Department of Homeland Security
 

Independent Auditors’ Report on 

U.S. Customs and Border Protection’s 


FY 2011 Financial Statements 


OIG-12-65 March 2012
 
Office Q/lllspectQr Gel/era! 

U.s. Depa rtment of Homeland &t: urit)· 

Washingto n. DC 20528 

Homeland 

Security 

MAR 27 lOll 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 

established by the Homeland Secllrity Act of 2002 (Publ ic Law 107-296) by amendment 

to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effecti veness within the Department. 

The attached report presents the results of the U.S. Customs and Border Protection's 

(CSP) financial statement audits for fiscal year (FY) 2011 and FY 20 10. We contracted 

with the independent publi c accounting finn KPMG LLP (KPMG) to perfonn the audits. 

The contract required that KPMG perfonn its audits according to generall y accepted 

government auditing standards and guidance from the Office of Management and Budget 

and the Government Accountability Office. KPMG concluded that CSP's consolidated 

financial statements as of and for the years ended September 30, 20 II and 20 I 0, are 

presented fairl y, in all material respects, in confonnity with U.S. generally accepted 

accounting principles. The FY 2011 independent auditors' report discusses four 

significant deficiencies in internal control, one of which is considered a material 

weakness. KPMG is responsible for the attached auditors' report, and the conclusions 

expressed in the report. We do not express opinions on CSP's financial statements or 

provide conclusions on compliance with laws and regulations. 

The recommendations herein have been discussed in draft with those responsible for 

implementation. We trust this report will result in more effective, efficient, and 

economical operations. We express our appreciation to all of those who contributed to 

the preparation of this report. 

& ~ 

~.)I fly 

nne L. Richards 

Assistant Inspector General for Audits 
KPMG LLP 

1676 International Drive 

McLean, VA 22102 

Independent Auditors’ Report 

Acting Inspector General 

U.S. Department of Homeland Security: 

Acting Commissioner 

U.S. Customs and Border Protection: 

We have audited the accompanying consolidated balance sheets of the U.S. Customs and Border Protection 

(CBP), a Component of the U.S. Department of Homeland Security (DHS), as of September 30, 2011 and 

2010, and the related consolidated statements of net cost, changes in net position, and custodial activity, 

and combined statements of budgetary resources (hereinafter referred to as “consolidated financial 

statements”) for the years then ended. The objective of our audits was to express an opinion on the fair 

presentation of these consolidated financial statements. In connection with our fiscal year 2011 audit, we 

also considered CBP’s internal control over financial reporting and tested CBP’s compliance with certain 

provisions of applicable laws, regulations, and contracts that could have a direct and material effect on 

these consolidated financial statements. 

Summary 

As stated in our opinion on the consolidated financial statements, we concluded that CBP’s consolidated 

financial statements as of and for the years ended September 30, 2011 and 2010, are presented fairly, in all 

material respects, in conformity with U.S. generally accepted accounting principles. 

Our consideration of internal control over financial reporting resulted in identifying certain deficiencies 

that we consider to be a material weakness and other deficiencies that we consider to be significant 

deficiencies, as defined in the Internal Control Over Financial Reporting section of this report, as follows: 

Material Weakness: 

A. Drawback of Duties, Taxes, and Fees 

Significant Deficiencies: 

B. Property, Plant, and Equipment 

C. Entry Process 

1. In-Bond Program 

2. Trade Compliance Measurement 

3. Bonded Warehouse and Foreign Trade Zones 

D. Information Technology 

The results of our tests of compliance with certain provisions of laws, regulations, and contracts disclosed 

no instances of noncompliance or other matters that are required to be reported herein under Government 

Auditing Standards and Office of Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements 

for Federal Financial Statements, as amended. 

The following sections discuss our opinion on CBP’s consolidated financial statements; our consideration 

of CBP’s internal control over financial reporting; our tests of CBP’s compliance with certain provisions of 

applicable laws, regulations, and contracts; and management’s and our responsibilities. 

KPMG LLP is a Delaware limited liability partnership, 

the U.S. member firm of KPMG International Cooperative 

(“KPMG International”), a Swiss entity. 
 

Opinion on the Financial Statements 

We have audited the accompanying consolidated balance sheets of the U.S. Customs and Border 

Protection, a Component of the U.S. Department of Homeland Security, as of September 30, 2011 and 

2010, and the related consolidated statements of net cost, changes in net position, and custodial activity, 

and the combined statements of budgetary resources for the years then ended. 

In our opinion, the consolidated financial statements referred to above present fairly, in all material 

respects, the financial position of CBP as of September 30, 2011 and 2010, and its net costs, changes in net 

position, budgetary resources, and custodial activity for the years then ended, in conformity with U.S. 

generally accepted accounting principles. 

The information in the Management’s Discussion and Analysis and Required Supplementary Information 

sections is not a required part of the consolidated financial statements, but is supplementary information 

required by U.S. generally accepted accounting principles. We have applied certain limited procedures, 

which consisted principally of inquiries of management regarding the methods of measurement and 

presentation of this information. However, we did not audit this information and, accordingly, we express 

no opinion on it. 

