at risk of inappropriate disclosure, and critical

operations at risk of disruption. Our recent update to the federal

government’s internal control standards highlights the need for adequate

control over automated information systems to ensure protection from

inappropriate access and unauthorized use by hackers and other

trespassers or inappropriate use by agency personnel.

The most serious reported information security problem is inadequately

restricted access to agency data, including sensitive data such as taxpayer

records, personal medical information, and law enforcement data. Other

types of information security weaknesses include inadequacies in

segregating duties to help ensure that people do not conduct unauthorized

actions without detection, in preventing unauthorized software from being

implemented, and in mitigating and recovering from unplanned

interruptions in computer service. Unresolved information security

weaknesses could adversely affect the ability of agencies to produce

accurate data for decision-making and financial reporting because such

weaknesses could compromise the reliability and availability of data that

are recorded in or transmitted by an agency’s financial management

systems.

For example, we testified in May that the Department of Education was

plagued by serious internal control and system deficiencies, including

computer security vulnerabilities.29 Education places significant reliance

on its financial management systems to perform basic functions, such as

making payments to grantees and maintaining budget controls.

Consequently, weaknesses in Education’s information systems, such as

lack of an effective process to monitor security violations, increase the

risk of unauthorized access or disruption in services and make

Education’s sensitive grant and loan data vulnerable to inadvertent or

deliberate misuse, fraudulent use, improper disclosure, or destruction, all

of which could occur without being detected in a timely manner. Given the

high volume of transactions that flow through Education’s Grant

Administration and Payment System alone—over $30 billion a year—it is

28High-Risk Series: An Overview (GAO/HR-97-1, February 1997) and High-Risk Series: An Update

(GAO/HR-99-1, January 1999).

29Financial Management: Education’s Financial Management Problems Persist (GAO/T-AIMD-00-180,

May 24, 2000).
Page 17 GAO/T-AIMD-00-178

imperative that Education focus on addressing its computer security

vulnerabilities.

The Department of Health and Human Services (HHS) is another agency

with weak security over its information systems. HHS’ IG cited30

weaknesses in the entitywide security structure at the Health Care

Financing Administration (HCFA), which administers the Medicare

program. HCFA relies on extensive computer operations at both its central

office and the Medicare contractors to administer the Medicare program

and to process and account for Medicare expenditures, which totaled

more than $200 billion in fiscal year 1999. Controls over these operations

are essential to ensure the integrity, confidentiality, and reliability of

critical data while reducing the risk of errors, fraud, and other illegal acts.

These control weaknesses do not effectively prevent unauthorized access

to and disclosure of sensitive Medicare information.

One more example of an agency with serious information security

weaknesses is the Environmental Protection Agency (EPA). In February,31

we reported that EPA’s agencywide security program was ineffective

because of pervasive problems, the most serious of which were related to

inadequate protection from intrusions through the Internet and poor

security planning. We identified weaknesses that made it possible for

intruders, as well as EPA employees or contractors, to bypass or disable

computer access controls and undertake any of a wide variety of

inappropriate or malicious acts, including tampering with data, browsing

sensitive information, and seriously disrupting or disabling computersupported operations. Weaknesses we identified were associated with the

operating systems of EPA’s main computers and agencywide network and

therefore affect the security of all of the EPA operations that rely on them.

These operations include computer applications that EPA relies on to

carry out their day-to-day operations, including financial management.

EPA officials recognize the seriousness of the issues and have informed us

of some corrective actions and announced other plans which, if properly

implemented, can begin to address several of these serious problems.

30Report on the Financial Statement Audit of the Department of Health and Human Services for Fiscal

Year 1999, Report No. A-17-99-00002, February 2000.

31Information Security: Fundamental Weaknesses Place EPA Data and Operations at Risk (GAO/

T-AIMD-00-97, February 17, 2000).
Page 18 GAO/T-AIMD-00-178

Although the number of agencies receiving “clean” or unqualified audit

opinions32 is increasing, the financial management systems of most

agencies continue to be noncompliant with FFMIA’s requirements and,

therefore, fall short of the CFO Act’s and FFMIA’s goal to provide reliable,

useful, and timely information to assist in day-to-day management.

