DOD Financial Management: Significant Efforts Still Needed for Remediating Audit Readiness Deficiencies
Published: 2017-02-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: DOD remains on GAO's High-Risk List because of its long-standing financial management deficiencies. These deficiencies negatively affect DOD's audit readiness and its ability to make sound mission and operational decisions. The Army, Navy, and Air Force underwent their first Budgetary Schedule audits for fiscal year 2015.
This report, developed in connection with fulfilling GAO's mandate to audit the U.S. government's consolidated financial statements, examines (1) the results of the audits of the fiscal year 2015 Budgetary Schedules for the Army, Navy, and Air Force; (2) the extent to which each military service designed a process to address financial management-related audit findings and recommendations; and (3) the extent to which DOD has designed a department-wide process to monitor and report on audit readiness remediation efforts. GAO reviewed IPA reports and documentation from the military services and DOD Comptroller and interviewed cognizant officials.
section_title: What GAO Found
paragraphs: The Schedules of Budgetary Activity (Budgetary Schedules) for the Army, Navy, and Air Force for fiscal year 2015 reflected current year budget activity as an interim step toward producing an auditable Statement of Budgetary Resources that will reflect multiyear budget activity. All three of the independent public accountants (IPA) contracted to audit these fiscal year 2015 Budgetary Schedules issued disclaimers, meaning that the IPAs were unable to express an opinion because of a lack of sufficient evidence to support the amounts presented. The IPAs for all three military services also identified material weaknesses in internal control and collectively issued a total of over 700 findings and recommendations. These weaknesses included, among other things, the military services' inability to reasonably assure that the Budgetary Schedules reflected all of the relevant financial transactions that occurred and that documentation was available to support such transactions. Army, Navy, and Air Force management generally concurred with these findings and stated that they would develop and implement corrective actions to address the IPAs' recommendations.
Office of Management and Budget (OMB) guidance and the Department of Defense's (DOD) Financial Improvement and Audit Readiness (FIAR) Guidance include the following steps for addressing these and other financial management-related findings and recommendations reported by external auditors: (1) identify and track them, (2) prioritize them, (3) develop corrective action plans (CAP) to remediate them, and (4) monitor the implementation status of the CAPs. GAO found that the remediation processes designed by each military service had deficiencies in one or more of these areas. For example, each military service's policies and procedures lacked sufficient controls to reasonably assure that they identified and tracked the complete universe of open findings and recommendations related to financial management. Without identifying and tracking the complete universe of unresolved deficiencies, the military services cannot provide reasonable assurance that the deficiencies will be addressed in a timely manner, which can ultimately affect the reliability of financial information and the auditability of their financial statements.
The DOD Comptroller has established several elements of a department-wide audit readiness remediation process, but it does not have comprehensive information on the status of CAPs throughout the department needed to fully monitor and report on the progress being made to resolve financial management-related deficiencies. Specifically, (1) the DOD Comptroller does not obtain complete, detailed information on all CAPs from the military services related to the department's critical capabilities to be able to fully assess progress and (2) reports to external stakeholders such as the Congress on the status of audit readiness do not provide comprehensive information. A lack of comprehensive information on the CAPs limits the ability of DOD and Congress to evaluate DOD's progress toward achieving audit readiness, especially given the short amount of time remaining before the statutory deadline to submit to Congress the results of an audit of the department-wide financial statements for fiscal year 2018.
section_title: What GAO Recommends
paragraphs: GAO is making a total of eight recommendations to the Army, the Navy, the Air Force, and DOD to improve processes for tracking and monitoring financial management-related audit findings and recommendations. The military services concurred with the five recommendations to them, while DOD concurred with one and partially concurred with two of the recommendations directed to it. GAO continues to believe that the recommendations are valid, as discussed in the report.

section_title: Letter
paragraphs: The Department of Defense (DOD) has been on GAO’s High-Risk List  since 1995 because of long-standing deficiencies with its financial  management systems, reporting practices, and management of its  finances. These deficiencies not only affect DOD’s ability to have  auditable financial statements, they also affect its ability to make sound  decisions on missions and operations. Having sound financial  management practices and reliable, useful, and timely financial  information is important to ensure accountability over DOD’s extensive  resources to efficiently and economically manage the department’s  assets and budgets. Given the federal government’s continuing fiscal  challenges, reliable, useful, and timely financial and performance  information is important to help federal managers ensure fiscal  responsibility. This is particularly true for DOD, whose reported  discretionary spending makes up half of the federal government’s and  whose reported physical assets represent more than 70 percent of the  federal government’s. However, DOD remains one of the few entities  that cannot demonstrate its ability to accurately account for and reliably  report its spending and assets. DOD’s financial management problems  remain one of three major impediments preventing GAO from expressing  an opinion on the consolidated financial statements of the federal  government.
DOD continues to work toward the long-term goals of improving financial  management and achieving auditability of its department-wide financial  statements. In August 2009, the Under Secretary of Defense  (Comptroller)/Chief Financial Officer (hereinafter referred to as the DOD  Comptroller) designated the General Fund Statement of Budgetary  Resources (SBR) as a major financial audit priority for DOD. However,  because of difficulties encountered in preparing for an audit of the SBR,  DOD decided to limit the scope of the initial SBR audits for all DOD  components. Specifically, the scope of initial SBR audits beginning in  fiscal year 2015 was limited to current-year budget activity, to be reported  on a Schedule of Budgetary Activity (Budgetary Schedule). This is  intended to be an interim step toward achieving the audit of multiple-year  budgetary activity required for an audit of the SBR; subsequent audits will  include current-year appropriations as well as prior-year appropriations  going back to fiscal year 2015.
The Army, Navy, and Air Force (military services) asserted audit  readiness for their Budgetary Schedules in 2014 and underwent their first  Budgetary Schedule audits for fiscal year 2015. The DOD Office of  Inspector General (OIG) contracted with three separate independent  public accountants (IPA)—one for each military service—to conduct these  audits. The IPAs ultimately issued disclaimers of opinion on the Army’s,  Navy’s, and Air Force’s fiscal year 2015 Budgetary Schedules. In issuing  a disclaimer of opinion, the auditor does not express an opinion on the  financial statements. A disclaimer of opinion is appropriate when the  entity is unable to provide sufficient supporting evidence to enable the  auditor to express an opinion. In their reports, the IPAs identified material  weaknesses in internal control at all three military services. The IPAs did  not report any significant deficiencies for the military services.
This audit was performed in connection with fulfilling our mandate to audit  the U.S. government’s consolidated financial statements, which cover all  accounts and associated activities of executive branch agencies such as  DOD, because of the significance of the military services’ audit readiness  activities to the audit of the consolidated financial statements of the U.S.  government. Our objectives were to (1) report the results of the audits of  the fiscal year 2015 Budgetary Schedules for the Army, Navy, and Air  Force; (2) determine the extent to which each military service designed a  process to address financial management-related audit findings and  recommendations; and (3) determine the extent to which DOD has  designed a department-wide process to monitor and report on audit  readiness remediation efforts.
To address our first objective, we reviewed the audit work of the IPAs for  the military services by reviewing their audit reports and audit documentation related to planning, internal control, testing, and reporting  on the audit. To address our second objective, we reviewed open  financial management recommendations and the military services’  policies and procedures related to tracking and addressing findings,  recommendations, and corrective actions, and interviewed Army, Navy,  and Air Force personnel. To address our third objective, we interviewed  DOD’s Deputy Chief Management Officer (DCMO), the military services’  respective DCMOs, and officials within the Office of the DOD Comptroller  to determine what department-wide process has been designed to  monitor and report on the military services’ development and  implementation of their corrective action plans (CAP). We also gained  an understanding of the DCMO’s and DOD Comptroller’s roles and  responsibilities regarding audit readiness, and of existing systems being  used to help DOD provide oversight of the department’s audit readiness  efforts. Further details on our scope and methodology are provided in  appendix I.
We conducted this performance audit from March 2015 to February 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: DOD has acknowledged that long-standing deficiencies in its internal  controls, business systems, and processes have prevented it from being  able to demonstrate that its financial statements are reliable. DOD spends  billions of dollars annually to maintain key business processes and  operations and to acquire modern systems. However, progress in making  system and process improvements has been slow and has hindered  DOD’s ability to achieve financial audit readiness.
DOD has undertaken several financial management improvement  initiatives over the years to address deficiencies in business systems,  processes, and controls through its Financial Improvement and Audit  Readiness (FIAR) Plan and financial management reform methodology  contained in its FIAR Guidance. DOD’s FIAR Guidance provides a  standard, multiphased methodology that DOD components should follow  to assess their financial management processes and controls and in  developing and implementing financial improvement plans. These plans,  in turn, are intended to provide a framework for planning, executing, and  tracking essential steps and related supporting documentation needed to  achieve auditability.
Congress mandated in the National Defense Authorization Act (NDAA) for  Fiscal Year 2010 that DOD develop and maintain a FIAR Plan that  includes the specific actions to be taken and costs associated with   (1) correcting the financial management deficiencies that impair DOD’s  ability to prepare complete, reliable, and timely financial management  information and (2) ensuring that DOD’s financial statements are  validated as ready for audit by September 30, 2017. In addition, the  2010 NDAA required that DOD provide recurring, semiannual reports to  the congressional defense committees not later than May 15 and  November 15 on the status of the department’s implementation of the  FIAR Plan. Additionally, the 2010 NDAA required the first semiannual  report to address DOD’s actions to develop standardized guidance for  DOD components’ financial improvement plans, define oversight roles,  and assign accountability for carrying out the FIAR Plan to appropriate  officials and organizations.
The NDAA for Fiscal Year 2013 additionally required that the FIAR Plan  Status Reports include (1) a description of the actions that each military  department has taken to achieve an auditable SBR for DOD no later than  September 30, 2014, and (2) a determination by each military  department’s Chief Management Officer on whether the unit would be  able to achieve an auditable SBR no later than September 30, 2014,  without an unaffordable or unsustainable level of onetime fixes and  manual work-arounds and without delaying the auditability of the financial  statements. In the event that the Chief Management Officer of a military  department determined that the military department would not be able to  achieve an auditable SBR by that date, the Chief Management Officer  was required to explain why the military department could not meet that  date and provide an alternative date for achieving an auditable SBR along  with a plan to meet the alternative date.
In the November 2014 FIAR Plan Status Report, DOD acknowledged that  it did not meet the September 30, 2014, target date for achieving audit  readiness of the SBR (which reflects budgetary activity across multiple  years), but stated that the three military services asserted audit readiness  of their Budgetary Schedules for fiscal year 2015 (which reflect activity for  1 year) in the last quarter of fiscal year 2014. The NDAA for Fiscal Year  2014 mandated that the Secretary of Defense ensure that a full audit is  performed on DOD’s fiscal year 2018 financial statements and submit the  results of that audit to Congress no later than March 31, 2019. Further  detail on the distinctions between the SBR and Budgetary Schedule is  provided in appendix II.
subsections: section_title: Military Services’ Assertions of Audit Readiness
paragraphs: The FIAR Guidance was first issued by the DOD Comptroller in May 2010  and provides a standardized methodology for DOD components to follow  for achieving financial management improvements and audit readiness  objectives. However, according to DOD Comptroller officials, in applying  this guidance during the initial years of discovery and documentation,  they spent an inordinate amount of time validating the military services’  management assertions, which delayed an independent review by the  DOD OIG or an IPA. As a result, DOD Comptroller officials revised their  approach to leverage independent reviews by the auditors to focus  resources and remediation efforts on most critical deficiencies. To  emphasize the need for the military services to take ownership of their  own audit readiness assertions for their Budgetary Schedules, this  approach was applied to the decision to proceed with the audits of the  fiscal year 2015 Budgetary Schedules. According to DOD Comptroller  officials, they participated in ongoing dialogue with the military services at  audit readiness oversight meetings and reviewed their progress in key  areas, but the military services did not have to provide detailed  documentation to the DOD Comptroller’s office in support of their  assertions of audit readiness for their Budgetary Schedules. Instead,  each military service submitted a memo to the DOD OIG prior to  September 30, 2014, asserting that its Budgetary Schedule was either  ready or would be ready for audit beginning with fiscal year 2015.