The information in the Commissioner’s Message, Performance Section, Message from the Chief Financial 

Officer, Other Accompanying Information, and Acronyms as reflected in CBP’s Fiscal Year 2011 

Performance and Accountability Report is presented for purposes of additional analysis, and is not required 

as part of the consolidated financial statements. This information has not been subjected to auditing 

procedures and, accordingly, we express no opinion on it. 

Internal Control Over Financial Reporting 

Our consideration of the internal control over financial reporting was for the limited purpose described in 

the Responsibilities section of this report and was not designed to identify all deficiencies in internal 

control over financial reporting that might be significant deficiencies or material weaknesses and therefore, 

there can be no assurance that all deficiencies, significant deficiencies, or material weaknesses have been 

identified. However, in our fiscal year 2011 audit, we identified certain deficiencies in internal control 

over financial reporting that we consider to be a material weakness and other deficiencies that we consider 

to be significant deficiencies. 

A deficiency in internal control exists when the design or operation of a control does not allow 

management or employees, in the normal course of performing their assigned functions, to prevent, or 

detect and correct misstatements on a timely basis. A material weakness is a deficiency, or combination of 

deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of 

the entity’s financial statements will not be prevented, or detected and corrected on a timely basis. We 

consider the deficiencies described in Exhibit I to be a material weakness. 

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less 

severe than a material weakness, yet important enough to merit attention by those charged with 

governance. We consider the deficiencies described in Exhibit II to be significant deficiencies. 

Exhibit III presents the status of prior year significant deficiencies and the material weakness. 

We noted certain additional matters that we will report to the management of CBP in a separate letter. 

2
 
Compliance and Other Matters 

The results of our tests of compliance as described in the Responsibilities section of this report disclosed no 

instances of noncompliance or other matters that are required to be reported herein under Government 

Auditing Standards or OMB Bulletin No. 07-04. 

* * * * * * * 

Responsibilities 

Management’s Responsibilities. Management is responsible for the consolidated financial statements; 

establishing and maintaining effective internal control; and complying with laws, regulations, and contracts 

applicable to CBP. 

Auditors’ Responsibilities. Our responsibility is to express an opinion on the fiscal year 2011 and 2010 

consolidated financial statements of CBP based on our audits. We conducted our audits in accordance with 

auditing standards generally accepted in the United States of America; the standards applicable to financial 

audits contained in Government Auditing Standards, issued by the Comptroller General of the United 

States; and OMB Bulletin No. 07-04. Those standards and OMB Bulletin No. 07-04 require that we plan 

and perform the audits to obtain reasonable assurance about whether the consolidated financial statements 

are free of material misstatement. An audit includes consideration of internal control over financial 

reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the 

purpose of expressing an opinion on the effectiveness of CBP’s internal control over financial reporting. 

Accordingly, we express no such opinion. 

An audit also includes: 

•	 Examining, on a test basis, evidence supporting the amounts and disclosures in the consolidated 

financial statements; 

•	 Assessing the accounting principles used and significant estimates made by management; and 

•	 Evaluating the overall consolidated financial statement presentation. 

We believe that our audits provide a reasonable basis for our opinion. 

In planning and performing our fiscal year 2011 audit, we considered CBP’s internal control over financial 

reporting by obtaining an understanding of CBP’s internal control, determining whether internal controls 

had been placed in operation, assessing control risk, and performing tests of controls as a basis for 

designing our auditing procedures for the purpose of expressing our opinion on the consolidated financial 

statements, but not for the purpose of expressing an opinion on the effectiveness of CBP’s internal control 

over financial reporting. Accordingly, we do not express an opinion on the effectiveness of CBP’s internal 

control over financial reporting. We did not test all controls relevant to operating objectives as broadly 

defined by the Federal Managers’ Financial Integrity Act of 1982. 

As part of obtaining reasonable assurance about whether CBP’s fiscal year 2011 consolidated financial 

statements are free of material misstatement, we performed tests of CBP’s compliance with certain 

provisions of laws, regulations, and contracts, noncompliance with which could have a direct and material 

effect on the determination of the consolidated financial statement amounts, and certain provisions of other 

laws and regulations specified in OMB Bulletin No. 07-04. We limited our tests of compliance to the 

provisions described in the preceding sentence, and we did not test compliance with all laws, regulations, 

3
 
______________________________ 

 

and contracts applicable to CBP. However, providing an opinion on compliance with laws, regulations, 

and contracts was not an objective of our audit and, accordingly, we do not express such an opinion. 

CBP’s response to the findings identified in our audit is presented in Management’s Response to the 

Independent Auditors’ Report. We did not audit CBP’s response and, accordingly, we express no opinion 

on it. 

This report is intended solely for the information and use of CBP’s management, DHS’ management, the 

DHS Office of Inspector General, OMB, the U.S. Government Accountability Office, and the U.S. 

Congress, and is not intended to be and should not be used by anyone other than these specified parties. 

January 27, 2012 

4
 
EXHIBIT I
 

Material Weakness 

A.	 Drawback of Duties, Taxes, and Fees 

Background: 

U.S. Customs and Border Protection (CBP) performs an important revenue collection function for the U.S. 

Department of the Treasury. CBP collected approximately $33.9 billion in import duties, taxes, and fees in 

fiscal year (FY) 2011 on merchandise arriving in the U.S. from foreign countries. 

Drawback is a remittance, in whole or in part, of duties, taxes, or fees previously paid by an importer. 

