UNITED STATES OFFICE OF PERSONNEL MANAGEMENT 

Washington, DC 20415 

Office of the 

Inspector General 

November 14, 2008 

Report No. 4A-CF-00-08-025 

MEMORANDUM FOR HOWARD WEIZMANN ( 

Deputy Director ~~

FROM:	 PATRICKF.McFARLAND 

Inspector General p~

SUBJECT:	 Audit of the Office of Personnel Management's Fiscal Year 

2008 Consolidated Financial Statements 

This memorandum transmits KPMG LLP's (KPMG) report on its financial statement 

audit of the Office of Personnel Management's (OPM) Fiscal Year 2008 Consolidated 

Financial Statements and the results of the Office of the Inspector General'5 (OIG) 

oversight of the audit and review of that report. OPM's consolidated financial statements 

include the Retirement Program, Health Benefits Program, Life Insurance Program, 

Revolving Fund Programs (RF) and Salaries & Expenses funds (S&E). 

Audit Reports on Financial Statements, Internal Controls and Compliance 

with laws and Regulations 

The ChiefFinancial Officers (CFO) Act of 1990 (P.L. 101-576) requires OPM's Inspector 

General or an independent external auditor, as determined by the Inspector General, to 

audit the agency's financial statements in accordance with Government Auditing 

Standards (GAS) issued by the Comptroller General of the United States. We contracted 

with the independent certified public accounting firm KPMG LLP to audit OPM's 

consolidated financial statements as of September 30, 2008 and for the fiscal year then 

ended. The contract requires that the audit be performed in accordance with generally 

accepted government auditing standards and the Office of Management and Budget 

(OMB) bulletin number 07-04, Audit Requirementsfor Federal Financial Statements. 

KPMG's audit report for Fiscal Year 2008 includes: (I) opinions on the consolidated 