Fourteen of the 23 CFO Act agencies whose audit reports were issued as

of June 1, 2000, received unqualified audit opinions on their financial

statements for fiscal year 1999, up from 12 in fiscal year 1998 and 11 in

fiscal year 1997. Yet FFMIA noncompliance has been fairly consistent

since fiscal year 1997 when the systems of 20 of the 24 CFO Act agencies

were reported to be noncompliant. In fiscal year 1998, the systems of 21 of

the 24 agencies were reported to be noncompliant, and in fiscal year 1999,

the systems of 20 of the 23 agencies whose audit reports had been issued

were reported to be noncompliant. The Department of State, which had

not issued its audit report as of June 1, 2000, was found to be

noncompliant with FFMIA in fiscal years 1997 and 1998.

Auditors of 11 of the 14 agencies that received unqualified audit opinions

reported that the agencies’ financial systems did not comply substantially

with FFMIA’s requirements in fiscal year 1999. In many cases, these

agencies spent considerable resources to obtain a clean opinion because

their financial statements could not be produced from their financial

systems. Table 2 summarizes the auditors’ FFMIA determinations and

financial statement opinions for fiscal year 1999 and highlights the 11

agencies that received clean audit opinions in spite of their systems

problems.

32In an unqualified opinion, the auditor concludes that the principal statements and accompanying

notes present fairly, in all material respects, the assets, liabilities, and net position of the entity at the

end of the period, and the net costs, changes in net position, budgetary resources, and reconciliation of

net costs with budgetary obligations for the period then ended.

Increasing Number of

Agencies Receive

Unqualified Audit

Opinion, but Systems

Weaknesses Remain
Page 19 GAO/T-AIMD-00-178

Table 2: Auditors’ FFMIA Determinations and Financial Statement Opinions

for Fiscal Year 1999

Agency Auditor’s determination

of substantial compliance

Audit opinion

Yes No Unqualified Qualified Disclaimer

Department of

Agriculture

√ √

Department of

Commerce

√ √

Department of Defense √ √

Department of

Education

√ a

Department of Energy b

√ √

Department of Health

and Human Services

√ √

Department of Housing

and Urban Development

√ √

Department of the

Interior

√ √

Department of Justice √ √

Department of Labor √ √

Department of State c

Department of

Transportation

√ √

Department of the

Treasury

√ √

Department of Veterans

Affairs

√ √

Agency for International

Development

√ √

Environmental

Protection Agency

√ √

Federal Emergency

Management Agency

√ √

General Services

Administration

√ √

National Aeronautics

and Space

Administration

√ √

National Science

Foundation

√ √

Nuclear Regulatory

Commission

√ √

Office of Personnel

Management

√ d

Small Business

Administration

√ √

Social Security

Administration

√ √

Total 3 20 14 3 4
Page 20 GAO/T-AIMD-00-178

= Auditors gave the agency’s financial statements an unqualified audit opinion,

but reported that the agency’s systems did not comply substantially with FFMIA’s

requirements.

a

Education received a disclaimer of opinion on its Statement of Financing and qualified

opinions on its other financial statements.

b

According to OMB guidance in OMB Bulletin 98-08, material weaknesses in internal

controls that affect an agency’s ability to prepare auditable financial statements and

related disclosures is an indication of noncompliance with FFMIA. In its fiscal year 1999

Report on Internal Controls, the Department of Energy’s IG reported a material weakness

related to the Western Area Power Administration’s new financial management system.

The report states, “While the Department’s systems as a whole substantially comply with

FFMIA, the new financial management system implemented by Western was not in

compliance with the FFMIA requirements as of September 30, 1999....Thus, Western was

unable to adequately track and report on budget execution and meet external reporting

requirements, including preparation of financial statements.”

c

Audit report not issued as of June 1, 2000.

d

The Office of Personnel Management does not prepare agency-wide financial

statements. For fiscal year 1999, OPM received disclaimers of opinion on its financial

statements for Revolving Fund and Salaries and Expenses and unqualified opinions on

the financial statements for the Retirement, Health Benefits Insurance, and Life Insurance

Programs.