In their assertion memos, the Army stated that its Budgetary Schedule  was ready for audit and the Air Force stated that its schedule would be  ready. The Army and Air Force assertion memos stated that the  assertions depended on planned corrective actions (e.g., producing a  complete population of transactions and implementing service provider  integration). The Navy’s assertion memo stated that its Budgetary  Schedule was ready for audit based on the results of the multiyear effort  to document, test, and remediate known control deficiencies related to its  procedures, processes, controls, and financial systems.
section_title: Military Services’ Funds
paragraphs: Each military service is organized into two reporting entities: a general  fund and a working capital fund. A military service’s general fund  account structure includes five major groups: (1) military personnel;   (2) operations, readiness and support; (3) procurement; (4) research,  development, test and evaluation; and (5) family housing/military  construction. Each military service’s programs are authorized by  Congress in annual NDAAs, and each military service receives  appropriations from Congress through annual appropriations acts. Table  1 presents information on each military service’s fiscal year 2015 general  fund appropriations, personnel, and locations.
section_title: Audits of the Army’s, Navy’s, and Air Force’s Fiscal Year 2015 Budgetary Schedules Resulted in Disclaimers of Opinion
paragraphs: The Army, Navy, and Air Force asserted audit readiness for their  Budgetary Schedules in 2014 and underwent their first Budgetary  Schedule audits for fiscal year 2015. The IPAs for all three military  services issued disclaimers of opinion on the respective services’ fiscal  year 2015 Budgetary Schedules and identified material weaknesses in  internal control. For example, all three IPAs reported findings related to  the military services’ inability to (1) provide complete populations of  transactions, (2) provide documentation to support transactions,   (3) effectively implement information system controls to protect their  financial data in both general ledgers and related feeder systems, and   (4) exercise sufficient oversight of their service providers. The IPAs for  all three military services reported each of these reportable findings as a  stand-alone material weakness or as part of a larger, combined material  weakness. Army, Navy, and Air Force management generally concurred  with the findings in the respective IPA reports and stated that they will  develop and execute corrective actions to address the IPAs’ related  findings.
subsections: section_title: Army, Navy, and Air Force Were Unable to Provide Complete Populations of Transactions
paragraphs: The IPAs for all three military services reported that they were unable to  identify complete populations of transactions for the respective services’  fiscal year 2015 Budgetary Schedules. This reportable finding contributed  to each IPA’s disclaimer of opinion. For financial statements to be  considered reliable, they must reflect the results of all significant financial  activity (transactions) during the reporting period (e.g., 1 fiscal year for the  Budgetary Schedules). When performing a financial statement audit, one  of the assertions that the auditor evaluates is completeness, which  pertains to whether all transactions and events that should have been  recorded in the financial statements were recorded.
Most military service transactions are initially processed and recorded in  information technology systems called feeder systems. For example,  payroll transactions are processed in a military service’s payroll system.  Transactions processed in feeder systems should eventually be  transferred to the military service’s general ledger where all transactions  are accumulated. At the end of a reporting period, each military  service’s general ledger data are transferred to DOD’s financial reporting  system, which summarizes the financial data according to the line items  that are ultimately reported in the financial statements.
Figure 1 illustrates how financial data for the military services are initially  processed, then combined with other data as they are transferred from  one automated system to another, and ultimately result in the Budgetary  Schedule.
When data are transferred from one system to another, interface controls  should be in place to reasonably assure that the data are transferred  accurately, timely, and completely. The objectives of interface controls  are to implement effective (1) interface strategy and design and   (2) interface processing procedures. Effective interface procedures  reasonably assure that interfaces are processed completely, accurately,  and only once in the proper period; interface errors are rejected, isolated,  and corrected in a timely manner; and access to interface data and  processes is properly restricted. The systems should be designed with  balancing controls, such as control totals and record counts, to  reasonably assure that data are controlled. Also, the entity should have  effective procedures to reconcile control information between the two  systems. If the reconciliation identifies differences, these differences  should be researched to determine their causes and any errors corrected.  This reconciliation process helps ensure that the results of all transactions  occurring during the reporting period are accurately reported in the  financial statements.
In conducting the audits of the military services’ Budgetary Schedules, the  IPAs reviewed the military services’ reconciliation processes to determine  whether all transactions were completely transferred from military  services’ feeder systems to the general ledgers and, ultimately, to the  DOD-wide financial reporting system. The IPAs reported that the military  services did not have sufficient reconciliation processes in place to  reasonably assure that the general ledgers included all of the transactions  that should be included in the Budgetary Schedules, increasing the risk  that the Budgetary Schedules did not reflect the results of all budgetary  transactions that occurred.
The following are examples of completeness issues reported by the IPAs.
The Army was unable to reconcile the first quarter fiscal year 2015  population of civilian payroll transactions from a civilian pay feeder  system to one of its four general ledger systems.
The Navy had no assurance that transactions were completely and  accurately recorded in its four general ledger systems because it has  not designed and implemented sustainable and recurring manual and  automated reconciliations with its more than 100 feeder systems.
The Air Force’s nonintegrated information technology system  environment requires both manual reentry of data into multiple  systems and complex system interfaces. The auditors found that the  Air Force did not always reconcile the data after entering the data  manually or transferring the data from interfacing systems. The  auditors reported that many of the reconciliations were newly  implemented and not in place during the entire fiscal year or were not  performed through the end of the fiscal year.
section_title: Army, Navy, and Air Force Were Unable to Provide Documentation to Support Transactions
paragraphs: The IPAs for all three military services noted the lack of adequate  supporting documentation as a reportable finding on their Budgetary  Schedule audits, which also contributed to each IPA’s disclaimer of  opinion. Appropriate documentation for financial transactions allows the  military services to support financial statement line items and allows  auditors to test line items. For all three military services, auditors found  that adequate documentation to support disbursements and obligations  was not always available. The lack of adequate documentation increased  the risk of a misstatement on the Budgetary Schedules.
According to Standards for Internal Control in the Federal Government,  developing and maintaining thorough and accurate documentation to  support financial transactions is essential to management’s ability to  effectively monitor financial transactions and provide reasonable  assurance that internal controls are in place and operating as intended.  Accurate documentation also allows management to correct errors timely  and safeguard assets. Additionally, appropriate documentation of  financial transactions allows support to be readily available for  examination by an auditor.
The following are examples of supporting documentation issues reported  by the IPAs:
The Army did not have documentation readily available to  demonstrate that specific transactions were properly reported in the  Budgetary Schedule. Specifically, the auditors reported that  documentation supporting contractual services, military payroll,  civilian payroll, reimbursable authority, disbursement, and collection  transactions was either not available, was insufficient, or did not agree  to the general ledger detail.
The Navy did not always have the underlying detail for journal  vouchers or sometimes lacked complete explanations for the purpose  of journal vouchers. The auditors reported that in some cases,  journal vouchers were used to adjust amounts to agree with  Department of the Treasury (Treasury) or trading partner balances,  without underlying support for the adjustment amounts.
The Air Force did not always maintain adequate documentation to  support disbursements and obligations. The auditors reported a lack  of adequate supporting documentation for transactions related to  travel expenses and payments made to vendors and contractors for  purchases of goods and services.
section_title: Army, Navy, and Air Force Did Not Have Adequate Information System Controls
paragraphs: The IPAs for all three military services identified a lack of adequate  information systems general controls as another reportable finding, which  precluded the IPAs’ ability to rely on the services’ financial data and thus  contributed to their disclaimers of opinion. The military services’ ability  to efficiently and effectively manage and oversee their day-to-day  operations and programs relies heavily on the capacity of their financial  management information systems to produce complete, reliable, timely,  and consistent financial information. The IPAs for all three military  services identified information systems general control deficiencies  related to access controls, segregation of duties, and configuration  management. In addition, the IPA for the Army identified information  systems general control deficiencies in security management and  contingency planning; the IPA for the Navy reported information system  general control deficiencies in security management and information  system control deficiencies related to interface controls; and the IPA for  the Air Force reported information system control deficiencies related to  interface controls.
The following are examples of information system control deficiencies  reported by the IPAs.
The Army did not consistently perform effective daily operating system  backup procedures or maintain evidence of operating system and  database backups when performed for certain financial systems. As a  result, the IPA concluded that this condition could affect the Army’s  ability to provide financial data that are complete, valid, and accurate.  Further, the IPA found that the Army and its service providers had not  implemented sufficient, effective information system general controls  to protect the Army’s general ledgers and related feeder systems’  financial data.
The Navy did not consistently implement effective interface controls  between its systems and its service providers. As a result, the IPA  found that the Navy was unable to reasonably assure the  completeness and accuracy of financial data flowing between its  systems and the service providers. The IPA found that the Navy also  lacked effective information system controls over its general ledger  systems and financial feeder systems and had pervasive control  deficiencies in its decentralized information system environment.
The Air Force did not have controls in place to prevent certain  individuals from controlling key aspects of computer-related  operations; as a result, the IPA found that unauthorized access to  systems and system information and unauthorized actions had  occurred. Multiple systems allowed a significant number of  administrator users the authority to complete an entire functional  process by inputting, processing, and approving transactions.  Additionally, the IPA reported that developers were granted  inappropriate access to make modifications directly to the production  environment and delete system files.
section_title: Army, Navy, and Air Force Did Not Exercise Sufficient Oversight of Their DOD Service Providers
paragraphs: The IPAs identified insufficient oversight by the Army, Navy, and Air  Force of DOD service organizations, also referred to as service providers,  as a reportable finding that also contributed to each IPA’s disclaimer of  opinion. Specifically, the IPAs for all three military services found that  the services did not exercise sufficient oversight of their service providers responsible for  performing financial reporting activities to ensure completeness,  accuracy, and validity of the financial data reported and evaluate the complementary user entity controls included in the  Statement on Standards for Attestation Engagements (SSAE) No. 16  reports to determine design and operating effectiveness.
The Army, Navy, and Air Force utilize many service providers to improve  efficiency and standardize business operations. Among the many service  providers within DOD are the Defense Finance and Accounting Service  (DFAS), Defense Information Systems Agency, Defense Logistics  Agency, and Defense Contract Management Agency. According to the  FIAR Guidance, the Army, Navy, and Air Force rely on these DOD  service organizations to provide a variety of accounting, personnel,  logistics, and system operations services.
Each of the reporting entities—the Army, Navy, and Air Force—is  ultimately responsible for ensuring that all key processes, systems,  internal controls (including those performed by service organizations),  and supporting documentation affecting its financial reporting objectives  are audit ready. However, service providers working with reporting  entities are also responsible for executing audit readiness activities  surrounding service provider systems and data, processes and internal  controls, and supporting documentation that have a direct effect on the  reporting entities’ audit readiness.
Therefore, to ensure successful completion of audit readiness tasks, the  reporting entity and service provider must agree on the roles and  responsibilities for the authorization, initiation, processing, recording, and  reporting of transactions; the information technology controls affected by  the service provider; or both. The FIAR Guidance states that a shared understanding and agreement between the service provider and reporting  entity on these roles and responsibilities must be documented in a  service-level agreement or memorandum of understanding. According to  the FIAR Guidance, these mutual responsibilities include maintaining open communications and coordinating with one another; establishing common expectations in writing; providing additional system and financial information within agreed- providing access to subject matter experts or contractors supporting  those organizations within agreed-upon time frames; working together to discover and correct audit impediments; and establishing a common, detailed understanding of the method for  obtaining assurance.
According to the FIAR Guidance, reporting entity management is  responsible for the internal control over their financial information and  therefore must ensure that it understands what financially significant  activities are outsourced to service providers and the effectiveness of the  service providers’ related internal controls. In turn, each service provider  is responsible for providing a description of its controls that may affect its  customer reporting entities’ control environments, risk assessment,  control activities, and information and communication systems. Appendix  D to Office of Management and Budget (OMB) Circular A-123,  “Compliance with the Federal Financial Management Improvement Act of  1996,” requires each service provider to provide a Report on Controls at a  Service Organization Relevant to User Entities’ Internal Control over  Financial Reporting to its customers or allow customer auditors to perform  appropriate tests of internal controls at its organizations. These reports  are an important tool for agency management and auditors to use in  evaluating the effect of the controls at the service organization on the  user entities’ controls for financial reporting.
The following are IPA-identified examples of insufficient oversight by the  Army, Navy, and Air Force of their service providers.
The Army did not have policies and procedures to assess service  providers that host or manage financial systems that support accounts  reported on the Army's Budgetary Schedule. Specifically, the IPA  found that the Army did not document its understanding of the  services provided or the related SSAE No. 16 reports so that it could  determine whether the scope of these reports met the Army’s needs  for obtaining assurance regarding service provider controls.
The Navy did not implement effective controls over its service provider  systems. As a result, the IPA (1) encountered difficulties in identifying  key points of contact within the Navy, (2) reported that appropriate  service-level agreements with the Navy’s service providers were not  fully developed, and (3) noted that Navy personnel did not periodically  review available SSAE No. 16 reports.