financial statements and the individual statements for the three benefit programs, (2) a 

~~~._-----_._-- .- _-_ _- --­ .~------ - www.opm.gov	 WWW.U5ilJobs.gov 
HOWARD WEIZMANN . 2 

report on internal controls, and (3) a report on compl ianee with laws and regulations. In 

its audit of OPM, KPMG found: 

•	 The consolidated financial statements were fairly presented, in all material
 

respects, in conformity with generally accepted accounting principles.
 

•	 There were no material weaknesses identified in the internal controls. A material 

weakness is a condition in which the design or operation of an internal control 

does not reduce to a relatively low level the risk that misstatements, in amounts 

that would be material in relation to the financial statements being audited, may 

occur and not be detected within a timely period. 

However, KPMG's report did identify two significant deficiencies: 

	 Information systems general control environment, and 

	 Financial management and reporting processes of the Office of the 

Chief Financial Officer (OCFO). (Revolving Fund Program (RF 

Program) and Salaries and Expenses (S&E) Fund) 

A significant deficiency represents a deficiency in the design or operation of 

internal controls that could adversely affect OPM's ability to record, process, 

summarize, and report financial data consistent with management assertions in the 

financial statements. 

•	 KPMG's report on compliance vlith certain provisions oflaws and regulations
 

disclosed onc other matter related to the Federal Financial Management
 

Improvement Act of 1996 (FFMIA) (RF and S&E only).
 

DIG Evaluation of KPMG's Audit Performance 

In connection with the audit contract, we reviewed KPMG's report and related documentation 

an,! made inquiries of its representatives regarding the audit. To fulfill our audit 

responsibilities under the CFO Act for ensuring the quality of the audit work performed, we 

conducted a review ofKPMG's audit ofOPM's Fiscal Year 2008 Consolidated Financial 

Statements in accordance with GAS. Specifically, we: 

•	 reviewed KPMG's approach and plmming of the audit; 

•	 evaluated the qualifications and independence of its auditors; 

•	 monitored the progress of the audit at key points; 

•	 examined its working papers related to planning the audit and assessing internal 

controls over the financial reporting process; 

•	 reviewed KPMG's audit reports to ensurc compliance with Government Auditing 

Standards; 

•	 coordinated issuance of the audit report: and 

•	 performed other procedures we deemed necessary. 
HOWARD WEIZMAN1\. 3 

Our review, as differentiated from an audit in accordance with generally accepted 

government auditing standards, was not intended to enable us to express, and we do not 

express, opinions on OPM's financial statements or internal controls or on whether OPM's 

financial management systems substantially complied with FFMIA or conclusions on 

compliance with laws and regulations. KPMG is responsible for the attached auditor's 

rcpurt dated November 14, 2008, and the conclusions expressed in the report However, 

our review disclosed no instances where KPMG did not comply, in all material respects, 

with the generally accepted GAS. 

In accordance with the OMB Circular A-50 and Public Law ·103-355, all audit findings 

must be resolved within six months of the date of this report. In order to ensure audit 

findings are resolved within the required six-month period, we are asking that the OCFO 

respond directly to the OIG within 90 days of the date of this report advising us whether 

they agree or disagree with the audit findings and recommendations. As stated in OMB 

Circular A-50, where agreement is indicated, the OCFO should describe plmmed corrective 

action. If the OCFO disagrees with any of the audit findings and recommendations, they 

need to explain the reason for the disagreement and provide any additional documentation 

that would support their opinion. 

In closing, we woulcllike to congratulate OPM's financial management staff for once 

agail1 issuing the consolidated financial statements by the November 15 due date. Their 

professionalism, courtesy, and cooperation allowed us to overcome the many challenges 

encountered during OPM's preparation, KPMG's aUdit, and the DIG's oversight of the 

financial statement audit this year. If you have any questions about KPMG's audit or our 

oversight, please contact me or have a member of your staff contact Michael R. Esser, 

Assistant Inspector General for Audits, at_ 

cc:	 Mark Reger 

Chief Financial Officer 
KPMG llP 

2001 M Street, NW 

Washington. DC 20036 

Independent Auditors' Report 

Acting Director and Inspector General 

U.S. Office of Personnel Management: 

We have audited the accompanying consolidated balance sheets of the United States 

(U.S.) Office of Personnel Management (OPM) as of September 30, 2008 and 2007, and 

the related consolidated statements of net cost and changes in net position, and combined 

statements of budgetary resources (hereinafter referred to as "consolidated financial 

statements"), for the years then ended. We have also audited the individual balance 

sheets of the Retirement, Health Benefits, and Life Insurance Programs (hereinafter 

referred to as the "Programs") as of September 30, 2008 and 2007, and the related 

individual statements of net cost, changes in net position, and budgetary resources 

(hereinafter referred to as the Programs' "individual financial statements"), for the years 

then ended. 

The objective of our audits was to express an opinion on the fair presentation of these 