Drawback typically occurs when the imported goods, on which duties, taxes, or fees have been previously 

paid, are subsequently exported from the United States or destroyed prior to entering the commerce of the 

United States. Depending on the type of drawback claim, the claimant has up to eight years from the date 

of importation to file for drawback. 

The conditions cited below have existed for several years; however, since FY 2009 CBP’s planned 

remediation for many of these conditions were tied to systems modernization through the Automated 

Commercial Environment (ACE). In FY 2010, funding for the implementation of ACE was reduced, and a 

systems solution is currently unfunded. During FY 2010 and continuing into FY 2011, CBP began an 

effort to improve the drawback process as a whole and is currently reassessing the planned solutions to 

conditions below. 

Condition: 

The following weaknesses related to internal control over drawback of duties, taxes, and fees paid by the 

importer were identified: 

•	 CBP is unable to prevent, or detect and correct excessive drawback claims against an entry summary
 

due to the inherent limitations of the Automated Commercial System (ACS) and the lack of controls 


therein. An entry summary can comprise numerous line items; however, ACS does not have the 


capability to compare, verify, and track essential information on drawback claims to the related 


underlying consumption entries (UCEs), their individual line items, or export documentation upon 


which the drawback claim was based.
 

•	 Currently, the drawback module within ACS provides information to ensure that the total amount of all 

drawback claims against a given import entry does not exceed 100% of the total amount of duties, 

taxes, and fees collected, at the entry summary level. By law, the amount paid for drawback claims 

against a given import entry should not exceed 99% of the duties, taxes, and fees collected at the 

individual line item level and the entry summary level. In addition, export information is not linked to 

the drawback module and, therefore, electronic comparisons of export data cannot be performed within 

ACS to ensure that overpayments of drawback claims are not made. 

•	 Drawback review policies did not require Drawback Specialists to review all, or a statistically valid 

sample, of prior drawback claims against a selected import entry to determine whether, in the 

aggregate, an excessive amount had been claimed against import entries. CBP utilizes a “validity tree” 

approach when selecting prior drawback claims for review. The validity tree approach requires CBP to 

review the largest prior related drawback claims; however, this approach is not statistical. In addition, 

drawback review policy and procedures allow Drawback Specialists, with supervisory approval, to 

judgmentally decrease the number of UCEs randomly selected for review, which decreases the review’s 

effectiveness. Further, CBP’s sampling methodology for selecting UCEs is not considered to be 

statistically valid and CBP’s Drawback Handbook does not include procedures for statistically 

projecting errors noted in the sample. 

I.1
 
 

 

EXHIBIT I
 

•	 The statutory period for document retention related to a drawback claim is only three years from the 

date of payment. However, there are several situations that could extend the life of the drawback claim 

well beyond three years. 

Cause/Effect: 

Due to system functionality limitations, much of the drawback process is manual, placing an added burden 

on limited resources. CBP uses a sampling approach to compare, verify, and match consumption entry and 

export documentation to drawback claims submitted by importers. However, system and procedural 

limitations decrease the effectiveness of this approach. 

The inherent risk of fraudulent claims or claims made in error is high, which increases the risk of erroneous 

payments. Since all, or a statistically valid sample, of the related drawback claims are not reviewed for a 

selected import entry, the possibility exists that the related drawback claims, in aggregate, will exceed the 

amount of duty and tax collected on the related import entry. In addition, the length of the drawback claim 

lifecycle often extends beyond the document retention period, which is set by statute at three years after 

payment of the claim. 

Criteria: 

Presented in Index of Financial Reporting and Internal Control Criteria behind Exhibit III. 

Recommendations: 

We recommend that CBP: 

1.	 Continue to pursue alternative compensating controls and measures that may ultimately identify the 

potential revenue loss exposure to CBP, as the incorporation of drawback processing is not in the nearterm schedule for ACE production. These alternative internal controls over drawback claims may 

result in the ability to compare, verify, and track essential information on drawback claims to the 

related UCEs and export documentation for which the drawback claim is based, and identify duplicate 

or excessive drawback claims; 

2.	 Develop and implement automated controls to prevent overpayment of a drawback claim; and 

3.	 Analyze current policies and procedures performed at the Drawback Centers, determine the 

cost/benefit of current procedures, and revise as necessary. 

CBP Response: 

See management’s response included in the attached letter. 

I.2
 
EXHIBIT II
 

Other Significant Deficiencies 

B.	 Property, Plant, and Equipment 

Background: 

U.S. Customs and Border Protection (CBP) has acquired substantial new technology, facilities, and other 

assets in recent years through purchase and construction. CBP’s increased assets primarily include 

construction of border fencing (both physical and virtual), purchase of inspection equipment at Ports of 

Entry, and new construction at Port of Entry facilities. 

Condition: 

Several weaknesses were identified related to CBP’s accounting for property, plant, and equipment 

(PP&E). Specifically, CBP: 

•	 Did not have a fully implemented, documented, formal review process in place to determine if the 

Percentage of Completion (POC) amounts, reported by Project/Construction Managers, were correct 

and led to accurate financial reporting under U.S. generally accepted accounting principles as it 

related to construction prior to the second quarter of FY 2011. Therefore, CBP did not detect 

inaccurate POCs reported throughout the first quarter or obtain supporting documentation for the 

POCs submitted by the Project/Construction Managers. Once CBP issued formalized guidance in the 

second quarter, the POC amounts reported varied, including both increases and decreases, from the 

POC amounts reported in the first quarter of the FY. In addition, the POC amounts continued to vary 

from the second quarter to the third quarter as a result of additional changes made to the process. 