Source: GAO analysis of agency audit reports for fiscal year 1999.

Financial statement audit results are key indicators of the quality of

agency financial data at year-end and provide an annual public scorecard

on accountability. Agencies are to be commended for receiving unqualified

audit opinions. At the same time, a clean audit opinion is not an end in and

of itself. A clean audit opinion assures financial statement users only that

the information is fairly presented as of the date of the financial

statements. It provides no assurance about the effectiveness and efficiency

of financial systems used to prepare the statements or whether use of the

same or other information for management use would be appropriate. The

results shown in table 2 indicate that, although auditors reported that the

financial statements of 14 of the 23 CFO Act agencies were fairly

presented and reliable at the end of the fiscal year, the financial systems of

20 of the agencies have weaknesses, some of which are so serious that

they are not able to routinely provide reliable, useful, and timely

information on an ongoing basis.

It bears repeating that the goal of the CFO Act, FFMIA, and other key

financial legislation is to establish systems that routinely produce reliable,

useful, and timely financial information for decisionmakers in the agency,

in the Congress, and elsewhere as part of agencies’ ongoing daily

operations. In order to receive an unqualified opinion, many agencies

whose systems did not comply with FFMIA had to rely on time-consuming

ad hoc programming and analysis of data produced by inadequate systems
Page 21 GAO/T-AIMD-00-178

that are not integrated or reconciled and often require significant audit

adjustments.

HHS is an example of an agency that obtained a clean opinion, even

though its systems did not satisfy FFMIA requirements. HHS’ IG reported33

that the accounting systems used by HHS and its operating divisions did

not meet FFMIA criteria because they were not adequate for preparing

reliable and timely financial statements. Because of these systems

inadequacies, HHS resorted to a manually intensive and error-prone

process, involving numerous manual account adjustments. Together, this

led to delays in preparing the statements, increased the risk of material

misstatements, and limited the resources available for financial analyses.

The extent and magnitude of account adjustments required at year-end

demonstrate that the systems were not operating efficiently or effectively.

For example, HCFA, HHS’ largest operating division with almost

$300 billion in net outlays34 in fiscal year 1999, issued its initial financial

statements in mid-December 1999 and then made billions of dollars in

adjustments to payables and receivables before producing final, auditable

financial statements in late January 2000.

Likewise, while IRS was able to receive a clean audit opinion on its fiscal

year 1999 Statement of Custodial Activity, its systems do not comply with

FFMIA. We were able to verify that the reported balances on the

Statement of Custodial Activity were fairly stated, in all material respects,

only after extensive audit procedures and tens of billions of dollars of

adjustments. IRS had to rely on extensive, labor-intensive, and time

consuming compensating ad hoc procedures to enable it to report reliable

revenue and refund balances on its Statement of Custodial Activity.

DOT received its first unqualified opinion on its fiscal year 1999

departmentwide financial statements. However, like several other

agencies, in spite of the clean opinion, DOT’s IG reported35 that its systems

did not comply substantially with FFMIA. DOT’s existing core accounting

system—designed to be the primary system for producing financial

information and financial statements—was not the primary source of

information used to prepare the financial statements. Because the core

33Report on the Financial Statement Audit of the Department of Health and Human Services for Fiscal

Year 1999, Report No. A-17-99-00002, February 2000.

34The almost $300 billion in net outlays includes the Medicare and Medicaid programs, which are both

administered by HCFA.

35Office of Inspector General Audit Report, Fiscal Year 1999 Consolidated Financial Statements,

Department of Transportation, Report No. FE-2000-062, March 8, 2000.
Page 22 GAO/T-AIMD-00-178

system did not provide the necessary data, DOT made about 800 adjusting

entries totaling $36 billion. Also, according to the IG, 36 the Federal

Aviation Administration’s property systems were not designed as an

integrated system to accurately account for property costs. Therefore,

DOT hired additional contractors, detailed employees, and used extensive

overtime and compensatory time to provide sufficient evidence to support

the amounts of property, plant, and equipment shown on its financial

statements. The IG reported that these manual and labor-intensive

methods are expensive; prone to errors, mistakes, and inaccuracies; and

cannot be sustained.