The Air Force compiled a list of complementary user entity controls;  however, the IPA found that it did not validate the operating  effectiveness of the controls or verify the accuracy and completeness  of the complementary user entity controls list.
section_title: The Military Services Did Not Sufficiently Design Their Processes to Address Financial Management Deficiencies
paragraphs: The IPAs for the Army, Navy, and Air Force collectively issued over 700  notices of findings and recommendations to the respective military  services during the course of the fiscal year 2015 Budgetary Schedule  audits. Each notice had one or more findings and discussed deficiencies  that the IPA identified during the audit along with a corresponding  recommendation(s) for addressing the deficiencies. These deficiencies  pertained primarily to internal control deficiencies, with almost 75 percent  of these related to information systems. In addition, the military services  received findings and recommendations related to financial management  deficiencies identified during audits performed by other audit  organizations, including the DOD OIG and GAO, which also must be  remediated. Also, management may have identified financial  management deficiencies, for example, through OMB Circular A-123  reviews or management studies.
Each military service is responsible for establishing its own processes for  addressing these findings and recommendations by (1) identifying and  tracking them, (2) prioritizing them, (3) developing corrective action plans  (CAP) to address them, and (4) monitoring the status of CAP  implementation. However, we found to varying degrees that each service  did not have sufficient processes for doing so. While the military services  should have already had such processes in place to manage findings and  recommendations resulting from any audit, the need to effectively  implement these processes has become more important in light of (1) the  many findings and recommendations that resulted from the Budgetary  Schedule audits, (2) future audits that will have a broader scope of work  and may therefore identify additional findings, and (3) the short period  remaining before the fiscal year 2018 audits must occur. For example,  with the large number of findings resulting from the Budgetary Schedule  audits and the effort it will take to address them all, prioritization of  deficiencies that preclude the ability to audit the financial statements is  crucial for the military services to achieve audit readiness.
We compared the military services’ existing processes to the guidance  and standards defined in the Implementation Guide for OMB Circular A- 123, Management’s Responsibility for Internal Control, Appendix A,  Internal Control over Financial Reporting (Implementation Guide for OMB  Circular A-123); the FIAR Guidance; and Standards for Internal Control in  the Federal Government. According to these sources, which we used as  criteria in evaluating the design of the services’ existing processes, a  sound approach to addressing financial management deficiencies would  include the following four elements.   1.  Identifying and tracking audit findings and recommendations.
Federal internal control standards require that managers (1) promptly  evaluate findings from audits and other reviews, including those  showing deficiencies and recommendations reported by auditors and  others who evaluate agencies’ operations; (2) determine proper  actions in response to findings and recommendations from audits and  reviews; and (3) complete, within established time frames, all actions  that are needed to correct or otherwise resolve the matters brought to  management’s attention. To ensure that these actions are taken,  management needs a means—that is, accurate and adequate  documentation—to keep track of the findings and recommendations.  2.  Prioritizing findings and recommendations. The Implementation  Guide for OMB Circular A-123 and the April 2016 FIAR Guidance  state that the extent to which corrective actions are tracked should be  commensurate with the severity of the deficiency. The Implementation  Guide for OMB Circular A-123 also states that an agency’s senior  assessment team will work with the responsible officials and  personnel to determine which deficiencies are cost beneficial to  correct.   3.  Developing CAPs. The Implementation Guide for OMB Circular A- 123 states that a CAP, including targeted milestones and completion  dates, will be drafted and progress will be monitored. The elements of  a CAP include a summary description of the deficiency;   the year the deficiency was first identified;   the target corrective action date (the date of management follow- up);  the agency official responsible for monitoring progress;  the indicators, statistics, or metrics used to gauge resolution  progress (in advance of audit follow-up) in order to validate the  resolution of the deficiency (referred to as outcome measures for  assessing the effectiveness of the corrective actions for purposes  of this report); and  the quantifiable target or otherwise qualitative characteristic that  reports how resolution activities are progressing (referred to as  interim milestones for monitoring progress on interim actions for  purposes of this report).
DOD’s FIAR Guidance states that CAPs should be developed for all  material weaknesses and that progress in implementing these plans  should be periodically assessed and reported to management, which  should track progress to ensure timely and effective results. For  significant deficiencies, as well as nonsignificant deficiencies that  were not externally reported, CAPs should be developed and tracked  internally at the appropriate level.  4.  Monitoring the status of CAP implementation. Federal internal  control standards state that the resolution process begins when audit  or other review results are reported to management, and is completed  only after action has been taken that (1) corrects identified  deficiencies, (2) produces improvements, or (3) demonstrates that the  findings and recommendations do not warrant management action.  The Implementation Guide for OMB Circular A-123 states that an  entity’s senior management council, or similar forum(s), has  ownership and accountability for resolving deficiencies. These forums  should use CAPs as a guide or road map for discussion as well as in  determining when sufficient action has been taken to declare that a  deficiency has been corrected.
According to DOD’s FIAR Guidance, management’s process for  resolution and corrective action of identified material weaknesses in  internal control must do the following:
Provide for appointment of an overall corrective action  accountability official from senior agency management. The  official should report to the agency’s senior management council,  if applicable.
Maintain accurate records of the status of the identified material  weaknesses through the entire process of resolution.
Assure that CAPs are consistent with laws, regulations, and DOD  policy.
Assure that performance appraisals of appropriate officials reflect  effectiveness in resolving or implementing corrective actions for  identified material weaknesses.
The FIAR Guidance further states that a determination that a  deficiency has been corrected should be made only when sufficient  corrective actions have been taken and the desired results achieved.  This determination should be in writing and, along with other  appropriate documentation supporting the determination, should be  available for review by appropriate officials.
After comparing the criteria under the four elements above with the  design of the Army, Navy, and Air Force policies and procedures for  tracking and resolving audit findings, we found that while Navy had  sufficiently drafted policies and procedures to address three out of the  four elements, the Army’s and Air Force’s policies and procedures did not  sufficiently address any of the four elements, as detailed below.
subsections: section_title: Army’s Process for Addressing Financial Management-Related Audit Findings and Recommendations Was Not Comprehensive
paragraphs: The Army’s process for managing the remediation of financial  management deficiencies was not comprehensive, and portions of it were  evolving as it began to address the financial management-related findings  and recommendations from the fiscal year 2015 Budgetary Schedule  audit. The Army’s regulation regarding audits of the Army includes  general guidance establishing responsibility for responding to audit  findings from different sources, such as the Army Audit Agency, DOD  OIG, GAO, and IPAs. This regulation primarily focuses on the role of the  Army Audit Agency and states that the Army Audit Agency is responsible  for forwarding external audit reports to the appropriate principal Army  official who has responsibility for responding to a given report. In  addition, the Army organization with overall responsibility for the results  from the Budgetary Schedule audit has its own policies and procedures  for responding to audit recommendations. However, the Army lacks  procedures for reasonably assuring that it identifies and tracks all  financial management findings and recommendations. In addition, the  Army’s policies and procedures (1) did not provide sufficient details on  how to prioritize financial management findings and recommendations,  (2) were not consistent with the Implementation Guide for OMB Circular  A-123 for developing CAPs, and (3) did not sufficiently describe how the  status of corrective actions should be monitored.
subsections: section_title: Army’s Procedures for Identifying and Tracking Open Audit Findings and Recommendations Vary and Are Incomplete
paragraphs: The status of each open finding and recommendation pertaining to Army  financial management issues is supposed to be tracked by one of two  organizations. Specifically, under the Assistant Secretary of the Army,  Financial Management and Comptroller (ASA(FM&C)), (1) the  Accountability and Audit Readiness Directorate (hereafter referred to as  the Audit Readiness Directorate) is responsible for tracking findings and  recommendations from the Budgetary Schedule audit, as well as other  financial statement-related audits and audit readiness activities, and   (2) the Internal Review Directorate is responsible for tracking other  financial management-related findings and recommendations, primarily  from the DOD OIG and GAO but also some from the Army Audit Agency,  that pertain to the ASA(FM&C). When they receive new audit  recommendations, each of these directorates determines which Army  organization is responsible for addressing each recommendation under  its purview.
We reviewed the tracking procedures for each of these directorates and  found that they varied. Specifically, the Audit Readiness Directorate uses  a spreadsheet called a CAP tracker to keep track of the hundreds of  findings and recommendations issued during the audit of the Army’s fiscal  year 2015 Budgetary Schedule, as well as the status of CAPs developed  to remediate them. During our audit, we looked at the CAP tracker in  March 2016 and found that it consisted primarily of findings and  recommendations from the Budgetary Schedule audit, but also included  two findings and recommendations each from the DOD OIG and the Army  Audit Agency. These other recommendations were included in the CAP  tracker because they also pertained to audit readiness issues. The CAP  tracker is mentioned in the Audit Readiness Directorate’s Standard  Operating Procedure (SOP) for follow-up actions needed to respond to  financial statement audits and other audit readiness activities, which it  finalized in May 2016. However, the SOP does not provide any details  about what information for each finding and recommendation should be in  the CAP tracker, such as interim milestones and outcome measures.
The Internal Review Directorate also uses a spreadsheet to track the  findings and recommendations that it is responsible for tracking.  However, according to an Internal Review Directorate official, the  directorate did not have an SOP or other written policies and procedures  pertaining to its tracking of audit recommendations or to any other aspect  of managing the audit remediation process and related corrective actions  to address them. While reviewing the CAP tracker in March 2016, we  identified 42 unresolved recommendations related to financial  management that resulted from prior audits conducted by the Army Audit  Agency, the DOD OIG, and GAO and that should have been tracked by  the Internal Review Directorate. We found that as of August 2016, the  Internal Review Directorate was tracking 37 of these recommendations  while the other 5 open recommendations were not included in its tracker.  An Internal Review Directorate official said that these 5  recommendations, all of which stemmed from a GAO report from fiscal  year 2013, were made before he began working in the directorate, and  therefore, he did not know why they were not included. According to this  official, neither the Internal Review Directorate nor anyone else within  ASA(FM&C) had established procedures to ensure that all financial  management-related recommendations were being tracked within this  organization.
Without policies and procedures that clearly specify how audit findings  and recommendations should be tracked and which types of findings and  recommendations should be tracked by each of the two Army  organizations described above—the Audit Readiness Directorate and the  Internal Review Directorate—it can be difficult to hold either organization  accountable and reasonably assure that procedures are followed  consistently, particularly when there is staff turnover. If findings and  recommendations are overlooked and do not get tracked by either  organization, they are less likely to be remediated in a timely manner or  possibly at all.
section_title: Army’s SOP for Prioritizing Audit Findings and Recommendations Provides Only General Guidance
paragraphs: The Audit Readiness Directorate’s SOP includes general guidance for  prioritizing audit findings that is based on direction and criteria outlined in  the FIAR Guidance. Specifically, the SOP cites the following criteria for  prioritization: severity of deficiencies (material weakness or significant  deficiency); designation as a FIAR deal-breaker; findings that reference a  documentation gap; findings that are pervasive across business  processes; and finding sensitivity (e.g., failure of good stewardship of  government resources). However, the SOP does not identify which of  the criteria might be a higher priority than others. Consequently, if the  Audit Readiness Directorate followed the SOP criteria for prioritization,  most of the over 200 Budgetary Schedule audit findings would be  considered a priority, which would defeat the intent of identifying priorities.  To avoid this, Army officials said that based on input from the IPA they  decided to narrow the criteria for prioritizing the Budgetary Schedule  findings and recommendations to those related to the critical areas of  completeness, documentation, Fund Balance with Treasury, and information systems. Using these criteria, Army officials said they  identified specific findings and recommendations, and the related CAPs,  as high priority. These criteria are a subset of the criteria in the Audit  Readiness Directorate’s SOP as these issues were reported as material  weaknesses by the IPA and three of the four areas are also considered  deal-breakers in the FIAR Guidance. However, these more narrow criteria  are not yet included in the Audit Readiness Directorate’s SOP.
The Internal Review Directorate does not have any policies or procedures  for prioritizing the audit recommendations that it tracks. Instead,  according to a directorate official, the action officers responsible for  specific recommendations are in the best position to determine priorities  as they are more familiar with the conditions that generated each  recommendation. Without sufficiently detailed policies and procedures for  consistently and systematically prioritizing audit findings, the Army is at  increased risk of not identifying and focusing its efforts on its most critical  financial management weaknesses, and thereby not taking the steps  necessary to resolve them at the earliest possible date.
section_title: Army’s Guidance for Developing CAPs Was Not Complete
paragraphs: Only one of the two Army organizations responsible for remediating audit  findings had documented guidance for developing CAPs. The Audit  Readiness Directorate’s SOP describes the procedures for developing  CAPs to address findings from financial statement audits and audit  readiness activities. For example, it states that the Army official  responsible for developing a CAP should identify the root cause of the  finding related to the CAP. It also states that CAPs should be developed  using the format and template provided by the Audit Readiness  Directorate. This template includes most of the elements recommended in  the Implementation Guide for OMB Circular A-123, including a description  of the deficiency, the responsible official, interim milestones, outcome  measures, and an estimated completion date.