Furthermore, the formalized guidance did not provide instructions on how to calculate POCs for 

general funding projects and thus CBP did not record a POC for the six projects identified as general 

funding projects. 

•	 Did not properly classify six American Recovery and Reinvestment Act projects. CBP recognized 

these projects as repairs and maintenance, which did not require a POC, when in fact the projects 

were ongoing leasehold improvements, which required a POC. 

•	 Did not properly and timely record certain construction-in-progress (CIP) settlement transactions. 

Specifically, there were 73 instances in which assets were untimely moved from CIP to fixed assets, 

resulting in the misclassification of assets in the general ledger. These delays spanned from one to 

twenty-six months. As a result of these late settlements, depreciation for the assets was understated 

from the time the assets were placed in service to when the assets were settled. To correct total 

depreciation in the general ledger, CBP recorded an additional $30.9 million in accumulated 

depreciation and depreciation expense. In addition, 16 assets were identified in which CBP 

understated the value of its assets that were placed in service. CBP did not recognize the full value of 

the asset until further invoices were received. Furthermore, CBP settled a project to the incorrect 

general ledger account and settled four projects to the incorrect sub-asset number. A project was also 

capitalized when it should have been expensed and another settlement was recorded in duplicate. 

Lastly, CBP did not properly complete and review certain Technically Complete (TECO) forms, 

which indicate when a project has been completed and determines when the transaction to record the 

settlement should occur. 

•	 Did not properly perform and/or document certain annual physical inventories related to real and 

personal property and did not detect assets incorrectly recorded, misclassified, or not recorded in the 

general ledger. In addition, the personal property inventory instructions did not provide sufficient 

detail for documenting the inventory results on the count sheets. 

II.1
 
EXHIBIT II
 

•	 Recorded certain asset additions for an amount other than the amount paid, without proper supporting 

documentation, in an untimely manner, or used the incorrect general ledger account. Furthermore, 

the transactions performed to record the asset additions did not consistently comply with the United 

States Standard General Ledger at the transaction level. 

•	 Did not properly input the correct capitalization date for 23 asset reclassifications, which in turn 

affected the corresponding accumulated depreciation balance. 

•	 Improperly recorded certain asset retirements. Specifically, some assets that were retired were still in 

use, did not have proper approval and/or supporting documentation, or the transaction used to record 

the retirement included an incorrect general ledger account. 

•	 Untimely recorded certain asset retirements and did not properly write-down the value of some assets 

that were no longer providing their expected services. Of the retirement transactions tested, one to 

thirty-four months lapsed between when an asset was physically removed from service and when it 

was retired from the system. 

Criteria: 

Presented in Index of Financial Reporting and Internal Control Criteria behind Exhibit III. 

Cause/Effect: 

CBP did not document and/or fully implement policies and procedures and does not have sufficient 

oversight of its policies and procedures, to ensure that all PP&E transactions are recorded timely and 

accurately. As a result, CBP’s CIP, PP&E, depreciation expense, and accumulated depreciation may be 

misstated at any point during the FY by the recording of transactions, which are incorrect, unsupported, or 

untimely. 

Recommendations: 

We recommend that CBP: 

1.	 Ensure standard operating procedures are in place and used by all Facilities, Management and 

Engineering Program Management Offices to create construction projects and to determine accurate 

POCs for all capitalized projects; 

2.	 Review current policies and procedures for the proper recordation of asset additions, transfers and 


retirements with regard to asset valuations and depreciation;
 

3.	 Determine whether existing policies and procedures regarding purchase orders and goods receipt are 

sufficient, revise policies where necessary, and communicate policies and procedures to receivers of 

goods throughout CBP; 

4.	 Establish and implement internal controls to ensure that timely and accurate transfer of completed 


assets from CIP to final asset settlement occurs;
 

5.	 Revise the current TECO process to include detailed accountability of time gaps, identify and correct 

problem areas, and establish procedures and training materials to ensure that the timely and correct 

accounting of assets occurs; 

6.	 Clearly define and communicate instructions regarding the requirements for the performance and 


documentation of physical inventories; and
 

7.	 Request system changes, where possible, to require the submission of detailed supporting
 

documentation, and to ensure the proper authorization for retirement has been obtained, prior to the 


completion of the asset retirement transaction.
 

II.2
 
 

 

 

 

EXHIBIT II
 

C.	 Entry Process 

1. In-Bond Program 

Background: 

General In-Bond Process 

An in-bond entry allows the movement of cargo through the United States without payment of 

duty or appraisement prior to entry into domestic or foreign commerce. The cargo may enter 

commerce after it arrives at the destination port and an entry is filed. An in-bond also allows 

foreign merchandise arriving at one U.S. port to be transported through the U.S. for export 

from another U.S. port without the payment of duty. The shipment might not enter commerce 

if the shipment is entered into a Bonded Warehouse or admitted into a Foreign Trade Zone. 