As I have just illustrated, many agencies rely on time-consuming, costly

procedures to receive a clean opinion. Absent substantive improvements

in underlying financial systems, these agencies will likely continue to rely

on these procedures every year to maintain that opinion. Similarly,

agencies that have not yet achieved the milestone of receiving a clean

opinion will feel pressure to also perform such costly procedures every

year until their systems are able to produce reliable, useful, and timely

financial information. Having good systems would eliminate the time and

expense needed to routinely produce a complete set of auditable financial

statements and allow financial management staff to address other critical

and frankly more valuable functions, such as analyzing cost data and other

financial data and developing financial and program results information.

The Social Security Administration (SSA) has achieved the end game—

systems and processes that routinely generate reliable, useful, and timely

information. SSA is able to prepare financial statements from information

in its financial system. SSA’s audited financial statements for fiscal year

1999, for which it received a clean opinion, were issued on November 18,

1999, only 7 weeks after the close of the fiscal year and almost 31⁄2 months

before the March 1 statutory deadline. SSA’s auditor did find serious

problems with computer security and continuity of operations but

otherwise found that SSA’s financial systems substantially comply with

FFMIA.

Having an effective, integrated financial management system that can

produce financial statements in a timely manner would prevent the need

for time-consuming and costly procedures. In our Executive Guide:

Creating Value Through World-class Financial Management, we identified

the success factors, practices, and outcomes associated with world-class

36Fiscal Year 1999 Financial Statements, Federal Aviation Administration, Report No. FE-2000-060,

February 29, 2000.
Page 23 GAO/T-AIMD-00-178

financial management efforts. We found that many leading finance

organizations have a goal to reduce the time spent on routine accounting

activities, such as financial statement preparation, so that financial

management staff can spend more time on activities such as business

performance analysis or cost analysis.

Mr. Chairman, these problems are not new. As I mentioned at the outset of

my testimony, financial systems problems date back many years, and

agencies have known about their severity for just as long. In 1989, we

reported that many federal financial systems were weak, outdated, and

inefficient and could not routinely produce relevant, timely, and

comprehensive data.37 Now, over 10 years later, the vast majority of

agencies’ financial systems still do not meet the goals of the CFO Act,

although today, through the rigors of the financial statement audit process

and the requirements of FFMIA, agencies have a better understanding of

their problems and the impetus to resolve those problems. As I will

discuss later, agencies have efforts planned or underway to address their

systems problems, and we are seeing a commitment across government.

However, until these systems problems are resolved, agencies will

continue with their extraordinary, inefficient, time-consuming efforts to

obtain a clean opinion.

We may be back in a few years to report that substantially more, perhaps

even all, of the 24 CFO Act agencies have received clean audit opinions. I

feel less confident that their systems will, in the short term, comply with

FFMIA and meet the intended results of the CFO Act. The biggest concern

is that while all or almost all agencies will have devised and mastered a

repeatable process for developing reliable annual results of operations and

year-end balances, overhauling financial systems is a much more difficult

challenge. Overhauling systems is at the heart of the end game we have

spoken about—reliable, useful, and timely data for accurately measuring

performance and providing a basis for ongoing management and decisionmaking.

Bringing financial management systems into compliance with the

requirements of FFMIA is a formidable challenge for any agency. Today,

across government, agencies recognize the severity of their systems

weaknesses and have made plans or are already taking action to resolve

them, including the development of new core financial management

37Financial Integrity Act: Inadequate Controls Result in Ineffective Federal Programs and Billions in

Losses (GAO/AFMD-90-10, November 28, 1989).

Key Elements for

Improving Financial

Management Systems
Page 24 GAO/T-AIMD-00-178

systems. We have issued guidance to help agencies make information

technology investment decisions and improve information security

management. JFMIP has efforts underway, including the testing of

commercial off-the-shelf software for compliance with current systems

requirements and updating and issuing systems requirements documents.

Finally, lessons learned from the government’s Year 2000 efforts can be

applied to efforts to help improve agencies’ financial management systems

so that they can produce the reliable, useful, and timely information

needed by management and other decisionmakers.