However, the Internal Review Directorate does not have any policies  requiring the development of CAPs or any other procedures that should  be followed to remediate the audit recommendations that it tracks,  according to a directorate official. Instead, the official said that after the  Internal Review Directorate forwards a report to an action officer for  remediation, the action officer will provide the directorate an estimated  completion date for each recommendation that the officer is responsible  for. When responsible organizations or officials believe that  recommendations have been remediated, they send descriptions of the  actions taken to the Internal Review Directorate with messages indicating  that the recommendations can be closed. These procedures were not  documented and do not include the elements recommended in the  Implementation Guide for OMB Circular A-123. Without documented  procedures for developing CAPs for all audit findings, the Army is at  increased risk of not developing CAPs for all findings or developing CAPs  that do not include all necessary elements.
section_title: Army’s Process for Monitoring the Status of CAP Implementation Was Not Fully Documented
paragraphs: Once a plan for a corrective action is complete, the CAP is expected to be  carried out and monitored by senior management, as recommended by  the Implementation Guide for OMB Circular A-123. According to Army  officials, any detailed documentation of CAP implementation is  maintained by the person responsible for carrying out the plan. We found  that this was the case for the remediation of all financial management- related recommendations, whether they fell under the responsibility of the  Audit Readiness Directorate or the Internal Review Directorate.
Because the Internal Review Directorate does not require CAPs for the  audit recommendations under its purview, it also does not monitor the  status of CAP implementation. Rather, it only maintains information about  when the corrective actions for a given audit recommendation are  considered complete and the recommendation can therefore be closed.
For the audit recommendations that fall under the Audit Readiness  Directorate, the directorate’s SOP states that the directorate is  responsible for monitoring the progress of the CAPs and provides some  information on how the monitoring should be conducted. For example, it  states that monitoring is carried out via regularly scheduled meetings  during which the senior responsible officials for each CAP provide  briefings about the status of corrective actions. The SOP mentions the  following types of meetings:
Synchronization calls are held weekly between the Audit Readiness  Directorate and one of two different groups that alternate every other  week. According to Army officials, one group includes the Enterprise  Resource Planning (ERP) managers, feeder system managers, and  DFAS, while the other group includes the Army commands—that is,  business process areas.
The Army Audit Committee meets bimonthly and is chaired by the  ASA(FM&C). Army officials told us that these meetings include all of  the Deputy ASAs, Army principals and major commands, as well as  DOD management such as the DCMO and officials from the DOD  Comptroller’s office, including the Deputy Chief Financial Officer.
However, the SOP does not provide complete information about all of the  monitoring activities that take place. For example, Army officials told us  that monitoring of the CAPs takes place at other meetings as well,  although these meetings are not described in the SOP. These meetings  included the following:
The Senior Level Steering Group/Senior Assessment Team, which  represents senior Army management responsible for monitoring  development and implementation of the CAPs. This group meets  quarterly with Army commands and service providers to review the  status of the CAPs.
Audit Status Update meetings, which are held biweekly, and during  which the Audit Readiness Directorate provides updates to the Army  Comptroller.
Audit Readiness Directorate’s “Stand-Up” meetings, which are held  twice a week to communicate with the field on the status of the CAPs.  One meeting per week focuses on Budgetary Schedule issues, while  the other meeting focuses on the Balance Sheet.
According to Army officials, any decisions or action items resulting from  these various meetings are documented, but we found that the  requirements for documenting such decisions are not included in the  Army’s SOP.
Further, the Army’s SOP did not describe or include specific procedures  for the preparation of “scorecards” that the Audit Readiness Directorate  uses to monitor the status of CAPs. These scorecards provide an  overview of the status of CAPs at status meetings and other management  oversight meetings. Army officials told us that a scorecard is prepared for  the development of each high-priority CAP and indicates both the  organization and the individual responsible for developing and  implementing the CAP, as well as estimated and actual dates for  completion of the CAP. After a CAP has been developed, the Army uses  another scorecard to monitor the execution of the CAP. This scorecard  includes some of the same information as the development scorecard,  but instead of CAP completion dates, it includes estimated and actual  dates for the execution and validation of each CAP. According to Army  officials, the scorecards are updated every 2 weeks. However, the  scorecards do not include any interim milestones or other metrics that  could be used to gauge progress or any outcome measures for assessing  the effectiveness of corrective actions. These types of metrics are an  important tool for monitoring the status of CAPs. Instead of metrics, each  scorecard uses color-coded symbols (i.e., red, yellow, blue, and green) to  indicate the status of each CAP. For example, to indicate the status of  CAP execution, green indicates that a CAP’s execution has been  completed, while blue indicates that the completed CAP execution has  been validated by an independent party.
The SOP states that the Audit Readiness Directorate will use a CAP  tracker to track the progress of CAP development and implementation.  However, as discussed previously, it does not provide any details about  what should be in the CAP tracker. For example, the SOP does not  specify which findings and recommendations, and related CAPs, should  be included in the tracker. It also does not describe what information  should be maintained in the tracker for each CAP. We obtained periodic  updates of the CAP tracker and determined that while the tracker  contained most of the elements recommended in the Implementation  Guide for OMB Circular A-123, it did not include any interim milestones or  other metrics that could be used to gauge progress, even though many of  the CAPs themselves did. In addition, similar to the CAPs, the CAP  tracker did not include any outcome measures for assessing the  effectiveness of corrective actions.
While the Audit Readiness Directorate has an SOP that has some  information about its monitoring procedures, it lacks certain details about  procedures that are being performed as well as other monitoring  procedures that should be performed. Moreover, the Internal Review  Directorate does not have any SOP regarding such procedures. Without  complete policies and procedures to describe all aspects of the Army’s  process for monitoring the implementation status of CAPs, the Army is at  increased risk that information about the status of CAPs will not be  adequately documented and monitored.
section_title: Navy’s Process for Addressing Financial Management-Related Audit Findings and Recommendations Has Not Been Finalized but Is Generally Consistent with Guidance
paragraphs: Prior to April 2015, the Navy had a decentralized approach for identifying  and tracking its findings and recommendations from audits or  examinations, with primary responsibility for these activities assigned to  the specific Navy program area under audit. In April 2015, in anticipation  of the notices of findings and recommendations that the Navy expected  would be issued as a result of the Budgetary Schedule audit, the Navy’s  Office of Financial Operations established the Evaluation, Prioritization,  and Remediation (EPR) Program. The purpose of this program is to build  a centralized capability to manage and track known deficiencies (reported  from both internal and external sources) and manage the related  remediation process across the Navy. As part of the effort, the Navy  drafted several SOPs for implementing its various remediation activities.  Although the Navy has not finalized the SOPs related to this process, the  draft guidance includes processes to identify and track its financial  management-related deficiencies, prioritize its audit findings and  recommendations, develop CAPs to address these deficiencies, and  monitor and report its findings and recommendations.
While the design of these processes is generally consistent with the  Implementation Guide for OMB Circular A-123, the Navy’s draft guidance  for identifying and tracking findings from external sources such as DOD  OIG and GAO and from the Naval Audit Service does not include specific  details and procedures for reasonably assuring the (1) completeness of  the universe of audit findings and recommendations from these sources  and (2) accuracy of the status of these audit findings and  recommendations, as discussed in detail below. Navy officials told us that  they plan to finalize the draft SOPs by December 31, 2016.
subsections: section_title: Navy’s Process for Identifying and Tracking Open Audit Findings and Recommendations Results in Omissions and Inconsistencies
paragraphs: The Navy drafted its EPR Program: Deficiency Universe Guide to  describe its process to centrally identify and track its financial  management-related findings and recommendations from both internal  and external sources. This draft guide includes procedures on steps the  Navy is taking to gather data from internal and external stakeholders, the  data structure used, activities to preserve the monthly integrity of these  data, and the reporting requirements for keeping the information updated.
The Navy uses a detailed spreadsheet, called a Deficiency Universe  Tracker (tracking spreadsheet), to keep track of the over 200 notices of  findings resulting from the Budgetary Schedule audit, as well as to  monitor the status of the related CAPs. The tracking spreadsheet also  tracks deficiencies identified from other sources, such as GAO, DOD  OIG, and the Naval Audit Service.
During our audit, we analyzed the tracking spreadsheet provided by the  Navy in July 2016 and identified differences between the number of audit  reports listed and the status of the deficiencies reported by the Navy on  its tracking spreadsheet, and with the number of reports listed and the  status of the deficiencies identified by GAO, the DOD OIG, and the Naval  Audit Service. For example, our analysis of the DOD OIG audit reports  listed on the Navy’s July 2016 tracking spreadsheet found that there was  a DOD OIG report that was issued in fiscal year 2015 with 5 open  financial management-related recommendations that was omitted from  the Navy’s tracking spreadsheet. Our analysis of the tracking spreadsheet  also found that the Navy was tracking 9 open financial management- related recommendations from three DOD OIG reports that were issued  in fiscal year 2015. However, a report we received from the DOD OIG’s  recommendation tracking system showed that the DOD OIG was tracking  10 open financial management-related recommendations from these  same three reports. With regard to the DOD OIG report that was not  entered into the tracking spreadsheet, Navy officials told us that they  were focused on addressing the notice of findings and recommendations  and did not enter this report. A Navy official also told us that going  forward the Navy will review and update the tracking spreadsheet to  account for this DOD OIG report and will also review other reports to help  ensure the completeness of its tracking spreadsheet.
With regard to the status of DOD OIG deficiencies the Navy was tracking,  Navy officials told us that they aggregate the recommendations from each  DOD OIG report into one data field on their tracking spreadsheet.  Therefore, all 3 recommendations from a DOD OIG report will be listed in  one data field (not three data fields) on the tracking spreadsheet. This  approach makes it difficult to determine the status of each  recommendation separately and may result in inaccurate reporting by the  Navy on the status of each audit recommendation. Another complication  with this approach is that it will be difficult to assess the Navy’s progress  in addressing those DOD OIG recommendations that are identified in the  DOD OIG report as one recommendation, yet have multiple steps listed  within that recommendation.
We believe that the omission of the DOD OIG audit report and the  inconsistencies of the status of the deficiencies reported by the Navy on  its tracking spreadsheet occurred because the Navy’s process for  obtaining, consolidating, monitoring, and updating its audit findings from  the DOD OIG, which involves conducting a monthly online search of audit  reports, is not properly designed. Relying on a monthly online search of  DOD OIG audit reports without periodically confirming with the external  auditor (the DOD OIG in this example) that the (1) list of reports is  complete and (2) status of audit findings and recommendations being  tracked is consistent could result in incomplete and inconsistent  information being reported on the Navy’s tracking spreadsheet.  Furthermore, according to the Navy’s draft guidance, its process for  gathering and monitoring audit findings from GAO and the Naval Audit  Service is designed using the same approach (i.e., a monthly online  search) and could therefore also result in similar incomplete and  inconsistent information being reported on the Navy’s tracking  spreadsheet.
Without detailed guidance and specific procedures in place for confirming  and validating the completeness and consistency of the status of the  financial management-related deficiencies it is tracking, the Navy is at risk  of reporting incomplete and inconsistent information both internally and  externally. If the Navy does not identify and track the status of the  complete universe of its unresolved deficiencies related to financial  management, it cannot provide reasonable assurance that all such  deficiencies will be addressed in a timely manner; which can ultimately  affect the reliability of its financial information and the auditability of its  financial statements. As the Navy progresses toward a full financial  statement audit for fiscal year 2018, completely identifying and  consistently tracking reported audit results will become even more  important, as audit coverage expands and additional deficiencies may be  identified.
section_title: Navy Has Developed a Detailed Methodology for Prioritizing Audit Findings and Recommendations
paragraphs: The Navy drafted its EPR Program: Deficiency Prioritization Standard  Operating Procedures (SOP) with details on its methodology for  prioritizing audit findings and recommendations by weighing various  factors, including the deficiency’s source; deficiency type; organizational  impact; whether it is a FIAR deal-breaker; whether it is financial or  information technology related; whether compensating controls exist; and  materiality, or the potential financial statement dollar amount affected by  the deficiency. According to the draft SOP, the EPR prioritization team will  evaluate each audit finding and recommendation to identify high-priority  deficiencies for remediation. As part of this process, the EPR team  defines key deficiency data elements, prioritization criteria, methodology,  scoring, risk factors, and qualitative considerations to assess what factors  to include in the final prioritization determination. Our analysis of the  tracking spreadsheet provided in July 2016 showed that the Navy had  identified and applied three prioritization categories (high, medium, and  low) to 82 percent of the recommendations from other sources that were  being tracked.
section_title: Navy’s Guidance for Developing CAPs Was Consistent with OMB Guidance
paragraphs: Our review of the template that the Navy is using to develop its CAPs and  the information presented on the tracking spreadsheet found that both of  these documents included the elements recommended in the  Implementation Guide for OMB Circular A-123. The template and tracking  spreadsheet both included a description of the deficiency, officials  responsible for addressing the deficiency, interim milestones for the  various activities and steps to address that deficiency, and validation  dates of when the CAP process is complete according to management.  Although the template and tracking spreadsheet do not include specific  outcome measures for assessing the effectiveness of the corrective  actions, we found that the Navy does have a process for developing and  reporting outcome measures as outlined in its draft reporting guidance.