Compliance Audit and In-Bond 

In 1998, CBP implemented an audit system within the Automated Commercial System (ACS) to 

serve as a compliance measurement system. This audit system, known as Tin-Man, utilizes 

random physical examinations and post audit reviews to ensure bonded carrier compliance with 

bond obligations. Tin-Man is used to select ports to perform physical examinations at the time 

of arrival and departure and to perform post audit reviews of carrier activity. Once each week, 

ports throughout the U.S. should be assigned post audits and physical examinations to perform 

based on a U.S. Government Accountability Office approved algorithm. 

In-Bond Shipments Overdue for Export (M02) Report 

In-bond shipments overdue for export are included on the M02 report. Items on this report are 

in-bond movements transmitted by importers or brokers via the Automated Manifest System 

(AMS), Automated Broker Interface, or paper that have not been exported within the required 

time limit. Review of the M02 report is designed to identify, but is not limited to, cargo that 

has not been exported and therefore may have physically, but not formally entered into U.S. 

commerce, administrative or clerical errors with paperwork, or system processing errors. 

Monthly List of In-Bond Shipments Overdue (M07) Report 

In-bond shipments overdue are included on the M07 report. Data on paperless and 

conventional in-bond movements transmitted by AMS participants, as well as in-bond 

information input via the “In-Bond Departure” function in ACS appear on this report. Review 

of the M07 report is designed to identify cargo that has not arrived at the original destination 

port of entry communicated to CBP. 

Condition: 

The following weaknesses were identified over the in-bond program: 

•	 Ports are required to submit a summary of post audits conducted and the associated results 

to Headquarters. However, due to a system limitation in ACS, Headquarters cannot run an 

oversight report to determine if ports have completed all required audits. The “In-Bond 

Exam/Audit Selection” report in ACS is designed to provide this function, but it currently 

does not accurately list the history of all in-bonds selected for audit and is not consistent 

with the listing of incomplete Tin-Man audits on the “In-Bond Exam Audit Table” report. 

•	 Headquarters completes a monthly analysis of the post audits and results submitted from 

the ports to determine the overall compliance rate of the in-bond program; however, 

documentation of this analysis is not maintained. 

II.3
 
 

EXHIBIT II
 

•	 The M02 report does not track air in-bonds. 

•	 The design of the M02 and M07 reports causes these monitoring reports to contain old and 

outdated information. Therefore, the ports have been instructed to focus on the most 

current issues and are not required to completely resolve all items on the M02 and M07 

reports. Thus, items on the reports may go unresolved. 

•	 Tin-Man is designed to assign both examinations of cargo and post audits on a weekly 

basis. The frequency of the current year examinations and audits is determined by an 

algorithm based on prior year results in Tin-Man. In FY 2010, Tin-Man was not reset by 

the Office of Information Technology at the beginning of the fiscal year for cargo 

examinations; therefore, no cargo examinations for the ports were generated by Tin-Man. 

As the current year frequency is based on prior year results, some ports did not receive any 

cargo examinations designated by Tin-Man in FY 2011. 

Criteria: 

Presented in Index of Financial Reporting and Internal Control Criteria behind Exhibit III. 

Cause/Effect: 

A Headquarters memorandum to all field offices was issued in August 2011, indicating the 

retention guidelines for in-bond audits, in-bond examinations, the M02 report, and the M07 

report; however, not all ports were in compliance with the memorandum during FY 2011. 

Additionally, due to a flaw in the design of the M02 and M07 reports, there is no requirement 

for ports to completely resolve all items on the reports each time they are reviewed. The 

inability to effectively monitor the in-bond process and verify the arrival of in-bond 

merchandise at the port level could result in the loss of fines and penalty custodial revenue. 

Current ACS system limitations restrict the ability of CBP to accurately monitor the in-bond 

process, both at the Headquarters and port levels. The lack of an automatic compilation and 

analysis of audit results at the national level hampers CBP’s ability to ensure complete 

information is received from the ports to determine the effectiveness of in-bond audits and 

common in-bond errors. 

Recommendations: 

We recommend that CBP: 

1.	 Continue to monitor and review the Tin-Man audit results to ensure that the national inbond compliance rate continues; 

2.	 Implement the “M1” release in the Automated Commercial Environment (ACE), which 

will replace the M02 and M07 reports, and continue to monitor the in-bond system 

through the new in-bond compliance system being developed in the Automated Targeting 

System (ATS); and 

3.	 Continue to provide outreach and guidance to the field as necessary. 

2. Trade Compliance Measurement 

Background: 

Trade Compliance Measurement (TCM) provides key data to CBP for the management of risk 

associated with trade compliance and revenue collection. CBP utilizes TCM to measure the 

effectiveness of its control mechanisms deployed and its execution in collecting revenues 

II.4
 
EXHIBIT II
 

rightfully due to the U.S. Department of the Treasury. Further, TCM is used to determine the 

revenue gap that is reported as “Other Accompanying Information” in the financial statements. 

In February 2010, the targeting platform in ACS was replaced by ATS and the findings 

platform was replaced by ACE. This change affected all future entries, whether filed in ACE 

or ACS. All determinations from entry summary reviews are recorded in the Validation 

Activity (VA) tool in ACE. 

Condition: 

Improvements over the TCM process were observed in FY 2011; however, the following 

weaknesses related to TCM were identified: 

•	 TCM Coordinators inconsistently use data queries and reports to monitor TCM as TCM 

Coordinators in the field stated that the ACE reporting functionality is not operating 

effectively. Instances were identified when the ACE reports listed entries with a VA that 

had already been closed and/or the reports would not list TCM hits with open VAs. 