Agencies have submitted remediation plans to OMB describing the

corrective actions they plan to take to address the problems previously

discussed in this statement, including the replacement or overhaul of their

financial management systems. We are currently reviewing these plans and

intend to include the results of our review in our annual FFMIA report in

October. In our previous report on FFMIA,38 we reviewed agency audit

reports and remediation plans and found that several agencies’ corrective

actions included development of new core financial management systems

to replace noncompliant systems. Information from OMB’s inventory of

financial systems shows that over the next few years, significant amounts

of money will be needed to replace or upgrade 79 percent of the over 1,100

financial management system applications39 that were reported as being in

operation at the time.

Replacing financial systems will understandably take time, and the

systems may not be operational for several years. For many years, federal

agencies have struggled with delivering promised system capabilities on

time and within budget. This has proven to be a difficult challenge. We

have reported in the past that billions of dollars have been wasted on

systems development projects. This waste helped give rise to the 1996

enactment of the Clinger-Cohen Act. Clinger-Cohen put in place a

disciplined system development process for deciding upon and controlling

information technology investments.

38Financial Management: Federal Financial Management Improvement Act Results for Fiscal Year

1998 (GAO/AIMD-00-3, October 1, 1999).

39An application is a group of interrelated components of financial or mixed systems that supports one

or more functions and has the following characteristics: a common data base, common data element

definitions, standardized processing of similar types of transactions, and common version control over

software.

Plans to Replace or

Overhaul Agencies’

Systems

Information Technology

Investment and Security

Guidance
Page 25 GAO/T-AIMD-00-178

To ensure that information technology dollars are directed toward prudent

investments designed to achieve cost savings, increase productivity, and

improve the timeliness and quality of service delivery, agencies need to

apply the framework outlined in the Clinger-Cohen Act and implementing

guidance.40 This includes adopting sound information technology

investment and control processes, designing well-developed architectures

to guide information flows and technical standards, and establishing

disciplined approaches for developing and acquiring computer software.

In this regard, we have worked on strengthening federal agency

management of information technology investment and have developed

guidance based on best practices in the public and private sectors related

to information technology investment. Two guides resulting from our

work are:

• Assessing Risks and Returns: A Guide for Evaluating Agencies’ IT

Investment Decision-making (GAO/AIMD-10.1.13, February 1997) and

• Executive Guide: Measuring Performance and Demonstrating Results of

Information Technology Investments (GAO/AIMD-98-89, March 1998).

However, it is important to remember that these guides are not a “silver

bullet” to guarantee success. Rather, the key is for an organization to

adopt and effectively implement policies and procedures, such as those

described in the guides, that foster the necessary discipline for the

organization to produce predictable and repeatable results. Therefore, it is

critical that an organization first choose the practices that are compatible

with its culture and then effectively implement those practices.

In addition to the guidance we issued on information technology

investment decisions, we have issued guides to help agencies improve

security over their information systems. As mentioned previously,

weaknesses in information systems security was a reported cause of

FFMIA noncompliance for 19 of the 20 noncompliant agencies. We have

identified best practices for improving information security management,

which we published in two guides:

• Information Security Management: Learning from Leading Organizations

(GAO/AIMD-98-68, May 1998) and

40The Clinger-Cohen Act of 1996 builds on the best practices of leading public and private

organizations by requiring agencies to better link information technology planning and investment

decisions to program missions and goals.
Page 26 GAO/T-AIMD-00-178

• Information Security Risk Assessment: Practices of Leading Organizations

(GAO/AIMD-00-33, November 1999).

Our guides are consistent with guidance on information security program

management provided to agencies by OMB and the National Institute of

Standards and Technology. In addition, the May 1998 guide has been

endorsed by the federal Chief Information Officers Council as a useful

resource for agency managers.

An important effort focused specifically on improving federal financial

systems is the work of the JFMIP. In a governmentwide cooperative effort

to improve federal financial systems, JFMIP established its Program

Management Office (PMO) in 1998 with resources provided by the 24 CFO

agencies to assist agencies and vendors in developing and implementing

commercial off-the-shelf software that complies with current financial

management system requirements. The PMO’s responsibilities include,

among other things, developing comprehensive testing vehicles,

interpreting requirements, serving as an information clearinghouse for

federal financial systems, and facilitating communication with the private

sector.

