Financial Management: Improved Financial Systems Are Key to FFMIA Compliance
Published: 2004-10-01T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The ability to produce the data needed to efficiently and effectively manage the day-to-day operations of the federal government and provide accountability to taxpayers has been a long-standing challenge to most federal agencies. To help address this challenge, the Federal Financial Management Improvement Act of 1996 (FFMIA) requires the 23 Chief Financial Officers Act agencies to implement and maintain financial management systems that comply substantially with (1) federal financial management systems requirements, (2) applicable federal accounting standards, and (3) the U.S. Government Standard General Ledger (SGL) at the transaction level. FFMIA also requires GAO to report annually on the implementation of the act.
section_title: What GAO Found
paragraphs: Federal agencies continue to make progress in addressing their financial management weaknesses; however, for fiscal year 2003, auditors for 17 of the 23 CFO Act agencies still reported that agencies' financial management systems failed to comply with FFMIA. The nature and severity of the reported problems indicate that generally agency management lacked the full range of reliable, useful, and timely information needed for accountability, performance reporting, and decision making. Six main types of problems related to agencies' systems were consistently identified. As prescribed in OMB's reporting guidance, auditors for six agencies provided negative assurance on agency systems' FFMIA compliance for fiscal year 2003. This means that nothing came to their attention to indicate that financial management systems did not meet FFMIA requirements. GAO continues to believe that this type of reporting is not sufficient under the act and that report users may have the false impression that auditors have reported agency systems to be compliant. To address problems such as nonintegrated systems, inadequate reconciliations, and lack of SGL compliance, agencies are implementing or upgrading financial management systems. Agencies anticipate the new systems will provide reliable, useful, and timely data to support managerial decision making. However, our work at DOD, HHS, and NASA has shown significant problems exist in implementing financial management systems and that agencies are not following the necessary disciplined processes for efficient and effective implementation of these systems. Disciplined processes have been shown to reduce the risks associated with software development and acquisition efforts to acceptable levels and are fundamental to successful system acquisition and implementation. Moreover, governmentwide initiatives to improve financial management systems can help enhance the government's performance and services for citizens.

section_title: Letter
paragraphs: Many federal agencies still lack the ability to produce the data needed to  efficiently and effectively manage day-to-day operations and provide an  acceptable level of accountability to taxpayers.  To address this long- standing weakness of the federal government, the Chief Financial Officers  (CFO) Act of 1990 designates executive branch officials with  responsibility for the modernization of financial management systems, so  that the systematic measurement of performance; the development of cost  information; and the integration of program, budget, and financial  information for management reporting can be achieved.
The Federal Financial Management Improvement Act of 1996 (FFMIA)  builds on the foundation laid by the CFO Act by reflecting the need for  agencies to have systems that can generate reliable, useful, and timely  information with which to make fully informed decisions and to ensure  accountability on an ongoing basis.  FFMIA requires the CFO Act agencies  to implement and maintain financial management systems that comply  substantially with (1) federal financial management systems requirements,  (2) applicable federal accounting standards, and (3) the U.S. Government  Standard General Ledger (SGL) at the transaction level.  The act also  requires auditors to state in their audit reports whether the agencies’  financial management systems substantially comply with the act’s  requirements.  Furthermore, we are required to report annually on the  implementation of the act.  This report, our eighth, discusses (1) the  auditors’ assessments of agency systems’ compliance with FFMIA for fiscal  year 2003 and the financial management systems problems that continue to  affect systems’ FFMIA compliance and (2) the challenges agencies have  faced when implementing financial systems to help move toward FFMIA  compliance.
We conducted our work from April through August 2004 in the Washington,  D.C., area in accordance with U.S. generally accepted government auditing  standards.
subsections: section_title: Background
paragraphs: FFMIA and other financial management reform legislation have  emphasized the importance of improving financial management across the  federal government.  Beginning in 1990, the Congress has passed a series of  management reform legislation to improve the general and financial  management of the federal government.  As shown in figure 2, the  combination of reforms ushered in by the (1) CFO Act of 1990, (2)  Government Performance and Results Act of 1993, (3) Government  Management Reform Act of 1994, (4) FFMIA, (5) Clinger-Cohen Act of  1996, and (6) Accountability of Tax Dollars Act of 2002, if successfully  implemented, provides a solid basis for improving accountability of  government programs and operations as well as routinely producing  valuable cost and operating performance information.
Figure 2 shows the three levels of the pyramid that result in the end goal,  accountability and useful management information.  The bottom level of  the pyramid is the legislative framework that underpins the improvement  of the general and financial management of the federal government.  The  second level shows the drivers that build on the legislative requirements  and influence agency actions to meet these requirements.  The three  drivers are the (1) President’s Management Agenda (PMA),   (2) congressional and other oversight, and (3) the Joint Financial  Management Improvement Program (JFMIP).  The third level of the  pyramid represents the key success factors for accountability and  meaningful management information—integrating core and feeder  financial systems, producing reliable financial and performance data for  reporting, and ensuring effective internal control.  The result of these three  levels, as shown at the top of the pyramid, is accountability and meaningful  management information needed to assess and improve the government’s  effectiveness, financial condition, and operating performance.
Building on the foundation laid by the CFO Act, FFMIA reflects the need  for agencies to have systems that can generate reliable, useful, and timely  information with which to make fully informed decisions and to ensure  accountability on an ongoing basis.  FFMIA requires the  departments and  agencies covered by the CFO Act to implement and maintain financial  management systems that comply substantially with (1) federal financial  management systems requirements, (2) applicable federal accounting  standards, and (3) the SGL at the transaction level.   FFMIA also requires  auditors to state in their CFO Act financial statement audit reports whether  the agencies’ financial management systems substantially comply with  FFMIA’s systems requirements.
subsections: section_title: President’s Management Agenda Supported by FFMIA Initiatives
paragraphs: The PMA, announced in the summer of 2001, is a plan for improving the  management and performance of the federal government.  It targets the  most apparent deficiencies, where the opportunity to improve performance  is the greatest.  The modernization of agency financial management  systems, as reflected in FFMIA, is critical to the success of all five PMA  initiatives.  Although FFMIA implementation relates directly to the  improved financial performance initiative, development and maintenance  of FFMIA-compliant systems will also affect the implementation of the  other initiatives.
A key element of PMA’s performance budgeting initiative is the  Performance and Assessment Rating Tool (PART).  The development of  PART represents a step toward a more structured involvement of program  and performance analysis in the budget.  It is a systematic method of  assessing the performance of program activities across the federal  government, consisting of a set of general questions on (1) program  purpose and design, (2) strategic planning, (3) program management, and  (4) program results.  It also includes a set of more specific questions, which  vary according to the type of delivery mechanism or approach an individual  program uses, and calls for timely, reliable data to perform those  assessments.
section_title: Congressional Oversight Helps Provide Accountability
paragraphs: The leadership demonstrated by the Congress has been an important  catalyst to reforming financial management in the federal government.  As  previously discussed, the legislative framework provided by the CFO Act  and FFMIA, among others, produces a solid foundation to stimulate change  needed to achieve sound financial systems management.  For example, in  November 2002, the Congress enacted the Accountability of Tax Dollars  Act to extend the financial statements audit requirements of the CFO Act to  additional federal agencies.  Further, the Congress is currently  contemplating adding DHS to the list of CFO Act agencies and requiring  DHS to obtain an audit opinion on its internal controls.  There is value in  sustained congressional interest in these issues, as demonstrated by  hearings on federal financial management and reform held over the past  several years.  It will be key that the appropriations, budget, authorizing,  and oversight committees hold agency top management accountable for  resolving these problems and that they support improvement efforts.  The  continued attention by the Congress to these issues will be critical to  sustaining momentum for financial management reform.
section_title: JFMIP Works to Improve Federal Financial Management
paragraphs: JFMIP is a joint and cooperative undertaking of the U.S. Department of the  Treasury, GAO, OMB, and the Office of Personnel Management (OPM),  working in cooperation to improve financial management practices in the  federal government.  Leadership is provided by the four principals of  JFMIP—the Comptroller General of the United States, the Secretary of the  Treasury, and the Directors of OMB and OPM.  Since August 2001, the  JFMIP principals have met regularly to discuss financial management  issues, such as the acceleration of financial statement reporting.  The  Program Management Office (PMO), managed by the Executive Director of  the JFMIP using funds provided by the CFO Council agencies, is  responsible for the testing and certification of commercial off-the-shelf  (COTS) core financial systems for use by federal agencies and coordinating  the development and publication of functional requirements for financial  management systems.  OMB Circular No. A-127, Financial Management  Systems requires agencies to purchase only COTS packages sold by  vendors whose core financial systems software has been certified by PMO.   As shown in table 1, in 2003 and 2004, PMO certified that six core financial  software packages met the core financial systems requirements.