Therefore, the TCM Coordinators did not have a standard functioning method of 

monitoring TCM. 

•	 Ports did not fully understand the use of the ACE Inbox, which hosts TCM hits. Ports that 

generate more than 100 hits were not aware of the ACE Inbox functionality allowing users 

to view additional TCM hits needing attention. 

•	 Headquarters provides the ports with a monthly database, which provides an effective tool 

to analyze and monitor TCM hits; however, the Headquarters Database for the FY 2011 

TCM hits was not made available to the ports until February 2011. 

•	 CBP Directive 3550-074C, Uniform Input of Entry Summary Review Findings Using the 

ACE Validation Activity, issued March 18, 2011, does not provide sufficient information 

to the TCM Coordinators on how to appropriately review the ACE reports and the 

Headquarters Database. Details regarding the review, annotations, and maintenance of the 

reports were not provided. 

Criteria: 

Presented in Index of Financial Reporting and Internal Control Criteria behind Exhibit III. 

Cause/Effect: 

Incomplete guidelines and inconsistent use of the reporting tools to monitor TCM, may lead 

ports to inadequately monitor the TCM process throughout the FY, resulting in a lack of 

appropriate review of TCM entries. With inadequate oversight of the TCM data, CBP may 

have an inaccurately projected revenue gap. Additionally, CBP may incorrectly evaluate the 

effectiveness of its control environment over the collections of duties, taxes, and fees. 

Recommendations: 

We recommend that CBP: 

1.	 Continue distribution of the monthly TCM database, which satisfies the requirements for 

TCM Coordinator and Headquarters oversight of the TCM process at the port level; 

2.	 Ensure ports are appropriately reviewing the ACE reports in accordance with CBP 


Directive 3550-074C and issue new or updated guidance as needed; and
 

II.5
 
 

 

EXHIBIT II 

3.	 Communicate, at least quarterly, current issues needing attention and resolutions in place 

to the ports. 

3. Bonded Warehouse and Foreign Trade Zones 

Background: 

Bonded Warehouses (BWs) are facilities under CBP’s supervision used to store merchandise 

that has not made entry into the U.S. commerce. The merchandise stored in such warehouses 

is secured by the bond on the warehouse. Merchandise is entered into the BW by submission 

of the CBP Entry Summary Form 7501 and can be stored in the bonded facility for up to five 

years. 

Foreign Trade Zones (FTZs) are secure areas under CBP supervision considered outside of 

CBP territory. Authority for establishing these facilities is granted by the Foreign Trade 

Zones Board under the Foreign Trade Zones Act of 1934, as amended (19 United States Code 

(U.S.C.) 81a-81u). Foreign and domestic merchandise may be admitted into zones for 

operations not otherwise prohibited by law, including storage, exhibition, assembly, 

manufacturing, and processing. Merchandise is admitted into an FTZ using CBP Form 214. 

Condition: 

Improvements over the BW and FTZ processes were observed in FY 2011; however, the 

following internal control weaknesses were identified: 

•	 While CBP has developed national databases within ACE, which contain an inventory of 

all BWs and FTZs, CBP does not use the databases to document the assessed risk of each 

BW or FTZ, scheduled compliance reviews, or the results of compliance reviews. 

Although ACE is the system of record, CBP uses SharePoint to document the assessed 

risk of each BW or FTZ, scheduled compliance reviews, or the results of compliance 

reviews. In addition, CBP has not conducted a reconciliation of the Facilities 

Information Resource Management System codes within SharePoint due to known 

system issues. Furthermore, there are no requirements for Headquarters or the field 

offices to compare the ACE database to the compliance review schedules submitted by 

the ports to ensure that all compliance reviews are performed. 

•	 Headquarters compiles a survey that is completed by the ports at the end of each FY to 

determine the current status of the BW and FTZ programs. CBP performed an analysis 

over the FY 2011 survey results; however, the detailed analysis was not readily available 

and was unable to be provided. Additionally, the FY 2011 memo that Headquarters 

distributed to the ports with the intent to communicate the compliance results of the 

BW/FTZ programs did not contain detail of CBP’s internal analysis and results. The 

memo reiterated the responsibilities of the CBP Officers over the bonded facilities and 

commented on the external auditor’s results on the operating effectiveness of the 

program. 

Criteria: 

Presented in Index of Financial Reporting and Internal Control Criteria behind Exhibit III. 

Cause/Effect: 

CBP does not have updated, formal guidance related to Headquarters’ monitoring of the BW 

and FTZ programs, including procedures to ensure all necessary compliance reviews are 

scheduled and completed. 

II.6
 
 

 

EXHIBIT II
 

Headquarters cannot effectively monitor the BW and FTZ programs as there is no formal 

requirement for Headquarters to reconcile the database with the compliance reviews 

conducted. 