consolidated and individual financial statements. In connection with our fiscal year 2008 

audit, we also considered arM's and the Programs' internal controls over financial 

reporting and tested OPM's and the Programs' compliance with certain provisions of 

applicable laws, regulations, and contracts that could have a direct and material effect on 

these consolidated and individual financial statements. 

SUMMARY 

As stated in our opinIOn on the financial statements, we concluded that OPM's 

consolidated financial statements and the Programs' individual financial statements as of 

and for the years ended September 30, 2008 and 2007, as presented in OPM's Fiscal 

Year 2008 Agency Financial Report, are presented fairly, in all material respects, in 

confonnity with U.s. generally accepted accounting principles. 

As discussed in Note 17 to the financial statements, OPM changed its method of 

accounting for presenting distributed offsetting receipts related· to the Postal Service 

Retiree Health Benefits Fund in fiscal year 2008. 

Our consideration of internal control over financial reporting resulted in the following 

conditions being identified as significant deficiencies: 

1.	 Infonnation systems general control environment. (OPM and the Programs) 

2.	 Financial management and reporting processes of the Office of Chief Financial 

Officer (OCFO). (Revolving Fund Program (RF Program) and Salaries and 

Expenses (S&E) Fund) 

l<PMG LLP. a U5_ IImiled Iiabil(ty paHl1elship. is the US 

member firm of KPMG Internalional, is' SWISS cooper8uve 
However, none of the significant deficiencies are believed to be material 

weaknesses. 

The results of our tests of compliance with certain provisions of laws, regulations, and 

contracts disclosed the following instance of noncompliance or other matter that are 

required to be reported under Government Auditing Standards, issued by the Comptroller 

General of the United States, and Office of Management and Budget (OMB) Bulletin No. 

07-04, Audit Requirements for Federal Financial Statements: 

3.	 Other matter related to Federal Financial Management Improvement Act (RF 

Program and S&E Fund) 

The following sections discuss our opinion on OPM's consolidated financial statements 

and the Programs' individual ~nancial statements; our consideration of OPM's and the 

Programs' internal controls over financial reporting; our tests of OPM's and the 

Programs' compliance with certain provisions of applicable laws, regulations, and 

contracts; and management's and our responsibilities. 

OPINION ON THE FINANCIAL STATEMENTS 

We have audited the accompanying consolidated balance sheets of the U.S. Office of 

Personnel Management as of September 30, 2008 and 2007, and the related consolidated 

statements of net cost, changes in net position, and the combined statements of budgetary 

resources for the years then ended. We have also audited the individual balance sheets of 

the Programs as of September 30, 2008 and 2007, and the related individual statements of 

net cost, changes in net position, and budgetary resources for the years then ended. The 

Programs' individual financial statements are included in the consolidating financial 

statements presented in the Consolidating Financial Statements section of OPM's Fiscal 

Year 2008 Agency Financial Report. 

In our opinion, the consolidated financial statements referred to above present fairly, in 

all material respects, the consolidated financial position of aPM and the financial 

position of each of the Programs as of September 30, 2008 and 2007, and the 

consolidated and individual Programs' net costs, changes in net position, and budgetary 

resources, for the years then ended, in confonnity with U.S. generally accepted 

accounting principles. 

As discussed in Note 17 to the financial statements, aPM changed its method of 

accounting for presenting distributed offsetting receipts related to the Postal Service 

Retiree Health Benefits Fund in fiscal year 2008. 

The infonnation in the Management Discussion and Analysis and Required 

Supplementary Information sections of OPM's Fiscal Year 2008 Agency Financial 

Report is not a required part of the consolidated financial statements, but is 

supplementary information required by U.S. generally accepted accounting principles. 

We have applied certain limited procedures, which consisted principally of inquiries of 
management regarding the methods of measurement and presentation of this infonnation. 

However, we did not audit this infonnation and, accordingly, we express no opinion on it. 

Our audits were conducted for the purpose of forming an opinion on the consolidated 

financial statements of aPM taken as a whole and on the Programs' individual financial 

statements. The individual financial statements of the RF Program and S&E Fund 

included in the Consolidating Financial Statements section of OPM's Fiscal Year 2008 

Agency Financial Report (Schedules 1 through 4) are presented for purposes of additional 

analysis of the consolidated financial statements rather than to present the financial 

position, net costs, changes in net position, and budgetary resources of the individual RF 

Program and S&E Fund. The financial statements of the RF Program and S&E Fund 

have been subjected to the auditing procedures applied in the audit of the consolidated 

financial statements of aPM and, in our opinion, are fairly stated in all material aspects 

in relation to OPM's consolidated statements taken as a whole. 

In addition, the consolidating Civil Service Retirement System (CSRS) and Federal 

Employees Retirement System (FERS) information included in the consolidating 