PMO assesses COTS packages for conformity with the minimum level or  “floor” of system requirements.  Therefore agencies should be aware that  simply implementing a core financial system that has been certified by  PMO does not ensure that these agencies will have financial systems that  are compliant with FFMIA or provide reliable, useful, and timely data for  day-to-day management.  Factors that affect the FFMIA compliance and the  effectiveness of an implemented COTS core financial system include how  the software package has been configured to work in the agency’s  environment, whether any customization is made to the software, the  success of converting data from legacy systems to new systems, and the  quality of transaction data in the feeder systems.
section_title: Guidance for FFMIA Issued by OMB
paragraphs: OMB sets governmentwide financial management policies and  requirements and has issued two sources of guidance related to FFMIA.   First, OMB Bulletin No. 01-02, Audit Requirements for Federal Financial  Statements, dated October 16, 2000, prescribes specific language auditors  should use when reporting on an agency system’s substantial compliance  with FFMIA.  Specifically, this guidance calls for auditors to provide  negative assurance when reporting on an agency system’s FFMIA  compliance.  Second, in OMB Memorandum, Revised Implementation  Guidance for the Federal Financial Management Improvement Act (Jan.  4, 2001), OMB provides guidance for agencies and auditors to use in  assessing substantial compliance.  The guidance describes the factors that  should be considered in determining whether an agency’s systems  substantially comply with FFMIA’s requirements.  Further, the guidance  provides examples of the types of indicators that should be used as a basis  in assessing whether an agency’s systems are in substantial compliance  with each of the three FFMIA requirements.  Finally, the guidance  discusses the corrective action plans, to be developed by agency heads, for  bringing their systems into compliance with FFMIA.
section_title: Financial Audit Manual Section on FFMIA Developed by PCIE and GAO
paragraphs: We worked with representatives from the President’s Council on Integrity  and Efficiency (PCIE) to revise the joint GAO/PCIE Financial Audit  Manual (FAM) to include sections that provide specific procedures  auditors should perform when assessing FFMIA compliance.  These  sections include detailed audit steps for testing agency systems’ substantial  compliance with FFMIA.  The FAM guidance on FFMIA assessments  recognizes that while financial statement audits offer some assurance  regarding FFMIA compliance, auditors should design and implement  additional testing to satisfy FFMIA criteria.  For example, in performing  financial statement audits, auditors generally focus on the ability of the  financial management systems to process and summarize financial  information that flows into annual agency financial statements.  In  contrast, FFMIA requires auditors to assess whether an agency’s financial  management systems comply with system requirements.  To do this,  auditors need to consider whether agency systems provide reliable, useful,  and timely information for managing day-to-day operations so that agency  managers would have the necessary information to measure performance  on an ongoing basis rather than just at year-end.
section_title: Scope and Methodology
paragraphs: We reviewed the fiscal year 2003 financial statement audit reports for the  23 CFO Act agencies to identify the auditors’ assessments of agency  financial systems’ compliance and the problems that affect FFMIA  compliance.  We also reviewed the fiscal year 2003 financial statement  audit report for DHS to identify any FFMIA-related issues.  Our prior  experience with these auditors and our review of their reports provided the  basis to determine the sufficiency and relevancy of evidence provided in  these documents.  Based on the audit reports, we identified problems  reported by the auditors that affect agency systems’ compliance with  FFMIA.  The problems identified in these reports are consistent with long- standing financial management weaknesses that we have reported based  on our work at the Department of Agriculture, NASA, Treasury, and other  agencies.   However, we caution that the occurrence of problems in a  particular category may be even greater than auditors’ reports of FFMIA  noncompliance would suggest because auditors may not have included all  problems in their reports.
We also reviewed our previously issued reports and those by the inspectors  general to identify the challenges federal agencies face when implementing  new systems.  Finally, we held discussions with OMB officials to obtain  information about its current efforts to help agencies develop systems that  will comply with FFMIA.
We conducted our work from April through August 2004 in the Washington,  D.C., area in accordance with U.S. generally accepted government auditing  standards.  We requested comments on a draft of this report from the  Director of OMB or his designee.  Comments from OMB are discussed in  the “Agency Comments and Our Evaluation” section and reprinted in  appendix VI.
section_title: Continued Systems Weaknesses Impede Financial Management Accountability
paragraphs: While agencies are making some progress in producing auditable financial  statements and addressing their financial management systems  weaknesses, the vast majority of agency systems are still not substantially  compliant with FFMIA’s requirements.  Figure 3 summarizes auditors’  assessments of FFMIA compliance for fiscal years 2000 through 2003 and  suggests that the instances of noncompliance with FFMIA’s three  requirements have remained fairly constant.  For fiscal year 2003, OIGs and  their contract auditors reported that the systems of 17 of the 23 CFO Act  agencies did not substantially comply with at least one of FFMIA’s three  requirements—federal financial management systems requirements,  applicable federal accounting standards, or the SGL at the transaction  level.
In fiscal year 2002, auditors for five agencies (SSA, Energy, NSF, EPA, and  GSA) provided negative assurance that the agencies’ financial systems  were in compliance with FFMIA.  In fiscal year 2003, the auditors at two  additional agencies, Commerce and NRC, provided negative assurance that  the systems at those agencies were in compliance with FFMIA, while  auditors reported GSA’s systems to be noncompliant.
At Commerce, the auditors were able to provide negative assurance due to  the implementation of a new integrated financial management system,  combined with improvements in general information technology controls.   Auditors at NRC provided negative assurance due to a redesign of the  agency’s cost accounting system and enhancement of the internal controls  and operating procedures documentation.  In contrast, for fiscal year 2003,  GSA’s systems were found to be noncompliant by its auditors due to  reconciliation issues related to a newly implemented system.  Specifically,  the auditors concluded that the systems GSA relied on during fiscal year  2003 failed to perform timely reconciliations of accounts payable and  undelivered orders, Fund Balance with Treasury, and accounts receivable,  which represented a lack of substantial compliance with FFMIA.  In total,  for 6 of the 23 CFO Act agencies, the auditors provided negative assurance  by stating that nothing came to their attention that would indicate the  systems did not comply with FFMIA for fiscal year 2003.
While more CFO Act agencies have obtained clean or unqualified audit  opinions on their financial statements, there is little evidence of marked  improvements in agencies’ capacities to create the full range of information  needed to manage day-to-day operations.  The number of unqualified  opinions has been increasing over the past 7 years, from 11 in fiscal year  1997 to 20 for fiscal year 2003; but the number of agencies reported to have  substantially noncompliant systems has remained relatively steady.  While  the increase in unqualified opinions is noteworthy, a more important  measure of financial systems’ capability and reliability is that the number of  agencies for which auditors provided negative assurance of FFMIA  compliance has remained relatively constant throughout this same period.   In our view, this has led to an expectation gap since, as more agencies  receive clean opinions, expectations are raised that the government has  sound financial management and can produce reliable, useful, and timely  information on demand throughout the year, whereas FFMIA assessments  offer a different perspective.
All CFO Act agencies issued their audited financial statements by the  accelerated reporting deadline of February 1, 2004, for agency fiscal year  2003 financial statements.  However, the deadline for issuance of fiscal year  2004 audited financial statements is November 15, 2004, just 45 days after  the close of the fiscal year.  Auditors at several of the CFO Act agencies  reported that the agencies may not be able to produce auditable financial  statements within the accelerated time frame for fiscal year 2004 without  making fundamental changes to improve a number of their financial  management practices.
subsections: section_title: DHS Is Not Required To Comply with FFMIA
paragraphs: DHS is not subject to the CFO Act and, consequently, is not required to  comply with FFMIA.  Accordingly, DHS’ auditors did not report on the  department’s compliance with FFMIA in fiscal year 2003.  However, the  auditors identified and reported deficiencies that relate to the three FFMIA  requirements.