In fiscal year 1999, the PMO implemented a new software testing process

in which it tests vendor products to certify that they meet current JFMIP

systems requirements. The PMO publishes the testing results in its Webbased electronic repository, called the Knowledgebase, which also

includes information for agencies and vendors about financial systems

requirements, business practices, and certified vendor products. JFMIP

compliant systems help assure an agency that the system properly records

transactions defined in the JFMIP Core Financial System Requirements

document. However, agencies will still need to define their business

requirements and then compare the various applications against those

requirements to identify gaps. Once these gaps are identified, agencies

need to determine the cost, schedule, and performance impacts associated

with these gaps and determine the best approach to accomplishing the

requirement—modifying the system or, if the desired functionality is not

cost effective, eliminating the requirement. OMB Circular A-127, Financial

Management Systems, requires that agencies replacing software to meet

core financial system requirements use off-the-shelf software that has

been tested and certified through the JFMIP software certification process

as meeting JFMIP core financial system requirements.

JFMIP Software

Certification
Page 27 GAO/T-AIMD-00-178

JFMIP has also been updating existing financial management systems

requirements, as well as issuing requirements documents covering systems

where none previously existed. JFMIP’s systems requirements

publications are the primary source of governmentwide requirements for

financial management systems. These requirements are detailed in the

Federal Financial Management Systems Requirements (FFMSR) series

issued by JFMIP which, according to OMB Circular A-127, Financial

Management Systems, agencies are required to follow. Table 3 lists the

publications in the FFMSR series and their issue dates.

Table 3: Publications in the Federal Financial Management System

Requirements Series

Federal Financial Management System

Requirements (FFMSR) Document

Issue date

FFMSR-0 Framework for Federal Financial Management

Systems

January 1995

FFMSR-7 Inventory System Requirements June 1995

FFMSR-8 Managerial Cost Accounting System Requirements February 1998

JFMIP-SR-99-4 Core Financial System Requirements February 1999

JFMIP-SR-99-5 Human Resources & Payroll Systems Requirements April 1999

JFMIP-SR-99-8 Direct Loan System Requirements June 1999

JFMIP-SR-99-9 Travel System Requirements July 1999

JFMIP-SR-99-14 Seized Property and Forfeited Asset Systems

Requirements

December 1999

JFMIP-SR-00-01 Guaranteed Loan System Requirements March 2000

JFMIP is also developing systems requirements where none existed.

JFMIP issued an exposure draft on Property Management System

Requirements this past April and is finalizing its Grant Financial System

Requirements. JFMIP systems requirements, among other things, provide a

framework for establishing integrated financial management systems to

support program and financial managers. JFMIP also issued an exposure

draft41 of a guide to assist agencies in performing financial management

systems reviews as required by FFMIA and other legislation.

As one of the JFMIP’s principals, we have published checklists to assist

agencies in implementing and monitoring their systems and to assist

management and auditors in reviewing systems to determine whether they

are in substantial compliance with FFMIA. The checklists are based on

41Financial Management Systems Compliance Review Guide (JFMIP-MI-99-15, October 1999, exposure

draft).

Systems Requirements

Documents and Checklists
Page 28 GAO/T-AIMD-00-178

JFMIP systems requirements documents. We issue them when JFMIP

requirements are published for the first time and when requirements are

updated. Table 4 lists the checklists we have issued in final form or as

exposure drafts.