According to the Navy’s draft EPR Program: Reporting and Reporting  Metrics SOP, outcome measures (or operational reporting metrics) will be  continuously collected and stored in the program’s EPR Program  SharePoint Tool and will be the data source used to create both periodic  and ad hoc reports as needed. Testing results and other pertinent data  derived from the EPR’s program activities will be collected in a  standardized format and stored in the tool. According to the draft  reporting SOP, program metrics that are tracked may include, but are not  limited to, notice of findings and recommendations response statuses,  CAP action results, associated financial impact of deficiencies, and any  additional reporting information relevant to effectively presenting the  CAPs. This draft SOP also provides details regarding the process for  approving any necessary thresholds that reporting metrics or other data  should be measured against for report creation purposes.
In addition to the draft reporting metric SOP, the Navy has drafted its EPR  Program: Corrective Action Plan Process SOP, which describes  procedures for adding certain data elements into the CAP template and  tracking spreadsheet. This SOP describes how the information flows to  and from the offices of primary responsibility or action officers, system  owners, and resource managers responsible for the CAP development  process. Our review of the design of the Navy’s CAP development  process found that it is consistent with guidance in the Implementation  Guide for OMB Circular A-123. The Navy’s approach to CAP  development involves a phased approach (i.e., planning and design,  implementation, validation, and closeout); a description of the root cause  analysis; an analysis of alternative CAPs; whether system or process  changes are required; whether policy updates are necessary; and  whether additional resources are needed to implement the CAPs. If  effectively implemented, the Navy’s design for developing CAPs should  provide it with information on the needed steps or activities for addressing  identified deficiencies.
section_title: Navy Designed a Multilayered Process for Monitoring the Status of CAP Implementation
paragraphs: We found that the design for monitoring the status of corrective action  implementation at the Navy involves several layers of management  oversight and collaboration and various reporting activities. According to  its draft EPR Guidebook, one of the Navy’s objectives for centralizing its  remediation efforts and establishing the EPR Program is to facilitate a  culture of collaboration, integration, and accountability across the Navy in  support of its auditability milestones. To this end, the Navy has  established its Senior Management Council at the most senior Navy  management level comprising senior executive civilians and flag  officers. According to its charter, the council is responsible for  monitoring, assessing, and reporting to the Assistant Secretary of the  Navy, Financial Management and Comptroller on the implementation of  corrective actions to ensure that they are accurate and timely, and  reporting the results of CAP implementation. At a minimum, this council  meets quarterly each year, in part to review the Navy’s progress in  correcting previously identified material weaknesses. In addition to  periodic monitoring at the Navy’s senior management level, the Navy has  identified other key personnel in its Office of Financial Operations who  play critical roles in ongoing monitoring of its remediation efforts. These  key personnel are the office of primary responsibility and the responsible  action officer.
Office of primary responsibility. The office of primary responsibility  is a senior executive civilian or flag officer responsible for facilitating  the collaboration and communication necessary for the engagement  of senior leaders and major stakeholders supporting CAP  development and resource identification as needed. This person is the  primary point of contact and driver for remediating a deficiency and  should have the knowledge to assess the root cause of the deficiency.
Action officer. The action officer is generally more at the working  level and is responsible for hands-on remediation of a deficiency, and  should have a strong understanding of the mission needs and  capabilities. This officer’s tasks include conducting a root cause  analysis of the deficiency, implementing and sustaining the CAPs, and  reporting on the CAPs’ status.
To facilitate collaboration for addressing its remediation activities, the  Navy also holds recurring meetings attended by the EPR Program team  and Navy senior leadership to discuss CAP progress and milestones  accomplished. According to Navy officials, the purpose of these meetings  is to help drive accountability for CAPs, address potential challenges, and  increase transparency in the EPR process. Navy officials told us that the  EPR team meets regularly to assess prioritized deficiencies for action,  discuss updates on CAP progress, and identify risks as reported by the  office of primary responsibility. According to Navy officials, monthly  meetings are also held with the Assistant Secretary of the Navy, Financial  Management and Comptroller, and the Navy’s Office of Financial  Operations senior management to review CAP status, approve CAP  implementation, assess identified risks, and evaluate CAP mitigation  plans as needed.
As discussed earlier, to provide guidance on the Navy’s reporting  activities on the status of its CAPs, the Navy drafted an EPR Program:  Reporting and Reporting Metrics SOP. This SOP establishes guidelines,  policies, and procedures for the EPR Program to follow when creating  reports and reporting metrics across program activities. According to this  draft SOP, performing these procedures will help provide a high level of  data integrity and minimize gaps of information across the Navy. The draft  SOP also states that all of the aggregated CAP, deficiency, and findings  and recommendations data will be stored in the EPR Program SharePoint  Tool. This tool will serve as the source for all reporting and reporting  metrics required by the EPR Program and will assist the EPR program  manager in developing accurate reports and reporting metrics, when  needed.
The Navy also drafted the EPR Program: CAP Validation SOP that  establishes guidelines, policies, and procedures to validate CAPs and  deficiencies through testing to determine if deficiencies have been  remediated and the corrective actions are operating effectively. This SOP  provides details on the CAP validation’s objectives, roles and  responsibilities, and procedures. Results from the CAP validation process  are compiled and reported in a CAP Testing Results Report and reported  to the Navy’s Office of Financial Operations. This report includes the  testing scope, pass rates, and recommendations for improvement.
The Navy’s draft guidance provides details on the roles and  responsibilities, level of collaboration needed, and reporting framework  that if implemented effectively should allow Navy management to  sufficiently monitor implementation progress of its CAPs.
section_title: Air Force Did Not Design a Comprehensive Process for Addressing Financial Management-Related Audit Findings and Recommendations
paragraphs: The Air Force did not have a comprehensive process in place to identify  and track all financial management-related findings and  recommendations. The Air Force had written policies and procedures  providing limited information for selected recommendations, such as  those from the Air Force Audit Agency (AFAA), but the policies did not  discuss the development of CAPs. The Air Force’s written policies and  procedures did not provide specific details to support how   (1) recommendations from all audit sources are identified and prioritized  for tracking purposes, (2) CAPs are developed for these  recommendations, and (3) CAPs are implemented and monitored. The Air  Force provided guidance in the June 2016 CAPs Process Guide  describing the Air Force’s process for developing and implementing CAPs  to remediate self-identified deficiencies and its over 200 findings and  recommendations issued by the IPA during the fiscal year 2015  Budgetary Schedule audit. This guidance describes at a high level the  CAP development and implementation process, responsible  organizations/stakeholders, and the steps required of each responsible  party. However, even this guidance did not provide the information to  resolve all the limitations we identified.
subsections: section_title: Air Force Did Not Have a Comprehensive Process for Identifying and Tracking All Open Audit Findings and Recommendations
paragraphs: The Air Force did not design comprehensive policies and procedures for  how it identifies and tracks all of its financial management-related findings  and recommendations. While the Air Force had developed a mechanism  for identifying and tracking the findings and recommendations from AFAA,  self-identified deficiencies, and its fiscal year 2015 Budgetary Schedule  audit, it had not established a similar process for identifying and tracking  most other findings and recommendations from other audits, such as  those conducted by the DOD OIG and GAO. Therefore, the Air Force did  not track the complete universe of its financial management-related  findings and recommendations from all sources.
Moreover, the Air Force had policies and procedures for following up on  DOD OIG and GAO reports, but these policies and procedures—which  are described in Air Force Instructions 65-402, Financial Management:  Relations with the Department of Defense, Office of the Assistant  Inspector Generals for Auditing and Analysis and Follow Up, and 65- 401, Financial Management: Relations with the Government  Accountability Office—primarily discussed the audit report processes  and applicable roles and responsibilities, but did not assign the tracking of  the DOD OIG and GAO audit findings and recommendations to anyone in  the Air Force. Instead, the Air Force relies on the DOD OIG to track and  follow up on any Air Force-related DOD OIG and GAO findings and  recommendations. As noted previously, in accordance with the  Implementation Guide for OMB Circular A-123, the Air Force is  responsible for tracking and addressing any recommendations that the  DOD OIG or GAO made to it. Unless the Air Force actively tracks findings  and recommendations and reasonably assures that it has a complete  universe of findings and recommendations from all audit sources and has  assigned responsibility for addressing them, it increases the risk that it  may not adequately address and remediate all deficiencies that could  hinder it from becoming fully audit ready.
Without specific procedures in place for identifying and tracking financial  management-related audit findings and recommendations from all  sources, the Air Force is at risk of not addressing the complete universe  of its findings and recommendations. If the Air Force does not identify and track the complete universe of its unresolved deficiencies related to  financial management, it cannot provide reasonable assurance that all  such deficiencies will be addressed in a timely manner, which can  ultimately affect the reliability of its financial information and the  auditability of its financial statements.
section_title: Air Force’s Process Does Not Reasonably Assure That Audit Findings and Recommendations Are Appropriately Prioritized
paragraphs: The Air Force policies and procedures for prioritizing its financial  management-related audit findings and recommendations do not  reasonably assure that all findings and recommendations are  appropriately prioritized. This is because the CAPs Process Guide  includes limited criteria for prioritizing Budgetary Schedule audit findings  and self-identified deficiencies. The guidance also describes different  priority designations (Priorities 1, 2, and 3) for the Budgetary Schedule  audit findings and recommendations and self-identified financial  management-related deficiencies. However, the guidance is silent on  other financial management-related deficiencies from other sources, such  as AFAA, DOD OIG, and GAO. Additionally, the Air Force guidance does  not specify prioritizing recommendations based upon financial  management impact but rather upon the source of the finding. For  example, a self-identified deficiency is assigned a Priority 1 if the finding  and recommendation align with an Air Force team working in specific  areas. The Implementation Guide for OMB Circular A-123 and FIAR  Guidance state that the extent to which corrective actions are tracked by  the agency should be commensurate with the severity of the deficiency.  Given the significant number of findings and recommendations that the  Air Force has received from the various audit entities, it is important for  the Air Force to appropriately prioritize them to help achieve audit  readiness.
The Air Force has policies and procedures for following up on AFAA,  DOD OIG, and GAO reports that are set forth in Air Force Instructions 65- 403, Financial Management: Followup on Internal Air Force Audit  Reports, and Instructions 65-402 and 65-401, but these also do not  describe prioritization. Without sufficiently detailed policies and  procedures for identifying and prioritizing audit findings, the Air Force is at  increased risk of not addressing its most critical financial management  weaknesses and achieving audit readiness.
section_title: Air Force’s Guidance for Developing CAPs Is Incomplete
paragraphs: The Air Force does not have detailed policies and procedures for  developing CAPs for its self-identified financial management-related  deficiencies and financial management-related audit findings and  recommendations issued by the 2015 Budgetary Schedule audit IPA,  AFAA, the DOD OIG, and GAO. The CAPs Process Guide describes the  Air Force’s process for developing CAPs to remediate both self-identified  deficiencies and audit findings and recommendations issued during the  fiscal year 2015 Budgetary Schedule audit. The guidance describes at a  high level the process for developing CAPs and includes root causes,  milestones, validation, and testing, but the guidance is not sufficiently  detailed to include all of the elements recommended by the  Implementation Guide for OMB Circular A-123. For example, while there  are several start and end dates for interim milestones within the CAPs  guidance, the guidance does not include a provision for the CAPs to  include the targeted corrective action dates (the dates of management  follow-up). Also, the guidance does not discuss outcome measures for  assessing the effectiveness of the corrective actions. During our audit, we  reviewed a status summary of the CAPs for the fiscal year 2015  Budgetary Schedule financial-related findings and recommendations and  found that the CAPs did not include all elements recommended by the  Implementation Guide for OMB Circular A-123, such as the targeted  corrective action dates (the dates of management follow-up) or outcome  measures.