statement of net cost (Schedule 2) is presented for purposes of additional analysis of the 

consolidated financial statements of OPM and the individual financial statements of the 

Retirement Program rather than to present the net costs of the CSRS and FERS funds. 

The consolidating CSRS and FERS infonnation have been subjected to the auditing 

procedures applied in the audit of OPM's consolidated financial statements and the 

individual financial statements of the Retirement Program, in our opinion is fairly stated 

in all material respects in relation to OPM's consolidated statements of net cost and 

changes in net position and combined statement of budgetary resources and the individual 

statements of net cost and changes in net position and combining statement of budgetary 

resources of the Retirement Program taken as a whole. 

The information in the Other Accompanying Information, and Appendix A, included in 

OPM's Fiscal Year 2008 Agency Financial Report, are presented for purposes of 

additional an~lysis and are not required as part of the consolidated financial statements. 

This infonnation has not been subjected to auditing procedures and, accordingly, we 

express no opinion on it. 

INTERNAL CONTROL OVER FINANCIAL REPORTING 

Our consideration of the internal control over financial reporting was for the limited 

purpose described in the Responsibilities section of this report and would not necessarily 

identify all deficiencies in the internal control over financial reporting that might be 

significant deficiencies or material weaknesses. 

A control deficiency exists when the design or operation of a control does not allow 

management or employees, in the nonnal course of perfonning their assigned functions, 

to prevent or detect misstatements on a timely basis. A significant deficiency is a control 

deficiency, or combination of control deficiencies, that adversely affects OPM's or the 

Programs' ability to initiate, authorize, record, process, or report financial data reliably in 
accordance with U.S. generally accepted accounting principles such that there is more 

than a remote likelihood that a misstatement of OPM's consolidated financial statements 

or the Programs' individual financial statements that is more than inconsequential will 

not be prevented or detected by OPM's or the Programs' internal control. A material 

weakness is a significant deficiency, or combination of significant deficiencies, that 

results in more than a remote likelihood that a material misstatement of the financial 

statements will not be prevented or detected by OrM's or the Programs' internal control. 

In our fiscal year 2008 audit, we consider the deficiencies described in Items 1 and 2 

below to be significant deficiencies in internal control over financial reporting. However, 

we believe that none of the significant deficiencies described below are material 

weaknesses. Exhibit I presents the status of prior year significant deficiencies. 

1.	 Information systems general control environment 

The Office of the Chief Information Officer (OCIO) has made progress in addressing 

information system general control deficiencies identified in previous years. However, 

some deficiencies have not been fully addressed and consequently are not in full 

compliance with authoritative guidance. Specifically, security policies and procedures 

have not been updated to incorporate current authoritative guidance and the procedures 

performed to certify and accredit certain financial systems were not complete. In 

addition, we noted that application access permissions have not been fully documented to 

describe the functional duties the access provides to assist management in reviewing the 

appropriateness of system access. Also, we noted instances where background 

investigations and security awareness training was not completed prior to access being 

granted. 

Recommendation 

The acro should continue to update and implement entity-wide security policies and 

procedures and provide more direction and oversight to Program Offices for completing 

certification and accreditation requirements. In addition, documentation on application 

access permissions should be enhanced and linked with functional duties and procedures 

for granting logical access need to be refined to ensure access is granted only to 

authorized individuals. 

Management Response 

aPM concurs with these findings and recommendations. The Center for Information 

Services is updating the Information Security and Privacy Policy, approved September 

28, 2007, and intends to take such additional actions as the following: 

•	 Clarifying roles and responsibilities in the certification and accreditation of 

systems; 

•	 Training the OPM's designated security officers in conducting certification and 

accreditation of systems and in the handling of plans of action and milestones ; 
•	 Reviewing and revising as necessary OPM's process for establishing new user 

access accounts; 

•	 Investigating tools that can be used to mask personally identifiable information in 

production use; 

•	 Documenting and implementing change control monitoring procedures for data 

base administrator activities; and 

•	 Beginning discussions with the staff ofthe OPM's Chief Financial Officer on how 

to establish and maintain functional descriptions. 

2.	 Financial Management and Reporting Process of the Office of the Chief 

Financial Officer 

Certain deficiencies in the operation of the OCFO's internal control over financial 

management and reporting, affecting the accuracy of the RF Program and S&E Fund, 