Table 4: Checklists for Reviewing Systems Under the Federal Financial

Management Improvement Act

Checklist Issue date

GAO/AIMD-98-21.2.1 Framework for Federal Financial

Management System Checklist

May 1998

GAO/AIMD-00-21.2.2 Core Financial System Requirements

Checklist

February 2000

GAO/AIMD-00-21.2.3 Human Resources and Payroll Systems

Checklist

March 2000

GAO/AIMD-98-21.2.4 Inventory System Checklist May 1998

GAO/AIMD-21.2.5 Seized Property and Forfeited Assets System

Requirements Checklist (exposure draft)

April 2000

GAO/AIMD-21-2.6 Direct Loan System Requirements Checklist April 2000

GAO/AIMD-21.2.8 Travel System Requirements Checklist May 2000

GAO/AIMD-99-21.2.9 System Requirements for Managerial Cost

Accounting Checklist

January 1999

Finally, the leadership and partnerships established to successfully

address the Year 2000 computing problem provide valuable lessons that

can also be used to address financial management reform across

government. In our October 1999 FFMIA report42 we noted that addressing

Year 2000 conversion issues was understandably a priority for federal

agencies and that Year 2000 preparation had resulted in delaying financial

systems changes in some agencies. We also reported that, over the long

term, there should be residual benefits from Year 2000 efforts. Now that

the federal government has made the successful conversion to Year 2000,

it has learned some valuable lessons.

We testified before this Subcommittee in January about the Year 2000

computing challenge, including lessons that can be carried forward to

improve the management of information technology activities.43 Among

42Financial Management: Federal Financial Management Improvement Act Results for Fiscal Year

1998 (GAO/AIMD-00-3, October 1, 1999).

43Year 2000 Computing Challenge: Leadership and Partnerships Result in Limited Rollover Disruptions

(GAO/T-AIMD-00-70, January 27, 2000).

Lessons Learned From

Year 2000 Efforts
Page 29 GAO/T-AIMD-00-178

the lessons learned were the importance of (1) providing high-level

congressional and executive branch leadership, (2) understanding the

importance of computer-supported operations, (3) providing standard

guidance, (4) establishing partnerships, (5) facilitating progress and

monitoring performance, and (6) implementing fundamental information

technology improvements. The Year 2000 efforts have reinforced an

understanding of the importance of consistent and persistent top

management attention, which is essential to solving any intractable

problem.

According to officials at OMB, the Year 2000 problem also gave agency

chief information officers a “crash course” in how to accomplish projects.

Many chief information officers were relatively new in their positions, and

expediting Year 2000 efforts required many of them to quickly gain an

understanding of their agency’s systems, work extensively with agency

program managers and chief financial officers, and become familiar with

budgeting and financial management practices. Addressing these issues, in

turn, provided them with real-time experience in responding to farreaching management problems and in finding solutions. These

experiences could prove valuable to resolving the systems issues impeding

compliance with FFMIA.

Long-standing problems with agencies’ financial systems make it difficult

for the agencies to produce reliable, useful, and timely financial

information and hold managers accountable. Federal managers need this

important information for formulating budgets, managing government

programs, and making difficult policy choices. The extraordinary efforts

that many agencies go through to produce auditable financial statements

are not sustainable in the long term. These efforts use significant

resources that could be used for other important financial-related work.

For these reasons, the widespread systems problems need top

management attention. We learned from the Year 2000 experience that

proactive leadership at the highest levels of government is one of the most

important factors in prompting attention and action on a widespread

problem.

The federal government’s size and complexity and the discipline needed to

overhaul or replace its financial management systems present a significant

challenge—not simply a challenge to overcome a technical glitch, but a

demanding management challenge that requires attention from the highest

levels of government. We recognize that it will take time, investment, and

sustained emphasis on correcting deficiencies to improve federal financial

management systems to the level required by FFMIA and for effectively

Conclusions
Page 30 GAO/T-AIMD-00-178

managing government funds. However, with concerted effort, including

attention from top agency management and the Congress, the federal

government can make progress toward improving its financial

management systems and thus achieve the goals of the CFO Act and

provide accountability to the nation’s taxpayers.

Mr. Chairman, this concludes my prepared statement. I would be pleased

to answer any questions you or other Members of the Subcommittee may

have.

For information about this statement, please contact Gloria Jarmon,

Director, Health, Education, and Human Services, Accounting and

Financial Management Issues, at (202) 512-4476 or by e-mail at

jarmong.aimd@gao.gov. Individuals making key contributions to this

statement include Kay Daly, Diane Morris, Sandra Silzer, and Meg Mills.

(916351)

Contacts and

Acknowledgments
Orders by Internet

For information on how to access GAO reports on the Internet, send

an e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs