Financial Management: Long-standing Financial Systems Weaknesses Present a Formidable Challenge
Published: 2007-08-03T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Federal Financial Management Improvement Act of 1996 (FFMIA) requires the 24 Chief Financial Officers (CFO) Act agencies to implement and maintain financial management systems that comply substantially with (1) federal financial management systems requirements, (2) federal accounting standards, and (3) the U.S. Government Standard General Ledger (SGL). FFMIA also requires GAO to report annually on the implementation of the act. This report, primarily based on GAO and inspectors general reports, discusses (1) the problems that continued to affect agencies systems' FFMIA compliance in fiscal year 2006 and (2) the initiatives under way to help move federal financial management toward FFMIA compliance.
section_title: What GAO Found
paragraphs: Federal agencies have continued to make progress in meeting the requirements of FFMIA since the passage of the law in 1996. Most agencies though, have not yet progressed to the stage that their systems are substantially compliant, and some agencies have made little progress. Accordingly, agencies continue to fall short in their attempts to establish the financial systems needed to create the full range of information needed for effective day-to-day management. In fiscal year 2006, auditors for 17 of the 24 CFO Act agencies reported that agencies' financial management systems did not substantially comply with at least one of the three FFMIA requirements. Based on audit reports, GAO identified six types of problems primarily related to agencies' systems. These problems with agency financial systems remain a significant obstacle to supporting effective management of the federal government. With regard to improvement initiatives, GAO noted continued progress in two key areas: (1) agencies' required remediation plans and (2) the Office of Management and Budget's (OMB) efforts to address system implementation problems. All 12 of the remediation plans GAO reviewed included corrective actions, but several were missing key elements. Moreover, agencies continue to struggle with efforts to modernize their financial management systems. This problem is particularly acute at the Department of Defense. Agency modernization efforts have been consistently hampered by failure to follow best practices in systems development and implementation, commonly referred to as disciplined processes. As a result, these efforts far too often do not meet cost, schedule, and performance goals. To help address these problems, OMB has demonstrated continued progress in the implementation of the financial management line of business initiative. However, additional steps forward are needed to provide a foundation for this initiative.

section_title: Letter
paragraphs: Having the reliable, useful, and timely financial data needed to efficiently  and effectively manage their day-to-day operations is a long-standing  challenge for federal agencies. To address this challenge, the Congress  mandated financial management reform within the federal government by  enacting the Chief Financial Officers (CFO) Act of 1990. The CFO Act laid  the foundation for a comprehensive reform of federal financial  management by establishing a leadership structure, requiring audited  financial statements, and strengthening accountability reporting. This act  also requires agencies to implement modern financial management  systems in order to attain the systematic measurement of performance;  the development of cost information; and the integration of program,  budget, and financial information for management reporting. The end goal  of the CFO Act is to greatly enhance the ability of federal managers to do  their jobs by providing the full range of financial information needed for  day-to-day management.
Building on the foundation laid by the CFO Act, the Federal Financial  Management Improvement Act of 1996 (FFMIA) requires the major  departments and agencies covered by the CFO Act to implement and  maintain financial management systems that comply substantially with    (1) federal financial management systems requirements, (2) applicable  federal accounting standards, and (3) the U.S. Government Standard  General Ledger (SGL) at the transaction level. The act also requires the  heads of agencies and auditors to determine whether the agencies’  financial management systems comply with the act’s requirements. In  addition, we are required to report annually on the implementation of the  act.
This report discusses (1) the auditors’ assessments of federal agency  systems’ compliance with FFMIA requirements for fiscal years 1997  through 2006 and the financial management systems problems that  continued to affect systems’ FFMIA compliance in fiscal year 2006 and    (2) the initiatives under way to help move federal financial management  toward the goals of the CFO Act and FFMIA compliance. This report  incorporates historical information from our prior FFMIA reports, other  reports issued by GAO, and reports issued by inspectors general (IG). We  analyzed and summarized information from these reports that related to  FFMIA issues and determined that the data in these reports were  sufficiently reliable for the purposes of this report. We conducted our  work from January through June 2007 in Washington, D.C., in accordance  with generally accepted government auditing standards. We requested  comments on a draft of this report from the Director of the Office of  Management and Budget (OMB) or his designee. We received written  comments from the OMB Controller. OMB’s comments are discussed in  the Agency Comments and Our Evaluation section and reprinted in  appendix VI.
subsections: section_title: Background
paragraphs: FFMIA is part of a series of management reform legislation passed by the  Congress over the past two decades. This series of legislation started with  the Federal Managers’ Financial Integrity Act of 1982 (FMFIA), which the  Congress passed to strengthen internal controls and accounting systems  throughout the federal government, among other purposes. Issued  pursuant to FMFIA, the Comptroller General’s Standards for Internal  Control in the Federal Government provides the standards that are  directed at helping agency managers implement effective internal control,  an integral part of improving financial management systems. Internal  control is a major part of managing an organization and comprises the  plans, methods, and procedures used to meet missions, goals, and  objectives. In summary, internal control helps government program  managers achieve desired results through effective management of public  resources.
Effective internal control also helps in managing change to cope with  shifting environments and evolving demands and priorities. As programs  change and agencies strive to enhance operational processes and  implement new technological developments, management must  continually assess and evaluate its internal control to ensure that the  control activities being used are effective and updated when necessary.  While agencies had achieved some early success in identifying and  correcting material internal control and accounting system weaknesses,  their efforts to implement FMFIA had not produced the results intended  by the Congress.
Therefore, beginning in the 1990s, the Congress passed additional  management reform legislation to improve the general and financial  management of the federal government. This legislation includes the        (1) CFO Act of 1990, (2) Government Performance and Results Act of  1993, (3) Government Management Reform Act of 1994, (4) FFMIA,      (5) Clinger-Cohen Act of 1996, (6) Accountability of Tax Dollars Act of  2002, (7) Improper Payments Information Act of 2002, (8) The Federal  Information Security Management Act of 2002, and (9) Department of  Homeland Security (DHS) Financial Accountability Act of 2004. The  combination of reforms ushered in by these laws, if successfully  implemented, provides a solid foundation to improve the accountability of  government programs and operations as well as to routinely produce  valuable cost and operating performance information. These financial  management reform acts emphasize the importance of improving financial  management of the federal government.
In particular, building on the foundation laid by the CFO Act, FFMIA  emphasizes the need for CFO Act agencies to have systems that ensure  ongoing accountability and generate reliable, useful, and timely  information for decision-making purposes. FFMIA requires the  departments and agencies covered by the CFO Act to implement and  maintain financial management systems that comply substantially with    (1) federal financial management systems requirements, (2) applicable  federal accounting standards, and (3) the SGL at the transaction level.  FFMIA also requires auditors to state in their CFO Act financial statement  audit reports whether the agencies’ financial management systems  substantially comply with these three FFMIA systems requirements.  Appendixes I through IV include details on the various requirements and  standards that support federal financial management.
subsections: section_title: Guidance for FFMIA Issued by OMB
paragraphs: OMB establishes governmentwide financial management systems policies  and requirements and has issued two sources of guidance related to  FFMIA reporting. First, OMB Bulletin No. 06-03, Audit Requirements for  Federal Financial Statements, dated August 23, 2006, prescribes audit  requirements, including language auditors should use when reporting on  an agency system’s substantial compliance with the three FFMIA  requirements. Specifically, this guidance calls for auditors to provide  negative assurance when reporting on an agency system’s FFMIA  compliance. Second, in the OMB Memorandum, Revised Implementation  Guidance for the Federal Financial Management Improvement Act        (Jan. 4, 2001), OMB provides guidance for agencies and auditors to use in  assessing substantial compliance. The guidance describes some of the  factors that should be considered in determining whether an agency’s  systems substantially comply with FFMIA’s three requirements and  examples of indicators that should be used in assessing whether an  agency’s systems are in substantial compliance with each of the three  FFMIA requirements. Finally, the guidance addresses the development of  remediation plans to be developed by agency officials for bringing their  systems into compliance with FFMIA.
section_title: Financial Audit Manual Section on FFMIA Developed by GAO and the President’s Council on Integrity and Efficiency
paragraphs: We have worked in partnership with the President’s Council on Integrity  and Efficiency (PCIE) to develop and maintain the joint GAO/PCIE  Financial Audit Manual (FAM). The FAM includes sections that provide  specific procedures auditors should perform when assessing FFMIA  compliance. These sections include detailed audit steps for testing  agency systems’ substantial compliance with the requirements of FFMIA.
As detailed in appendix V, we have also issued a series of checklists to  help assess whether agencies’ systems meet systems requirements. The  FAM guidance on FFMIA assessments recognizes that while financial  statement audits offer some assurance on FFMIA compliance, auditors  should design and implement additional testing to satisfy FFMIA criteria.  For example, in performing financial statement audits, auditors generally  focus on the ability of the financial management systems to process and  summarize financial information that flows into annual agency financial  statements. In contrast, FFMIA requires auditors to assess whether an  agency’s financial management systems comply with system requirements,  accounting standards, and the SGL. To do this, auditors need to consider  whether agency systems provide reliable, useful, and timely information  for managing day-to-day operations so that agency managers would have  the necessary information to measure performance on an ongoing basis  rather than just at year end. Further, OMB’s current audit guidance calls  for financial statement auditors to review performance information for  consistency with the financial statements, but does not require auditors to  determine whether this information is available to managers for day-to-day  decision making as called for by the FAM guidance for testing compliance  with FFMIA. In collaboration with the PCIE, we are currently in the  process of updating the FAM and expect to issue an updated version later  in 2007.
section_title: Scope and Methodology
paragraphs: We reviewed the fiscal year 2006 financial statement audit reports for the  24 CFO Act agencies to identify the auditors’ assessments of agency  financial systems’ compliance and the problems that affect FFMIA  compliance. To determine whether the data were sufficiently reliable, we  performed the following procedures. We gained an understanding of the  quality control environments at the respective IGs; leveraged our  understanding of the methodology used by the IGs and their contract  auditors in past years to reach conclusions with respect to FFMIA  compliance at the respective agencies; considered management responses  to the auditor’s findings and conclusions; and asked questions to improve  our understanding of the procedures applied and/or conclusions drawn,  where appropriate. We also reviewed the data for obvious inconsistencies  or errors, completeness, and changes from the prior year. When we found  data which were inconsistent or incomplete we brought them to the  attention of the cognizant IG staff and worked with them to resolve any  issues before using the data as a basis for this report. When we  encountered data that varied from the prior year, we reviewed the PAR  and/or IPA report to determine the reason for the change. Based on these  actions, we determined that the data from these reports were sufficiently  reliable for the purposes of our report.
Using the auditors’ reports for the 24 CFO Act agencies, we identified  problems reported by the auditors that affect agency systems’ compliance  with FFMIA. The problems identified in these reports are consistent with  long-standing financial management weaknesses we have reported based  on our work at a number of agencies. However, we caution that the  occurrence of problems in a particular category may be even greater than  auditors’ reports of FFMIA noncompliance would suggest, because  auditors may not have identified all instances of noncompliance with  systems requirements and included all problems in their reports. Further,  we identified other GAO and IG reports that discussed financial  management systems issues and summarized the reports. We also  obtained data from agencies’ annual PAR reports. We also met with OMB  officials to discuss their current efforts to improve federal financial  management and address our prior recommendations related to FFMIA. In  addition, we reviewed documentation provided by OMB regarding its  current initiatives.
We conducted our work from January through June 2007, in accordance  with U.S. generally accepted government auditing standards. We requested  written comments on a draft of this report from the Director of OMB or his  designee. We received written comments from the OMB Controller. OMB’s  comments are discussed in the Agency Comments and Our Evaluation  section and reprinted in appendix VI. We also received technical  comments from OMB, which we incorporated as appropriate.
section_title: FFMIA Assessments Identify Marginal Improvements in Some Cases
paragraphs: Many agencies still do not have effective financial management systems in  place that can produce reliable, useful, and timely financial information,  including cost data, with which to make informed decisions and help  ensure accountability on an ongoing basis. Agencies are making progress  in addressing their financial management systems weaknesses—some  dramatically. Most agency systems, though, are not yet substantially in  compliance with FFMIA’s requirements. As shown in figure 3, IGs and  their contract auditors reported for fiscal year 2006 that 17 of the 24 CFO  Act agencies did not substantially comply with at least one of FFMIA’s  three requirements—federal financial management systems requirements,  applicable federal accounting standards, or the SGL at the transaction  level. Figure 3 also shows that the number of agencies’ systems reported  by auditors as noncompliant with FFMIA has decreased marginally (from  20 agencies to 17 agencies) since FFMIA was enacted.
Of the seven remaining CFO Act agencies, one auditor provided positive  assurance of FFMIA compliance, while the other six provided negative  assurance in fiscal year 2006. However, it would be erroneous to assume  that statements of negative assurance provided by auditors for the six  agencies equate to compliance with FFMIA. Auditors’ assessments for  three agencies changed from fiscal year 2005 to 2006. For fiscal year 2006,  auditors for GSA provided negative assurance that GSA’s financial  management systems, as a whole, were substantially compliant with  FFMIA’s three requirements. Auditors for AID provided positive assurance  that AID’s financial management systems complied with FFMIA in fiscal  year 2006. In fiscal year 2005, both AID and GSA were deemed  noncompliant with FFMIA by the independent auditors. According to  management, AID was able to become compliant due to completion of  outstanding remediation items and the worldwide deployment of its  financial management system. Conversely, auditors for the Department of  Labor (Labor) reported that Labor’s financial management systems did not  substantially comply with FFMIA requirements in fiscal year 2006, but had  provided positive assurance of FFMIA compliance in fiscal year 2005. The  change was primarily due to weaknesses Labor auditors identified  concerning general computer access controls, application access controls,  and related manual controls.
subsections: section_title: FFMIA Guidance Issues
paragraphs: Auditors for six agencies (Commerce, EPA, GSA, NSF, OPM, and SSA)  provided negative assurance that the agencies’ systems were compliant  with FFMIA requirements. Auditors provide negative assurance when they  state that nothing came to their attention during the course of their  planned procedures to indicate that the agency’s financial management  systems did not meet FFMIA requirements. Although OMB’s current audit  guidance instructs auditors to test for compliance with FFMIA, it does  not provide guidance on the nature and extent of tests to be performed. It  calls for auditors to provide negative assurance when reporting whether  an agency’s systems are in substantial compliance with the three FFMIA  requirements. However, financial statement users not familiar with the  concept of negative assurance may incorrectly assume that these six  agencies’ systems have been fully tested by the auditors and that the  agencies have achieved FFMIA compliance. In addition, without  adequately testing systems for FFMIA compliance in a manner that is  sufficient to support an opinion, auditors may not identify all areas of  noncompliance; therefore, the number of problems may be even greater  than those currently disclosed in auditors’ reports on FFMIA compliance  based on negative assurance.
As we have previously reported, from our perspective, FFMIA requires  auditors to provide positive assurance, which is an opinion. Section 803  (b) (1) of FFMIA requires auditors to “report whether the agency financial  management systems comply with the requirements of .”  Providing positive assurance on FFMIA compliance involves additional  testing to determine whether an agency’s financial management systems  comply substantially with systems requirements, the SGL at the  transaction level, and accounting standards. The procedures necessary to  provide such assurance go beyond those needed for performing a financial  statement audit. While financial statement audits in general will offer some  assurance on FFMIA compliance, auditors should also design and  implement additional testing to satisfy the criteria in FFMIA. For example,  in fiscal year 2006, agency auditors for AID stated that they interviewed  staff and contract personnel and reviewed documentation related to the  capabilities of Phoenix, AID’s core financial system. According to AID  auditors, they examined documentation, including reports, system queries,  system screen captures, testing documents generated during system  implementation, and documents generated for certification and  accreditation activity in order to determine if the implemented systems  provide complete, accurate, and timely information for managing day-to- day operations necessary to achieve positive assurance. When reporting  an agency’s financial management systems to be in substantial  compliance, positive assurance from independent auditors can provide  users with confidence that the agency systems provide the reliable, useful,  and timely information envisioned by the act. The fact that AID’s auditors  provided positive assurance on FFMIA compliance is a noteworthy  achievement.
In addition, performing audit procedures designed to provide positive  assurance of an agency’s financial management systems’ substantial  compliance with FFMIA requirements can identify weaknesses and lead to  improvements that enhance the performance, productivity, and efficiency  of federal financial management systems in support of day-to-day  managerial decision making. It also provides a clear “bottom line,”  whereas negative assurance does not. Some auditors we interviewed in  prior years indicated that a revision to OMB’s guidance on FFMIA  reporting would be necessary for them to provide an opinion of FFMIA  compliance. Therefore, as we have discussed in prior reports covering  fiscal years 2000 through 2005, we continue to believe that our prior  recommendation for OMB to require agency auditors to thoroughly  examine agencies’ financial management systems and provide a statement  of positive assurance when reporting an agency’s systems to be in  substantial compliance with the three FFMIA systems requirements is  appropriate and required. Doing so will be key to achieving the act’s goal  of effective financial management systems across government.
However, OMB has not concurred with our recommendation in its  responses to our prior reports and in its comments on a draft of this  report. For example, last year, in response to our report on fiscal year  2005 FFMIA results, OMB stated that the broad scope of the President’s  Management Agenda and the fundamental changes occurring under the  Financial Management Line of Business initiative, combined with  strengthened reporting requirements under Circular No. A-123, are helping  agencies identify and correct FFMIA deficiencies. In that context, OMB  reiterated its belief that requiring a statement of positive assurance would  prove only marginally useful.
Further, as we have previously reported, a number of auditors have  expressed a need for clarification on the definition of “substantial  compliance.” They cited a need for additional guidance to assist them in  assessing whether agency systems substantially comply with the three  FFMIA requirements. The auditors reported a need for clearer guidance  from OMB on assessing FFMIA compliance that is consistent with the  GAO/PCIE FAM. As a result, we continue to believe that implementation  of our recommendation for OMB to explore clarifying the definition of  “substantial compliance” would be useful. Other related concerns of  agency auditors included a need for (1) more clearly defined and objective  criteria to assist in their determination of FFMIA compliance, (2) more  specific guidance on testing and sampling methodologies, and   (3) additional guidance for assessing compliance with certain accounting  standards, such as the Statement of Federal Financial Accounting  Standards (SFFAS) No. 4, Managerial Cost Accounting Concepts and  Standards for the Federal Government. In its comments on prior reports,  OMB stated that its growing experience helping agencies implement the  PMA enables it to refine the existing FFMIA indicators associated with  substantial compliance. Accordingly, OMB said it would consider our  recommendation in any future policy and guidance updates. In  commenting on a draft of this report, OMB agreed to take this  recommendation under advisement as it updates Circular No. A-127,  Financial Management Systems.
section_title: Problems Reported by Agency Auditors
paragraphs: Based on our review of the fiscal year 2006 audit reports for the 17  agencies reported to have systems not in substantial compliance with one  or more of FFMIA’s three requirements, we identified six primary reasons  for agency systems not being compliant:    nonintegrated financial management systems,   inadequate reconciliation procedures,   lack of accurate and timely recording of financial information,    noncompliance with the SGL,   lack of adherence to federal accounting standards, and    weak security controls over information systems.
The weaknesses reported by the auditors ranged from serious, pervasive  systems problems to less serious problems that may affect only one aspect  of an agency’s accounting operation. While at some agencies, the problems  were so serious that they affected the auditor’s opinion on the agency’s  financial statements, at other agencies, the auditors cited problems that  represented significant deficiencies in the design or operation of internal  control, but were not material to the financial statements as a whole.
Figure 4 shows the relative frequency of these problems at the agencies  reported to have noncompliant systems from fiscal years 2002 through  2006. The same six types of problems have been cited by auditors although  the auditors may not have reported these problems as specific reasons for  their systems’ lack of substantial compliance with FFMIA’s requirements.  Some agencies have made little progress addressing these areas. In  addition, as previously discussed, the occurrence of problems in any  particular category may be even greater than auditors’ reports of FFMIA  noncompliance would suggest because auditors may not have identified all  problems in their reviews conducted to provide negative assurance.
The CFO Act calls for agencies to develop and maintain integrated  accounting and financial management systems that comply with federal  systems requirements and provide for (1) complete, reliable, consistent,  and timely information that is responsive to the financial information  needs of the agency and facilitates the systematic measurement of  performance; (2) the development and reporting of cost management  information; and (3) the integration of accounting, budgeting, and program  information. OMB Circular No. A-127, Financial Management Systems,  requires agencies to establish and maintain a single integrated financial  management system that conforms to functional requirements now issued  by the Office of Federal Financial Management (OFFM). More details on  the financial management systems requirements can be found in  appendixes I and II.
The lack of integrated financial management systems typically results in  agencies expending major effort and resources, including in some cases  hiring external consultants, to develop information that their systems  should be able to provide on a daily or recurring basis. Agencies with  nonintegrated financial systems are also more likely to devote more time  and resources to collecting information than those with integrated  systems. In addition, opportunities for errors are increased when agencies’  systems are not integrated.
Auditors frequently cited the lack of integrated financial management  systems in their fiscal year 2006 audit reports. Although improvements  have been made, as shown in figure 5, auditors for 12 of the 17 agencies  with noncompliant systems in fiscal year 2006 reported nonintegrated  systems as a problem, compared with 13 of the 18 agencies reporting such  problems in fiscal year 2005.
As a case in point, auditors for the Department of State (State) reported  the lack of a modern, integrated financial management system in their  fiscal year 2006 audit report. Since September 30, 2003, auditors have  reported that State’s financial and accounting systems are inadequate, thus  preventing the department from routinely issuing timely financial  statements and increasing the risk of materially misstating financial  information. The principal areas of weakness included (1) certain  elements of the financial statements, including, but not limited to, personal  property, capital leases, and certain accounts payable, were developed  from sources other than the general ledger; and (2) the department used  several systems that were not integrated with the department’s centralized  financial management system for the management of grants and other  types of financial assistance.
subsections: section_title: Inadequate Reconciliation Procedures
paragraphs: A reconciliation process, whether manual or automated, is a necessary  and valuable internal control in a sound financial management system. The  less integrated the financial management system, the greater the need for  adequate reconciliations because data are being accumulated from a  number of different sources. Reconciliations are needed to ensure that  data have been recorded properly between the various systems and  manual records. As shown in figure 6, for fiscal year 2006, auditors for 14  of the 17 agencies with noncompliant systems reported that the agencies  had reconciliation problems, as compared with 14 of the 18 agencies  reporting such problems in fiscal year 2005.
While reconciling balances with the Department of the Treasury  (Treasury) remains a common problem, many other types of reconciliation  problems were also cited during fiscal year 2006. For example, at the  Department of Agriculture (Agriculture), the independent auditor reported  that over 50 abnormal balances exceeding $360 million existed at year end.  The abnormal balances stemmed from a variety of causes. In one case, the  auditors reported that Agriculture did not perform timely research to  ensure that account relationships were reconciled and corresponding  corrections promptly made. The number and dollar value of abnormal  account balances had been significantly reduced from last year at  Agriculture; however, when abnormal balances exist, immediate research  should be performed to identify the cause and correct the condition.
section_title: Lack of Accurate and Timely Recording of Financial Information
paragraphs: As shown in figure 7, auditors for 15 of 17 agencies with noncompliant  systems reported the lack of accurate and timely recording of financial  information as a problem for fiscal year 2006, compared with 17 of 18  agencies reporting such problems in fiscal year 2005.
Accurate and timely recording of financial information is essential for  effective financial management. Timely recording of transactions  facilitates accurate reporting in agencies’ financial reports and other  management reports used to guide managerial decision making. In  addition, having systems that record information in an accurate and timely  manner is critical for key governmentwide initiatives, such as integrating  budget and performance information.
In contrast, lack of timely recording of transactions during the fiscal year  can result in agencies making substantial efforts at fiscal year end to  perform extensive manual financial statement preparation efforts that are  susceptible to error and increase the risk of misstatements. For example,  auditors for the Department of Energy (Energy) noted that the department  has not completed all of the corrective actions needed to reconcile  obligation data converted from Energy’s legacy systems to its new  financial management system, the Standard Accounting and Reporting  System (STARS), affecting the accuracy of undelivered order balances at  every field office tested by the auditors. As of September 30, 2006, Energy  reported undelivered orders of $11.3 billion. Errors in recording  obligations, such as duplicating obligation entries or recording obligations  in subsequent periods, resulted in misstatements of the undelivered orders  balance. These problems precluded the department from providing  assurance of accurate and complete undelivered orders balance in  Energy’s consolidated financial statements. Further, such problems  typically result in funds not being available for use that otherwise would  be, and in managers not having accurate financial information during the  year for well-informed decisions.
section_title: Noncompliance with the SGL
paragraphs: As shown in figure 8, auditors for 7 of the 17 agencies with noncompliant  systems reported that the agencies’ systems did not comply with SGL  requirements for fiscal year 2006, compared with 11 of the 18 agencies  reporting such problems in fiscal year 2005.
FFMIA specifically requires federal agencies to implement the SGL at the  transaction level. Using the SGL promotes consistency in financial  transaction processing and reporting by providing a uniform chart of  accounts and pro forma transactions and provides a basis for comparison  at the agency and governmentwide levels. The defined accounts and pro  forma transactions standardize the accumulation of agency financial  information as well as enhance financial control and support internal and  external reporting.
According to auditors at Interior and AID, progress has been made in this  area as a result of the agencies retiring legacy systems and implementing  new systems that conform to the SGL. Nevertheless, failure to adhere to  the SGL continues to impede the ability of some agencies to prepare  accurate financial statements. For example, auditors for the Department  of Health and Human Services (HHS) noted that its Division of Financial  Operations (DFO) CORE accounting system, which supports net outlays of  more than $93 billion, is a legacy accounting system and does not fully  support the SGL. Specifically, the auditors found that HHS compiles its  financial statements through a multistep process using a combination of  manual and automated procedures. Further, agency auditors identified  over 100 instances with an approximate value of over $3 billion of general  ledger accounts and crosswalks that were not used consistently or in  compliance with Treasury’s guidance on the SGL. To address this issue,  HHS is in the process of implementing a new financial management  system.
section_title: Lack of Adherence to Federal Accounting Standards
paragraphs: One of FFMIA’s requirements is that agencies’ financial management  systems account for transactions in accordance with federal accounting  standards. Appendixes III and IV list the federal financial accounting  standards and other guidance issued by the Federal Accounting Standards  Advisory Board and its Accounting and Auditing Committee, respectively.  The purpose of these standards and other guidance is to ensure that  federal agencies’ financial reports provide users with understandable,  relevant, and reliable information about the financial position, activities,  and results of operations of the U.S. government and its components.  Many agencies face continuing challenges in this area. As shown in figure  9, for fiscal year 2006, auditors for 10 of the 17 agencies with noncompliant  systems reported that these agencies had problems complying with one or  more federal accounting standards.
Two agencies, the Department of the Interior (Interior) and Department of  Transportation (DOT), reported weaknesses affecting compliance with the  recently issued SFFAS 27, Identifying and Reporting Earmarked Funds,  which became effective for fiscal year 2006. For example, at Interior,  auditors noted that the Sport Fish Restoration and Boating Trust Fund was  properly classified as an earmarked fund but that Interior had not fully  established controls to ensure that its portion of the fund was accurately  included in the financial statements. As a result, Interior analyzed and  adjusted the financial statements. While newly issued standards may cause  significant compliance problems, agencies also struggled to implement  standards which have been in effect for some time.
Auditors reported compliance problems with 11 specific accounting  standards in fiscal year 2006. Of those standards, the 4 that were most  troublesome for agencies were SFFAS No. 1, Accounting for Selected  Assets and Liabilities; SFFAS No. 4, Managerial Cost Accounting  Concepts and Standards; SFFAS No. 6, Accounting for Property, Plant,  and Equipment; and SFFAS No. 7, Accounting for Revenue and Other  Financing Sources.
section_title: Weak Security Controls over Information Systems
paragraphs: Information security weaknesses are a major concern for federal agencies  and the general public and one of the frequent problems auditors cited  concerning noncompliance with FFMIA. As shown in figure 10, auditors  for 15 of the 17 agencies with noncompliant systems reported security  weaknesses in information systems to be a problem, compared with 16 of  the 18 agencies reporting such problems in fiscal year 2005.
These control weaknesses place vast amounts of government assets at risk  of inadvertent or deliberate misuse, financial information at risk of  unauthorized modification or destruction, sensitive information at risk of  inappropriate disclosure, and critical operations at risk of disruption.  Since 1997, we have considered information security to be a high-risk area  at a governmentwide level and continue to emphasize it on our most  recent list issued in January 2007.
For example, the Nuclear Regulatory Commission (NRC) auditors  reported that only 1 out of 30 operational NRC information systems had a  current certification and accreditation. Auditors also noted that in the past  4 years NRC has not performed a current certification and accreditation of  its general support systems. As a result, all NRC information systems that  depend on the security controls provided by these general support  systems are subject to an unknown potential risk. Two of NRC’s financial  reporting systems, Federal Financial System (FFS) and the Federal  Personnel and Payroll System (FPPS), were outsourced to the Department  of Interior’s National Business Center (DOI-NBC) but continue to rely on  the NRC’s general support system. According to the auditors, their reliance  on the top tier of controls of the general support systems puts the FFS and  the FPPS at risk despite the DOI-NBC assurance that the certification and  accreditations for the two systems have been performed.
The security breaches at Department of Veterans Affairs (VA), Treasury,  and other agencies compromised the personal data of millions of U.S.  citizens and highlighted the importance of adequate system security  policies and programs. Robust federal security programs are critically  important to properly protect personal and financial information and the  privacy of individuals. When there is a lack of reasonable assurance that  controls are correctly implemented, operating as intended, and producing  the desired outcome with respect to meeting the security requirements of  the agency, the agencies’ information and systems are left vulnerable to  attack or compromise.
section_title: Efforts Are Under Way to Address Federal Financial Management System Challenges
paragraphs: Agencies and OMB have a number of efforts under way to address their  existing financial management systems problems. For example,  noncompliant agencies are required by OMB to include in their annual  PARs a summary of their detailed remediation plans including corrective  actions as well as the resources and target dates for implementing the  corrective actions. A number of those corrective actions involve  implementing new financial management systems, which over time has  proven to be very challenging. Efforts to modernize financial management  systems have often exceeded budgeted costs, experienced delays in  delivery dates, and not provided the anticipated system functionality and  performance. This problem is particularly serious at the Department of  Defense. To help provide a governmentwide solution, OMB has developed  the financial management line of business (FMLOB) initiative. While  progress has been made in defining standard business processes and  issuing draft guidance to facilitate a smooth transition to shared service  providers, the FMLOB initiative involves complex issues that have far- reaching implications for the government and private sector shared  service providers. As we reported last year, the key for federal agencies  to avoid the long-standing problems that have plagued financial  management system improvement efforts is to address the foremost  causes of those problems and adopt solutions that reduce the risks  associated with these efforts to acceptable levels.
subsections: section_title: Comprehensive Remediation Plans Are Critical to Agencies’ Improvement Efforts
paragraphs: Correcting financial management system problems has proven to be  particularly difficult for many agencies. To assist in this effort, FFMIA  requires the heads of agencies with noncompliant systems to prepare  detailed remediation plans to bring agencies’ systems into substantial  compliance with the law. Specifically, the law requires the head of the  agency to establish a remediation plan that includes resources, remedies,  and intermediate target dates necessary to bring the agency’s financial  management systems into substantial compliance. Further, OMB Circular  A-11 requires agencies with noncompliant systems to include in their  annual PARs a summary of their detailed remediation plans containing    (1) corrective actions to be taken, (2) resources to be used for  implementation of the corrective actions, and (3) target dates for  implementation of the corrective actions.
As previously discussed, auditors reported that 17 agency systems were  substantially noncompliant with FFMIA in fiscal year 2006. The agency  heads for 5 of these agencies disagreed with the auditor and considered  their agencies’ systems to be substantially compliant with FFMIA. The law  does not require an agency to prepare a remediation plan if the agency  head determines that the agency’s systems are in substantial compliance  with the law even if the agency’s auditor determines the agency’s systems  are not substantially compliant. The remaining 12 agencies are required  to include summarized remediation plans in their PARs. We reviewed the  12 PARs for those agencies to determine if their summarized remediation  plans included the required information. Figure 11 presents the results of  our analysis.
As shown in figure 11, all of the agencies’ summarized remediation plans  included corrective actions. However, one third of the agencies’  summarized remediation plans did not include a discussion of the staffing  resources required to complete the planned corrective actions.  Remediation plans provide a “road map” to resolve financial management  problems in a transparent manner, and also help hold managers  accountable for needed improvements. A discussion of the resources to be  used when implementing the corrective actions is essential in determining  whether the corrective actions can realistically be accomplished within  the specified time frames. Assigning resources to a corrective action  facilitates on-time implementation and helps avoid confusion over what  funding sources will be used and the personnel responsible for the  implementation.
One agency did not include target dates for completing corrective actions  to become substantially compliant with FFMIA. Setting specific target  dates, including intermediate target dates, facilitates tracking the progress  agencies are making in reaching their specified goals. If agencies do not  include target dates in their remediation plans, it is difficult for the  Congress and the American taxpayer to hold them accountable for  correcting long-standing financial management system problems.
section_title: Agencies Struggle with Financial Management Systems Modernization
paragraphs: Across the government, agencies have many efforts under way to  implement new financial management systems or to upgrade existing  systems that may help improve FFMIA compliance. However, these efforts  far too often result in systems that do not meet their cost, schedule, and  performance goals. While agencies anticipate that the new systems will  provide reliable, useful, and timely data to support managerial decision  making, our work and that of others has shown that has often not been the  case. For example, many of DOD’s over 2,000 business systems are  nonintegrated, stove piped, and not capable of providing departmental  management and the Congress accurate and reliable information on DOD’s  day-to-day operations. For decades, DOD has been challenged in  modernizing its timeworn business systems. In 1995, we designated DOD’s  business systems modernization program as high-risk, and we continue to  designate it as such in our most recent high-risk report. In another case,  HHS has been plagued with systems implementation issues with its  Unified Financial Management System (UFMS) from inception. In fiscal  year 2006, HHS auditors reported that the agency continued to experience  significant challenges in resolving issues with the system conversion and  implementation and that sustained efforts will be necessary to overcome  the continuing serious weaknesses.
Furthermore, modernization efforts at DHS and DOJ have been hampered  because these agencies did not follow best practices in systems  development and implementation efforts (commonly referred to as  disciplined processes).
Since its establishment, DHS has faced the daunting task of bringing  together 22 diverse agencies and developing an integrated financial  management system. DHS halted implementation of the Electronically  Managing Enterprise Resources for Government Effectiveness and  Efficiency (Emerge2) program in December 2005, which was expected to  integrate financial management systems across the entire department and  to address its financial management weaknesses. DHS officials have stated  that approximately $52 million in total was spent on the Emerge2 project  before it was halted. In fiscal year 2006, we testified and provided an  assessment of the status of DHS’s efforts to modernize its financial  management systems. In early March 2007, DHS officials issued a high- level plan to address the existing internal control weaknesses. However, as  we recently reported and testified, more detailed implementation  strategies will be necessary to fully address the financial management  system challenges. DHS has received permission from OMB to leverage its  current investments by consolidating and migrating components to either  the Transportation Security Administration (TSA) or Customs and Border  Protection financial management systems models. Our concern is that  these components have numerous financial management weaknesses. For  example, auditors for TSA reported that they were unable to provide  sufficient evidential matter or make knowledgeable representations to  support fiscal year 2005 and 2006 transactions and account balances,  particularly for budgetary accounting and undelivered orders, and  property, plant, and equipment, among others.
The Department of Justice has developed plans for a Unified Financial  Management System (UFMS) intended to correct many of its financial  accounting and reporting issues. The UFMS is expected to standardize and  integrate financial processes and systems to more efficiently support  accounting operations, facilitate preparation of financial statements, and  streamline audit processes. The department’s efforts over the past few  years to implement the UFMS to replace the seven major accounting  systems currently used throughout the department have been challenging.  For example, 2 years after the department selected a vendor for the  unified system, problems with funding, staff turnover, and other  competing priorities caused delays in implementation of the new system.  As of September 2006, none of Justice’s accounting systems were  integrated with each other. The Drug Enforcement Administration (DEA)  is scheduled to begin implementing the UFMS in fiscal year 2008, and  current plans are for implementing the system in all department  components by fiscal year 2012.
subsections: section_title: Challenges of Implementing the Financial Management Line of Business
paragraphs: OMB’s FMLOB initiative, launched in March 2004, promotes business- driven, common solutions to enhance the federal government’s  performance and services. This initiative is intended to address past  financial management systems’ weaknesses and implementation failures  and support the PMA goal of expanding electronic government.
The goals of OMB’s Financial Management Line of Business initiative  include:    providing timely and accurate data for decision making;  facilitating stronger internal controls that ensure integrity in  accounting and other stewardship activities;  reducing costs by providing a competitive alternative for agencies to  acquire, develop, implement, and operate financial management  systems through shared service solutions;    standardizing systems, business processes, and data elements; and    providing for seamless data exchange between and among federal  agencies by implementing a common language and structure for  financial information and system interfaces.
OMB’s initial framework for the competitive migration to either a public  shared service provider or a qualified private sector provider under the  initiative is expected to help agencies maximize value by considering  alternative solutions in a reasoned and structured manner. We have long  supported and called for initiatives to standardize and streamline common  systems, which can reduce costs and, if done correctly, improve  accountability. Likewise, OMB has correctly recognized that enhancing the  government’s ability to implement financial management systems that are  capable of providing accurate, reliable, and timely information on the  results of operations needs to be addressed as a governmentwide solution,  rather than individual agency stove-piped efforts designed to meet a given  entity’s needs. The FMLOB is a work in progress, and OMB has not yet  fully defined and implemented the processes necessary to successfully  complete it. In our March 2006 report, we recommended that careful  consideration of the following four concepts, each one building upon the  former, would be integral to the success of OMB’s FMLOB initiative and  could help break the cycle of failure in implementing financial  management systems. The four concepts were (1) developing a concept of  operations, (2) defining standard business processes, (3) developing a  strategy for ensuring that agencies migrate to a limited number of service  providers in accordance with OMB’s stated approach, and (4) defining and  effectively implementing disciplined processes necessary to properly  manage the specific projects.
OMB has taken steps to develop the foundational guidance needed for the  FMLOB, but many challenging tasks remain. As we reported last year,  OMB has designated four federal agencies as shared service providers;  released a competition framework in May 2006; issued migration planning  guidance in September 2006; and encouraged private sector providers that  can satisfy the shared services requirements to participate in the  procurement process for these services. In November 2006, OMB released  an exposure draft of a common governmentwide accounting classification  structure that may address lack of standardization among agency  accounts. A critical factor for this project will be the ability to develop an  approach that captures all stakeholders’ needs with minimal redundancy  and complexity.
In addition, OMB and the Financial Systems Integration Office (FSIO)  have also developed and released an exposure draft for the funds control  standard business process and the payment management standard  business process. Further, in March 2007, the Financial Services  Assessment Guide (SAG) was issued to establish a set of financial service  metrics to facilitate an assessment of opportunities to improve  performance and affordability of financial services provided by shared  service providers and federal agencies. In order to promote consistency  among agencies and service providers, starting June 15, 2007, and every  month thereafter, OMB is requiring monthly reporting from all agencies on  their performance data through a single system managed by FSIO,  including data for each system listed as a core financial management  system.
Furthermore, FSIO released its core financial system product compliance  test policy, documenting the specific core financial systems qualifications  test policy and procedures starting in 2007. This new policy provided  detailed information about each test, including schedule, scope, and  requirements to be tested. This is a useful tool to promote consistency in  core financial systems governmentwide, clarify the system requirements,  and reduce the risk that agencies will acquire noncompliant or ineffective  core financial system software. This, though, does not eliminate the need  for agencies to conduct comprehensive testing efforts to ensure that  financial system software meets their requirements, and the  implementation of FSIO-tested software does not guarantee that the  agencies will have financial systems that are compliant with FFMIA.
While much has been accomplished by OMB, many important issues  remain unresolved. For example, one of the recommendations in our  March 2006 report called for a concept of operations to provide the  foundation for the FMLOB. An effective concept of operations would  describe, at a high level, (1) how all of the various elements of federal  financial systems and mixed systems relate to each other and (2) how  information flows from and through these systems. A concept of  operations would provide a useful tool to explain how financial  management systems at the agency and governmentwide levels can  operate cohesively. It would be geared to a governmentwide solution  rather than individual agency stove-piped efforts. Because the federal  government does not have an overall concept of operations, there is no  clear understanding of the interrelationships among federal financial  systems and how the shared service provider concept fits into this  framework. OMB officials recognize that standardization is important and  are developing a standard set of business processes in four areas: funds  control, accounts payable, accounts receivable, and financial reporting. In  addition, as the FMLOB initiative moves forward, there are numerous  additional areas where standardization is also important, such as  inventory, supplies, and material management, as well as the loan  management areas. Absent this standardization, shared service providers  have been designated without common business rules and potential  customer agencies continue to implement and operate individual stove- piped systems that may require additional work to adopt these processes.
Further, as we reported in September 2006, there are a number of factors  that affect FFMIA compliance, including the quality of transaction data in  agency feeder systems; the success of converting data from legacy  systems; and the interaction of people, process, and technology within an  agency’s environment. The shared service provider concept, if adopted,  will still require that agencies address long-standing human capital  problems and develop long-term strategies for acquiring, developing, and  retaining an organization’s total workforce to meet the needs of the future.  To date, none of the major CFO Act agencies has moved to an OMB- designated shared service provider to handle their financial management  system activities, although some agencies, such as DOT, GSA, and NRC  were already using the shared service provider concept prior to OMB’s  financial management line of business initiative. In addition, other  agencies such as Labor, use a commercial shared service provider to  provide hosting and operations and maintenance services. There are some  major CFO Act agencies, such as EPA, HUD, Agriculture, and OPM that  are in the process of selecting a shared service provider for full financial  management systems activities. OMB officials told us that a successful  FMLOB outcome would be for agencies to solicit for government or  commercial shared service providers, identify the best value, and move  forward in the FMLOB process. Whether agencies move to a shared  service provider or implement their own systems, they must have  disciplined processes in place to achieve the intended results, within  established resources, and on schedule.
section_title: Comptroller General Convening Forum on FFMIA Issues
paragraphs: To address the challenges CFO agency managers and auditors face in  implementing and maintaining financial management systems that meet  the intent of the CFO Act and the requirements of FFMIA, we are  convening a Comptroller General forum later this year in Washington, D.C.  The forum is intended to build on 10 years of experience with FFMIA  implementation and foster discussion with a select group of experts and  knowledgeable officials on the financial management systems  opportunities and challenges facing agencies across the federal  government. The discussion will focus on options for addressing the  impediments faced by federal managers in attempting to bring their  respective agencies into compliance with the requirements of the law.  More importantly, after 10 years, this forum provides an opportunity to  “think outside the box” and foster innovative ideas on how the federal  government can overcome long-standing challenges in improving financial  management systems with the goal of providing meaningful data to  support managerial decision making on a daily basis.
Invitees to the forum will include representatives from the federal Chief  Financial Officer and inspector general communities, key OMB officials  and congressional staff, and selected other knowledgeable officials from  the public and private sectors. After the forum, we plan to issue a separate  report summarizing the discussion and to consider the key issues in our  future FFMIA work. Accordingly, we are not making any new  recommendations in this report.
section_title: Conclusion
paragraphs: Over the 10 years since FFMIA’s enactment, the federal government has  continued to make incremental improvement in implementing financial  management systems that substantially comply with the requirements of  the act. Nonetheless, significant and long-standing obstacles remain for  developing and implementing effective financial management systems that  can provide essential financial data in support of day-to-day managerial  decision making—the ultimate goal of FFMIA. Continued high-priority and  sustained top-level commitment by OMB and leaders throughout the  federal government will be required to fully and effectively achieve the  goal of FFMIA. In addition, to help address the fundamental obstacles  impeding FFMIA implementation, we are taking a proactive stance by  convening a forum to help identify innovative approaches and corrective  actions.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments (reprinted in app. VI) on a draft of this report, OMB  agreed with our assessment that while federal agencies have continued to  make progress in financial management, many agencies still need to  improve their financial systems so that reliable, useful, and timely financial  management information is available for day-to-day operations. OMB  stated that it was working aggressively to assist agencies in building a  strong foundation for financial management practices and also applauded  our plans to convene a forum on these issues.
As in previous years, we and OMB have differing views on the necessity of  agency auditors providing a statement of positive assurance when  reporting agency systems to be in substantial compliance with the  requirements of FFMIA. OMB stated that its three major initiatives, the  PMA, FMLOB, and the revised Circular No. A-123, are helping agencies  identify and correct FFMIA deficiencies. Further, OMB stated that many of  the ongoing assessments required under the revised Circular No. A-123  mirror the types of assessments that would occur in establishing a  statement of positive assurance under FFMIA. As a result, OMB believed  that requiring a statement of positive assurance would be costly and would  not provide additional information that would be of benefit to the federal  agency, OMB, or the taxpayer.
While we agree that these initiatives are helping drive improvements,  auditors need to consider other aspects of financial management systems  when assessing FFMIA compliance that are not fully addressed through  the current reporting structure. For example, in preparing the PMA  scorecard assessments, OMB officials meet with agencies to discuss a  number of financial management issues and have systems demonstrations.  Our concern is that some of the information provided by this approach  does not come under audit scrutiny and may not be reliable. Similarly,  internal control assessments performed under Circular No. A-123 are  management’s judgments and are subject to an opinion-level review by  independent auditors only in limited circumstances. An opinion by an  independent auditor on FFMIA compliance would confirm whether an  agency’s systems substantially met the requirements of FFMIA and could  also provide additional confidence in the information provided as a result  of the PMA, FMLOB, and Circular No. A-123 initiatives. In our view,  confidence that agency financial management systems provide reliable,  useful, and timely information to help government leaders invest  resources, oversee programs, and reduce costs, would be of significant  value to the federal agency, OMB, the Congress, and the taxpayer.  Moreover, to minimize the cost of providing an audit opinion, the  GAO/PCIE Financial Audit Manual includes a number of techniques that  auditors can use to reduce the incremental cost of providing positive  assurance. Finally, we continue to believe that a statement of positive  assurance is a statutory requirement under the act.
With regard to our prior recommendation for revised guidance that  clarifies the definition of substantial compliance, OMB stated that in its  update to Circular No. A-127, Financial Management Systems, its goal  will be to simplify FFMIA compliance requirements as well as to better  balance the FFMIA objectives of generating audited financial statements  and providing meaningful information for decision makers. Accordingly,  OMB agreed to take this recommendation under advisement. As we noted  in our prior reports, auditors we interviewed expressed a need for  clarification regarding the meaning of substantial compliance.
OMB also provided technical comments which we incorporated as  appropriate.
We are sending copies of this report to the Chairman and Ranking  Member, Subcommittee on Federal Financial Management, Government  Information, Federal Services, and International Security, Senate  Committee on Homeland Security and Governmental Affairs, and to the  Chairman and Ranking Member, Subcommittee on Government  Management, Organization, and Procurement, House Committee on  Oversight and Government Reform. We are also sending copies to the  Director of the Office of Management and Budget, the heads of the 24 CFO  Act agencies in our review, and agency CFOs and inspectors general.  Copies will be made available to others upon request. In addition, this  report will be available at no charge on the GAO Web site at  http://www.gao.gov.
This report was prepared under the direction of McCoy Williams, Director,  Financial Management and Assurance, who may be reached at (202) 512- 9095 or williamsm1@gao.gov if you have any questions. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff that made key contributions to this  report are listed in appendix VII.
section_title: Appendix I: Requirements and Standards Supporting Federal Financial Management
subsections: section_title: Financial Management Systems Requirements
paragraphs: The policies and standards prescribed for executive agencies to follow in  developing, operating, evaluating, and reporting on financial management  systems are defined in Office of Management and Budget (OMB) Circular  No. A-127, Financial Management Systems. The components of an  integrated financial management system include the core financial  system, managerial cost accounting system, administrative systems, and  certain programmatic systems. Administrative systems are those that are  common to all federal agency operations, and programmatic systems are  those needed to fulfill an agency’s mission. Circular No. A-127 refers to the  series of publications entitled Federal Financial Management Systems  Requirements, initially issued by the Joint Financial Management  Improvement Program’s (JFMIP) Program Management Office (PMO) as  the primary source of governmentwide requirements for financial  management systems. However, as of December 2004, the Financial  Systems Integration Office (FSIO) assumed responsibility for coordinating  the work related to federal financial management systems requirements  and OMB’s Office of Federal Financial Management (OFFM) is responsible  for issuing the new or revised regulations. In December 2004, the JFMIP  Principals voted to modify the roles and responsibilities of JFMIP,  resulting in the creation of FSIO. Appendix II lists the federal financial  management systems requirements published to date. Figure 12 is the  current model that illustrates how these systems interrelate in an agency’s  overall systems architecture.
subsections: section_title: FFMIA Guidance
paragraphs: OMB establishes governmentwide financial management policies and  requirements and has issued two sources of guidance related to FFMIA  reporting. First, in OMB Memorandum, Revised Implementation  Guidance for the Federal Financial Management Improvement Act (Jan.  4, 2001), OMB provides guidance for agencies and auditors to use in  assessing substantial compliance. The guidance describes the factors that  should be considered in determining whether an agency’s systems  substantially comply with FFMIA’s three requirements. Further, the  guidance provides examples of the types of indicators that should be used  as a basis for assessing whether an agency’s systems are in substantial  compliance with each of the three FFMIA requirements. Finally, the  guidance discusses the corrective action plans, to be developed by agency  heads, for bringing their systems into compliance with FFMIA. Second, on  August 23, 2006, OMB issued Bulletin No. 06-03, Audit Requirements for  Federal Financial Statements, which superseded OMB Bulletin No. 01-02.
This new bulletin did not substantially revise the FFMIA audit guidance  included in Bulletin No. 01-02, which calls for auditors to provide negative  assurance when reporting on an agency system’s FFMIA compliance.
We have worked in partnership with representatives from the President’s  Council on Integrity and Efficiency (PCIE) to develop and maintain the  joint GAO/PCIE Financial Audit Manual (FAM). The FAM provides  specific procedures auditors should perform when assessing FFMIA  compliance. As detailed in appendix V, we have also issued a series of  checklists to help assess whether agencies’ systems meet systems  requirements. The FAM guidance on FFMIA assessments recognizes that  while financial statement audits offer some assurance regarding FFMIA  compliance, auditors should design and implement additional testing to  satisfy FFMIA criteria.
OMB Circular No. A-127 also requires agencies to purchase commercial  off-the-shelf (COTS) software that has been tested and certified through  the PMO software certification process when acquiring core financial  systems. However, in December 2004, OMB transferred the responsibility  of certifying systems to FSIO as part of the realignment of JFMIP. In  March 2007, FSIO updated the testing policy for COTS software. However,  the certification process does not eliminate or significantly reduce the  need for agencies to develop and conduct comprehensive testing efforts to  ensure that the COTS software meets their requirements. Moreover, core  financial systems certification does not mean that agencies that install  these packages will have financial management systems that are compliant  with FFMIA. Many other factors can affect the capability of the systems to  comply with FFMIA, including modifications made to the FSIO-certified  core financial management systems software and the validity and  completeness of data from feeder systems.
section_title: Federal Accounting Standards
paragraphs: The Federal Accounting Standards Advisory Board (FASAB) promulgates  federal accounting standards and concepts that agency chief financial  officers use in developing financial management systems and preparing  financial statements. FASAB develops the appropriate accounting  standards and concepts after considering the financial and budgetary  information needs of the Congress, executive agencies, and other users of  federal financial information and comments from the public. FASAB  forwards the standards and concepts to the Comptroller General, the  Director of OMB, the Secretary of the Treasury, and the Director of the  Congressional Budget Office (CBO) for a 90-day review. If, within 90 days,  neither the Comptroller General nor the Director of OMB objects to the  standard or concept, then it is issued and becomes final. FASAB  announces finalized concepts and standards in The Federal Register.
The American Institute of Certified Public Accountants designated the  federal accounting standards promulgated by FASAB as being generally  accepted accounting principles for the federal government. This  recognition enhances the acceptability of the standards, which form the  foundation for preparing consistent and meaningful financial statements  both for individual agencies and the government as a whole. Currently,  there are 32 Statements of Federal Financial Accounting Standards  (SFFAS) and 4 Statements of Federal Financial Accounting Concepts  (SFFAC). The concepts and standards are the basis for OMB’s guidance to  agencies on the form and content of their financial statements and for the  government’s consolidated financial statements. Appendix III lists the  concepts, standards, interpretations, and technical bulletins, along with  their respective effective dates.
FASAB’s Accounting and Auditing Policy Committee (AAPC) assists in  resolving issues related to the implementation of accounting standards.  AAPC’s efforts result in guidance for preparers and auditors of federal  financial statements in connection with implementation of accounting  standards. To date, AAPC has issued six technical releases, which are  listed in appendix IV along with their release dates.
section_title: U.S. Government Standard General Ledger (SGL)
paragraphs: The SGL was established by an interagency task force under the direction  of OMB and mandated for use by agencies in OMB and Treasury  regulations in 1986. The SGL promotes consistency in financial transaction  processing and reporting by providing a uniform chart of accounts and pro  forma transactions used to standardize federal agencies’ financial  information accumulation and processing throughout the year, enhance  financial control, and support budget and external reporting, including  financial statement preparation. The SGL is intended to improve data  stewardship throughout the federal government, enabling consistent  reporting at all levels within the agencies and providing comparable data  and financial analysis governmentwide.
section_title: Internal Control Standards
paragraphs: The Congress enacted legislation, 31 U.S.C. § 3512(c), (d) (commonly  referred to as the Federal Managers’ Financial Integrity Act of 1982  (FMFIA)), to strengthen internal controls and accounting systems  throughout the federal government, among other purposes. Issued  pursuant to FMFIA, the Comptroller General’s Standards for Internal  Control in the Federal Government provides standards that are directed  at helping agency managers implement effective internal control, an  integral part of improving financial management systems. Internal control  is a major part of managing an organization and comprises the plans,  methods, and procedures used to meet missions, goals, and objectives. In  summary, internal control, which under OMB’s guidance for FMFIA is  synonymous with management control, helps government program  managers achieve desired results through effective stewardship of public  resources.
Effective fiscal year 2006, OMB strengthened the requirements for  conducting management’s assessment of internal control over financial  reporting by revising OMB Circular No. A-123. Significant revisions  contained in Appendix A of the circular include requiring Chief Financial  Officers (CFO) Act agency management to annually assess the adequacy of  internal control over financial reporting, provide a report on identified  material weaknesses and corrective actions, and provide a separate  assurance statement on the agency’s internal control over financial  reporting. In initiating the revisions, OMB cited the internal control  requirements for publicly traded companies that are contained in section  404 of the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley). Sarbanes-Oxley  was enacted in response to corporate accountability failures of several  years prior to its enactment and contains a provision (section 404) calling  for management’s assessment of internal control over financial reporting  similar to the long-standing requirements for executive branch agencies  contained in FMFIA to issue annual statements of assurance over internal  control in the agencies. Opinions on internal control over financial  reporting as required by Sarbanes-Oxley for publicly traded companies are  important to protect investors by improving the accuracy and reliability of  corporate disclosures made pursuant to the securities laws.
section_title: Appendix II: Publications in the Federal Financial Management Systems Requirements Series
section_title: Appendix III: Statements of Federal Financial Accounting Concepts, Standards, Interpretations, and Technical Bulletins
section_title: Appendix IV: Accounting and Auditing Policy Committee Technical Releases
paragraphs: Appendix IV: Accounting and Auditing Policy  Committee Technical Releases TR-1 Audit Legal Representation Letter Guidance  TR-2 Determining Probable and Reasonably Estimable for  Environmental Liabilities in the Federal Government  TR-3 Preparing and Auditing Direct Loan and Loan Guarantee  Subsidies Under the Federal Credit Reform Act  TR-4 Reporting on Non-Valued Seized and Forfeited Property  TR-5 Implementation Guidance on SFFAS No. 10: Accounting for  Internal Use Software  TR-6 Preparing Estimates for Direct Loan and Loan Guarantee  Subsidies Under the Federal Credit Reform Act (Amendments to TR-3)
section_title: Appendix V: Checklists for Reviewing Systems under the Federal Financial Management Improvement Act
section_title: Appendix VI: Comments from the Office of Management and Budget
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the contact named above, Kay L. Daly, Assistant Director;    F. Abe Dymond, Assistant General Counsel; Debra Cottrell; Francine  DelVecchio; Lauren Fassler; C. Robin Hodge; Jennifer Leone; Sheila D.  Miller; and George Warnock made key contributions to this report.