Recommendations: 

We recommend that CBP: 

1.	 Continue to monitor the compliance review results to ensure that the high national 

compliance rate continues; 

2.	 Continue to review facility profiles in ACE to make sure that profiles are constantly 

updated; 

3.	 Work within the constraints of the current fiscal parameters to develop additional training 

and information sharing processes for the ports; and 

4.	 Continue to provide outreach and guidance to the field as necessary. 

D. 	Information Technology 

Background: 

Controls over information technology (IT) and related financial systems are essential elements of 

financial reporting integrity. Effective general controls in an IT and financial systems environment are 

typically defined in five key control areas: security management, access control, configuration 

management, segregation of duties and contingency planning. In addition to reliable controls, financial 

management system functionality is important to program monitoring, increasing accountability of 

financial and program managers, providing better information for decision-making, and increasing the 

efficiency and effectiveness of services provided by the Federal government. 

Condition: 

During FY 2011, CBP took corrective action to address prior year IT control deficiencies. For example, 

CBP made improvements over various system logical access processes and system security settings. 

However, during FY 2011 new and continuing general IT control weaknesses were identified that could 

potentially impact CBP’s financial data. The most significant weaknesses from a financial statement 

audit perspective related to controls over access to programs and data. Collectively, the IT control 

weaknesses limit CBP’s ability to ensure that critical financial and operational data is maintained in such 

a manner to ensure confidentiality, integrity, and availability. Additionally, CBP’s current system of 

record used to process entries imported into the U.S. cannot support all of CBP’s operations, which limits 

CBP’s ability to effectively manage and monitor the custodial revenue and drawback processes. Because 

of the sensitive nature of the issues identified, we will issue a separate restricted distribution report that 

discusses the IT general control and functionality control deficiencies in more detail. 

Criteria: 

Presented in Index of Financial Reporting and Internal Control Criteria behind Exhibit III. 

Cause/Effect: 

Funding for IT development and implementation has been reduced in recent years, resulting in delays of 

systems which would replace or enhance current systems. In addition, because of the presence of IT 

control and financial system functionality weaknesses, there is added pressure on mitigating controls to 

operate effectively. 

II.7
 
 

EXHIBIT II
 

Recommendation: 

We recommend that CBP improve the application and general controls over its financial systems to 

ensure adequate security, protection, and functionality of the information systems. 

CBP Response: 

See management’s response included in the attached letter. 

II.8
 
 

 

 

 

Exhibit III 

Status of Prior Year Material Weakness and Significant Deficiencies 

Prior Year Condition As Reported at 

September 30, 2010 Status as of September 30, 2011 

Drawback of Duties, Taxes, 

and Fees 

Material weakness: The Automated 

Commercial System (ACS) lacked controls 

to detect and prevent excessive drawback 

claims and payments, requiring inefficient 

compensating manual processes. The 

drawback review policies did not require 

Drawback Specialists to review all related 

drawback claims. 

Continue as a material 

weakness: Weaknesses continue 

to exist related to the drawback 

process in FY 2011. See control 

finding letter A. 

Financial Reporting Significant deficiency: CBP did not have 

an effective process in place to timely 

review and analyze contractor information 

that could impact the financial statements. 

CBP did not have proper segregation of 

duties or sufficient review over manual 

journal entries. Additionally, CBP did not 

have sufficient controls or documented 

policies in place to detect errors in its 

population used to search for unrecorded 

accounts payable. 

Significant deficiency was 

remediated in FY 2011. 

Property, Plant, and Significant deficiency: Weaknesses Continue as a significant 

Equipment (PP&E) existed related to timely addressing the 

valuation of the Secure Border Initiative 

network (SBInet). As a result, a write-off 

was identified but was not timely recorded. 

Weaknesses existed related to the untimely 

transfer of construction-in-progress (CIP) 

to fixed assets and an understated value of 

assets that were placed into service. 

Several weaknesses existed related to 

oversight of PP&E, such as not properly 

performing inventory counts, and recording 

addition and retirement transactions 

untimely or inaccurately. 

deficiency: Weaknesses 

continue to exist related to 

untimely transfer of CIP to fixed 

assets and recording PP&E 

additions, reclassifications, and 

retirements. Additionally, 

weaknesses continue to exist 

with recording the percentage of 

completion for certain 

construction projects. See 

control finding B. 

Inactive Obligations Significant deficiency: Weaknesses 

existed in CBP’s policies and procedures 

related to the monitoring of obligations and 

the timely deobligation of inactive 

obligations. 

Significant deficiency was 

remediated in FY 2011. 

Entry Process – In-Bond Significant deficiency: Several 

weaknesses existed related to in-bond, such 

as lack of official guidance related to 

monitoring in-bond shipments at the port 

level, lack of CBP Headquarters review of 

the in-bond program, and the overall 

inability to determine the effectiveness of 

Continue as a significant 

deficiency: Weaknesses 

continued to exist related to inbond, such as ACS system issues 

preventing appropriate 

Headquarters oversight, 

inadequate documentation of the 

monthly in-bond analysis, 

III.1
 
 

 

Exhibit III 

Prior Year Condition As Reported at 

September 30, 2010 Status as of September 30, 2011 

the in-bond program for CBP in its entirety. inability to track air in-bonds, 

ineffective monitoring of the 

M02 and M07 reports, and TinMan system limitations. See 

control finding letter C, section 

1. 

Entry Process –Trade 

Compliance Measurement 

(TCM) 

Significant deficiency: Weaknesses 

existed related to TCM, such as 

inconsistent procedures followed at the 

ports and development and/or 

implementation of policies and procedures 

to ensure reliability and accuracy of TCM 

input results. 