The Air Force also has limited policies and procedures for following up on  audit findings and recommendations from AFAA, the DOD OIG, and  GAO, which are described in Air Force Instructions 65-403, 65-402, and  65-401. However, these documents do not provide detailed guidance on  developing CAPs. While the Air Force has an Audit Recommendation  Implementation Tracking policy memo and attached Air Force Audit  Implementation Plan Guidance that pertains to AFAA recommendations,  these documents only describe the process at a high level and do not  provide specific details as to how CAPs for these audit findings and  recommendations would be developed and monitored.
Without complete and sufficiently detailed policies and procedures for  designing CAPs, the Air Force is at increased risk of developing CAPs  that do not include all elements necessary for ensuring accountability and  for effectively monitoring the development and implementation of CAPs.  Also, without CAP information on AFAA, DOD OIG, and GAO financial  management-related findings and recommendations, it is not clear how  Air Force management can assess the progress being made toward  achieving audit readiness.
section_title: Air Force’s Process for Monitoring the Status of CAP Implementation Is Incomplete
paragraphs: The Air Force does not have detailed policies and procedures for  monitoring progress against the CAPs for its financial management- related audit findings and recommendations. The CAPs Process Guide  describes at a high level the Air Force’s process for monitoring and  reporting on the CAPs’ implementation to remediate both self-identified  deficiencies and audit findings and recommendations issued during the  fiscal year 2015 Budgetary Schedule audit. The guidance provides a brief  description of the monitoring to be performed by the responsible  organization, but the guidance is not complete. For example, the  guidance describes that regular updates on progress of the CAPs should  be provided to the Air Force financial management CAP lead by the office  of primary responsibility. However, as recommended by the  Implementation Guide for OMB Circular A-123, the guidance does not  discuss specific details, such as the role of the Air Force’s Senior  Assessment Team (Air Force Financial Improvement Executive Steering  Committee) in resolving deficiencies, setting targeted corrective action  dates, and determining outcome measures.
Without having complete policies and procedures to describe all aspects  of the Air Force’s CAP monitoring process, the Air Force is at increased  risk that CAP implementation will not be adequately monitored; this could  result in some CAPs not receiving adequate attention and therefore not  being implemented in a timely manner, which could negatively affect the  Air Force’s efforts to achieve audit readiness.
section_title: DOD’s Process for Monitoring and Reporting on Audit Remediation Efforts Lacks Comprehensive Information
paragraphs: Although the DOD Comptroller’s office has established several elements  of a department-wide audit readiness remediation process, it does not  have the comprehensive information on the status of all CAPs throughout  the department needed to fully monitor and report on the progress being  made to resolve financial management-related deficiencies that preclude  DOD from being auditable. Specifically, (1) the DOD Comptroller’s office  is not able to fully assess the military services’ progress because it does  not obtain complete, detailed information on all of their CAPs related to  critical capabilities—those identified in the FIAR Guidance as necessary  to achieve auditability—and (2) reports to internal stakeholders and  external stakeholders, such as DOD OIG, OMB, GAO, and Congress, on  the status of audit readiness do not provide comprehensive information.  As a consequence, the DOD Comptroller’s office is unable to provide and  prepare department-wide, comprehensive information on the status of all  CAPs related to critical capabilities that are necessary to achieve  auditability. Having comprehensive DOD-wide information on the CAPs  related to critical capabilities will take on additional importance as DOD  moves forward with audits that have broader scopes beyond its budgetary  statements, potentially leading to other findings being identified.
subsections: section_title: DOD Does Not Obtain Detailed Information on All CAPs from the Military Services Related to Critical Capabilities to Fully Assess Progress
paragraphs: The Implementation Guide for OMB Circular A-123 states that the senior  management council, or similar forums, has ownership and accountability  for resolving deficiencies. Such forums should use CAPs as a road map  for discussion as well as in determining when sufficient action has been  taken to declare that a deficiency has been corrected. The  Implementation Guide for OMB Circular A-123 also recommends that a  senior assessment team communicate the status of CAPs developed for  material weaknesses to the senior management council on a regular  basis. The senior management council should be responsible for  determining if the progress is sufficient or if additional action must be  taken to expedite the remediation process. DOD Comptroller officials told  us that the FIAR Governance Board is considered DOD’s equivalent of a  senior management council as described in the Implementation Guide for  OMB Circular A-123. Further, the Implementation Guide for OMB  Circular A-123 recommends that an agency establish a CAP framework  to facilitate stakeholder oversight and ensure accountability for results.  For example, the agency could prepare a CAP management summary  that is made available to external stakeholders and to the agency senior  management council.
In addition, the April 2016 FIAR Guidance identifies the following seven  capabilities as being critical to achieving audit readiness and therefore the  highest priorities for corrective actions: (1) produce a universe of  transactions; (2) reconcile its Fund Balance with Treasury; (3) provide  supporting documentation for adjustments to its financial records;   (4) validate the existence, completeness, rights, and obligations of its  assets; (5) establish processes to manage and value its assets correctly;  (6) establish an auditable process for estimating and recording its  environmental and disposal liabilities; and (7) implement critical  information technology controls for its financial systems.
DOD Comptroller officials told us that as part of their process to update  the FIAR Guidance, generally about once a year, they also consider  whether any additional critical capabilities should be identified in the  guidance. Because the critical capabilities are the DOD Comptroller’s  highest priorities for corrective actions, it is important that they are  updated to reflect the audit findings that result from DOD’s audit  readiness efforts. For example, one of the seven critical capabilities  currently addresses the need for supporting documentation for  adjustments to financial records. However, as stated previously, the IPAs  for all three military services noted the lack of adequate supporting  documentation for transactions, not just adjustments, as a reportable  finding on their Budgetary Schedule audits, which also contributed to  each IPA’s disclaimer of opinion. Appropriate documentation for financial  transactions allows the military services to support financial statement line  items and allows auditors to test the line items. Expanding the critical  capabilities to reflect significant audit findings will increase the ability of  the DOD Comptroller to monitor and report on the CAPs most likely to  affect audit readiness.
DOD has designed a department-wide process to monitor and report on  the department’s audit readiness and remediation efforts. According to  DOD Comptroller officials, the department-wide process consists primarily  of the following procedures: (1) obtaining periodic updates on summary- level interim milestones and percentages of completion for major  processes related to critical capabilities (but not for specific CAPs related  to these critical capabilities), (2) attending various meetings with the  military services and other defense organizations to discuss and obtain  high-level updates on the status of CAPs and other audit readiness  efforts, (3) obtaining and tracking the status of all findings and  recommendations from service providers and other defense  organizations, and (4) reporting the status of audit readiness efforts to  Congress and other stakeholders in semiannual FIAR Plan Status  Reports.
According to DOD Comptroller officials, the offices of the DCMO and the  DOD Comptroller are the main parties at the department level that are  involved in monitoring financial management improvement and audit  readiness efforts throughout DOD. To monitor the status of the military  services’ remediation efforts, officials from both of these offices attend  bimonthly (i.e., every other month) FIAR Governance Board meetings to  discuss and obtain high-level updates on the status of military services’  CAPs and other audit readiness efforts. In addition, DOD Comptroller  officials attend other, more frequent meetings (e.g., audit committee) with  the military services regarding their audit readiness efforts. During these  meetings, DOD officials receive briefing slides that provide high-level  summaries of the military services’ audit readiness, including some  information on the status of the CAPs relating to the Budgetary Schedule  audits that each service, using its respective criteria, has determined to  be high priority.
DOD Comptroller officials told us that they compile some of this  summary-level information, such as the percentages of completion for  critical capabilities by various DOD components, based on more detailed  information that they receive from the components. However, even this  more detailed information is based on some summarization of tasks that  are part of the critical capabilities, as well as the percentages of  completion for these tasks. Except for certain findings and  recommendations related to DOD-wide issues, DOD Comptroller officials  said that they do not receive detailed information on individual findings,  recommendations, and CAPs from the military services. Although the  DOD Comptroller developed a Notice of Findings and Recommendations  Tracking Tool, it is used primarily to track the audit readiness findings and  recommendations for the other defense organizations and findings and  recommendations for the military services that pertain to DOD-wide  issues that require action at the department level. DOD Comptroller  officials said that because of resource constraints, they do not plan to  obtain or track the detailed status of most of the military services’ findings,  recommendations, and CAPs, but instead will rely on the information  provided for various oversight meetings to monitor the status of audit  readiness efforts. The officials also explained that they have obtained  some detailed findings and recommendations related to DOD-wide issues  that they are using to help develop policies to address these issues. As  new policies are issued, then the military services will likely need to  develop CAPs to implement the new policies.
As described above, the DOD Comptroller receives some details about  the status of the seven critical capabilities at the military services.  However, without obtaining all of the military services’ findings,  recommendations, and related CAPs with consistent data elements  pertaining to the seven critical capabilities, the DOD Comptroller’s office  and other DOD officials could be limited in their ability to adequately  monitor these issues. Further, without detailed, consistent, and timely  updates (e.g., updates for the bimonthly FIAR Governance Board  meetings) from the military services on the status of CAPs related to the  critical capabilities, DOD officials will not have the consistent, readily  available information needed to effectively monitor and report the status  of these CAPs. Having consistent, readily available information on these  types of CAPs will take on additional importance as DOD moves forward  with more audits beyond its Budgetary Schedules, potentially leading to  more findings being identified.
section_title: Reports on Audit Readiness Status Do Not Provide Comprehensive Information for Stakeholders
paragraphs: DOD is also responsible for reporting the status of audit readiness and  remediation efforts to its internal stakeholders and its external  stakeholders, such as the DOD OIG, OMB, GAO, and Congress. For  example, the 2010 NDAA required that DOD provide recurring,  semiannual reports by May 15 and November 15 on the status of the  department’s implementation of the FIAR Plan to congressional defense  committees. Federal internal control standards also require that an  entity’s management communicate with and obtain quality information  from external parties through established reporting lines. In these  communications, management should include information relating to the  entity’s activities that affect the internal control system. DOD’s FIAR Plan  Status Reports are the department’s primary mechanism for reporting the  status of its audit readiness, including audit remediation efforts, to  Congress and other external parties. The reports include narratives on  each military service’s audit readiness efforts, focusing on material  weaknesses and the seven critical capabilities necessary to achieve audit  readiness, and estimated completion dates for each of these areas. Over  the years, as the military services have set target dates for asserting audit  readiness, the target dates have been delayed, which we have reported  increases the risk that DOD may not complete its audit readiness efforts  within planned time frames, thereby affecting DOD’s ability to meet the  statutory requirements. For example, we recently reported that the  military services’ target dates for asserting audit readiness for real  property were delayed by at least 2 years. In addition, we have reported  that the military services’ SBR milestone dates had been delayed.
Further, although the FIAR Plan Status Reports appropriately provide  summary-level information, they do not provide the detailed information  that might be needed by some stakeholders. For example, even though  the reports contain summary-level information regarding milestones for  the seven critical capabilities, they do not include the detailed actions and  interim milestones for the CAPs related to critical capabilities, which could  provide a more complete picture of the status of corrective actions. The  Implementation Guide for OMB Circular A-123 recommends that such  detailed information about CAPs be provided to external stakeholders  upon request. However, if DOD does not routinely obtain consistent and  detailed information from the military services on the status of their CAPs,  it cannot readily provide this type of information to stakeholders when  requested and must instead rely on inefficient methods, such as data  calls to collect detailed information for stakeholders.
As part of our past audits of the consolidated financial statements of the  U.S. government, we have observed significant progress being made in  improving federal financial management government-wide. For example,  nearly all of the 24 Chief Financial Officers (CFO) Act agencies received  unmodified or “clean” opinions on their fiscal year 2015 financial  statements, up from 6 CFO Act agencies that received clean audit  opinions in 1996 when the CFO Act agencies were first required to  prepare audited financial statements. For example, the Department of  Homeland Security (DHS) was able to overcome its numerous material  weaknesses that had prevented its financial statements from being  auditable. Since its creation in fiscal year 2003 when 22 separate  agencies were brought together to form the new department, DHS was  able to move from receiving disclaimers of opinion on its financial  statements to first achieving an unqualified or “clean” opinion on all of its  financial statements for fiscal year 2013, which has continued through  fiscal year 2016. DHS policy on corrective action plans, issued in fiscal  year 2012, indicates that its process included maintaining a department- wide accumulation of significant CAPs from all of its components; using  standard data elements; and providing monthly updates on the status of  CAPs to the CFO, and updates on an as-needed basis to the OIG and the  Secretary.
As we have previously reported, many of the planned audit readiness  actions and milestones reported by DOD and its components in FIAR  Plan Status Reports have not been realized. Given the short amount of  time remaining before the statutory deadline of March 31, 2019, for  submitting to Congress the results of an audit of its fiscal year 2018  financial statements, having complete, reliable, and detailed information  on the department-wide status of CAPs related to critical capabilities is  essential for DOD and its stakeholders so that they can measure and  communicate DOD’s progress in addressing the financial management  deficiencies and determine if additional actions are necessary to expedite  the remediation process.
section_title: Conclusions
paragraphs: DOD is moving forward with its efforts to achieve the goal of being audit  ready by September 30, 2017, and as part of this effort, had the Army,  Navy, and Air Force undergo their first audits of their Schedules of  Budgetary Activity for fiscal year 2015. The IPAs for all three military  services issued disclaimers of opinion on the respective services’ fiscal  year 2015 Schedules of Budgetary Activity and identified material  weaknesses in internal control. In response, the Army, Navy, and Air  Force have all begun taking significant steps toward resolving their  material weaknesses, such as developing and implementing CAPs to  address the IPAs’ recommendations. However, none of the military  services have complete policies and procedures to identify and  sufficiently track all of their financial management-related findings and  recommendations reported by audits, and only the Navy has drafted  policies and procedures that effectively prioritize, develop, and monitor  the status of its CAPs’ implementation. The DOD Comptroller and DCMO  have also begun to take a more active role in monitoring the status of the  military services’ CAPs to ensure that adequate progress is being made.  However, DOD’s process for monitoring and reporting on its audit  remediation efforts lacks some of the information recommended by the  Implementation Guide for OMB Circular A-123. Specifically, DOD does  not obtain comprehensive information from the military services on the  status of their CAPs, such as interim milestones, completion dates, and  other indicators or targets that facilitate management’s ability to fully  determine how the resolution of CAPs is progressing. This type of  detailed information is critical for DOD management and its external  stakeholders to evaluate the progress that DOD military services are  making in correcting the deficiencies that are preventing the department  from obtaining an audit opinion on its financial statements. The lack of  comprehensive information on the status of CAPs increases DOD’s risk  that it will not be able to fully, timely, and efficiently correct its long- standing deficiencies.
section_title: Recommendations for Executive Action
paragraphs: To improve processes for identifying, tracking, remediating, and  monitoring financial management-related audit findings and  recommendations, we are making the following eight recommendations.
subsections: section_title: Secretary of the Army
paragraphs: 1.  We recommend that the Secretary of the Army direct the Internal  Review Directorate under the Assistant Secretary of the Army,  Financial Management and Comptroller, to develop written policies  and procedures for all financial management-related audit findings  and recommendations under its purview that include the following: how the status of the recommendations will be tracked;  the process and criteria to be followed for prioritizing the findings  and recommendations;  the process for developing CAPs to remediate the findings and  recommendations, including the detailed CAP elements  recommended by the Implementation Guide for OMB Circular A- 123; and  the process for monitoring the status and progress of the CAPs,  including the documentation to be maintained for monitoring CAP  status and any actions to be taken if a lack of progress is found.    2.  We recommend that the Secretary of the Army direct the  Accountability and Audit Readiness Directorate under the Assistant  Secretary of the Army, Financial Management and Comptroller, to  enhance the directorate’s policies and procedures for (1) tracking and  prioritizing all financial management-related audit findings and  recommendations under its purview and (2) developing and  monitoring CAPs for all such recommendations so that they include  sufficient details, such as the criteria used to prioritize the CAPs, the  recommended CAP elements, and the process for monitoring and  documenting the progress and status of CAPs.
section_title: Secretary of the Navy
paragraphs: 3.  We recommend that the Secretary of the Navy, when finalizing the  Navy’s policies and procedures for identifying and tracking its CAPs to  remediate financial management-related audit findings and  recommendations, enhance this guidance so it includes detailed steps  and specific procedures for confirming and validating the  completeness and accuracy of the status of these audit findings and  recommendations.
section_title: Secretary of the Air Force
paragraphs: 4.  We recommend that the Secretary of the Air Force design and  document a comprehensive process to ensure that the complete  universe of all financial management-related findings and  recommendations from all audit sources is identified and tracked.   5.  We recommend that the Secretary of the Air Force update the Air  Force’s written policies and procedures for prioritizing financial  management-related audit findings and recommendations from all  audit sources and for developing and monitoring CAPs so that they  include sufficient details. These procedures should include the  following details:
The process to be followed for prioritizing the financial  management-related findings and recommendations from audit  sources.
The guidance for developing CAPs for all financial management- related audit findings and recommendations from all audit sources  to include complete details, including the elements recommended  by the Implementation Guide for OMB Circular A-123.
The process for monitoring the status of the CAPs for all financial  management-related audit findings and recommendations from all  audit sources, including the documentation to support any  corrective actions taken, as recommended by the Implementation  Guide for OMB Circular A-123.
section_title: Secretary of Defense
paragraphs: 6.  To improve DOD management’s process for monitoring the military  services’ audit remediation efforts and to provide timely and useful  information to stakeholders as needed, we recommend that the  Secretary of Defense direct the Secretary of the Army, the Secretary  of the Navy, and the Secretary of the Air Force to prepare and submit  to the Under Secretary of Defense (Comptroller), on at least a  bimonthly basis for availability at the FIAR Governance Board  meetings, a summary of key information included in the CAPs that at  a minimum contains the data elements recommended by the  Implementation Guide for OMB Circular A-123 for each CAP related  to critical capabilities for achieving audit readiness.   7.  To reasonably assure that DOD management and external  stakeholders have a comprehensive picture of the status of corrective  actions needed for audit readiness throughout the department, we  recommend that the Secretary of Defense direct the Under Secretary  of Defense (Comptroller) to prepare a consolidated CAP management  summary on a bimonthly basis that includes the data elements  referred to above on the status of all CAPs related to critical  capabilities for the military services and for the service providers and  other defense organizations.
section_title: Under Secretary of Defense (Comptroller)
paragraphs: 8.  To facilitate the development of a consolidated CAP management  summary and the ability to efficiently respond to stakeholder requests,  we recommend that the Under Secretary of Defense (Comptroller)  develop and implement a centralized monitoring and reporting  process that at a minimum (1) captures department-wide information  on the military services’ and other defense organizations’ CAPs  related to critical capabilities, including the standard data elements  recommended in the Implementation Guide for OMB Circular A-123,  and (2) maintains up-to-date information on the status of these CAPs.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOD and the military services for  review and comment. In their written comments, reprinted in appendix IV,  the Army, Navy, and Air Force concurred with our respective  recommendations to them, while DOD concurred with one  recommendation and partially concurred with two other recommendations  that we made to it.
subsections: section_title: Army
paragraphs: The Army concurred with our recommendation that its Internal Review  Directorate develop written policies and procedures for all financial  management-related audit findings and recommendations under its  purview. The Army stated that the Internal Review Directorate has  completed updating its policies and procedures to include how the status  of findings and recommendations will be tracked and prioritized as well as  how CAPs will be developed and monitored. The Army also concurred  with our recommendation that its Accountability and Audit Readiness  Directorate enhance its policies and procedures for (1) tracking and  prioritizing all financial management-related audit findings and  recommendations under its purview and (2) developing and monitoring  CAPs for all such recommendations so that they include sufficient details,  such as the criteria used to prioritize the CAPs, the recommended CAP  elements, and the process for monitoring and documenting the progress  and status of CAPs. The Army stated that the Accountability and Audit  Readiness Directorate has completed actions to enhance its current  standard operating procedures to include (1) updating its CAP database  and reporting tool, (2) documenting its reporting procedures, and   (3) updating its CAP template to include additional elements  recommended by the Implementation Guide for OMB Circular A-123. In  addition, the Army stated that its policies and procedures include steps to  incorporate external financial management-related audit findings  assigned to the Accountability and Audit Readiness Directorate by the  Internal Review Directorate and that the existing process the Army uses  to prioritize findings and the related CAPs and to monitor the progress  and status of CAPs has been documented.
section_title: Navy
paragraphs: The Navy concurred with our recommendation to enhance its guidance to  include detailed steps and specific procedures for confirming and  validating the completeness and accuracy of the status of financial  management-related audit findings and recommendations. The Navy  stated that it is (1) recording new findings and recommendations on a  weekly basis in its deficiency database, (2) reviewing historical audits to  ensure that previous findings and recommendations are recorded, and   (3) collaborating with audit agencies to establish a process to reconcile  the status of recommendations to ensure that its deficiency database  accurately reports open and closed recommendations. The Navy also  stated that these processes would be documented and implemented by  January 31, 2017.
section_title: Air Force
paragraphs: The Air Force concurred with our recommendation that the Air Force  design and document a comprehensive process to ensure that the  complete universe of all financial management-related findings and  recommendations from all audit sources is identified and tracked. The Air  Force described planned actions that it will take to address the  recommendation, including revising the existing process for identifying  and tracking all financial management-related findings and  recommendations from all audit sources and coordinating with all  stakeholders. The Air Force plans to implement this recommendation by  January 31, 2018. The Air Force also concurred with our recommendation  to update its written policies and procedures for prioritizing financial  management-related audit findings and recommendations from all audit  sources, and for developing and monitoring CAPs so that they include  sufficient details. The Air Force stated that it will revise its existing written  policies and procedures to include (1) prioritizing findings and  recommendations and (2) providing guidance for developing detailed and  actionable CAPs and for monitoring the status and progress toward  implementing and closing the CAPs, as recommended by the  Implementation Guide for OMB Circular A-123. The Air Force plans to  implement this recommendation by January 31, 2019. However, the Air  Force’s planned implementation dates indicate that the changes to  policies and procedures will not be in place before fiscal year 2018, the  period that the department-wide financial statements will be under audit.
DOD concurred with our recommendation that the department direct the  military services to prepare and submit, on at least a bimonthly basis,  summaries of key information included in their CAPs that include, for  each CAP related to critical capabilities, the data elements recommended  by the Implementation Guide for OMB Circular A-123. Specifically, DOD  stated that it is updating its template for the military services to use for  reporting this information so that it will include the recommended standard  data elements. In addition, it stated that the FIAR Guidance will be  updated to explicitly state that the military services should include these  data elements in their CAPs.
DOD partially concurred with our recommendation that the department  direct the DOD Comptroller to prepare a bimonthly consolidated CAP  management summary that includes the data elements outlined in the  Implementation Guide for OMB Circular A-123 for all CAPs related to  critical capabilities for the military services as well as for the service  providers and other defense organizations. According to DOD, and as we  stated in our report, the military services already provide summary-level  updates on their critical capability CAPs at FIAR Governance Board  meetings. It also stated that the template that is used to present CAPs to  the FIAR Governance Board meetings at the summary level has been  updated to align CAPs to critical capabilities. However, DOD’s response,  while reiterating what is already being reported, does not address how all  of the data elements from the Implementation Guide for OMB Circular A- 123 will be summarized or otherwise reported for all CAPs pertaining to  critical capabilities across the department, as we recommended. In  addition, DOD stated that because the DOD Comptroller takes  responsibility for maintaining, monitoring, and reporting on the status of  CAPs for the service providers and other defense organizations and of  DOD-wide issues, the Comptroller will also summarize this information.  However, it does not provide any further details about what information  will be summarized, and as we note in the report, the Comptroller’s  tracking does not include CAPs for the military services. Without  developing a consolidated department-wide summary of CAPs, DOD will  continue to lack a department-wide view of all CAPs pertaining to each  critical capability. Therefore, we continue to believe that DOD needs to  take actions to fully implement this recommendation.
DOD also partially concurred with our recommendation for the DOD  Comptroller to develop and implement a centralized monitoring and  reporting process that captures and maintains up-to-date information,  including the standard data elements recommended in the  Implementation Guide for OMB Circular A-123, for all CAPs department- wide that pertain to critical capabilities. In its response, DOD said that as  outlined in the military services’ responses to our recommendations  directed to them, the Army, Navy, and Air Force have agreed to take the  responsibility for developing, maintaining, and monitoring all CAPs at the  level recommended by the Implementation Guide for OMB Circular A- 123. Further, DOD stated that the information reported at FIAR  Governance Board meetings, along with the CAP information maintained  by the DOD Comptroller, provides the department the ability to efficiently  respond to stakeholder requests for CAPs related to critical capabilities.  As noted above, we acknowledge the important steps the military  services have planned or taken to address our recommendations and  improve their CAP monitoring processes. However, DOD’s actions do not  address our recommendation to develop a centralized reporting process  to capture department-wide information on the military services’ and other  defense organizations’ CAPs related to critical capabilities.
