U.S. RAILROAD RETIREMENT BOARD

OFFICE OF INSPECTOR GENERAL 

Railroad Retirement Board 

Bureau of Fiscal Operations 

Sections’ Functions Need 

Improvement

Report No. 21-08 September 1, 2021
OFFICE OF INSPECTOR GENERAL

U.S. RAILROAD RETIREMENT BOARD

Railroad Retirement Board Bureau of Fiscal Operations Sections’ 

Functions Need Improvement

Report Summary September 1, 2021 Report No. 21-08

What WAI Found

Wai & Associates, PLLC (WAI) concluded that five weaknesses 

significantly affect the effectiveness and efficiency of the 

Railroad Retirement Board’s (RRB) Bureau of Fiscal 

Operations’ (BFO) Treasury, Debt Recovery, and Financial 

Systems Sections’ (TS, DRS, and FSS, respectively) operations, 

including inefficiencies that affect the optimum use of 

resources. 

WAI also concluded that exceptions and errors in criminal 

restitution debt and employer contributions transactions of 

DRS and TS render them inaccurate, incomplete, and/or

untimely recorded. Additionally, WAI concluded that crossorganizational communication between DRS and another

RRB component (RRB’s Office of Programs) is inadequate for 

their shared responsibility for the unapplied cash function.

Lastly, WAI determined that seven of eight key functions 

identified within DRS are outsourceable, and one of the four 

key functions identified within TS is outsourceable. For FSS, 

WAI determined that three of five functions are

outsourceable, of which two are already outsourced.

What WAI Recommends

To address the weaknesses identified in this audit, WAI made 

18 recommendations to the Bureau of Fiscal Operations.

Specifically, WAI made 13 recommendations to address the 

weaknesses that affect the effectiveness and efficiency of 

BFO Sections’ operations, 3 recommendations to improve 

criminal restitution debt and employer contributions 

transactions, and 2 recommendations to improve the 

communication for unapplied cash functions that BFO shares 

with another RRB component.

RRB management concurred with six recommendations, 

partially concurred with five recommendations, and did not 

concur with seven recommendations.

What We Did

The Office of Inspector General (OIG) for 

the RRB engaged WAI to conduct a 

performance audit of the effectiveness 

and efficiency of RRB’s BFO’s TS, DRS, and 

FSS. This audit was conducted in 

accordance with the performance audit 

standards established by Generally 

Accepted Government Auditing 

Standards. WAI is responsible for the 

audit report and the conclusions 

expressed therein. RRB OIG does not 

express any assurance on the conclusions 

presented in WAI’s audit report.

The audit objective was to assess the 

effectiveness and efficiency of RRB BFO

TS, DRS, and FSS, the effectiveness of 

cross organizational communications 

within the RRB, and determine if the 

functions of the TS, DRS, and/or FSS could

be outsourced.

The scope of the audit was operations of 

RRB BFO TS, DRS, and FSS during fiscal 

year 2019.
Railroad Retirement Board Bureau of Fiscal 

Operations Sections’ Functions Need 

Improvement

Wai and Associates, PLLC

5415 Backlick Road, Suite B

Springfield VA 22151

Tel: 703-639-8080

www.waicpa.com
2

Table of Contents

Railroad Retirement Board Bureau of Fiscal Operations Sections’ Functions Need Improvement3

OBJECTIVE, SCOPE, AND METHODOLOGY.......................................................................... 5

BACKGROUND ............................................................................................................................ 9

RESULTS OF THE AUDIT......................................................................................................... 10

A Comprehensive Set of Policies and Procedures Guiding the Sections’ Operations is 

Inadequate or Does Not Exist ............................................................................................... 11

Key Controls Necessary for Efficiency and Effectiveness in the Sections’ Operations Are 

Improperly Designed or Not Operating Effectively ............................................................. 15

Transactions Relating to Criminal Restitution Debt Recorded by the RRB BFO Debt 

Recovery Section Were Inaccurate, Incomplete, and/or Untimely....................................... 17

Financial Systems Section Does Not Perform Adequate Oversight of Functions Outsourced 

to a Contractor....................................................................................................................... 18

Financial Systems Section does Not Have Controls to Mitigate Key Person Dependency and 

Succession Planning Risk for Key Positions........................................................................ 22

Inefficiencies Noted in Sections’ Operations Affect the Optimum Use of Resources......... 24

Communication with Other RRB Components Sharing Responsibility for Unapplied Cash 

Functions is Inadequate......................................................................................................... 27

Treasury Section Does Not Perform Verification of Data Critical for Accurate Recording of 

Employer Contributions........................................................................................................ 28

Appendix A: Management Response Memo.................................................................................. 32

Appendix B: Summary of Assessment of Outsourceable Functions ............................................. 41

Appendix C: Sampling Methodology and Evaluation of Sample Testing Results ........................ 44
3

Railroad Retirement Board Bureau of Fiscal Operations Sections’ Functions Need 

Improvement

Inspector General

U.S. Railroad Retirement Board:

We were engaged by the U.S. Railroad Retirement Board (RRB), Office of Inspector General 

(OIG), to conduct a performance audit of the effectiveness and efficiency of RRB’s Bureau of 

Fiscal Operations’ (BFO) Treasury, Debt Recovery, and Financial Systems sections for the 

Fiscal Year (FY) 2019. This report entitled “Railroad Retirement Board Bureau of Fiscal 

Operations Sections’ Need Improvement” presents the results of our audit. 

Our performance audit objectives were to: 1) assess the effectiveness and efficiency of RRB 

BFO Treasury, Debt Recovery, and Financial Systems sections, including the effectiveness of 

cross organizational communications within the RRB, and 2) determine if the functions of the

Treasury, Debt Recovery, and Financial Systems sections can be outsourced.

To perform our audit, we identified and reviewed laws, regulations, as well as internal policies 

and procedures that serve as authoritative bases for the sections operations and underlying 

transactions. 

We interviewed personnel within RRB BFO Treasury, Debt Recovery, and Financial Systems 

sections, as well as Senior Management of BFO, and conducted walkthroughs to develop an 

understanding of key business processes and controls underlying the sections’ operations. We 

identified and evaluated the design and operating effectiveness of controls within key processes 

that ensure the effectiveness and efficiency of sections’ operations and the accuracy of related 

transactions and reports. We also reviewed, analyzed, and validated reconciliations and selected 

and tested samples of transactions underlying the sections’ operations, including criminal 

restitution, waivers and write-offs, collections, travel invoices, and purchase invoices. 

We evaluated the degree to which Management of the respective sections optimizes the use of 

available resources to achieve the goals and objectives of the sections and determined whether 

any function is ineffective and/or inefficient. We also performed procedures to determine 

appropriateness for outsourcing functions given the provisions of Federal Acquisition 

Regulations (FAR) Subpart 7.5 Inherently Governmental Functions, and other applicable 

guidance. 

We conducted this performance audit in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions 
4

based on our audit objectives.

1 We believe that the evidence obtained provides a reasonable basis 

for our findings and conclusions based on our audit objectives. 

We concluded that weaknesses noted significantly affect the effectiveness and efficiency of RRB 

BFO Treasury, Debt Recovery, and Financial Systems sections’ operations, including 

inefficiencies that affect the optimum use of resources. Those weaknesses include:

• lack of adequate and comprehensive set of policies and procedures guiding the RRB BFO 

Treasury, Debt Recovery, and Financial Systems sections’ operations;

• key controls necessary for efficiency and effectiveness in the RRB BFO Debt Recovery, 

and Financial Systems sections’ operations are improperly designed or not operating 

effectively;

• RRB BFO Financial Systems Section does not perform adequate oversight of functions 

outsourced to a contractor;

• RRB BFO Financial Systems Section does not have controls to mitigate key person 

dependency and succession planning risk for its key positions; and

• inefficiencies noted in RRB BFO Debt Recovery, and Financial Systems sections’ 

operations affect the optimum use of resources. 

We issued five Notice of Findings and Recommendations (NFRs) relating to the weaknesses 

identified above. 

We also concluded that exceptions and errors noted in transactions of RRB BFO Debt Recovery 

Section render them inaccurate, incomplete, and untimely recorded. Those exceptions and errors 

include:

• transactions relating to criminal restitution debt recorded by the RRB BFO Debt 

Recovery Section were inaccurate, incomplete, and/or untimely; and

• RRB BFO Treasury Section does not perform verification of data critical for accurate 

recording of employer contributions. 

We issued two NFRs relating to the exceptions and errors noted in RRB BFO Debt Recovery 

Section’s transactions as described above. 

We concluded that cross-organizational communication between BFO Debt Recovery Section 

and another component sharing responsibility for unapplied cash function is inadequate. We did 

not determine any other evidence of a lack of cross-organizational communication within the 

RRB BFO Treasury and Financial Systems sections. 

We issued one NFR relating to the inadequate cross-organizational communication weaknesses 

identified in BFO Debt Recovery Section as described above. 

We also performed procedures to determine whether functions within each of the sections can be 

outsourced, based on whether they are inherently governmental. 

1 GAO Government Auditing Standards 2018 Revision Technical Update April 2021, Section 8.35.d. 
5

We determined that seven of eight key functions identified within Debt Recovery Section are 

outsourceable, and one of the four key functions identified within Treasury Section is 

outsourceable. For Financial Systems Section, we determined that three of five functions are 

outsourceable. However, two of the three outsourceable functions are currently outsourced to a 

contractor. See Appendix B, “Summary of Assessment of Outsourceable Functions”, for a listing 

of key functions of the sections, and our conclusions on outsourceable functions. 

This report is for the purpose of concluding on the audit objectives described above. 

Accordingly, this report is not suitable for any other purpose. 

Wai and Associates, PLLC

Augsut 31, 2021

Springfield, VA

OBJECTIVE, SCOPE, AND METHODOLOGY

Objective

The objective of our audit is to assess the effectiveness and efficiency of RRB BFO Treasury

Section (TS), Debt Recovery Section (DRS), and Financial Systems Section (FSS), the 

effectiveness of cross organizational communications within the RRB, and determine if the 

functions of the TS, DRS, and/or FSS can be outsourced.

Scope

Subject to this audit were the operations and activities of the three sections that were in effect 

from October 1, 2018, through September 30, 2019. The scope of our audit covered operations of 

RRB BFO TS, DRS, and FSS for the FY ended September 30, 2019.

Methodology

In accomplishing our audit objectives, we utilized the following methodologies:

• identified and reviewed laws and regulations, as well as internal RRB policies and 

procedures applicable to the sections’ operations;

• interviewed personnel within RRB BFO TS, DRS, and FSS, as well as Senior 

Management of BFO (Management), and conducted walkthroughs to develop an 

understanding of key business processes and controls underlying the sections’ operations; 

• performed audit procedures specifically required by generally accepted government 

auditing standards to address the objectives described above;

• evaluated the design and operating effectiveness of key controls identified in the 

processes subject to our audit, as well as controls at the transaction level; and 

• performed specific analytical procedures to evaluate the degree to which management of 

the respective sections optimizes the use of available resources to achieve the goals and 
6

objectives of the sections, and determined whether an ineffective and/or inefficient 

function should be improved, discontinued, or outsourced. 

As required by Government Accountability Office (GAO) guidance2, WAI also performed 

procedures to assess the reliability of computer-generated data. In doing so, we identified 

specific data necessary for our audit; analyzed data characteristics; assessed the use of data; 

examined data for errors, inaccuracies, and completeness; reconciled data to source; considered 

system control to determine the current state of data system controls; and communicated errors 

and exceptions noted in the data with RRB personnel knowledgeable about the data. Because of 

the errors and exceptions noted in the data, we conclude that the data was not reliable for the 

purpose of our audit. Therefore, we did not rely on the data to conclude on the audit objectives. 

As part of our control testing at the transaction level, we validated reconciliations and selected 

and tested samples of transactions underlying the sections’ operations, including criminal 

restitution debts, waivers and write-offs, collections, travel invoices, and purchase invoices. See 

Appendix C: Sampling Methodology and Evaluation of Sample Testing Results for the universe 

of transactions subject to our testing, including sample size and exceptions and deviations noted.

Based on this methodology, WAI selected and tested 78 samples from the population of each of 

types of transactions to test, in accordance with our sampling methodology. 

Process Level Controls Testing—for internal control assessment relating to the functions of the 

sections, WAI tested all key controls identified in the processes underlying the sections’ 

operations in order to determine existence and completeness of applicable control attributes: 

DRS Section

• For the key control of establishing policies, WAI tested 1 out of 1 set of policies to test 

the attributes of existence, accuracy, and currency of policies that establish an overall 

framework for accomplishing the section’s objectives

• For the key control of developing procedures, WAI tested 1 out of a population of 1 set of 

procedures, to test the attributes of existence, accuracy, and currency of procedures that 

document the section’s processes and functions for achieving its objectives

FSS Section 

• For the key control of establishing policies, WAI tested 1 out of 1 set of policies to test 

the attributes of existence, accuracy, and currency of policies that establish an overall 

framework for accomplishing the section’s objectives 

• For the key control of developing procedures, WAI tested 1 out of a population of 1 set of 

procedures, to test the attributes of existence, accuracy, and currency of procedures that 

document the section’s processes and functions for achieving its objectives 

2 GAO Applied Research and Methods, Assessing Data Reliability (GAO-20-283G), December 2019 
7

• For the key control of approving users access to FMIS, WAI selected 5 from a population 

of 5 users and tested attributes related to the appropriateness and timeliness of granting 

users access to FMIS 

• For the key control of terminating users access from FMIS, WAI selected 5 from a 

population of 5 users, to test attributes relating to the timeliness of revoking access from 

FMIS

• For the key control of continuous monitoring of users’ access to FMIS, WAI selected 9 

from a population of 9 users, to test attributes relating to the occurrence of periodic 

review of user recertification for continuous access to FMIS 

• For the key control of approving RRB users access to US Treasury systems, WAI 

selected 5 from a population of 5 users and tested attributes related to the appropriateness 

and timeliness of granting users access to US Treasury systems 

• For the key control of periodically updating FMIS data tables, WAI selected 3 out of the 

3 FMIS tables updated by FSS, to test attributes related to the timeliness and accuracy of 

data table updates

• For the key control of reviewing FMIS issue log, WAI selected 1 out of a population of 1 

issue log for FY 2019, to test attributes relating to the occurrence and timeliness of FSS 

review of FMIS issues log 

• For the key control around FSS’ review of monthly service level reports for FMIS users, 

WAI selected 12 out of a population of 12 monthly service level reports, to test attributes 

relating to the occurrence and timeliness of review of FMIS monthly service level reports 

• For the key control of monitoring FMIS security, through updating the system’s security 

plan, WAI selected 1 annual update of FMIS security plan from a population of 1 year, to 

test the attributes of existence, review, and currency of FMIS security plan 

• For the key control of FSS tracking and implementing corrective actions associated with 

FMIS reviews and findings, WAI selected 1 out of a population of 1 of the Plan of Action 

and Milestones (POAM) for FY 2019, to test the attributes of existence, review, and 

currency of FSS tracking and implementation of corrective actions required to address 

issues identified during various audits of FMIS

• For the key control of monitoring FSS contractors for FMIS outsourced functions, WAI 

selected 1 out of a population of 1 service level agreements (SLA), to test the attributes of 

existence, accuracy, currency, and monitoring of FSS’ agreement with its FMIS 

contractor 

• For the key control of monitoring FSS monitoring of its FMIS service provider’ audit 

issues, WAI selected 1 out of a population of 1 Standards for Attestation Engagements 

(SSAE) reports, to test attributes of review and follow-up by FSS

• For the key control of change management to FMIS, WAI selected 1 out of a population 

of 1 change made to FMIS in FY 2019, to test attributes of the timeliness and 

authorization of changes and modifications to FMIS 
8

TS Section 

• For the key control of establishing policies, WAI tested 1 out of 1 set of policies to test 

the attributes of existence, accuracy, and currency of policies that establish an overall 

framework for accomplishing the section’s objectives 

• For the key control of developing procedures, WAI tested 1 out of a population of 1 set of 

procedures, to test the attributes of existence, accuracy, and currency of procedures that 

document the section’s processes and functions for achieving its objectives 

• For the key control of reviewing disbursements for duplicate payments, WAI tested 4 out

of a population of 4 reports to test the attributes of performance, accuracy, and timeliness 

of reviews of disbursements

• For the key control of reviewing benefits transactions to accurate recording, WAI 

selected a sample of 78 out of a population of 241 recorded benefit transactions, to test 

attributes of occurrence of review and the timeliness and accuracy of recorded 

transactions

• For the key control of periodically reviewing enrollees' eligibility for RRB metro 

benefits, WAI selected a sample of 1 from a population of 1, to review the attributes of 

occurrence of eligibility validation and the timeliness of enrollments

• For the key control of periodically reconciling employer contributions benefits, WAI 

selected a sample of 1 reconciliation out of a population of 1 annual reconciliation for FY 

2019, and tested the attributes of occurrence of reconciliation and reasonableness of the 

completion of reconciliation of employer contributions 

Transaction-level control testing—WAI also tested attributes in samples of transactions making 

up account balances related to the operations of Treasury, Debt Recovery and Financial Systems 

sections. Based on this, WAI selected 78 samples for testing in accordance with our sampling 

methodology. 

With respect to our transaction-level control testing, our procedures were limited to evaluation of 

attributes related to the controls, and our conclusions on the effectiveness of controls were based 

on whether the number of errors identified fall within or outside of our predetermined acceptable 

deviations. We did not project the errors we found in the samples to the entire population, 

because we tested specific attributes of each control; and projection of error is not applicable to 

attribute testing. WAI used the universe of transactions making up significant account balances 

for the period ended September 30, 2019. The population of transactions selected for testing at 

the transaction control-level and the sample size tested included: 

• A sample of 6 criminal restitution debts were tested out of a population of 6 for testing of 

completeness, existence, and accuracy/valuation or allocation

• A sample of 76 waivers and write-offs were tested out of a population of 76 for testing of 

completeness, existence, and accuracy/valuation or allocation

• A sample of 78 samples were selected from a population of 67,577 RRA collection 

transactions for testing of completeness, existence, and accuracy/valuation or allocation
9

• A sample of 78 samples were selected from a population of 21,497 RUIA collection 

transactions for testing of completeness, existence, and accuracy/valuation or allocation

• A sample of 78 samples was selected from a population of 2,093 travel invoices for 

testing of completeness, existence, and accuracy/valuation or allocation

• A sample of 78 samples was selected from a population of 1,664 purchase invoices for 

testing of completeness, existence, and accuracy/valuation or allocation

Criteria

WAI conducted the audit in accordance with Generally Accepted Government Auditing 

Standards (GAGAS). Specifically, we utilized chapters 8 and 9 of GAGAS3(GAO-18-568G 

revised July 2018) as it relates to performance audit. GAGAS also requires us to use our 

judgement to determine criteria that will enable us to “obtain sufficient, appropriate evidence that 

provides a reasonable basis for findings and conclusions based on the audit objectives.”

4 We also 

utilized the GAO Standards for Internal Control in Federal Government (Green Book), and 

Office of Management Budget (OMB) Circular No A-123, Management’s Responsibility for 

Enterprise Risk Management and Internal Control, Revised July 2016, as applicable. 

In complying with GAGAS requirements for performance audit, we obtained a reasonable 

assurance that evidence gathered throughout this audit is sufficient and appropriate to support 

our findings and conclusions in relation to the objectives described above.

5

As part of our process of identifying outsourceable functions, we used the FAR Subpart 7.5 

Inherently Governmental Functions, which prescribes policies and procedures to ensure that 

contractors do not perform inherently governmental functions; and the Office of Federal 

Procurement Policy (OFPP) Policy Letter 11-01, which guides agencies within the Executive 

Branch of the US government in addressing the performance of inherently governmental 

functions and critical functions; the Federal Activities Inventory Reform Act (FAIR Act) of 

1998, which provides a process for determining functions within the Federal Government that 

are not inherently governmental, and OMB Circular No. A-76 (Revised), Performance of 

Commercial Activities, which establishes federal policy for the competition of commercial 

activities, and requires that government personnel perform inherently governmental functions.

BACKGROUND

RRB is an independent Federal Government agency with headquarters in Chicago, Illinois. The 

agency’s function is to administer retirement-survivor and unemployment-sickness benefit 

programs for railroad workers and their families. 

3 GAO Government Auditing Standards, 2018 Revision Technical Update April 2021

4 GAO Government Auditing Standards, 2018 Technical Update April 2021, Section 3.01 

5 GAO Government Auditing Standards 2018 Revision Technical Update April 2021, Section 8.35.d
10

RRB BFO is responsible for the agency’s financial related activities. Responsibility for these 

activities is divided among several sections. Three of these sections—TS, DRS, and FSS are 

subject to our audit. The TS is responsible for processing accounts payable and liquidation of the 

agency’s obligations, as well as for managing the RRB tax and contributions system. The DRS is 

responsible for managing debts, including collection, recording, and reporting of debts, as well 

as addressing delinquencies and adjudicating waivers and write-offs. The FSS is responsible for 

designing, managing, and maintaining the agency’s financial system—Financial Management 

Integrated System (FMIS). 

During FY 2020, RRB paid retirement and survivor benefit payments totaling approximately 

$13.1 billion to about 528,000 retirement and survivor beneficiaries. The agency also paid net 

unemployment/sickness benefits of $188 million to about 41,000 claimants.6

RESULTS OF THE AUDIT

Based on the results of our audit, we identified several weaknesses and exceptions which are 

described as follows: 

• a lack of an adequate and comprehensive set of policies and procedures guiding the 

sections’ operations;

• key controls necessary for efficiency and effectiveness in the sections’ operations are 

improperly designed or not operating effectively;

• transactions relating to criminal restitution debt recorded by the RRB BFO DRS were 

inaccurate, incomplete, and/or untimely;

• BFO Financial Systems Section does not perform adequate oversight of functions 

outsourced to a contractor;

• RRB BFO FSS does not have controls to mitigate key person dependency and succession 

planning risk for its key positions; 

• inefficiencies noted in sections’ operations affect the optimum use of resources;

• communication with other RRB components sharing responsibility for unapplied cash 

functions is inadequate; and 

• RRB BFO TS does not perform verification of data critical for accurate recording of 

employer contributions.

As described in the details below, we have issued 18 recommendations to address the 

weaknesses and exceptions noted during this audit. These weaknesses coupled with the 

exceptions noted in the transactions, in our judgement, significantly affect the effectiveness and 

efficiency of operations of BFO sections subject to our audit. 

6 U.S. Railroad Retirement Board, An Agency Overview, January 2021, page 1, par 2 
11

A Comprehensive Set of Policies and Procedures Guiding the Sections’ Operations is 

Inadequate or Does Not Exist

To test the existence, adequacy, and evidence of periodic review of policies for the sections, 

WAI requested copies of policies or equivalent documentation that form the authoritative 

guidance for the implementation of RRB mandates for DRS, FSS, and TS. In response to our 

request for policies, Management provided RRB Basic Board Order 4 (B.B.O.4) - Money and 

Finance Policies (Board Orders). 

The Green Book provides guidance on using policies as control activities. According to the 

Green Book “management should implement control activities through policies.” It further notes 

that “the following attributes contribute to the design, implementation, and operating 

effectiveness of this principle: Documentation of Responsibilities through Policies.” To 

effectively document responsibilities through policies, it requires that “management documents 

in policies for each unit its responsibility for an operational process’s objectives and related 

risks, and control activity design, implementation, and operating effectiveness. Each unit, with 

guidance from management, determines the policies necessary to operate the process based on 

the objectives and related risks for the operational process. Each unit also documents policies in 

the appropriate level of detail to allow management to effectively monitor the control activity.” 

The second attribute of an effective policy, as defined by Principle—12 of the Green Book, is a 

periodic review of control activities. It requires that “management periodically reviews policies, 

procedures, and related control activities for continued relevance and effectiveness in achieving 

the entity’s objectives or addressing related risks.” 

WAI reviewed the Board Orders to determine whether they were adequate in guiding personnel 

and management in achieving the objectives of the sections. RRB’s Board Orders establishes 

broad mandates of RRB’s financial management systems as well responsibilities of FSS. Section 

6 of the Board Orders “Debt Collection Program” also establishes broad mandates of RRB’s debt 

recovery program and the responsibilities for DRS and broad mandate for RRB tax collection 

program which includes some of the functions performed by TS. 

Upon review of the Board Orders, we determined that the documents are broad directives 

describing the goals and objectives of divisions within RRB, including BFO. They are written at 

the division level, do not provide sufficient detail for an effective monitoring of control 

activities, and do not provide specific activities that the sections are expected to do in carrying 

out their respective functions. WAI also determined that the Board Orders contained no dates or 

evidence of periodic review and update of control activities.

In addition to policies, WAI performed procedures to test the existence, adequacy, and evidence 

of periodic review of procedures for the sections. WAI also requested detailed procedures that 

clearly explain their processes and key controls within those processes. 

BFO did not provide any procedures for FSS’ functions. In addition, BFO did not provide 

procedures for two of its key functions, including TS’s Tax Management System and Payroll 
12

Processing Management. For these TS’ functions, BFO provided its Management Control 

Reviews (MCR) and reconciliation guidance. Based on a review of the MCR, WAI noted that it 

is a tri-annual (performed every 3 years) self-assessment certification of internal controls 

conducted by RRB’s assessable units (AU). We determined that it does not guide personnel in 

performing their assigned tasks and control activities. Also, the MCR is not readily available to 

personnel during the normal course of their work. Upon review of the reconciliation documents 

provided by BFO, we determined that they were guidelines on the timing and description of 

procedures required to be performed; unlike procedures, they do not provide detail steps on how 

to perform those procedures. 

In instances where Management provided procedures or equivalent documentation, WAI noted 

that they were not adequate and/or up to date. WAI noted the following: TS provided procedures 

for its Accounts Payable function. However, the procedures were outdated; they were dated 

June 19, 2012. Upon further review of the procedures, WAI observed that certain processes 

noted in the document were inaccurate. For instance, the document referred to a key control 

requiring a submission of “Receiver Document” through the system, in the payment 

authorization process for invoices related to obligations. However, TS personnel noted that 

references to a “receiver document” does not exist within FMIS, the current system used by TS 

to process accounts payable. Instead, it is applicable to the Federal Financial System (FFS), a 

predecessor system to FMIS. Based on our confirmation with Management and a review of prior 

audit reports, WAI noted that FMIS was implemented in October 2013. As such, the current 

procedures were referring to steps that had not been applicable since October 2013. Furthermore, 

the procedures provided by BFO contained no evidence of review and approval. Based on this, 

WAI concluded that TS procedures were inaccurate, outdated, and contains no evidence of 

periodic review and approval by Management. 

DRS provided procedures and documentation for various processes including the processing of 

waivers, criminal restitution debt, lockbox and pay.gov collection, copy of debt adjustment 

request form, cash handling, delinquent debt, and uncollectable debts. The procedures provided 

by DRS were either marked as "draft" and/or contained no evidence of review and approval. 

Management could not state when the current versions of the procedures were drafted. However, 

management noted that previous versions of the procedures were drafted prior to the current 

FMIS environment and were obsolete. Based on our confirmation with Management and a 

review of prior audit reports, WAI noted that FMIS was implemented in October 2013. As 

Management could not say when the current versions of the procedures were drafted, WAI 

further reviewed the “properties” of the procedures provided and noted that they were all created 

around August and October 2020. Based on the creation period noted in the documents’ 

properties and Management’s comment that the previous versions of the procedures were created 

prior to the implementation of FMIS in FY 2013, WAI determined that DRS did not have 

updated procedures for its functions between FY 2013 and FY 2020. As such, WAI concluded 

that the current procedures provided were not in effect in FY 2019. In addition, as the procedures 

provided were in “draft” form and contained no evidence of review and approval between FY

2013 and FY 2020, WAI concluded that Management does not review and update these 

procedures timely. 
13

Federal Managers Financial Integrity Act (FMFIA) of 1982 and its implementing guide, OMB 

Circular A-123, revised July 15, 2016, stipulate federal managers’ responsibility for internal 

control. Key components of internal control as prescribed by both the Committee of Sponsoring 

Organizations (COSO) framework and the GAO Green Book include the development of 

adequate policies and procedures as part of the development of “Control Activities.” Per OMB 

Circular A-123, revised July 15, 2016, management is “responsible for establishing and 

maintaining internal controls to achieve specific internal control objectives related to operations, 

reporting, and compliance.” Section OV2.04, of the Green Book specifically states that Control 

Activities are “actions management establishes through policies and procedures to achieve 

objectives and respond to risks in the internal control system, which includes the entity’s 

information system.” Section OV2.02, of the Green Book further states that “management is 

responsible for designing the policies and procedures to fit an entity’s circumstances and 

building them in as an integral part of the entity’s operations.” Management lacks adequate 

resources to develop and maintain policies and procedures. FSS noted that its two-member staff 

was inadequate to perform their assigned tasks and document procedures during the transition of 

its retiring Financial Manager. 

Management may lack adequate expertise to develop and maintain policies and procedures. 

Management equated RRB Board Orders, MCR documentation, and reconciliation guidance to 

policies and procedures. In our opinion, this demonstrates a lack of fundamental understanding 

of the attributes of policies and procedures. In addition, WAI noted that DRS charged significant 

number of hours and costs to codes related to the development of policies and procedures 

between FY 2019 through FY 2021 and was unable to produce policies and effective procedures. 

This inconsistency between the input (hours and costs incurred) output (lack of adequate policies 

and procedures), demonstrates that Management may lack expertise in performing the function. 

Management does not view the development and maintenance of policies and procedures as a 

requirement. For instance, FSS noted that it does not participate in RRB’s MCR process, and 

therefore is not required to perform risk assessment. In our judgment, this impacts BFO’s view 

of its responsibilities to develop control activities, including the development and maintenance of 

policies and procedures for FSS. 

Recommendations: 

We recommend that the Bureau of Fiscal Operations:

1. develop and maintain comprehensive set of policies and procedures for DRS, FSS, and TS, 

using in-house personnel with adequate relevant expertise and experience, or outsource the 

task to an entity with the relevant expertise and experience; 

2. assess the work effort required and hire adequate personnel to perform FSS functions; 

3. ensure that the development and maintenance of policies and procedures for DRS, FSS, and 

TS are performed by personnel with appropriate expertise; and
14

4. require FSS to participate in BFO’s MCR certification process, so that risks associated with 

the lack of adequate policies and procedures can be identified, mitigated, and reported on.

Management’s Response and Auditor’s Consideration of Management’s Response

The BFO concurred with recommendations 1 and 4 without exception. See full text to 

Management’s response in Appendix A. 

For recommendation 2, BFO non-concurred and stated, 

This recommendation is duplicative; please see also the discussion under Finding No. 5 and 

Recommendations No. 11 and 12. It is not cost effective for the BFO to perform an “assessment 

of the work effort required.” BFO Management has already determined the staffing level needed 

to support effective and efficient performance of FSS functions. BFO’s ability to hire an 

adequate number of staff for FSS is subject to the availability of sufficient funding and 

consideration of other Agency priorities as determined by the Board and the Executive 

Committee.

We disagree with Management that the recommendation is duplicative. The elements of the 

findings relating to recommendations 2, 11, and 12 as described are different. Therefore, even 

though we determined that the unique conditions were caused by a lack of adequate staffing, 

each recommendation is designed to address those unique elements underlying each finding. 

Therefore, they are not duplicates. Furthermore, in Management’s responses to recommendation 

12, RRB agrees to implement corrective actions in response to the recommendation. 

Accordingly, we conclude that finding and related recommendation in No. 2 still stands. 

For recommendation 3, BFO non-concurred and stated, 

This recommendation is duplicative of Recommendation No. 1.

We disagree with management that the recommendation is duplicative. We determined that the 

elements of the findings relating to recommendations 1 and 3, as described are different. 

Therefore, even though we determined that the unique conditions were caused by a lack of or 

inadequacy of policies and procedures, each recommendation is designed to address those unique 

elements underlying each finding. Therefore, they are not duplicates. Furthermore, in 

Management’s responses to recommendation 1, RRB agrees to implement corrective actions in 

response to the recommendation. Accordingly, we conclude that the findings and related 

recommendation in No 3 still stands. 

 
15

Key Controls Necessary for Efficiency and Effectiveness in the Sections’ Operations Are 

Improperly Designed or Not Operating Effectively 

WAI determined that key controls activities necessary for the efficiency and effectiveness of the 

operations of the sections were improperly designed or not operating effectively. Below is the 

description of the conditions we observed for the respective sections affected and related 

functions: 

Waiver and Write-off Process in DRS: Decisions on waivers equal to or greater than $25,000 are 

reviewed by a supervisor and/or require a second level of review. DRS personnel disclosed that 

the threshold was raised from $10,000 to $25,000 because of the significant increase in the 

number of waivers and write-offs that needs to be processed. Out of a population of 76 waivers, 

WAI identified 6 waivers and write-offs that met or exceeded the threshold of $25,000 and 

performed testing procedures to determine whether evidence exist to substantiate supervisory 

review and approval. No exception was noted. However, WAI performed further analysis to 

assess the reasonableness of DRS’ threshold and noted that only 8% of approved waivers and 

write-offs were reviewed by a supervisor and 92% of the items in the population of 70 were not 

subject to supervisory review because they did not meet the threshold.

Based on this analysis, WAI determined that waivers and write-offs not reviewed by a 

supervisory or higher appears to be significantly high. In addition, WAI noted that 

Management’s decision to increase the threshold from $10,000 to $25,000 did not appear to be 

based on risk posed by the increase in population of waivers and write-offs and may have 

increased the risk that significant number of DRS analyst decisions will not receive a supervisory 

or secondary review. Upon raising the observation with Management, they noted that change in 

threshold from $10,000 to $25,000 was unilaterally taken by the Debt Recovery Management 

and was not authorized. As such, the threshold was restored to $10,000. 

Granting User Access to FMIS in FSS: As a system administrator, an FSS employee is 

responsible for managing access, changes, and updating of certain tables within FMIS. During 

our walkthrough, WAI reviewed 5 FMIS users and requested related access request forms (Form 

G-441), to evaluate the design of control around user access and determine whether access 

requests were reviewed and approved prior to granting access. For 3 of the 5 users, FSS staff 

could not provide corresponding access request forms or related documentation to substantiate 

that users' requests were reviewed and approved prior to granting access to FMIS. 

Update of System Security Plan: Based on our walkthrough, FSS staff continuously monitor 

FMIS’ strategy and security plan, ensuring that it is current and relevant, by maintaining a FMIS 

system security plan (SSP) Risk Management Strategy Document annually. However, the RRB 

Systems Security Officer is responsible for the preparation and signing of the annual SSP. WAI 

requested the finalized SSP, including evidence of review and approval for FY 2019. The 2019 

SSP provided by FSS was not signed by the RRB Chief Security Officer. 

One of the objectives of the RRB debt collection program, as documented the RRB Basic Board 

Order 4, Money and Finance Policies, Section 6, paragraph 1, is to “establish and maintain a debt 

collection program designed, to the extent practicable, to collect all receivables, to enable 
16

Management to evaluate collection policies, to provide efficient and effective account servicing, 

and to provide accurate and timely financial reports.” 

B.B.O.4 (Money and Finance Policies) establishes that the responsibility for managing FMIS 

rests with BFO, under the leadership of the Chief Financial Officer (CFO). Specifically, 

paragraph 1 under "B. Responsibility" of the B.B.O.4, establishes that: “The Chief Financial 

Officer is responsible for general oversight of the agency's financial management system. As the 

Senior Financial Management official, the Chief Financial Officer shall coordinate the overall 

agency effort to review, improve, and report on the financial management system in accordance 

with the laws, standards, and guidance cited in this Board Order.” This applies to the FSS 

process.

Federal Managers Financial Integrity Act (FMFIA) of 1982 and its implementing guide, OMB 

Circular A-123, revised July 15, 2016, stipulate federal managers’ responsibility for internal 

control. Key elements of internal control as prescribed by both the Committee of Sponsoring 

Organizations (COSO) framework and the GAO Green Book require control activities as 

components of internal controls. They include the implementation of policies and procedures as 

control activities actions. Per OMB Circular A-123, revised July 15, 2016, Management is 

“responsible for establishing and maintaining internal controls to achieve specific internal 

control objectives related to operations, reporting, and compliance.”

GAO Green Book Section OV2.04, specifically states that Control Activities are “actions 

management establishes through policies and procedures to achieve objectives and respond to 

risks in the internal control system, which includes the entity’s information system.” The Green 

Book Section OV2.02, further states that “management is responsible for designing the policies 

and procedures to fit an entity’s circumstances and building them in as an integral part of the 

entity’s operations.” 

In our judgment, the conditions noted were due to a lack of or inadequacy of policies and 

procedures to guide personnel. For instance, Management noted that the change in threshold 

from $10,000 to $25,000 was unilaterally taken by the Debt Recovery Management and was not 

authorized by Management. 

In addition, FSS could not substantiate the review and approval of users' access requests prior to 

granting access to FMIS and evidence of signed security plan, because FSS had no policies and 

procedures to hold personnel accountable to the performance (and documentation of evidence) of 

these control activities. GAO Green Book Section OV2.04, Page 8, Paragraph 1 specifically 

states that Control Activities are “actions management establishes through policies and 

procedures to achieve objectives and respond to risks in the internal control system, which 

includes the entity’s information system.” As such, in our opinion, without policies and 

procedures, control activities for mitigating risks to the section's objectives may be inadequate 

and ineffective.
17

Recommendations:

We recommend that the Bureau of Fiscal Operations:

5. maintain documentary evidence of adequate periodic review of control activities performed;

and

6. ensure that DRS’ policies and procedures include guidance and process for developing and 

modifying thresholds, including those related to waivers and write-offs.

Management’s Response and Auditor’s Consideration of Management’s Response

The BFO concurred with recommendations 5 and 6 without exception. See full text to 

Management’s response in Appendix A. 

Transactions Relating to Criminal Restitution Debt Recorded by the RRB BFO Debt Recovery 

Section Were Inaccurate, Incomplete, and/or Untimely

As part of its testing of DRS’ debt establishment function, WAI tested the recording of Criminal 

Restitution Debt in FY 2019. WAI requested the supporting documentation substantiating each 

of the 6 receivables recorded into FMIS, which amounted to a total of $211,891,300, and DRS 

provided a court order (a judgement provided to RRB from the Southern District Court of New 

York). Based on our review of the court order, WAI noted that the judgment was rendered in FY 

2018, and as a result the debt should have been recorded in FY 2018. Based on discussion with 

Management about our observation, Management noted that DRS did not have a process in place 

for recording non-benefit criminal restitution debt prior to FY 2019, as the process was 

established in FY 2019. Therefore, the debts were recorded in FY 2019. 

Based on our understanding of DRS’ process, Quarterly, DRS ensures that RRB’s Treasury 

Report on Receivables (TROR) are generated, reviewed for accuracy and completion, and 

submitted to United States Treasury (US Treasury), through the Treasury Report of Receivable 

online submission system. WAI inquired of DRS about evidence that a review of the TROR is 

performed by DRS for each quarter in FY 2019, and Management noted that it does not retain 

documented evidence of its review and approval of the TROR prior to submission. 

One of the objectives of the RRB debt collection program, as documented in the RRB B.B.O.4, 

Money and Finance Policies, Section 6A, is to “establish and maintain a debt collection program 

designed, to the extent practicable, to collect all receivables, to enable Management to evaluate 

collection policies, to provide efficient and effective account servicing, and to provide accurate 

and timely financial reports.” 

The lack of a comprehensive set of written policies and procedures to guide and hold personnel 

accountable and required adequate supervisory review in the performance of control activities 

contributes to this exception. DRS recorded FY 2018 debts in FY 2019 because there was not a 
18

process in place to record the debts in FY 2018. Similarly, the unauthorized change in threshold 

resulted from a lack of policies and procedures to guide personnel on the requirement or process 

for changing thresholds, including authorization, review, and approval. GAO Green Book 

Section OV2.04, Page 8, Paragraph 1 specifically states that Control Activities are “actions 

management establishes through policies and procedures to achieve objectives and respond to 

risks in the internal control system, which includes the entity’s information system.” As such, 

without policies and procedures, control activities for mitigating risks to the section's objectives 

may be inadequate and ineffective. Additionally, in our judgment, a lack of written procedures 

mandating supervisory reviews, coupled with inadequate review and approval of transactions by 

an appropriate level of management, compromises the accuracy and completeness of data and 

information produced by the section which are relied on by both internal and external users. 

Recommendation:

We recommend that the Bureau of Fiscal Operations:

7. maintain documentary evidence of adequate supervisory review of control activities around 

recording of transactions and reconciliations for DRS section. 

Management’s Response and Auditor’s Consideration of Management’s Response

The BFO concurred with recommendation 7 without exception. See full text to Management’s 

response in Appendix A. 

Financial Systems Section Does Not Perform Adequate Oversight of Functions Outsourced to 

a Contractor

FMIS is RRB's financial system of record, a proprietary cloud-based software owned, designed, 

and hosted by Conseillers en gestion et informatique (CGI), a shared service provider within the 

federal industry. RRB has worked with CGI to customize or design the system to meet the 

agency’s needs and financial systems requirements for federal agencies. As such, responsibilities 

for establishing or modifying system design is shared between CGI and RRB FSS. 

As a standard practice recommended by the Chief Information Officers Council and Chief 

Acquisition Officers Council, services outsourced by Federal agencies to service providers 

should be described in Service Level Agreements (SLA). WAI inquired about documentation 

evidence of BFO’s oversight of CGI’s functions with regards to FMIS. Management was unable 

to provide evidence of an oversight framework. As such, WAI requested a copy of the signed 

SLA or equivalent document between CGI and RRB, but FSS was unable to provide a copy.

Instead, FSS provided a copy of a contract between RRB and CGI. With regards to Cloud 

Service Provider (CSP) as noted in General Services Administration (GSA) White Paper Best 

Practices for Effective Cloud Computing Services Procurement within the Federal Government

(January 2016), “Federal agencies should ensure that CSP performance is clearly specified in all 
19

SLAs and that all such agreements are fully incorporated, either by full text or by reference, into 

the CSP contract.” 

In the absence of an SLA, FSS was unable to articulate the scope of roles responsibilities it has

outsourced to CGI and its oversight responsibilities for those functions, including specific roles 

and activities outsourced to CGI, agreed upon service guarantees in terms of service delivery and 

incident reporting and response, expected interactions and hand-over points under the agreement, 

and the nature and extent of oversight activities that RRB FSS expects to conduct. In addition, 

FSS provided no evidence to suggest that Management has an alternative oversight framework in 

place. As such, WAI determined that BFO is unable to perform adequate oversight of those 

functions outsourced to CGI, if BFO could not articulate or provide documentary evidence of 

those functions. 

Chief Information Officers Council and Chief Acquisition Officers Council, Creating Effective 

Cloud Computing Contracts for the Federal Government, Best Practices for Acquiring IT as a 

Service (February 24, 2012) recommends that “SLAs need to define performance with clear 

terms and definitions, demonstrate how performance is being measured, and identify what 

enforcement mechanisms are in place to ensure the conditions are met.” Per GSA White Paper 

Best Practices for Effective Cloud Computing Services Procurement within the Federal 

Government (January 2016), “Federal agencies should ensure that CSP performance is clearly 

specified in all SLAs and that all such agreements are fully incorporated, either by full text or by 

reference, into the CSP contract.” 

BFO does not have a policy around outsourcing function, and therefore does not demonstrate 

awareness of oversight responsibilities, or use an SLA or similar documentation to clearly 

specify the roles and responsibilities of all parties. 

Without a policy on outsourcing, BFO lacks guidance on the process and the requirements for 

oversight of contractors, including implementing and oversight framework, and a documentation 

of the roles and responsibilities of all parties through an SLA or equivalent documentation. 

Without a documentation of the parties’ roles and responsibilities, BFO is unable to hold CGI 

accountable for the nature and extent of services to be provided, including an explicit 

documentation of each party’s role in ensuring RRB’s compliance with applicable laws and 

regulations, including Information Technology security requirements, and means to identify 

shortcomings and mitigate deficiencies. Without a clear documentation of each party’s roles and 

responsibilities and adequate oversight and monitoring of service provider, RRB may also be 

exposed to the risk of having a contractor perform inherently governmental functions. 

Recommendations:

We recommend that the Bureau of Fiscal Operations:

8. develop and maintain a comprehensive set of policies and procedures for outsourcing FSS 

functions; 
20

9. develop an oversight framework for overseeing FSS’ contractors, and ensure that the 

framework is reviewed and updated periodically; and

10. require an SLA or equivalent documentation that clearly defines the roles and responsibilities 

of RRB and CGI and ensure that the documentation is reviewed and updated periodically.

Management’s Response and Auditor’s Consideration of Management’s Response

RRB Management partially concurs with recommendations 8 and 10 and non-concurs with 

recommendation 9. Below are specific responses from Management regarding the

recommendations and our consideration of Management’s responses. 

For recommendation 8, BFO partially-concurred and stated, 

As written the recommendation implies that the RRB does not have policies and procedures in 

order to outsource functions as deemed appropriate, however, this is not the case. In accordance 

with RRB’s policy, BFO coordinated with the RRB Contracting Officer and worked through the 

competitive procurement process and related policies and procedures to solicit and award a 

service contract in fiscal year 2012 for an integrated financial system using a hosted shared 

services model from CGI Federal Inc. (CGI). In terms of performing oversight of contractors 

and in accordance with federal regulations, the RRB Contracting Officer designated a 

Contracting Officer’s Representative (COR) for the FMIS hosted services contract. Under this

designation, the Contracting Officer has identified contract administration duties for which the 

COR has designed responsibility. FSS will develop granular level procedures to inform how the 

COR performs said designated responsibilities.

While we take note of Management’s additional explanation in its response partially concurring 

with recommendation number 8, the explanation falls short of providing new evidence or 

documentation substantiating the existence of a comprehensive set of policies and procedures for 

outsourcing FSS functions. And since Management indicates it will however, “develop granular 

level procedures” to address the cause of the findings, we agree with such conclusion. 

Accordingly, we conclude that finding and related recommendation in No. 8 still stands.

For recommendation 9, BFO non-concurred and stated, 

In consultation with the Contracting Officer and as communicated to the auditors during the 

course of the audit, the contract with CGI contained a Quality Assurance Surveillance Plan

(QASP) that continues to serve as the RRB’s oversight framework. The QASP is a scorecard that 

facilitates fair and equitable performance measurement over the life of the contract. The 

negotiated QASP document incorporated into the fiscal year 2012 contract identified Service 

Level Agreements (SLAs) and related measures during the implementation and postimplementation phases. During the course of the audit, BFO staff provided examples of monthly 

reporting associated with the SLAs as required by the QASP. The COR designated 
21

responsibilities include executing the QASP and evaluating contractor performance. In 

consultation with the RRB Contracting Officer, the QASP, related SLAs, and the COR 

designation are satisfactory for the remainder of the contract.

Based on our review, the objective of a QASP is a systematic performance matrix used to assess 

whether a contractor is meeting the quality standards established in the performance work 

statement of a contract, and it is not a substitute for an SLA. A complete SLA for FMIS should 

explicitly state in detail the responsibilities that each party has in maintaining the system in order 

to avoid disregard of control activities that are critical to the overall service delivery, due to the 

task not being assigned to either party. Therefore, we conclude that the findings and related 

recommendation in No. 9 still stands. 

For recommendation 10, BFO partially-concurred and stated, 

In consultation with the RRB’s Contracting Officer, the criteria referenced by the auditors 

equates to best practice and not contract requirements. Though not required, agencies may 

determine that an SLA or equivalent should be included in the service contract and must include 

the appropriate language in the solicitation/request for proposal phase of the procurement 

process, as was the case in this matter. The solicitation/request for proposal for the Financial 

Management Integrated System (FMIS) contained a requirement for Service Level Agreements 

(SLAs) as a component of the Quality Assurance Surveillance Plan (QASP). While, the QASP 

serves as an oversight framework and a scorecard for performance measurement of the 

contractor, it does not include roles and responsibilities for RRB. The Contracting Officer has 

initiated discussions concerning the possibility of re-competing this contract. As such, it is not in 

the best interest of the government or effective use of resources to renegotiate the QASP and 

related SLAs with CGI at this time, when RRB may select another service provider through the 

competitive procurement process. However, BFO will work with the Contracting Officer to 

determine if an SLA or equivalent document that clearly defines roles and responsibilities of both 

parties, should be included in a forthcoming solicitation and subsequent contract award. Should 

the Contracting Officer determine that an SLA or equivalent document is necessary and codifies 

said document in the final contract, the COR will work with the Contracting Officer and the 

contractor to review and update the document periodically or as necessary. 

We agree with Management that the use of an SLA is a best practice. However, in the absence of 

an SLA, an equivalent documentation must exist that describes the specifics of services and roles

of parties under the outsourcing contract. Management noted that the solicitation/request for 

proposal of the contract with the contractor required that an SLA be included in the QASP. 

However, WAI reviewed the QASP provided by Management during the audit and noted that it 

did not include an SLA or equivalent documentation. Nevertheless, WAI believes that an 

implementation of Management’s plan to incorporate a requirement for an SLA in FSS’ next 

agreement for this contract will address the related finding. However, the condition noted existed 

during our audit and continues to exist until Management implements the said plan. Therefore, 

we conclude that the findings and recommendation in No. 10 still stands.
22

Financial Systems Section does Not Have Controls to Mitigate Key Person Dependency and 

Succession Planning Risk for Key Positions

FSS had a team of two staff, including a Financial Management and Program Analysis Manager 

("FSS Manager"), with over 40 years of experience, who was supported by a Financial Systems 

Analyst. The FSS Manager retired at the end of 2020 (during the period of our audit) and was 

succeeded by the Financial Systems Analyst. During our walkthrough of the sections' processes 

and our interaction with Management, we determined that his replacement had not been 

adequately trained on the full scope of his responsibilities prior to his retirement. Per 

Management, his replacement was still in the process of figuring out the scope of the 

responsibilities. WAI inquired why his replacement was not adequately trained in time, given 

that Management was aware of his retirement plan. Per Management, FSS’ two staff were 

preoccupied with their assigned tasks and responsibilities, and there were no additional resources 

to commit to the transition process, including documenting procedures and the full scope of his 

responsibilities. Based on our understanding of the FSS’ functions, and conditions we observed 

in the testing of all of FSS’ functions, WAI determined that FSS had inadequate staff in 

FY 2019. 

WAI also inquired whether Management had a written succession plan that ensured it had 

adequate and competent personnel to continue its operations effectively, in an event of retirement 

or other unforeseen events. Management was unable to provide a plan. RRB’s core financial 

systems, FMIS is relied on by various RRB components and interfaces with several systems in 

the processing of transactions that are essential to the agency’s overall mission, including the 

processing of benefit payments, collections, etc. Given that FSS is charged with the 

responsibility of managing FMIS, WAI determined that not addressing the key person 

dependency and succession planning risk could pose a serious threat to the agency’s mission and 

objectives. This is coupled with the fact that a Financial Systems Analyst with limited training in 

the area is the only resource left to manage the section’s operations. 

Federal Managers’ Financial Integrity Act (FMFIA) of 1982 and its implementing guide, OMB 

Circular A-123, revised July 15, 2016 stipulate federal managers’ responsibility for internal 

control, including assessing risks. OMB Circular A-123 further notes that the responsibilities of 

managing risks are shared throughout the Agency from the highest levels of executive leadership 

to the service delivery staff executing Federal programs, with various characteristics including 

supporting the implementation of effective controls. 

We noted that FSS lacks adequate resources/personnel to dedicate to transition management and 

succession, as well as specific policies and procedures to guide succession. In our opinion, 

Management did not have a plan to identify and mitigate significant risk within its operations, 

including human capital and key person dependency risks, because it is understaffed, and it does 

not perform risk assessment. A lack of control to mitigate key person dependency and succession 

planning risk could adversely impact FSS’ ability to effectively perform its responsibilities in the 

event of unexpected events such as retirements or even unanticipated departure of key personnel, 

and impact components relying on FMIS for their operations.
23

Recommendations:

We recommend that the Bureau of Fiscal Operations:

11. perform an assessment to determine adequate staffing required to perform FSS’ functions;

12. hire adequate personnel to perform its functions; and 

13. develop a written succession plan for FSS, including a framework for ensuring that human 

capital risk is assessed, to address key person dependency risk, including training personnel 

and documenting processes and procedures defining the scope of responsibilities required for 

achieving the section’s objectives.

Management’s Response and Auditor’s Consideration of Management’s Response

RRB Management partially concurs with recommendations 12 and 13 and non-concurs with 

recommendation 11. Below are specific responses from Management regarding the 

recommendations and our consideration of Management’s responses. 

For recommendation 11, BFO non-concurred and stated, 

It is not cost effective for the BFO to perform an “assessment” to determine adequate staffing 

levels for the FSS functions. BFO Management has already determined the staffing level needed 

to support effective and efficient performance of FSS functions. We note that this 

recommendation is duplicative of No. 2 above associated with Finding No. 1.

Management stated that BFO’s Human Capital Plan (HCP) takes into consideration the staffing 

needs for FSS, and that the staffing needs noted during our audit is because of overall RRB 

funding constraints. However, Management did not provide a copy of the documentation of BFO 

HCP or other supporting evidence specifically substantiating consideration given to FSS staffing 

needs. Therefore, we determined that the findings and related recommendation in No. 11 still 

stands.

For recommendation 12, BFO partially-concurred and stated, 

I share the auditors concern regarding the need for additional personnel in FSS to support its 

functions. However, BFO does not have unilateral authority to hire additional personnel and 

instead must work within the RRB’s annual human capital planning process, subject to Board 

approval. BFO will continue to consider, and include as appropriate, the personnel needs of FSS 

alongside other prioritized hiring needs within BFO for the Board’s consideration within the 

enterprise-wide Hunan Capital Plan. The Board will consider proposed hiring actions in light of 

available funding and in consideration of other Agency priorities. We note that this 

recommendation is duplicative of No. 2 above associated with Finding No. 1.
24

Despite the partial concurrence, we noted that Management concurs with the recommendation to 

hire adequate personnel for FSS, and ultimately plans to perform procedures to address the said 

recommendation. WAI agrees that an implementation of the planned corrective action described 

in Management’s response will address this finding. Therefore, we determined that the findings 

and related recommendation in No. 12 still stands.

For recommendation 13, BFO partially-concurred and stated, 

Please refer to the general discussion regarding Finding No. 5 and the response to 

Recommendation No. 12 above. 

While the reference to funding constraints in other comments are cited, we believe that 

developing a written succession plan for FSS, including a framework for ensuring that human 

capital risk is assessed, to address key person dependency risk, including training personnel and 

documenting processes and procedures defining the scope of responsibilities required for 

achieving the section’s objectives; are key control activities that should be part of the agency’s 

overall internal control framework. In our judgement, funding of key control activities must be 

prioritized by agencies. Therefore, we determined that the findings and related recommendation 

in No. 13 still stands.

Inefficiencies Noted in Sections’ Operations Affect the Optimum Use of Resources 

Our review and analysis of the RRB Cost Accounting Code by Individual data, which contains 

allocation of personnel hours and payroll cost to functions and tasks reveals evidence of 

inefficiencies that affect the optimum use of human resources. Our audit revealed that five 

personnel in DRS were allocated the total of 3,971 hours corresponding to $322,502 in payroll 

cost to codes related to the development and maintenance of policies and procedures in FY 2019. 

WAI performed procedures to determine the deliverables and other outputs that result from the 

allocated level of effort. Of the three deliverables listed (i.e., SOPs, MCRs, and Training) we 

noted that MCRs are tri-annual deliverable, and training is also accounted for under Management 

Supervisory and Training task. Accordingly, the hours were largely for preparing policies and 

procedures. Given that the procedures provided by DRS were all created after FY 2019, WAI 

determined that the hours and cost allocated to policies and procedures in FY 2019 were

unreasonable and unsupported. Table 1 below summarizes our assessment of resources expended 

by DRS in FY 2019 on the development and maintenance of policies and procedures. 
25

Table 1: DRS Resource Assessment for FY 2019

Cost

Cost Reported in FY 20191$322,502

Unsupported/Questioned Cost2$322,502

1These are costs reported on DRS' Cost Accounting Codes by Individuals, for work performed on the 

development and/or maintenance of policies and procedures in FY 2019. 

2Unsupported/Questioned Costs are amounts that, we determined, were not supported by adequate 

documentation by Management during the audit. As noted in Finding 1 above, all the procedures provided by 

DRS were created after FY 2019, and Management provided no evidence that DRS performed any work on the 

development and/or maintenance of policies and procedures in FY 2019.

As BFO reported hours and cost in FY 2019 for the development and/or maintenance of polices, 

even though the evidence reviewed indicated that no work was done on these deliverables 

between FY 2013 and FY 2020, WAI performed further analysis to assess the potential cost that 

BFO would have incurred during those years. As the years in question were out of scope for our 

audit, WAI was unable to obtain cost data from BFO for those years. Therefore, WAI estimated 

the potential costs incurred during those years, by calculating the average annual costs reported 

by DRS in Table 2, based on the cost data provided by BFO for FY 2019, 2020, and 2021. WAI 

subsequently applied the calculated average costs to each of the 6 years between FY 2013 and 

FY 2020 in Table 3 below. And as shown in Table 3, we determined that BFO may have

potentially incurred between $1,381,582 and $1,367,041 in cost associated with the development 

and/or maintenance of policies and procedures for DRS between FY 2013 and FY 2020, even 

though there was no evidence that work was performed on policies and procedures during those 

years.

Table 2: Estimated Average Yearly Cost Expended on Policies and Procedures by DRS

Costs 

FY 2019 FY 2020 FY 2021

Total 

Actual4

Total 

Adjusted4

Average

Actual 

/Year4

Average 

Adjusted/Year4

Actual1 Adjusted2 Actual1 Actual1 Adjusted

3

$322,502 $214,438 $227,179 141,110 $241,903 $690,791 $683,521 $230,264 $227,840

1 Cost reported on DRS' Cost Accounting Code by Individuals, for work performed on the development and maintenance of policies 

and procedures in FY 2019. 

2FY 2019 Cost was adjusted to accounting for accounting codes with descriptions that could be applicable to functions other than 

policies and procedure. 

3FY 2021 Cost Accounting Codes by Individuals only included data for 7 months. WAI annualized the data by multiplying the average 

monthly cost ($141,110/7) by 12 months.

4Amount calculated based on data in this table:

Total Actual— $690,791 (Sum of actual amounts: $322,502, $227,179, and $141,110) 

Total Adjusted—$683,521 (Sum of adjusted amounts: $214,438, 227,179, and $241,903)

Average Actual/Year—$230,264 (Total Actual divided by 3 years) Average Adjusted/Year—$227,840 (Total Adjusted divided 3 years) 

Table 3: Estimated Average Cost Incurred By DRS on Developing Policies and Procedures Between FY 2013

and FY 2020

Estimated Average 

Cost Reported1

2014 2015 2016 2017 2018 2019 Total Cost 

$230,264 $230,264 $230,264 $230,264 $230,264 $230,264 $1,381,582

Estimated Adjusted 

Average Cost 

Reported2

$227,840 $227,840 $227,840 $227,840 $227,840 $227,840 $1,367,041

1 Estimated Average Actual/Year—$230,264 (Total Actual divided by 3 years) 

2Average Adjusted/Year—$227,840 (Total Adjusted divided 3 years) 
26

OMB Circular A-123, revised July 15, 2016 “Federal leaders and managers are responsible for 

establishing and achieving goals and objectives, seizing opportunities to improve effectiveness 

and efficiency of operations, providing reliable reporting, and maintaining compliance with 

relevant laws and regulations.” The lack of expertise for developing policies and procedures 

seems to result in the unreasonable length of time and cost involved in the process. Management 

also did not have documented evidence of periodic review and assessment of the hours and 

output reported by personnel, and therefore did not appear to have adequate visibility into the 

roles and responsibilities of personnel, including assessing their efficiency, reasonableness of 

efforts allocated to key functions and tasks, and evaluating the quality, completeness, and 

appropriateness of related deliverables and output/outcome. Without adequate visibility into 

personnel roles and responsibilities and evaluation of related deliverables and outputs,

Management is unable to identify inefficiencies to ensure that resource deployment is the most 

optimum, and results in the achievement of the goals and objectives of the sections. 

Recommendation:

We recommend that the Bureau of Fiscal Operations:

14. develop and implement policies and procedures requiring the periodic review of the Cost 

Accounting Code by Individual data, to assess the reasonableness of personnel roles and 

responsibilities, resources expended (hours and amounts), and resulting deliverables or 

output.

Management’s Response and Auditor’s Consideration of Management’s Response

For recommendation 14, BFO non-concurred and stated, 

The RRB already has policies and procedures in place to review the cost accounting codes 

periodically. It appears that the auditors have concluded that since DRS staff charged labor 

hours to the “development and/or maintenance of policies and procedures” over the years, that 

these efforts should have resulted in all or a significant number of finalized DRS policies and 

procedures. Under normal circumstances, the auditor’s conclusion may be reasonable. 

However, and as stated earlier, the labor hours charged represents the efforts of our experienced 

DRS staff to develop, review, and/or update numerous procedures and instead underscores the 

significant resource constraints at the upper Management level within TDSD that has prevented 

finalization of many DRS procedures. Implementing the auditor’s recommendation would not 

address the root cause, therefore, we non-concur. 

Management provided no evidence of the existence of RRB’s policies and procedures for 

reviewing cost accounting codes periodically, or evidence that BFO reviews the cost accounting 

codes of its sections at all. In addition, Management’s interpretation that our conclusion is based 

on DRS’ lack of finalized policies and procedures is incorrect. The basis for concern is that 

between FY 2014 and FY 2020, there’s no evidence that DRS personnel performed any work on 
27

policies and procedures. Yet, DRS personnel reported significant hours during those periods, 

including the year under audit (FY 2019), and Management did not notice or detect this 

discrepancy. Furthermore, WAI disagrees with Management’s comment that this 

recommendation would not address the root cause of the issue. WAI determined that an effective 

periodic review of the DRS codes between FY 2014 and FY 2020 would have determined that 

the hours they charged during that period were unreasonable, because there was no evidence that 

they worked on policies and procedures. WAI acknowledges that resources constraints could 

impact Management’s ability to review the codes. However, we determined that personnel 

reporting hours to tasks they do not perform creates more constraints on BFO’s already meager 

available resources, which could otherwise be put to better use; this underscores the need for 

implementing our recommended corrective action. Therefore, we determined that 

recommendation 14 stands.

Communication with Other RRB Components Sharing Responsibility for Unapplied Cash 

Functions is Inadequate

During our audit of DRS Debt Collection function, we determined that the responsibility for the 

validating collections is shared with the Office of Programs (OP) because OP is responsible for 

validating unapplied cash that DRS could not apply. As a result, until OP has determined the 

application of unapplied cash amounts, DRS is unable to record the receipts in the appropriate 

accounts. During our walkthrough, we determined that while DRS sends over unapplied cash 

collections to OP for further research, there was no process in place for DRS to follow-up with 

OP, nor a timeframe during which OP is expected to respond. Based on our understanding of the 

Debt Management process, OP’s primary role is to calculate and establish debt, while collection 

process which includes applying receipts to the appropriate accounts and tracking and 

maintenance of detailed accounts receivable activity is the responsibility of DRS. Therefore, we 

conclude that DRS remains the responsible party for functions of collection, regardless of 

whether the process crosses organizations. Additionally, specific testing procedures performed 

by WAI resulted in the conclusion that communication between DRS and OP is ineffective. 

One of the objectives of the RRB debt collection program, is to “establish and maintain a debt 

collection program designed, to the extent practicable, to collect all receivables, to enable 

Management to evaluate collection policies, to provide efficient and effective account servicing, 

and to provide accurate and timely financial reports.” DRS' communication with OP is 

ineffective due to a lack of adequate policies and procedures on cross-organizational 

communication around the processing of unapplied cash. DRS is unable to complete its 

responsibilities of recording the collection of unapplied cash, until they receive a resolution 

update from OP. As such, OP's delay in communicating the status of the resolution of unapplied 

to DRS may prevent DRS from meeting some of its key objectives, including the timely and 

accurate recording and reporting of collections. 
28

Recommendations:

We recommend that the Bureau of Fiscal Operations:

15. develop a written communication framework or process that ensures that effective 

“two-way” communication occurs between OP and DRS on providing and receiving 

feedback on the status of unapplied cash, including follow up from DRS; and

16. design and implement process and procedures around the processing of unapplied cash, 

including follow-ups from DRS to OP, to ensure that timely feedback is received from OP 

regarding the timely and accurate application of unapplied cash. 

Management’s Response and Auditor’s Consideration of Management’s Response

The BFO concurred with recommendation 15 without exception. See full text to Management’s 

response in Appendix A. 

For recommendation 16, BFO non-concurred and stated, 

The BFO through its policies and procedures has no authority to ensure that the Office of Programs 

provides timely feedback.

Although BFO may not have the authority to compel or require OP to provide timely feedback, 

BFO has a responsibility to ensure that effective communication exists between DRS and key 

stakeholders impacting the section’s ability to achieve its objectives; and this includes 

communication between DRS and OP on the disposition of unapplied cash. In its response to the 

condition underlying the finding, Management acknowledged that BFO and OP share the 

responsibility for determining the disposition of unapplied cash related to RRB benefit programs. 

We agree with Management on this point, and further determined that the activities performed by 

DRS and OP on the disposition of unapplied cash are implemented to achieve the same 

objective, including the timely and accurate application of these amounts to appropriate 

accounts. Therefore, it is in BFO’s and RRB’s overall interest to engage and work with OP to 

ensure that effective communication exists between the two components on this matter. 

Furthermore, the timeliness of the disposition of unapplied cash impacts DRS’ ability to meet 

other objectives, including the accurate and timely reporting of receivables. Therefore, we 

determined that recommendation 16 still stands.

Treasury Section Does Not Perform Verification of Data Critical for Accurate Recording of 

Employer Contributions

Based on understanding of TS’ Contributions Collection Management function, gained from our 

walkthrough, the processing of employers' quarterly report of contributions (DC-1s), Employer 

Contribution and Collection System (ECCS) has automated controls to detect and correct certain 
29

inconsistencies in the data recorded. However, in instances where the system is unable to correct 

inconsistencies or errors, it identifies those discrepancies and flags them for TS to review and 

correct manually. 

WAI requested evidence the ECCS-flagged discrepancies were researched and resolved for FY 

2019. Per Management, the reconciliation for FY 2019 was still in progress. WAI inquired why 

the FY 2019 reconciliation still being performed in FY 2021. Per Management, the Statue of 

Limitations (SOL) for performing the reconciliations was three years; therefore, they were still 

within the SOL. Management also provided a document called “Annual Unemployment 

Compensation Reconciliation Procedures” to support its justification. Based on our review of the 

annual unemployment compensation reconciliation procedures, WAI noted that it was dated 

2005. Management stated that this was the most current version. The document also contained no 

references to a source and Management was unable to provide its authoritative basis. 

Furthermore, the three-year SOL appears to relate to the collection of payments resulting from 

the various annual reconciliations performed by Audit and Compliance function, including 

creditable compensation validation, and not for performing the actual reconciliation. As such, 

WAI determined that TS did not sufficiently substantiate the basis for not performing or 

completing the manual reconciliations for FY 2019 or using a 3-year widow for completing the 

reconciliation. 

WAI determined that given the nature of the discrepancies identified by ECCS, delaying the 

reconciliation (instead of reconciling them as they are flagged during the daily processing of 

collections) appears to undermine RRB's objective of accurate and complete recording of tax 

contribution collections. The errors and discrepancies identified by ECCS include items critical 

to the accurate and complete accounting of collections, including missing employer 

identification, incorrect contribution rates, etc. As such, WAI determined that it is unreasonable 

for TS to delay the research and correction of these discrepancies to an annual or 3-year window. 

Basic Board Order 4, Money and Finance Policies, Section 6. Page 10 #2 establishes BFO's 

(Treasury Section) responsibilities for contributions. TS lacks process and procedures for 

reconciling ECCS-identified discrepancies, and it uses inapplicable guidance as a basis for its 

reconciliation timeframe. Without the timely correction of discrepancies identified by ECCS, the 

processing and validation of employers' DC-1 filings, tax contributions and employer data may 

be inaccurate and/or incomplete, undermining RRB's objective of accurate and complete 

recording of tax contribution collections. 

Recommendations:

We recommend that the Bureau of Fiscal Operations:

17. develop policies and procedures and incorporate the review and reconciliation of ECCSgenerated discrepancies as part of its validation of employer DC-1 processing; and 
30

18. perform the ECCS-identified discrepancies reconciliation as part of TS’ validation of 

employer DC-1 processing to ensure that ECCS is updated accurately and timely, instead of 

using the current annual or 3-year timeframe. 

Management’s Response and Auditor’s Consideration of Management’s Response

BFO partially concurs with recommendation 17 and non-concurs with recommendation 18. 

Below are specific responses from Management regarding recommendations and our 

consideration of Management’s responses. 

For recommendation 17, BFO partially concurred and stated,

The validation process entails review and resolution of ECCS discrepancies immediately, in 

order to record the employer contributions properly. The BFO will develop granular level 

procedures that addresses the validation process and resolution of ECCS discrepancies. The 

auditors have conflated the two different processes in their finding and related 

recommendations. As previously communicated to the auditors, the BFO performs the validation 

and resolution of discrepancies in ECCS as the employers transmit contributions pursuant to the 

quarterly DC-1 requirement. Separately, on an annual basis, BFO reconciles the reported 

compensation amounts on the BA-3s to ensure agreement between the cumulative DC-1 

compensation amounts covering all four quarters of the same calendar year.

The BA-3 reconciliation noted by Management is not performed by BFO Treasury Section. 

Instead, it is performed by BFO Audit and Compliance Division. Per BFO personnel, the annual 

reconciliation they perform involves researching discrepancies flagged by ECCS for manual 

reconciliation. Therefore, Management’s comment that we have conflated the two reconciliations 

is inaccurate. Nevertheless, we determined that Management’s concurrence to implement a plan 

to develop detail procedures on the validation and resolution of ECCS discrepancies could 

address the finding, providing Management documents and maintains evidence that said 

reconciliations are performed. Management’s response provided no additional or new evidence 

that contradicts the findings and its related elements. Therefore, we determined that 

recommendation 17 stands.

For recommendation 18, BFO non-concurred and stated, 

As stated above in the response to Recommendation No. 17, the auditors have conflated the two 

different processes in their finding and related recommendations. The validation process and 

resolution of discrepancies occurs as employer contributions are received and recorded, 

whereas the reconciliation between the BA-3 and cumulative DC-1 occurs annually due to the 

annual submission requirement for the BA-3 and the need for cumulative DC-1 compensation 

data. The BFO cannot combine the two functions, as they are separate and distinct. 
31

The BA-3 reconciliation noted by Management is not performed by BFO Treasury Section. 

Instead, it is performed by BFO Audit and Compliance Division. According to BFO Treasury 

personnel, the annual reconciliation they perform involves researching discrepancies flagged by 

ECCS for manual reconciliation. Therefore, Management’s comment that we have conflated the 

two reconciliations is inaccurate. Management’s response provided no additional or new 

evidence that contradicts the findings relative the elements described. Therefore, we determined 

that the finding and related recommendation in No. 18 still stands.
32

Appendix A: Management Response Memo
33
34
35
36
37
38
39
40
41

Appendix B: Summary of Assessment of Outsourceable Functions

Table A: Debt Recovery Section Functions

Item 

#

Key Function Conclusion1

1 Development and Maintenance of Policies & Procedures2 Outsourceable

2 Recording of Debts in FMIS (Non-Benefit Debts) Outsourceable

3 Validation of Debts Recorded in FMIS Outsourceable

4 Management of Debtor Communication (Issuance of Notices to 

Debtor)

Outsourceable

5 Processing of Debt Collections/Recoveries Outsourceable

6 Management of Delinquent Debt Outsourceable

7 Termination of Debt Collection Efforts Not 

Outsourceable

8 Reporting on Debt Outsourceable

Table B: Financial Systems Section Functions

Item 

#

Key Function Conclusion1

1 Development and Maintenance of Policies & Procedures2 Outsourceable

2 System Maintenance3 Outsourceable 

3 System Security3 Not Outsourceable 

4 System Design & Establishment3 Outsourceable 

5 Contractor Oversight Not Outsourceable

Table C: Treasury Section Functions

Item 

#

Key Function Conclusion1

1 Development and Maintenance of Policies & Procedures2 Outsourceable 

2 Accounts Payable Liquidation Not Outsourceable

3 Payroll Function Accounts Payable Liquidation Not Outsourceable 

4 Employer Tax Contributions Collection Management4 Not Outsourceable

1The Office of Federal Procurement Policy (OFPP) Policy Letter 11-01 provides guidance to Federal Agencies to ensure that only 

federal employees perform functions that are inherently governmental. Consistent with OFPP Policy Letter 11-01, we identified 

inherently governmental functions within each section, by considering whether the functions involve exercising discretion or 

making value judgments or decisions on behalf of the Federal Government, or whether the function is listed as “inherently 

governmental” or “close to inherently governmental” in Appendix A or Appendix B of the OFPP Policy Letter 11-01. We 

determined that functions that are not inherently governmental functions are outsourceable. 

2Outsourceable policy function includes the drafting of policy documentation and not the determination of policy or decision on 

content. 

3BFO currently outsources this function to a contractor.

4

In FY 2019 the responsibilities for the RRB’s employer tax contributions system was shared between BFO’s Audit Affairs and

Compliance Division and BFO Treasury Section. However, in April of 2020 all of the functions performed by BFO Treasury

Section were transferred over to the Audit Affairs and Compliance Division.
42

Management’s Response to Appendix B: Summary of Assessment of Outsourceable 

Functions: 

Management noted that it believes that some of the functions included in Appendix B, Summary 

of Assessment of Outsourceable Functions, are incorrectly classified as “outsourceable”. 

Management stated, 

In Appendix B, the auditors provide their assessment of outsourceable functions, we note that the 

auditors have identified generally that BFO can outsource the “development and maintenance of 

policies and procedures” for TDSD. Additionally, the auditors identified six other Debt Recovery 

Section (DRS) functions as outsourceable. While we agree that external contractors may be able 

to assist TDSD with the development and maintenance of procedures, agency policy 

determination is inherently governmental according to FAR 7.503 (c) (5). 

Further, the DRS key functions that the auditors concluded can be outsourced as referenced in 

Appendix B, Table A, Items 2-6 and 8, support the proper administration and stewardship of the 

railroad retirement trust fund system, as such we disagree with the auditor’s assessment and 

consider these functions to be inherently governmental pursuant to FAR 7.503 (c) (19).

Auditor’s Consideration of Management’s Response to Appendix B: Summary of Assessment 

of Outsourceable Functions: 

With regards to the outsourceable of policies and procedures, we agree with Management that 

the “determination” of policy is an inherently governmental function and should not be classified 

as “outsourceable”. However, the Office of Federal Procurement Policy (OFPP) provides 

guidance to Federal agencies on the implementation of FAR 7.5. OFPP Policy Letter 11-01 

Appendix A, Number 7 further clarifies that this includes the determination of contents to 

include in policy as well as the application of regulations. However, as noted in Policy Letter 11-

01 Appendix B, Examples of functions closely associated with the performance of inherently 

governmental functions, Number 1(c), “providing support for the development of policies, 

including the drafting of documents, and conducting analysis, feasibility study, and strategy 

options” are not inherently governmental. 

We disagree with Management that three of DRS functions should be reclassified as “inherently 

governmental” based on FAR 7.503 (c) (19). Under FAR 7.503 (c) (19), “the administration of 

public trust” is listed as a broad, principle-based provision. Therefore, determining whether a 

specific function is covered by this FAR provision involves the consideration of the regulation in 

conjunction with its implementation guide, including the Office of Federal Procurement Policy 

(OFPP) Policy Paper 11-01. According to Section 3 of OFPP Policy Paper 11-01, the key 

characteristic of an “inherently governmental function” is that it involves the exercise of 

discretion in the application of authority on behalf of the Federal Government, or the exercise of 

judgment and decision that commits the Federal Government to a course of action, “including 

judgment relating to monetary transactions and entitlements.” As such, WAI assessed the 

activities performed by DRS under each of these functions to determine whether they meet the 

OFPP definition for inherently governmental functions. 
43

• Function 2. Recording of Debts in FMIS (Non-Benefit Debts): This DRS’ function 

involves entering (into FMIS) debt amounts that have already been determined through 

the courts and other processes outside of DRS. DRS’ responsibility is merely a data entry 

exercise that involves no calculation or judgment/decision on the determination of the 

amounts recorded.

• Function 6. Management of Delinquent Debt: The main activity performed by DRS under 

this function involves communicating with debtors on the status of their debts. FMIS 

automatically identifies debts that are past due and generates dunning notices. DRS prints 

and reviews the notices for accuracy and mails them out to debtors. DRS makes no 

judgment/decision during this process that commits the government any course of action; 

the function is administrative or clerical in nature. 

• Function 8. Reporting on Debt: DRS’ activities under this function involves gathering 

information from other RRB receivable stakeholders and submitting Treasury Report on 

Receivables (TROR) to the US Treasury. Quarterly, an RRB contractor generates the 

TROR. DRS reviews RRB benefits receivables and obtains comments on RUIA 

Contributions Receivables, and Administrative Receivables from respective point of 

contacts. DRS subsequently submits the final TROR to the US Treasury. We determined 

that this DRS function is merely a liaison and data analysis function. 

As noted in the above, the activities performed by DRS under functions 2, 6, and 8 involve no 

judgment or decision on behalf of the Federal Government, including those relating to monetary 

transactions and entitlements. Therefore, they do not meet the definition of “inherently 

governmental function” and are not covered by the “administration of public trust” provision 

under FAR 7.5. As such, our classification of these functions as “outsourceable” stands. 
44

Appendix C: Sampling Methodology and Evaluation of Sample Testing Results

Our sampling plan is informed by requirements consistent with Government Auditing Standards 

(GAGAS), GAO-18-568G sections 8.100, 8.103 and 8.107. WAI’s sampling plan includes the 

determination of the population or universe of transactions, sample size, sampling methodology, 

confidence level, tolerable rate of deviation, and procedures for evaluation of results. The 

objective of the sampling plan is to ensure a reasonable number of transactions and attributes 

underlying the Treasury, Debt Recovery and Financial Systems sections operations and internal 

controls are subjected to our audit. This allowed us to make a fair conclusion about the reliability 

of the transactions and balances taken as a whole and the evidence substantiating the design and 

operating effectiveness of controls in place to ensure efficiency and effectiveness of sections 

operations. 

Population or Universe of Transactions: For internal control assessment relating to the 

functions of the sections, WAI tested all key controls identified in the processes level underlying 

Treasury, Debt Recovery and Financial Systems sections operations. For transaction-level 

control testing, WAI tested attributes in samples of transactions making up account balances 

related to the operations of Treasury, Debt Recovery and Financial Systems sections. WAI used 

the universe of transactions making up significant account balances for the period ended 

September 30, 2019. 

Sampling Selection Methodology and Sample Size: Consistent with GAGAS (GAO-18-568G) 

Section 8.55, as it relates to the auditor’s responsibility to “identify and select suitable criteria 

based on audit objectives”, WAI selected for testing all process-level key controls identified in 

the operations of the sections subject to our audit, as well as a sample of key controls at the 

transactions level. For detail transaction-level control testing (i.e., criminal restitution debts, 

waivers and write-offs, receivables, collections, travel invoices, and purchase invoices, WAI 

selected randomly (using Microsoft Excel randomizer function) for testing 78 samples (a suitable 

criteria for samples size based on GAO Financial Audit Manual (FAM) Figure 450.1 and 90% 

confidence level and 10% tolerable rate of deviation) of transactions. 

Evaluation of Results: WAI identified, documented, and communicated in our report all 

significant exceptions resulting from our transaction-level control testing, and significant 

deviations noted in key controls evaluated in the process-level operations of the sections. 

Consistent with GAGAS Section 8.55, WAI determined individually or in combination with 

others, the pervasiveness and significance of the deficiencies noted in controls, as well as 

exceptions noted in transactions within the context of the audit objectives. We identified 

deficiencies both on an individual basis and in the aggregate. We also identified correlation 

among deficiencies noted. WAI identified, documented, and communicated in our report all 

exceptions and errors resulting from our transaction-level control testing, and significant 

deviations and exceptions noted in key controls at the process-level.

Except for the errors and exceptions noted in the data, in which we concluded that the data was 

not reliable for the purpose of our audit, and that we did not rely on the data to conclude on the 

audit objectives, no other significant limitations or uncertainties based on our overall assessment 

of the sufficiency and appropriateness of the evidence in the aggregate was noted.
45

WAI tested various process level controls. The below table depicts the population of key 

processes selected for control testing, and includes the population obtained, sample size tested, 

and issues noted. 

Process-Level Control Testing

Section

Key Control

Attributes tested Population 

size

Sample 

Size

Issues 

Noted

DRS Policies Existence of 

Policies

1 1 1

DRS Procedures Existence of 

Procedures

1 1 1

FSS Policies Existence of 

Policies

1 1 1

FSS Procedures Existence of 

Procedures

1 1 1

FSS FMIS Access--

Addition

Validation of 

access 

5 5 3

FSS FMIS Access--

Termination 

Validation of 

access 

5 5 0

FSS FMIS 

Recertification

Validation of 

access 

9 9 0

FSS US Treasury 

Systems 

Recertification

Validation of 

access 

5 5 0

FSS FMIS Table 

Updates

Accuracy of 

FMIS Tables

3 3 3

FSS FMIS Issue 

Resolution

Timeliness of 

issue resolution 

1 1 0

FSS FMIS Service 

Level Reports

Review of 

Service Level 

Reports

12 12 0

FSS System Security 

Plan

Existence of 

System Security 

Plan

1 1 1

FSS POAM Occurrence of 

performing 

corrective actions 

as necessary

1 1 0

FSS Service Level 

Agreement

Existence of 

Service Level 

Agreement

1 1 1

FSS SSAE 18 Oversight of 

FMIS outsourced 

functions 

1 1 1

FSS FMIS System 

Change 

Management

Authorization of 

system changes

1 1 1

TS Policies Existence of 

Policies

1 1 1

TS Procedures Existence of 

Procedures

1 1 1

TS Duplicate 

Payments

Validation of 

payments 

4 4 0

TS Benefit 

Establishment

Accuracy of 

recorded benefits 

241 78 1
46

TS Transit Benefit 

Recertification

Validation of 

benefits 

eligibility 

1 1 0

TS Contribution 

Collections 

Management 

Reconciliation

Completion of 

reconciliations of 

employer 

contributions 

1 1 1

With respect to our transaction-level control testing, our procedures were limited to evaluation of 

attributes related to the controls, and our conclusions on the effectiveness of controls were based 

on whether the number of errors identified fall within or outside of our predetermined acceptable 

deviations. We did not project the errors we found in the samples to the entire population, 

because we tested specific attributes of each control; and projection of error is not applicable to 

attribute testing. The below table depicts the population of transactions selected for testing at the 

transaction control-level, the sample size tested and exceptions noted. 

Transaction-Level Control testing

Transaction

Universe Size Sample 

Size

Exceptions 

Noted

Criminal Restitution 6 6 6

Waivers and Write-offs 76 76 0

RRA Collections 67,577 78 0

RUIA Collections 21,497 78 0

Travel Invoices 2,093 78 0

Purchase Invoices 1,664 78 0

The exceptions noted in the above tables resulted in our conclusion that the weaknesses noted 

significantly affect the effectiveness and efficiency of RRB BFO Treasury, Debt Recovery, and 

Financial Systems sections’ operations, including inefficiencies that affect the optimum use of 

resources. The details of our findings can be found in the detail of the report.