Continue as a significant 

deficiency: Improvements were 

identified; however, weaknesses 

continue to exist related to TCM, 

such as inconsistent use of data 

queries and reports by TCM 

Coordinators, Automated 

Commercial Environment (ACE) 

reporting functionality 

limitations, inadequate training 

on ACE capabilities, inadequate 

monitoring and insufficient 

review guidance. See control 

finding letter C, section 2. 

Entry Process – Bonded Significant deficiency: Several Continue as a significant 

Warehouse (BW) and weaknesses existed related to the BW and deficiency: Weaknesses continue 

Foreign Trade Zones (FTZ) FTZ processes, such as inadequate 

monitoring and documentation, lack of risk 

assessment guidance and inconsistent 

procedures at the port level. 

to exist related to the BW and 

FTZ programs, such as 

inadequate monitoring and 

documentation. See control 

finding letter C, section 3. 

Information Technology 

(IT) 

Significant deficiency: Weaknesses 

existed related to IT general and application 

controls and IT functionality. Specifically, 

these included findings in the area of 

general IT security planning and 

management, logical and physical access to 

programs and data, segregation of duties, 

software change management, business 

continuity, and the ability of systems to 

accurately and completely track financial 

transactions. 

Continue as a significant 

deficiency: Weaknesses 

continue to exist related to IT 

general and application controls 

and IT functionality. In FY 

2011, the majority of prior year 

findings were unresolved and 

several new findings were 

identified See control finding 

letter D. 

III.2
 
Index 

Index of Financial Reporting and Internal Control Criteria 

(Listed Alphabetically by Criteria Source) 

Criteria Reference Report Exhibit 

Sections 111.23(a), 163.4, 191.51(b)(1) I-A 

Code of Federal Regulations, Title 19 Sections 18.2(d), 18.6(b), 18.8(b) II-C-1 

Sections 19.4(a), 146.3 II-C-3 

Federal Information Security 

Management Act II-D 

Office of Management and Budget (OMB) 

Circular No. A-123, Management’s 

Responsibility for Internal Control 

I-A, II-B, II-C-1, II-C-3 

OMB Circular No. A-127, Financial 

Management Systems II-D 

OMB Circular No. A-130, Management of 

Federal Information Resources II-D 

OMB Circular No. A-136, Financial 

Reporting Requirements Section II, Subsection 5.3 II-C-2 

Statement of Federal Financial 

Accounting Standards (SFFAS) No. 6, 

Accounting for Property, Plant, and 

Equipment 

II-B 

SFFAS No. 7, Accounting for Revenue 

and Other Financing Sources and 

Concepts for Reconciling Budgetary and 

Financial Accounting 

Section 69.2 II-C-2 

Index.1 
1300 Pennsylvani a. Avenue NW 

Washington, DC 20229 

' U.S. Customs and 

If ~ Border Protection f'~"D'~~ 

JAN 2 0 2012 

MEMORANDUM FOR: Anne L. Richards 

Assistant Inspector General for Audits 

Department of Homeland Security 

FROM: Deborah J. Schilling 

Chief Financial Officer 

U.S. Customs and Border Protection 

SUBJECT: Management Response to Independent Auditor's Report on U.S. 

Customs and Border Protection's Fiscal Year 2011 Financial 

Statements 

On behalf of U.S. Customs and Border Protection (CBP), I am responding to the Independent 

Auditor's Report on CBP's Fiscal Year (FY) 2011 Financial Statements, which is included in our 

FY 2011 Perfonnance and Accountability Report. 

I accept the independent public accounting firm's (KPMG LLP), unqualified opinion on CBP's 

FY 201 1 Financial Statements, which concluded that CBP's consolidated financial statements 

are fairly presented in all material respects in conformity with accounting principles. 

CBP has reviewed and concurs with the one material weakness and the three significant 

deficiencies. Mission Action Plans (MAPs) outlining CBP's strategy to correct these conditions 

were completed and provided to the Office of Financial Management, Department of Homeland 

Security. CBP will continue to work to resolve all auditor identified weaknesses. 

CBP appreciates the opportunity to review this year's audit report and looks forward to 

continuing our professional auditing relationship with your office. If you have any questions or 

would like additional infonnation, please contact me at (202) 344-2300, or a member of your 

staff may contact Jaye M. Williams, Executive Director, Financial Operations, at 

(202) 344·2364. 

Deborah J. Schilling 
 

Appendix A 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

Chief Information Officer 

U.S. Customs and Border Protection

 Commissioner 

 Chief Financial Officer 

 Chief Information Officer 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 
 

 

ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General 

(OIG) at (202)254-4100, fax your request to (202)254-4305, or e-mail your request to 

our OIG Office of Public Affairs at DHS-OIG.OfficePublicAffairs@dhs.gov. For 

additional information, visit our OIG website at www.oig.dhs.gov or follow us on Twitter 

@dhsoig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 

or noncriminal misconduct relative to Department of Homeland Security programs and 

operations: 

• Call our Hotline at 1-800-323-8603 

• Fax the complaint directly to us at (202)254-4292 

• E-mail us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigation - Hotline, 

245 Murray Drive SW, Building 410 

Washington, DC 20528 

The OIG seeks to protect the identity of each writer and caller.