As stated in our report, DOD does not routinely obtain consistent and  detailed information from the military services on the status of their CAPs,  and without such it cannot readily provide this type of information to  stakeholders when requested and must rely on inefficient methods, such  as data calls to collect the detailed information. In addition, many of the  planned audit readiness actions and milestones reported by DOD and its  components in the FIAR Plan Status Reports have not been realized.  Given the short amount of time remaining before the statutory date of  March 31, 2019, for submitting to Congress the results of an audit of  DOD’s fiscal year 2018 financial statements, having complete and  reliable, detailed information on the department-wide status of CAPs  related to critical capabilities is essential for DOD and its stakeholders so  that they can (1) measure and communicate DOD’s progress in  addressing the financial management deficiencies and (2) determine if  additional actions are necessary to expedite the remediation process.  This type of detailed information is critical for DOD management and its  external stakeholders to evaluate the military services’ progress in  correcting the deficiencies that are preventing the department from  obtaining an audit opinion on its financial statements. Moreover, the lack  of comprehensive information on the status of CAPs increases DOD’s risk  that it will not be able to fully, timely, and efficiently correct its long- standing deficiencies. Therefore, we continue to believe that DOD needs  to take action to fully implement this recommendation.
We are sending copies of this report to the Secretary of Defense; the  Under Secretary of Defense (Comptroller)/Chief Financial Officer; the  Deputy Chief Financial Officer; the Director, Financial Improvement and  Audit Readiness; the Secretary of the Army; the Secretary of the Navy;  the Secretary of the Air Force; the Director of the Office of Management  and Budget; and appropriate congressional committees. In addition, the  report will be available at no charge on GAO’s website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made major contributions to this report  are listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) report the results of the audits of the fiscal year  2015 Schedules of Budgetary Activity (Budgetary Schedule) for the  military services, (2) determine the extent to which each military service  designed a process to address identified financial management-related  findings and recommendations, and (3) determine the extent to which the  Department of Defense (DOD) has designed a department-wide strategy  to monitor and report on audit readiness remediation efforts.
To address our first objective, we monitored the audit work of the military  services’ independent public accountants (IPA) by attending status  meetings, participating in site visits, and coordinating with DOD Office of  Inspector General (OIG) officials to discuss the audits’ progress and  challenges resulting from these first-year audits. We also reviewed  documentation of the audit work conducted by the IPAs. We reviewed  documentation related to planning, internal controls, testing, and reporting  on the audits. This included sampling plans, risk assessments, test plans  and summaries, audit opinions, and reports on internal control and  compliance with laws and regulations. In addition, we reviewed the audit  reports on the Army, Navy, and Air Force Budgetary Schedules along  with other audit reports addressed to Army, Navy, and Air Force  management that detailed audit findings and recommendations and the  services’ responses to these audit reports.
We reviewed the DOD OIG audit contracts (and contract modifications)  for the Army, Navy, and Air Force and the related statements of work. We  also reviewed the management representation letters from each military  service, which contained management’s assertions about the reliability of  its financial reporting in accordance with generally accepted accounting  principles, as it related to the Fiscal Year 2015 Budgetary Schedules.
To address our second objective, we obtained information on the IPAs’  findings and recommendations from the Budgetary Schedule audits as  well as other existing open recommendations or findings from other  sources related to financial management at the Army, Navy, and Air  Force. We met with applicable military service personnel to determine  what policies and procedures were designed to (1) identify and track open  findings and recommendations from all sources; (2) prioritize open  findings and recommendations by risk or other factors, such as audit  impediments identified in the Financial Improvement and Audit Readiness  guidance; (3) develop corrective action plans (CAP) to remediate findings  and recommendations; and (4) monitor the status of the CAPs’  implementation to confirm that deficiencies were remediated. We  compared the military services’ policies and procedures with guidance for  CAPs in the Implementation Guide for OMB Circular A-123,  Management’s Responsibility for Internal Control, appendix A, “Internal  Control over Financial Reporting.” We also reviewed relevant  documentation pertaining to how the military services were carrying out  the aforementioned procedures.
For the third objective, we held discussions with officials from the office of  the DOD Deputy Chief Management Officer (DCMO), the military  services’ respective DCMOs, and officials from the Office of the Under  Secretary of Defense (Comptroller) to determine what department-wide  strategy has been designed to monitor the military services’ development  and implementation of CAPs, and what their roles and responsibilities  were with respect to CAP oversight. We also reviewed DOD policies,  procedures, and DOD management documentation to gain an  understanding of how DOD management monitors the military services’  audit remediation activities.
We conducted this audit from March 2015 to February 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Relationship between the Schedule of Budgetary Activity and the Statement of Budgetary Resources
paragraphs: The fiscal year 2015 Schedule of Budgetary Activity (Budgetary  Schedule) is an interim, military service-level special report intended to  provide a building block toward an audit-ready Statement of Budgetary  Resources (SBR) through audits of consecutive fiscal year schedules of  budgetary activity. The Budgetary Schedule, like the SBR, is designed to  provide information on budgeted spending authority as outlined in the  President’s Budget, including budgetary resources, availability of  budgetary resources, and how obligated resources have been used.  However, instead of covering the full range of SBR activity on current and  expired appropriations that have not been canceled, the first-year  Budgetary Schedule covers only activity for current fiscal year  appropriations. Subsequent fiscal year Budgetary Schedules would  include activity for subsequent years’ appropriations, building toward an  SBR. For example, in the second year, the fiscal year 2016 Budgetary  Schedule would include fiscal year 2016 budgetary activity related to  fiscal year 2015 and 2016 appropriations.
In making the shift to focus on audit readiness for a Budgetary Schedule,  Department of Defense officials concluded—based on the difficulties  encountered in obtaining documentation for prior-year transactions on the  Marine Corps’ SBR audit—that the most effective path to an audit of the  SBR would be to start with reporting and auditing only current-year  activity for fiscal year 2015 appropriations and to expand subsequent  audits to include current-year appropriations and prior appropriations  going back to fiscal year 2015. Both the SBR and the Budgetary  Schedule consist of four separate but related sections that provide  information about budgetary resources, the status of budgetary  resources, changes in obligated balances, and outlays for major  budgetary accounts.
Budgetary resources. This section of a first-year Budgetary  Schedule shows total budgetary resources made available to the  agency for obligation during the current fiscal year only. It consists of  new budget authority, reimbursements, and other income. The first- year Budgetary Schedule does not include amounts from prior  periods, commonly referred to as beginning balances. In contrast, the  SBR includes amounts available from prior reporting periods;  transfers available from prior-year balances; and adjustments, such  as recoveries of prior-year obligations. In addition, the SBR includes  all other information provided in this section of the Budgetary  Schedule.
Status of budgetary resources. This section of the Budgetary  Schedule and the SBR shows the status of budgetary resources at  the end of the period and consists of obligations incurred and the  unobligated balances at the end of the period that are available for  future use. For the Budgetary Schedule and the SBR, the total for this  section must agree with the total for the budgetary resources section,  as this section describes the status of total budgetary resources. In  addition to the current-year activity, the SBR includes obligations that  are unavailable except to adjust or liquidate obligations chargeable to  prior period appropriations.
Change in obligated balance. This section of a first-year Budgetary  Schedule consists of obligations incurred in the current year, less  current-year outlays. In addition to current-year activity, the SBR  would also include unpaid obligations brought forward from the prior  years and recoveries of prior-year unpaid obligations.
Outlays. This section of the Budgetary Schedule shows the  relationship between obligations and outlays (also referred to as  disbursements or expenditures) and discloses payments made to  liquidate obligations. Obligations are usually liquidated by means of  cash payments (outlays), primarily by electronic fund transfers. This  section reconciles outlays with obligations incurred and the change in  obligated balances during the year. The content of this section is the  same for the SBR and the Budgetary Schedule.
section_title: Appendix III: Information Systems and the Role of Service Providers at the Department of Defense
subsections: section_title: Department of Defense and Military Service Financial Information Systems Operating Environment
paragraphs: Automated information systems are essential for modern accounting and  recordkeeping. The Department of Defense (DOD) is developing its  Enterprise Resource Planning (ERP) systems as the backbone of its  financial management improvement, and they are critical for transforming  its business operations. Implementation of ERP systems is critical to  ensuring that the department meets its statutory requirement to prepare  and submit audited department-wide financial statements for fiscal year  2018. However, ERP implementation has been delayed because of  deficiencies in functional capability and the need for remedial corrective  actions, which may affect DOD’s ability to achieve audit readiness.  According to the May 2016 Financial Improvement and Audit Readiness  (FIAR) Plan Status Report, while DOD continues to make progress in  addressing information technology system audit readiness challenges,  many of these challenges will still exist for fiscal year 2018, which is when  DOD is required to undergo a financial statement audit.
According to DOD officials, for the ERP systems that will not be fully  deployed prior to the financial statement audit readiness milestone, the  DOD components will need to identify effective work-around processes or  modifications to legacy systems that will enable audit readiness. Without  fully deployed ERPs, the department will be challenged to produce  reliable financial data and auditable financial statements without resorting  to labor-intensive efforts, such as data calls or manual work-arounds, or  to provide reliable financial data on a recurring basis.
section_title: Role and Significance of Information Systems in Effective Financial Management
paragraphs: The department’s ability to improve its accounting, including accounting  for budgetary information, has historically been hindered by its reliance on  fundamentally flawed financial management systems and processes.
Effective information systems help provide reasonable assurance to  management and auditors that data reported in the financial statements  are accurate and complete. When information system controls are  effective, auditors can rely on these controls; when information system  controls are not effective, auditors must perform substantially more  testing. DOD has identified its information system control deficiencies as  an impediment to its components being able to demonstrate audit  readiness or successfully completing an audit because under such  conditions, neither management nor auditors can rely on automated  application controls or system-generated reports. In addition, without  adequate financial management processes, systems, and controls, the  military services are at risk of having inaccurate and incomplete data for  financial reporting and management decision making and potentially  exceeding authorized spending limits. The lack of effective internal  controls hinders management’s ability to provide reasonable assurance  that allocated resources are used effectively, properly, and in compliance  with budget and appropriations law.
section_title: Reporting Entity and Service Provider Roles and Responsibilities in the Audit Process
paragraphs: The complexities inherent in DOD reporting entity and service provider  relationships and associated audit readiness interdependencies make it  essential that DOD establish a common, detailed, written understanding  regarding the mutual roles and responsibilities of the reporting entity and  the service provider. To help ensure successful completion of audit  readiness tasks, the reporting entity and service provider must agree on  the roles and responsibilities for the authorization, initiation, processing,  recording, and reporting of transactions; information technology controls  affected by the service provider; or both. The FIAR Guidance points out  that a shared understanding and agreement between the service provider  and the reporting entity on these roles and responsibilities must be  documented in a service-level agreement or memorandum of  understanding. Details such as the types of supporting documentation  that should be retained for each business process and transaction type,  which organization will retain the specific documents, and the retention  period for the documentation should be included in the service-level  agreement/memorandum of understanding. In addition, the service  provider must provide a description of the internal controls that may affect  the reporting entity’s financial reporting objectives.
Areas in which service providers play a critical role on behalf of DOD that  continue to pose significant risks to achieving full audit readiness include  the ability to support journal vouchers and the existence, completeness,  and valuation of assets reported on the Balance Sheet. To facilitate  progress in such critical areas, the department has developed a list of  critical capabilities along with interim milestone dates by which those  milestones must be completed and the critical capabilities must be  resolved department-wide. In addition to the critical capabilities, the  department identified DOD-wide issues, including service provider  processes and systems that affect customer audit readiness and the  timing of service provider audit readiness activity.
As discussed in DOD’s FIAR Guidance, service providers working with  reporting entities are responsible for audit readiness efforts surrounding  service provider systems and data, processes and controls, and  supporting documentation that have a direct effect on reporting entities’  auditability. The FIAR Guidance requires the service providers to have  their control activities and supporting documentation examined by the  DOD Office of Inspector General or an independent auditor in accordance  with Statement on Standards for Attestation Engagements No.16 so that  components have a basis for relying on the service provider’s internal  controls for their financial statement audits. Service providers are subject  to separate examination engagements on the service organization’s  systems and the suitability of the design and operating effectiveness of  the service organization’s controls to achieve stated control objectives for  various business processes. Service providers design processes and  related controls with the assumption that complementary user entity  controls will be placed in operation by user entities. The application of  these controls by user entities is necessary to achieve certain control  objectives within the service organization reports.
section_title: Appendix IV: Comments from the Department of Defense
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, the following individuals made  key contributions to this report: Arkelga Braxton (Assistant Director),  Beatrice Alff, Tulsi Bhojwani, Gloria Cano, Francine DelVecchio, Doreen  Eng, Peter Grinnell, Kristi Karls, Jason Kelly, Richard Larsen, Yvonne  Moss, Chanetta Reed, Sabrina Rivera, Althea Sprosta, Roger Stoltz,  Randy Voorhees, and Doris Yanger.