Based on its budget, DHS is the largest entity in the federal government  that is not subject to the CFO Act nor required to comply with FFMIA  system requirements.  Creating strong financial management at DHS is  particularly challenging because most of the 22 entities brought together to  form the department have their own financial management systems;  processes; and in some cases, deficiencies.  For example, five of the seven  major agencies that transferred to DHS had 30 reportable conditions, 18 of  which were considered material internal control weaknesses for fiscal year  2002 and four of the major agencies—that had previously been subject to  stand-alone audits—had financial management systems that were not in  substantial compliance with FFMIA.  Some progress has been made in  addressing the internal control weaknesses it inherited from component  agencies.  Nine of the 30 inherited internal control weaknesses have been  closed as of September 30, 2003.  For DHS to develop a strong financial  management infrastructure, it will need to address these and many other  financial management issues.
We fully support the objectives of the CFO Act to provide reliable financial  information and improve financial management systems and controls and,  as recently reported, we believe that it is critical that DHS be statutorily  required to comply with important financial management reforms  legislated in the CFO Act and FFMIA.  Consideration is now being given by  each house of Congress to adding DHS to the list of CFO Act agencies in  the Department of Homeland Security Financial Accountability Act, H.R.  4259 and S. 1567, 108th Congress.
subsections: section_title: FFMIA Compliance Findings Based on Negative Assurance
paragraphs: Auditors for six agencies (Commerce, Energy, EPA, NRC, NSF, and SSA)  provided negative assurance that the agencies’ systems were in compliance  with FFMIA in fiscal year 2003, and five agencies did so in fiscal year 2002.   Auditors provide negative assurance when they include language stating  that nothing came to their attention during the course of their planned  procedures to indicate that these agencies’ financial management systems  did not meet FFMIA requirements.  If readers are not familiar with the  concept of negative assurance, they may incorrectly assume that these  systems have been fully tested by the auditors and that the agencies have  achieved compliance.
OMB’s current audit guidancecalls for auditors to provide negative  assurance when reporting whether an agency’s systems are in substantial  compliance with FFMIA.  To provide positive assurance of FFMIA  compliance, auditors would need to perform more comprehensive audit  procedures than those necessary to render an opinion for a financial  statement audit.  In performing financial statement audits, auditors  generally focus on the capability of the financial management systems to  process and summarize financial information that flows into financial  statements.  In contrast, FFMIA is much broader and requires auditors to  assess whether an agency’s financial management systems substantially  comply with systems requirements.  To do this, auditors need to consider  whether agency systems provide complete, accurate, and timely  information for managing day-to-day operations.  We believe that providing  positive assurance of an agency’s financial management system would  identify weaknesses and lead to systems improvements that result in  enhancing the performance, productivity, and efficiency of federal financial  management, which is a goal of the PMA.  Therefore, as we discussed in  prior reports, we reaffirm our prior recommendation that OMB require  agency auditors to provide a statement of positive assurance when  reporting an agency’s systems to be in substantial compliance with FFMIA.
OMB continues to support the requirement for negative assurance of  FFMIA compliance due to cost-benefit concerns.  While OMB agrees that  testing should occur, and its guidance on FFMIA calls for it, OMB officials  are concerned that the level of testing needed for positive assurance may  be too time-consuming and costly.  OMB officials stated that different,  more coordinated approaches toward assessing an agency’s internal  controls and FFMIA compliance might provide sufficient assurance on an  agency’s systems.  For example, in preparing the PMA scorecard  assessments, OMB officials meet with agencies to discuss a number of  financial management issues and have systems demonstrations.  Agencies  are asked to identify key business questions and related cost drivers.  Then,  the agencies must develop systems that can produce the information  needed on those cost drivers to help management at all levels focus on  results.  OMB officials stated they believed the PMA scorecard framework  offers an alternative route toward substantial compliance that is similar to  that offered by positive assurance.  In its written comments on a draft of  this report (see app. VI) OMB stated that the processes used in evaluating  agencies against the PMA standards can provide a corroborative  mechanism in evaluating compliance with FFMIA.  Our concern is that the  information provided by this approach does not come under audit scrutiny  and may not be reliable.  For example, the PMA scorecard does not  examine the nature and extent of adjustments that agencies make to their  year-end financial statements.  As long as extensive year-end adjustments  are needed, there is no assurance that the financial information being  provided by the systems is complete and accurate for day-to-day  operations.
A joint CFO Council/PCIE group is also currently investigating how internal  control reporting similar to that required by the Sarbanes-Oxley Act of  2002 might be useful in the federal government.  OMB officials told us that  the results of this CFO Council/PCIE study might provide another method  of assessing and reporting on internal control and FFMIA compliance.   Auditor reporting on internal control is a critical component of monitoring  the effectiveness of an organization’s accountability, especially for large,  complex, or challenged entities that use taxpayers’ dollars.  Auditors can  better serve their clients and other financial statement users and better  protect the public interest by having a greater role in providing assurances  of the effectiveness of internal control in deterring fraudulent financial  reporting and protecting assets.  Financial systems are an important  element of an entity’s internal control over financial reporting.  Although  enhanced internal control reporting would not necessarily address the full  capability of the financial management systems in place, such reporting  would include reportable internal control weaknesses caused by financial  systems problems.  However, the full value of independent auditors’  assessments of FFMIA compliance will not be fully realized until auditors  perform a sufficient level of audit work to be able to provide positive  assurance that agencies are in compliance with FFMIA.  When reporting an  agency’s financial management systems to be in substantial compliance,  positive assurance will provide users with confidence that the agency  systems provide the reliable, useful, and timely information envisioned by  the act.
In addition, we also previously recommended that OMB explore clarifying  the definition of “substantial compliance” to help ensure consistent  application of the term.  As we noted in our prior reports, auditors we  interviewed had concerns about providing positive assurance in reporting  on agency systems’ FFMIA compliance because of a need for clarification  regarding the meaning of substantial compliance.  Therefore, we also  reaffirm this recommendation.  In its comments, OMB stated that its  growing experience assisting agencies in implementing the PMA  performance standards will enable it to refine the existing FFMIA  indicators associated with substantial compliance.  Accordingly, OMB  officials stated that they will consider our recommendation in any future  policy and guidance updates.
Reasons for Noncompliance  Based on our review of the fiscal year 2003 audit reports for the 17 agencies  reported to have systems not in substantial compliance with one or more of  FFMIA’s three requirements, we identified six primary reasons cited by the  auditors for agency systems not being compliant.  The weaknesses  reported by the auditors ranged from serious, pervasive systems problems  to less serious problems that may affect one aspect of an agency’s  accounting operation:  nonintegrated financial management systems,  lack of accurate and timely recording of financial information,  noncompliance with the SGL,  lack of adherence to federal accounting standards, and  weak security controls over information systems.
Figure 4 shows the relative frequency of these problems at the 17 agencies  reported to have noncompliant systems and the problems relevant to  FFMIA that were reported by their auditors.  The same six types of  problems were cited by auditors in their fiscal years 2000, 2001, and 2002  audit reports, although the auditors may not have reported these problems  as specific reasons for their systems’ lack of substantial compliance with  FFMIA.  In addition, we caution that the occurrence of problems in a  particular category may be even greater than auditors’ reports of FFMIA  noncompliance would suggest because auditors may not have identified all  problems in their reviews.
section_title: Nonintegrated Financial Management Systems
paragraphs: The CFO Act calls for agencies to develop and maintain an integrated  accounting and financial management system that complies with federal  systems requirements and provides for (1) complete, reliable, consistent,  and timely information that is responsive to the financial information needs  of the agency and facilitates the systematic measurement of performance;  (2) the development and reporting of cost management information; and  (3) the integration of accounting, budgeting, and program information.   OMB Circular No. A-127, Financial Management Systems requires each  agency to establish and maintain a single integrated financial management  system that conforms to functional requirements published by PMO.
Agencies that do not have integrated financial management systems  typically must expend major effort and resources, including in some cases  hiring external consultants, to develop information that their systems  should be able to provide on a daily or recurring basis.  Agencies with  nonintegrated financial systems are also more likely to be required to  devote more resources to collecting information than those with integrated  systems.  In addition, opportunities for errors are increased when agencies’  systems are not integrated.
Auditors frequently mentioned the lack of modern, integrated financial  management systems in their fiscal year 2003 audit reports.  As shown in  figure 4, auditors for 11 of the 17 agencies with noncompliant systems  reported this to be a problem, compared with 13 of the 19 agencies  reported with noncompliant systems in fiscal year 2002.  For example,  auditors determined that the Department of State’s financial and  accounting system, as of September 30, 2003, was inadequate, preventing  the department from routinely issuing timely financial statements and  increasing the risk of materially misstating financial information.  The  principal areas of weakness included (1) certain elements, including, but  not limited to, personal property, capital leases, and certain accounts  payable, were developed from sources outside the general ledger and   (2) several different systems were used for the management of grants and  other types of federal awards.  These systems for grants management and  other federal awards lacked standard data classifications and were not  integrated with the department’s centralized financial management system.
In another case, as auditor for Treasury’s Internal Revenue Service (IRS),  we reported that IRS’ general ledger system consists of two independent  general ledgers that are not integrated with each other or with their  supporting records for material balances.  Further, the information  contained in the general ledgers was not supported by adequate audit trails  for federal tax revenue, federal tax refunds, taxes receivable, or property  and equipment.  IRS’ use of two separate general ledgers to account for its  tax collection activities and the costs of conducting those activities,  respectively, greatly complicates efforts to measure the cost of IRS’ tax  collection efforts.  The use of multiple ledgers also causes difficulties in the  production of the reliable, useful, and timely financial and performance  information that IRS needs for decision making on an ongoing basis.
section_title: Inadequate Reconciliation Procedures
paragraphs: A reconciliation process, whether manual or automated, is a necessary and  valuable part of a sound financial management system.  The less integrated  the financial management system, the greater the need for adequate  reconciliations because data may be accumulated from a number of  different sources.  Reconciliations are needed to ensure that data have  been recorded properly between the various systems and manual records.   The Comptroller General’s Standards for Internal Control in the Federal  Government highlights reconciliation as a key control activity.
As shown in figure 4, auditors for 11 of the 17 agencies with noncompliant  systems in fiscal year 2003 reported that the agencies had reconciliation  problems, compared with 11 of the 19 agencies reported with  noncompliant systems in fiscal year 2002.  These reconciliation problems  included difficulty in reconciling their fund balance with Treasury  accounts with Treasury’s records.  Treasury policy requires agencies to  reconcile their accounting records with Treasury records on a monthly  basis (comparable to individuals reconciling their personal checkbooks to  their monthly bank statements).
For fiscal year 2003, NASA’s auditors reported a lack of effective internal  controls surrounding its fund balance with Treasury reconciliations.  Based  on a review of NASA headquarters’ fund balance with Treasury  reconciliations as of September 30, 2003, auditors reported an agencywide  difference of approximately $43 million, net, between NASA’s general  ledger and Treasury’s reported balance.  NASA did not provide sufficient  documentary evidence to explain these differences.  Further, NASA made  approximately 20 additional adjustments outside of its financial  management system, which indicated the difference between its fund  balance with Treasury balance and Treasury’s reported balance was  significantly greater than disclosed in its year-end reconciliations.  In total,  NASA recorded adjustments of approximately $2 billion, net, to decrease  its fund balance with Treasury balance in order to agree to Treasury’s  reported balance as of September 30, 2003.  NASA was unable to provide  the auditor documentation to explain the reasons for such a large dollar  amount of reconciliations.
section_title: Lack of Accurate and Timely Recording of Financial Information
paragraphs: As shown in figure 4, auditors for 15 of the 17 agencies with noncompliant  systems reported the lack of accurate and timely recording of financial  information as a problem for fiscal year 2003, compared with 17 of the 19  agencies reported with noncompliant systems in fiscal year 2002.  Accurate  and timely recording of financial information is essential for successful  financial management.  Timely recording of transactions facilitates  accurate reporting in agencies’ financial reports and other management  reports used to guide managerial decision making.  In addition, having  systems that record information in a timely and accurate manner is critical  for key governmentwide initiatives, such as integrating budget and  performance information.
In contrast, untimely recording of transactions during the fiscal year can  result in agencies making substantial efforts at fiscal year-end to perform  extensive manual financial statement preparation efforts that are  susceptible to error and increase the risk of misstatements.  For example,  auditors at the Department of the Interior reported in fiscal year 2003 that  the department (1) needed to improve controls over property, plant, and  equipment in order to prepare financial reports in a timely and reliable  manner; (2) capitalized assets that were transferred from other agencies at  incorrect amounts and also capitalized assets in the current year that had  been accidentally expensed in prior years; and (3) did not ensure that  journal vouchers were properly recorded by failing to include proper  general ledger accounts.  As a result, the department recorded over 180  adjustments after issuing the final year-end trial balance, requiring that  significant time and resources be dedicated to making manual adjustments.
section_title: Noncompliance with the SGL
paragraphs: As shown in figure 4, auditors for 10 of the 17 agencies reported to have  noncompliant systems for fiscal year 2003 stated that the agencies’ systems  did not comply with SGL requirements for fiscal year 2003, as compared  with 9 of the 19 agencies reported with noncompliant systems in fiscal year  2002.  Implementing the SGL at the transaction level is one of the specific  requirements of FFMIA.  Using the SGL promotes consistency in financial  transaction processing and reporting by providing a uniform chart of  accounts and pro forma transactions.  The SGL also provides a basis for  comparison at the agency and governmentwide levels.  The defined  accounts and pro forma transactions standardize the accumulation of  agency financial information as well as enhance financial control and  support financial statement preparation and other external reporting.  By  not implementing the SGL, agencies may experience difficulties in  providing consistent financial information across their components and  functions.
Auditors for HHS reported that some of its systems were not designed to  apply the SGL at the transaction level.  For example, the auditors stated  that the National Institutes of Health (NIH) recorded 1,900 nonstandard  accounting entries totaling $14.2 billion during the year.  According to the  auditors, these nonstandard entries were needed to properly adjust  account balances, including inventory, accrued leave, personal property,  receipt of donations, and other revenues.  Moreover, NIH developed a  process to record at year-end the effect of current-year, day-to-day entries  in its budgetary and expended appropriations accounts.  In their report, the  auditors stated that the use of nonstandard accounting entries increased  the risks of (1) bypassing accounting controls and (2) errors. To address  these issues, during fiscal year 2003, NIH reconfigured its transaction codes  to be SGL compliant and on October 1, 2003, implemented a new general  ledger system as part of the NIH Business and Research Support System  (NBRSS) initiative.  NBRSS is expected to be fully implemented in 2006.
Furthermore, approximately 2,300 nonstandard accounting entries with an  absolute value of about $41 billion were recorded in HHS’ Program Support  Center’s (PSC) CORE Accounting system to compensate for  noncompliance with the SGL.  These nonstandard accounting entries were  recorded to correct for misstatements and recorded balances, and to  record reclassifications.
section_title: Lack of Adherence to Federal Accounting Standards
paragraphs: One of FFMIA’s requirements is that agencies’ financial management  systems account for transactions in accordance with federal accounting  standards.  Agencies face significant challenges implementing these  standards.  As shown in figure 4, auditors for 11 of the 17 agencies with  noncompliant systems for fiscal year 2003 reported that these agencies had  problems complying with one or more federal accounting standards,  compared with 13 of the 19 agencies with noncompliant systems in fiscal  year 2002.
Auditors reported that agencies are having problems implementing  standards that have been in effect for some time—such as Statement of  Federal Financial Accounting Standards (SFFAS) No. 1, Accounting for  Selected Assets and Liabilities—as well as standards that have been  promulgated in the last few years—such as SFFAS No. 21, Reporting  Corrections of Errors and Changes in Accounting Principles.  For  example, in fiscal year 2003, auditors for the U.S. Agency for International  Development (USAID) found that the agency’s Accrual Reporting System  (ARS) was not in compliance with SFFAS No. 1, paragraph 77.  That  standard requires that when an entity accepts goods (or services), it should  recognize a liability for the unpaid amount of these goods or services.  If  related invoices are not available when the financial statements are  prepared, amounts owed should be estimated.  USAID uses ARS to develop  quarterly estimates of accrued expenses recorded against individual  contract and grant awards.  However, auditors discovered that ARS’  financial information was not reliable and, since the system-generated  estimates were based on the financial information contained in the system,  USAID had no assurance that the resulting estimates were reliable or  supported by adequate accrual methodology.  Further, simply eliminating  the system-generated estimates might cause the agency to materially  understate its accounts payable.  Consequently, as a result of revised ARS  estimates proposed by the OIG, USAID reduced its year-end accrued  expenses and accounts payable by $244 million to more accurately reflect  the activity in accounts affected by accruals.
section_title: Weak Security Controls over Information Systems
paragraphs: Information security weaknesses are a major concern for federal agencies  and the general public and are one of the frequently cited reasons for  noncompliance with FFMIA.  These control weaknesses place vast  amounts of government assets at risk of inadvertent or deliberate misuse,  financial information at risk of unauthorized modification or destruction,  sensitive information at risk of inappropriate disclosure, and critical  operations at risk of disruption.  Accordingly, we have considered  information security to be a governmentwide high-risk area since 1997.
The Congress and the executive branch have taken action to address the  risks associated with persistent information security weaknesses.  The  Federal Information Security Management Act of 2002 (FISMA) provides  the overall framework for ensuring the effectiveness of information  security controls that support federal operations and assets and requires  agencies and OMB to report annually to the Congress on their information  security programs. As we testified in March 2004, fiscal year 2003 agency  reporting required by FISMA showed apparent progress in implementing  FISMA’s information security requirements, but most agencies still had not  reached the level of performance that demonstrates they have  implemented the agencywide information security program mandated by  the act.  Only 6 agencies reported that they had authorized 90 to 100  percent of their systems, and 11 agencies reported that they had authorized  less than half of their systems.  While OMB monitors agency performance  by requiring agencies to provide quarterly updates on this and other key  performance measures, the fiscal year 2004 annual reports that agencies  must submit to the Congress are due to OMB by October 6, 2004, and  should provide updated information on agency progress in implementing  FISMA’s information security requirements.
As shown in figure 4, auditors for all 17 of the 17 agencies with  noncompliant systems reported security weaknesses in information  systems to be a problem, compared with 19 of the 19 agencies reported  with noncompliant systems in fiscal year 2002.  Unresolved information  security weaknesses could adversely affect the ability of agencies to  produce accurate data for decision making and financial reporting because  such weaknesses could compromise the reliability and availability of data  that are recorded in or transmitted by an agency’s financial management  system.
As a case in point, in fiscal year 2003, the auditors for the Department of  Education noted that the department needs improvement in seven key  security control areas.  These seven areas are (1) consistently updating  application versions, virus/data protection packages, and security  packages; (2) testing mission-critical systems for platform and database  level vulnerabilities; (3) enforcing the rule requiring complex passwords  across the enterprise; (4) deploying network and host based intrusion  detection systems to provide alerts of intrusions and malicious internal  activity; (5) implementing firewall rules to logically segregate database  servers containing sensitive data from servers within the Web-hosting  environment; (6) implementing access controls to protect mission-critical  systems from certain internal networks; and (7) correcting security  weaknesses previously identified at contractor facilities.
section_title: Agencies Struggle to Implement New Financial Systems
paragraphs: In an effort to address problems such as nonintegrated systems, inadequate  reconciliations, and lack of compliance with the SGL, a number of agencies  have efforts under way to implement new financial management systems or  to upgrade existing systems.  Agencies anticipate that the new systems will  provide reliable, useful, and timely data to support managerial decision  making and assist taxpayer and congressional oversight.  However,  implementing and upgrading systems bring new risks.  Organizations that  follow and effectively implement accepted best practices in systems  development and implementation (commonly referred to as disciplined  processes) can reduce these risks to acceptable levels.  However, our work  at DOD, HHS, and NASA has shown that agencies face significant problems  in implementing financial management systems and are not following the  necessary disciplined processes for efficient and effective implementation  of such systems.  Further, VA recently halted its pilot implementation of its  new core financial system for which $249 million had been invested.  The  VA OIG reported that the contracting and monitoring of the VA project was  not adequate, and the pilot deployment of the system encountered multiple  problems.  The problems the VA OIG cited were similar to those we noted  at DOD, HHS, and NASA.  As the federal government moves forward with  ambitious modernization efforts to identify opportunities to eliminate  redundant systems and enhance information accuracy and availability,  adherence to these disciplined processes will be a crucial element to  reduce risks to acceptable levels.
subsections: section_title: Agencies Are Not Following Disciplined Processes
paragraphs: Implementing new financial management systems provides the  groundwork for improved financial management, including providing  financial managers with more timely information for better informed  financial management decisions, and will help meet OMB’s accelerated  financial reporting deadline.  However, with implementation comes risk.   Organizations that follow and effectively implement accepted best  practices in systems development and implementation (commonly referred  to as disciplined processes) can reduce these risks to acceptable levels.   Our work at DOD, HHS, and NASA has shown that agencies face significant  problems in implementing financial management systems and are not  following the necessary disciplined processes for efficient and effective  implementation of financial management systems.  VA recently halted  implementation of its new core financial system, due in part to reported  concerns about the inadequate contracting and monitoring of the project  and multiple problems with the pilot deployment of the system.
Disciplined processes have been shown to mitigate some of the risks  associated with software development and acquisition efforts to acceptable  levels.  The term “acceptable levels” acknowledges that any systems  acquisition effort has risks and will suffer the risk of not achieving the  intended results (performance) within the established resources (costs) on  schedule.  However, effective implementation of the disciplined processes  reduces these risks and helps prevent any actual problems from having any  significant adverse impact on achieving the performance, cost, and  schedule of the project.
Although a standard set of practices that will guarantee success does not  exist, several organizations, such as the Software Engineering Institute  (SEI) and the Institute of Electrical and Electronic Engineers (IEEE), as  well as individual experts have identified and developed the types of  policies, procedures, and practices that have been demonstrated to reduce  development time and enhance effectiveness.  The key to having a  disciplined system development effort is to have disciplined processes in  several areas, including the following:  Requirements management.  Requirements are the specifications that  system developers and program managers use to design, develop, and  acquire a system.
Testing.  Testing is the process of executing a program with the intent  of finding errors.  Testing is a critical process that improves an entity’s  confidence that the system will satisfy the requirements of the end user  and operate as intended.
Project planning and oversight.  Project planning is the process used  to establish reasonable plans for carrying out and managing the  software project.  It includes estimating resources needed for the work  to be performed, establishing commitments, and defining the work plan.
Risk management.  Risk management is a set of activities for  identifying, analyzing, planning, tracking, and controlling risks.  Risk  management starts with identifying the risks before they can become  problems.
Organizations that do not effectively implement the disciplined processes  lose the productive benefits of these processes as a project moves through  its development and implementation and are forced to implement them  later when it takes more time and they are less effective.  A major  consumer of project resources in undisciplined efforts is rework.  Rework  occurs when the original work has defects or is no longer needed because  of changes in project direction.  Disciplined organizations focus their  efforts on reducing the amount of rework because it is expensive.  Studies  have shown that correcting a defect during the testing phase costs  anywhere from 10 to 100 times the cost of correcting it during the design or  requirements phase.  Projects that are unable to adopt disciplined  processes successfully will eventually only be spending their efforts on  rework and the associated processes that are needed rather than  productive work.  In other words, the project may find itself continually  reworking items.
We found in our review of three agencies’ implementation of new financial  management systems that these agencies are not following the disciplined  processes that are necessary to reduce the risks to acceptable levels.  In  our May 2004 report, we reported that long-standing problems continue at  DOD despite the significant investments made in DOD business systems  each year.  GAO’s two case study examples of logistics systems  modernization efforts, Business Systems Modernization (BSM) at the  Defense Logistics Agency (DLA) and the Army’s Logistics Modernization  Program (LMP), found that disciplined processes were not implemented.   We also reported in September 2004 that HHS had not followed key  disciplined processes and is at risk of implementing a new financial  management system that will not fully meet the needs of its users.  Further,  in 2003 and 2004 we issued five reports and testified about the  considerable challenges facing NASA’s implementation of a new financial  management program.  NASA is on its third attempt in 12 years to  modernize its financial management process and systems and has spent  about $180 million on its two prior failed efforts.
section_title: Department of Defense
paragraphs: DOD reported in April 2003 that its business systems environment  consisted of 2,274 systems. DOD requested approximately $19 billion for  fiscal year 2004 to operate, maintain, and modernize its reported 2,274  business systems.  More recently, DOD stated that its inventory of business  systems was over 4,000 and more systems are expected to be identified.   Despite its substantial investment over many years, DOD’s business  systems remain fundamentally flawed; unable to provide timely, reliable  information; and leave DOD vulnerable to fraud, waste, and abuse.  The  duplication and stovepiped nature of DOD’s systems environment is  illustrated by the numerous systems it has in the same functional areas,  such as over 450 personnel systems and 200 inventory systems.  These  systems are not integrated and thus have multiple points of data entry,  which can result in data integrity problems.
Two of the business system modernization efforts DOD has undertaken to  address some of its inventory problems are DLA’s BSM and the Army’s LMP.   BSM and LMP incorporate part of the inventory management portion of the  COTS software package used by both DLA and the Army.  In November  1999, DLA initiated an effort to replace two of its materiel management  systems with BSM.  BSM is intended to transform how DLA conducts its  operations in five core business processes: order fulfillment, demand and  supply planning, procurement, technical/quality assurance, and financial  management.  In February 1998, the Army began its effort to replace its two  material management systems with LMP.  LMP is intended to transform the  U.S. Army Materiel Command’s logistic operations in six core processes:  order fulfillment, demand and supply planning, procurement, asset  management, materiel maintenance, and financial management.
Our May 2004 report of DOD’s business system modernization found  numerous problems with both projects, BSM and LMP, including such  issues as failure to follow necessary disciplined processes, lack of financial  system integration, and system deployment schedule slippage.  We found  that DLA’s and Army’s program officials did not effectively implement the  disciplined processes associated with requirements management and  testing in developing and implementing their systems.  For almost all of the  requirements we analyzed, we found that the forward and backward  traceability was not maintained.  Traceability allows the user to follow the  life of the requirement both forward and backward through the DLA and  Army approaches and management plans and is critical to understanding  the parentage, interconnections, and dependencies among the individual  requirements.  Testing, the process of executing the program with the  intent of finding errors, was not effectively implemented for BSM or LMP.   DLA and the Army, therefore, did not achieve the important goal of  reducing the risk that BSM and LMP would not operate as intended.   Although DLA and the Army have asserted that BSM and LMP, respectively,  are compliant with the requirements of FFMIA, we have concerns.
In the case of LMP, we found that the Army relied upon PMO testing for 147  requirements because PMO had validated these requirements when it  tested the vendor’s commercial software used for LMP during fiscal year  1999.  PMO testing should not be considered a substitute for individual  system testing of the actual data that will be used by the entity.  Further,  PMO’s tests of software do not address entity-specific integrated tests of  end-to-end transactions or systems interfaces.  Because the Army had to  make modifications to the basic commercial software package to  accommodate some of its business operations, the Army cannot be  assured, without retesting, that these 147 requirements will produce the  intended results.  In the case of BSM, for one requirement the contractor  stated that “a sample of transactions were reviewed,  it appears that  BSM properly records transactions consistent with the SGL posting rules.”   However, we found no indication that this requirement was tested, and  therefore, we cannot conclude whether BSM has the capability to meet this  requirement.  Without adequate documentation to support testing of the  FFMIA requirements, it is questionable whether either system is  substantially compliant with FFMIA.
Additionally, we found that the system interfaces were not fully tested for  BSM and LMP and when they became operational, it became clear that the  system interfaces were not working as intended.  Costly manual reentry of  inventory transactions was necessary.  Further, both BSM and LMP have  experienced cost increase and schedule slippage.  BSM was originally  scheduled to be fully operational in September of 2005.  However, the date  has shifted to midyear 2006 and the cost has increased from $764 million to  $850 million.  LMP has a current estimated cost of over $1 billion.  As of  March 2004, the Army had not determined when LMP would be fully  operational at all locations.  In 1999, we reported that the Army’s estimated  cost was $421 million over a 10-year period.  DOD cannot be assured that  the two systems in our case study will provide the functionality needed and  fully meet DLA and Army objectives.
Successful reform of DOD’s fundamentally flawed financial and business  management operations must simultaneously focus on its systems,  processes, and people.  While DOD has made some encouraging progress in  addressing specific challenges, it is still in the very early stages of a  departmentwide reform that will take many years to accomplish.  Secretary  Rumsfeld has made business transformation a priority.  For example,  through its Business Management Modernization Program, DOD is  continuing its efforts to develop and implement a business enterprise  architecture and establish effective management oversight and control  over its business systems modernization investments.  However, after  about 3 years of effort and over $203 million in reported obligations, we  have not seen significant change in the content of DOD’s architecture or in  its approach to investing billions of dollars annually in existing and new  systems.  We have made numerous recommendations aimed at improving  DOD’s plans for developing the next version of the architecture and  implementing controls for selecting and managing business systems  investments.  To date, DOD has not addressed 22 of our 24  recommendations.
section_title: Department of Health and Human Services
paragraphs: HHS is currently implementing a new financial management system, the  Unified Financial Management System (UFMS), to replace five outdated  accounting systems.  This project is expected to be phased in at the  component agencies and fully implemented in fiscal year 2007.  Our 2004  analysis and evaluation focused on the system implementation efforts  associated with all the HHS entities except for the Centers for Medicare  and Medicaid Services (CMS) and NIH.  We found that the lack of  disciplined processes puts the implementation of HHS’ new financial  management system at risk.
We reported that HHS had not followed key disciplined processes and  was at risk of implementing a new financial management system that  would not fully meet the needs of its users.  While HHS had executive  sponsorship for the development of UFMS, it had focused on meeting its  implementation schedule to deploy the system at its component agency, the  Centers for Disease Control and Prevention (CDC) in October 2004 to the  detriment of disciplined processes.  HHS had not implemented effective  disciplined processes in such areas as requirements management, testing,  project management and oversight, and risk management.
We found significant problems with HHS’ requirements management and  testing process.  Problems with requirements management practices  include the lack of (1) a concept of operations to guide the development of  requirements, (2) traceability of a requirement from the concept of  operations through testing to ensure requirements were adequately  addressed in the system, and (3) specificity in the requirements to minimize  confusion in the implementation. These problems with requirements have  resulted in a questionable foundation for the system testing process.
Additionally, testing activities were scheduled too late in the  implementation cycle, leaving little time to ensure that the defects found  were addressed before the system was implemented at CDC.  While  adherence to schedule goals is generally desirable, it is key that project  decisions are based on objective data and demonstrated project  accomplishments, and are not schedule-driven.  Otherwise, the risk of  costly rework or failure appreciably increases.
We further found that HHS had not developed the quantitative data  necessary to assess whether UFMS will provide the needed functionality.   HHS did not have a metrics measurement process to understand its  capability to help manage the entire UFMS effort; or how its process will  affect the UFMS cost, schedule, and performance objectives; or what  corrective action is needed to reduce the risks associated with the  problems identified.  We also reported problems with HHS’ initial data  conversion and system interfaces.
In addition to the disciplined processes weaknesses, we noted that HHS  had weaknesses in its information technology investment management,  enterprise architecture, and information security.  Serious understaffing  and incomplete workforce planning have also plagued the UFMS project.   The cumulative effects of these weaknesses increase the risk that UFMS  will not fully serve the needs of its users nor achieve its budget and  schedule goals.
In September 2004, HHS decided to delay the implementation of a  significant amount of functionality associated with the CDC deployment  from October 2004 until April 2005 in order to address the issues that had  been identified with the project.
section_title: National Aeronautics and Space Administration
paragraphs: In April 2000, NASA began its third attempt to modernize its financial  management system.  This effort, IFMP, is expected to produce an  integrated, NASA-wide financial management system through the  acquisition and incremental implementation of COTS and related hardware  and software components.  As of June 30, 2003, NASA reported that it had  fully implemented the core financial module, which NASA considers the  backbone of IFMP, at all of its 10 operating locations.
As we have reported numerous times, NASA faces considerable  challenges in meeting its IFMP commitments and providing the necessary  tools to oversee its contracts and manage its programs.  In April 2003, we  reported that the core financial module does not provide agency managers  or the Congress with useful cost and related information with which to  make informed decisions, manage daily operations, and ensure  accountability on an ongoing basis, and NASA was not following key best  practices for acquiring and implementing the system.  As we reported, key  users, such as program managers, cost estimators, and congressional  staffs, were not included in defining the system requirements.  According to  IFMP officials, NASA chose to forgo certain system capabilities to expedite  implementation of the core financial model.  As a result, managers and cost  estimators continued to rely on means outside IFMP to capture data  needed to manage programs.
We have also reported that NASA’s approach to implementing its new  system did not optimize the system’s performance and would likely cost  more and take longer to implement than necessary.  Specifically, NASA was  not following key best practices for acquiring and implementing the  system, which may affect the agency’s ability to fully benefit from the new  system’s capabilities.  First, NASA did not analyze the relationships among  selected and proposed IFMP components to understand the logical and  physical relationships among the components it acquired.  By acquiring  these IFMP components without first understanding system component  relationships, NASA increased its risks of implementing a system that will  not optimize mission performance and will cost more and take longer to  implement than necessary.  Second, although industry best practices and  NASA’s own system planning documents indicate that detailed  requirements are needed as the basis for effective system testing, NASA did  not require documentation of detailed system requirements prior to system  implementation and testing.  NASA’s approach instead relied on certain  subject matter experts’ knowledge of the detailed requirements necessary  to evaluate the functionality actually provided.  As a result, NASA increased  its risk that IFMP would cost more and do less than planned.
Further, we reported that NASA’s new financial management system did  not provide key external reporting capabilities, such as the generation of  complete and accurate information necessary for external reporting of  NASA property and budgetary data, and the new system did not comply  substantially with the requirements of FFMIA.
section_title: Department of Veterans Affairs
paragraphs: VA recently halted implementation of its new core financial system, Core  Financial and Logistics System (CoreFLS), at a potential loss of almost  $250 million.  VA provides federal benefits, including disability  compensation, pensions, education, life insurance, home loan assistance,  and medical care, to the 26 million living veterans and veterans’ survivors  and dependents.  VA began the detailed planning and acquisition of  CoreFLS in June 1999 and was planning to have it fully implemented  throughout VA by March 2006.  The VA OIG reported that the contracting  and monitoring of the CoreFLS project was not adequate and the pilot  deployment of CoreFLS at a VA medical center encountered multiple  problems.  These problems are similar to the concerns we noted at DOD,  HHS, and NASA.
The VA OIG noted that the success of CoreFLS greatly depends on the  ability of the software to integrate with existing legacy systems, which in  turn requires that existing legacy systems are properly implemented and  maintained.  The VA OIG found that most of the VA legacy systems at the  pilot location contained inaccurate data because they had not been used  properly and that this may be a systemic problem throughout VA.  The  effect of transferring inaccurate data to CoreFLS at this pilot location  interrupted patient care and medical center operations.  This was  compounded by VA inadequately training employees on how to use the  system, unreliable test procedures and results, and unsubstantiated  performance results.  Problems were also identified with reconciling  accounts payable, accounts receivable, undelivered orders, and real  property.
When CoreFLS was deployed at the pilot location in October 2003, it did  not function as project managers expected because of inaccurate or  incomplete vendor and inventory system data.  Because of these problems  with vendor and inventory systems, the VA pilot location made excessive  purchases of medical supplies.  For example, on February 23, 2004, the  pilot location purchased 100 cup biopsy forceps with a total value of  $30,700, which were shipped overnight to the medical center, but returned  to the vendor less than a month later.  In addition, late payment penalties by  the medical center for the first two quarters of fiscal year 2004 totaled  $10,800, compared to $600 for the entire fiscal year 2003.  The VA OIG’s  review also found that the inventory was overstated by approximately $2.3  million out of $3.6 million recorded, because an item valued at $23 showed  a quantity on-hand of 100,000 when, in fact, the on-hand quantity was only  one.
As a result of these problems, patient care was interrupted by supply  outages and other problems.  The inability to provide sterile equipment and  needed supplies to the operating room resulted in the cancellation of 81  elective surgeries for a week in both November 2003 and February 2004.  In  addition, the operating room was forced to operate at two-thirds of its prior  capacity.  Because of the serious nature of the problems raised with  CoreFLS, VA management decided to focus on transitioning back to the  previous financial management software and pull together a senior  leadership team to examine the results of the pilot and make  recommendations to the VA Secretary regarding the future of CoreFLS.
section_title: Governmentwide Initiatives to Improve Financial Management Systems Spur Needed Change
paragraphs: As agencies move forward with initiatives to address FFMIA-related  problems, it is important that consideration be given to the numerous  governmentwide initiatives under way to address long-standing financial  management weaknesses.  As stated in the PMA, there are few items more  urgent than ensuring that the federal government operates efficiently and is  results-oriented.  While FFMIA implementation relates directly to the  improved financial performance initiative, development and maintenance  of FFMIA-compliant systems will also affect the implementation of the  other four PMA initiatives.  Notably, OMB is developing a federal enterprise  architecture that is intended to facilitate the government’s ability to make  significant progress across the PMA.  For example, as part of the e-gov  PMA initiative, the number of federal payroll providers is being  consolidated.  Numerous agencies had targeted their payroll operations for  costly modernization, and according to OMB, millions of dollars will be  saved through shared resources and processes and by modernizing on a  cross-agency, governmentwide basis.
The Clinger-Cohen Act sets forth a variety of initiatives to support better  decision making for capital investments in information technology, which  has led to the development of the Federal Enterprise Architecture and  better-informed capital investment and control processes within agencies  and across government.  This has produced another broad shift in the  financial systems environment—one that acknowledges that financial  systems planning can no longer take place within an isolated environment  or “stovepipe,” but must now be integrated with enterprise goals.  Managed  properly, an enterprise architecture can clarify and help optimize the  interdependencies and relationships among an organization’s business  operations and the underlying information technology infrastructure and  applications that support those operations.
Moreover, developing such an architecture will help address the  government’s inability to properly reconcile and report on  intragovernmental transactions.  We have reported for years that the heart  of the intragovernmental transactions issue was that the federal  government lacked clearly articulated business rules for these transactions  so that they would be handled consistently by agencies.  This is  compounded by limitations and incompatibility of agency and trading  partner systems, among other issues.  OMB and Treasury have taken steps  to help transform and standardize intragovernmental transactions,  including instituting an e-gov project to define a governmentwide data  architecture and provide a single source of detailed trading partner data.   The Intragovernmental Transaction Exchange was piloted from October  2003 to April 2004, and provided information about the business processes  and technologies used to interact with it.  After evaluating the results of the  pilot, OMB expects to phase it into use at all agencies.
Building upon the efforts of the Federal Enterprise Architecture program to  support the PMA for e-gov, OMB and designated agency task forces have  launched the line of business (LOB) initiative.  This initiative seeks to  develop business-driven, common solutions for five lines of business that  span across the federal government.  The five initiatives are financial  management, human resources management, grants management, federal  health architecture, and case management.  Each of the lines of business  shares similar business requirements and business processes.  OMB and  the LOB task forces plan to use either enterprise architecture-based  principles and best practices to identify common solutions for business  processes, technology-based shared services to be made available to  government agencies, or both.  Driven from a business perspective rather  than a technology focus, the solutions are expected to address distinct  business improvements to enhance government’s performance and  services for citizens.  The results of LOB efforts are expected to save  taxpayer dollars, reduce administrative burden, and significantly improve  service delivery.