continue to exist at OPM. The Government Financial Information System (OFIS) i:.; not 

designed properly to allow for: 

a.	 Capture of certain financial information and is not properly configured to produce 

useful financial reports that provide accurate information regarding related 

intragovernmental activities and balances. 

b.	 Reconciliations are not consistently or always clearly documented and are not always 

performed in a timely manner for the S&E Fund. 

c.	 Unidentified differences from prior years continue to exist between Treasury and 

OFIS. 

Further, because of system limitations, a number of correcting journal entries are 

processed. Adequate supporting documentation is not always readily available for 

correcting journal entries and there were instances where internal controls over 

processing and approving ofsuch entries were not consistently applied. 

According to OMS Circular A-123, transactions should be promptly recorded, properly 

classified, and accounted for in order to prepare timely accounts and reliable financial 

and other reports. The documentation for transactions, management controls, and other 

significant events must be clear and readily available for documentation. 

Deficiencies in the ability to record, process, summarize and report financial data may 

misstate financial information reported in the RF Program and S&E Fund. 

Recommendation 

The OCFO should continue implementation of its corrective action plan which should 

reduce or eliminate the need for correcting journal entries. Further, we recommend that: 

1.	 OPM implement a new accounting system or modifY the existing accounting system 

as appropriate to ensure that all financial information is properly captured and is 
properly configured to produce useful financial reports that provide accurate 

information regarding related intra-goverrunental activities and balances. 

2.	 aPM continue to identify and correct existing differences between aPM's internal 

data and the information reported by Treasury. At such a time when no additional 

reductions can be identified, OPM should, in conjunction with appropriate oversight 

agencies, write down the remaining amount to clear the remaining FBWT balance. 

3.	 aPM CFO management actively enforce procedures regarding the documentation of 

Salaries and Expense Fund reconciliations in accordance with guidelines outlined in 

the "Treasury Financial Manual" and OPM's "Cash Management Policy and 

Procedures." 

4.	 aPM retain appropriate supporting documentation for correcting joumal entries and 

emphasis be made on the need to follow existing internal control policies and 

procedures. 

Management Response 

aPM acknowledges deficiencies in the GFIS system lIsed for the RF program and S&E 

Fund accounts and concurs with KPMG's recommendations. While aPM has developed 

and applies controls over journal voucher entries, the availability of supporting 

documentation can be improved. aPM recently selected a new system integrator and 

software solution, and has begun working toward implementation of the new aPM 

accounting system. The new system will support the capture and reporting of all 

financial information regarding related intra-governmental activities and balances. 

Additionally, aPM continues to reconcile, identify and correct differences between 

aPM's internal data and Treasury balances. The process and complete reconciliation has 

not been completed but when the process is complete an adjusting entry will be processed 

to \VTite-down the remaining amount to clear the fund balance with Treasury balance. 

aPM OCFO management will continue to enforce procedures to document timely 

reconciliations compliant with the Treasury Financial Manual and OPM's Cash 

Management Policy and Procedures. 

COMPLIANCE AND OTHER MATTERS 

The results of our tests of compliance described in the Responsibilities section of this 

report, exclusive of those referred to in the Federal Financial Management Improvement 

Act of 1996 (FFMIA), disclosed no instances of noncompliance or other matters that are 

required to be reported herein under Government Auditing Standards or aMB Bulletin 

No. 07-04. 

The results of our tests of FFMIA disclosed no instances in which aPM's or the 

Programs' financial management systems did not substantially comply with the three 

requirements discussed in the Responsibilities section of this report. The results of our 

tests did disclose one other matter regarding FFMIA related to the RF Program and S&E 

Funds, as described below. 
3.	 Other matter related to Federal Financial Management Improvement Act of 

1996 (FFMIA) 

a.	 United States Standard General Ledger at the Transaction LevelIn accordance with OMB Circular A-127, Financial Management Systems, as 

amended, aPM is to record financial events consistent with the applicable definitions, 

attributes, and processing rules defined in the USSGL at the transaction leveL While 

improvements have been made, the OCFO does not consistently record RF Program 

and S&E Fund transactions at the USSGL level to support the RF Program and S&E 

Fund financial statements at the transaction leveL 

Recommendation 

We recommend that the OCFO should continue implementation of its corrective action 

plan over the GFIS system and related processes and procedures to enable the OCFO to 

account for the RF Program and S&E Fund's transactions in accordance with the USSGL 

at the transaction level. 

Management Response 

OPM concurs with the recommendation. The OFIS financial system cannot be 

reconfigured to meet fully the requirements of FFMIA. aPM recently selected a new 

system integrator and software solution, and has begun working toward implementation 

of the new aPM accounting system. The new system will support the capture and 

reporting of all financial infonnation regarding related intra-governmental activities and 

balances. OPM will ensure that the implementation of the financial system requirements 

are in compliance with FFMIA. 

* * * * * 

RESPONSIBILITIES 

Management's Responsibilities. Management is responsible for the consolidated 

financial statements of aPM and the individual financial statements of the Programs; 

establishing and maintaining effective internal control; and complying with laws, 

regulations, and contracts applicable to OPM. 

Auditors' Responsibilities. Our responsibility is to express an opinion on the fiscal year 

2008 and 2007 consolidated financial statements of aPM and the individual financial 

statements of the Programs based on our audits. We conducted our audits in accordance 

with auditing standards generally accepted in the United States of America; the standards 

applicable to financial audits contained in Government Auditing Standards, issued by the 

Comptroller General of the United States; and OMB Bulletin No. 07-04. Those standards 

and OMB Bulletin No. 07-04 require that we plan and perfol1l1 the audits to obtain 

reasonable assurance about whether the financial statements are free of material 
misstatement. An audit includes consideration of internal control over financial reporting 

as a basis for designing audit procedures that are appropriate in the circumstances, but not 

for the purpose of expressing an opinion on the effectiveness of OPM's internal control 

over financial reporting. Accordingly, we express no such opinion. 

An audit also includes: 

•	 Examining, .on a test basis, evidence supporting the amounts and disclosures in the 

overall consolidated and Programs' individual financial statements; 

•	 Assessing the accounting principles used and significant estimates made by 

management; and 

•	 Evaluating the overall consolidated and Programs' individual financial statement 

presentation. 

We believe that our audits provide a reasonable basis for our opinion. 

In planning and performing our fiscal year 2008 audit, we considered OPM's internal 

control over financial reporting by obtaining an understanding of OPM's and the 

Programs' internal control, determining whether internal controls had been placed in 

operation, assessing control risk, and performing tests of controls as a basis for designing 

our auditing procedures for the purpose of expressing our opinion on the consolidated 

financial statements ofOPM and the individual financial statements of the Programs. We 

did not test all internal controls relevant to operating objectives as broadly defined by the 

Federal Managers' Financial Integrity Act of1982. The objective ofour audit was not to 

express an opinion on the effectiveness of OPM's or the Programs' internal control over 

financial reporting. Accordingly, we do not express an opinion on the effectiveness of 

OPM's or the Programs' internal control over financial reporting. 

As part of obtaining reasonable assurance about whether OPM's fiscal year 2008 

consolidated and the Programs' fiscal year 2008 individual financial statements are free 

of material misstatement, we performed tests of OPM's and the Programs' compliance 

with certain provisions of laws, regulations, and contracts, noncompliance with which 

could have a direct and material effect on the determination of the financial statement 

amounts, and certain provisions of other laws and regulations specified in OMB Bulletin 

No. 07-04, including certain provisions referred to in Section 803(a) of FFMIA. We 

limited our tests of compliance to the provisions described in the preceding sentence, and 

we did not test compliance with all laws, regulations, and contracts applicable to aPM 

and the Programs. However, providing an opinion on compliance with laws, regulations, 

and contracts was not an objective of our audit and, accordingly, we do not express such 

an opinion. 

We noted certain additional matters that we have reported to management of OPM in a 

separate letter dated November 14,2008. 
OPM's responses to the findings identified in our audit are presented for each finding as 

Management Response, herein. We did not audit OPM's response and, accordingly, we 

express no opinionoD it. 

This report is intended solely for the infOlmation and use of OPM's management, OPM's 

Office of Inspector General, OMB, the U.S. Government Accountability Office, and the 

U.S. Congress and is not intended to be and should not be used by anyone other than 

these specified parties. 

November 14, 2008 
Exhibit I 

No. Title of Finding 

from 

FY07 Report 

Programl 

Fund, 

Prior Year 

Status 

"Current Year 

Status 

Factors A[fceting '. 

Current 

Year Status 

1 Infonnation 

Systems General 

Control 

Environment 

AliI Significant 

Deficiency 

Significant 

Deficiency - See 

FY 2008, 

Condition No. I 

aPM has made 

continual annual 

improvements to 

Information Systems 

General Control 

Environment, 

however, 

deficiencies still 

exist. 

2 Financial 

Management 

Reporting 

Processes of the 

Office of the Chief 

Financial Officer 

(aCFO) 

S&E; RF Significant 

Deficiency 

Significant 

Deficiency 

- See FY 2008, 

Condition No.2 

aPM has made 

improvements, 

however, 

deficiencies still exist 

because of system 

limitations. 

1. Includes the Retirement Program, Health Benefit Program (HBP), Life Insurance Program 

(LP), Revolving Fund (RF) Program and Salary and Expenses (S&E) Fund.