The financial management LOB goals are to (1) achieve or enhance process  improvements and cost savings in the acquisition, development,  implementation, and operation of financial management systems through  shared services, joint procurements, consolidation, and other means;   (2) promote seamless data exchange between and among federal agencies;  (3) provide for the standardization of business processes and data  elements; and (4) strengthen internal controls through real-time integration  of core financial and subsidiary systems.  OMB has an ambitious time  frame, September 2004, for identifying a common solution and developing a  target architecture and a joint business case.  At the time of our review,  OMB had not completed this effort.  Agency business cases submitted as  part of the budget cycle are expected to reflect the proposed common  solutions.  GAO has long supported and called for such initiatives to  standardize and streamline common systems, which cannot only reduce  costs but, if done correctly, can improve accountability.
The problems we have seen related to requirements, testing, interfaces, and  data conversion at the agency level indicate that attention to these  disciplined processes will continue to be important as OMB and the LOB  task forces move forward.  These initiatives and the intragovernmental  transaction exchange will be required to address broader sets of  requirements, interfaces, and data conversion issues than those at an  individual agency level, thus amplifying the complexity of the task.
Disciplined process can play an important role in helping governmentwide  systems initiatives reduce the risk of these projects to acceptable levels.
In addition, with many new financial management systems being  implemented in the federal government, it is crucial that the federal  government have a qualified workforce with the right mix of skills to  implement financial systems successfully.  Our report on effective  strategic workforce planning highlighted five principles that such a process  should address irrespective of the context in which planning is done.   Among the principles are determining the critical skills and competencies  that will be needed to achieve current and future results, and developing  strategies tailored to address gaps in the number, deployment, and  alignment of human capital approaches.  At a JFMIP-sponsored forum on  successful integration and interoperability of business management  systems held in May 2004, the participants noted that agencies are losing  experienced people for a variety of reasons and relying excessively on  outside contractors because they have no other choice.  Participants  expressed concern that internally, staff lack the technical expertise needed.   Agency officials overseeing implementations have expertise on the  functional requirements, such as government accounting standards, but  vendors and integrators have little expertise in these areas.  This is  extremely high risk and costly, and greater oversight and close monitoring  of contractors is needed.  Further, our executive guide emphasizes the  need for developing a financial management team with the right mix of  skills and competencies.  A changing financial management business vision  requires shifting workforce capacities and providing a financial  management workforce that is more analytic and capable of providing  decision support.
section_title: Conclusions
paragraphs: Long-standing problems with agencies’ financial systems continue to make  it difficult for agencies to routinely produce reliable, useful, and timely  financial information.  While a number of agencies are receiving  unqualified (“clean”) opinions on their financial statements, the continued  widespread noncompliance with FFMIA shows that agencies still have a  long way to go to having systems, processes, and controls that routinely  generate reliable, useful, and timely information.
The FFMIA-related problems reported in agency audit reports indicate that  federal financial management systems are not currently providing federal  managers the financial data needed for day-to-day management of their  programs or for external reporting in an efficient or timely manner.  Yet we  remain concerned that the full nature and scope of the problems have not  been identified because auditors have only provided negative assurance in  their FFMIA reports.  We believe the law requires auditors to provide  positive assurance on FFMIA compliance.  Therefore, we reaffirm our  recommendation made in prior reports that OMB revise its current FFMIA  guidance to require agency auditors to provide a statement of positive  assurance when reporting an agency’s systems to be in substantial  compliance, which entails a more thorough examination of the agency’s  systems.  We also reaffirm our other prior recommendation for OMB to  explore further clarification of the definition of “substantial compliance” in  its FFMIA guidance to encourage consistent reporting among agency  auditors.  As we stated in our prior reports, auditors we interviewed had  concerns about providing positive assurance in reporting on agency  systems’ FFMIA compliance because of a need for clarification regarding  the meaning of substantial compliance.
Implementing new COTS core financial systems is a formidable challenge  since financial management systems are not only needed for external  reporting but, most importantly, are needed to provide the financial  information program managers need to manage operations on a day-to-day  basis.  Reliable, useful, and timely financial management information is key  to achieving the goals of the PMA and its related initiatives, such as PART.   As the federal government moves forward with agency implementations of  new financial management systems and for systems implemented to satisfy  governmentwide initiatives, adherence to proven disciplined processes to  minimize risks and improve management of these implementations is  critical.  Moreover, people with the right skill sets in the right places at the  right times are critical to efficiently and effectively implementing a  financial management system and operating it once it is in place.   Improvements in federal financial management systems are in some cases  a long-term goal, but with sustained attention from important decision  makers, including the Congress and OMB, the goals of the CFO Act and  FFMIA can be achieved.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments (reprinted in app. VI) on a draft of this report, OMB  agreed with our assessment that while federal agencies continue to make  progress in addressing financial management systems weaknesses, many  agencies still lack the ability to produce the data needed to efficiently and  effectively manage day-to-day operations.  As in previous years, OMB  disagreed with our recommendation that agency auditors be required to  provide a statement of positive assurance when reporting agency systems  to be in substantial compliance with FFMIA.  OMB said that the PMA and  FFMIA should be viewed as complementary methods for achieving  improvements in financial management systems.  OMB stated that the  framework of performance standards established under the PMA provides  a corroborative mechanism for evaluating FFMIA compliance, which  together with existing audit processes can provide an accurate assessment  of substantial compliance.  Therefore, OMB does not believe that the  addition of a statement of positive assurance on FFMIA compliance would  be beneficial.  While we agree that the initiatives of the PMA are stimulating  improvements, auditors need to consider other aspects of financial  management systems when assessing FFMIA compliance that are not fully  addressed through the current reporting structure.  Our concern is that  some of the information provided by this approach, such as monthly  financial performance metrics for managing activities, does not come  under audit scrutiny and may not be reliable.  In contrast, an opinion by an  independent auditor of FFMIA compliance would confirm that an agency’s  systems substantially met the requirements of FFMIA and provide  additional confidence in the information provided by the PMA.  Finally, as  we have stated in previous reports, a statement of positive assurance is a  statutory requirement under the act.
With regard to our prior recommendation, which we reaffirmed in this  report, for revised guidance that clarifies the definition of substantial  compliance, OMB said that the performance results obtained from the PMA  initiatives will allow a further refinement of the existing substantial  compliance indicators.  OMB agreed to consider clarifying the definition of  “substantial compliance” in future policy and guidance updates.  As we  noted in our prior reports, auditors we interviewed expressed a need for  clarification regarding the meaning of substantial compliance.
OMB also provided additional oral comments, which we incorporated as  appropriate.
We are sending copies of this report to the Chairman and Ranking Minority  Member, Subcommittee on Financial Management, the Budget, and  International Security, Senate Committee on Governmental Affairs, and to  the Chairman and Ranking Minority Member, Subcommittee on  Government Efficiency and Financial Management, House Committee on  Government Reform.  We are also sending copies to the Director of the  Office of Management and Budget, the Secretary of Homeland Security, the  heads of the 23 CFO Act agencies, and agency CFOs and IGs.  Copies will  be made available to others upon request.  In addition, this report will be  available at no charge on the GAO Web site at http://www.gao.gov.
This report was prepared under the direction of Sally E. Thompson,  Director, Financial Management and Assurance, who may be reached at  (202) 512-2600 or by e-mail at thompsons@gao.gov if you have any  questions.  Staff contacts and other key contributors to this report are  listed in appendix VII.
section_title: Requirements and Standards Supporting Federal Financial Management
subsections: section_title: Financial Management Systems Requirements
paragraphs: The policies and standards prescribed for executive agencies to follow in  developing, operating, evaluating, and reporting on financial management  systems are defined in Office of Management and Budget (OMB) Circular  No. A-127, Financial Management Systems.  The components of an  integrated financial management system include the core financial system,  managerial cost accounting system, and administrative and programmatic  systems.  Administrative systems are those that are common to all federal  agency operations, and programmatic systems are those needed to fulfill  an agency’s mission.  The Program Management Office (PMO), managed by  the Executive Director of the Joint Financial Management Improvement  Program (JFMIP) and funded by the Chief Financial Officers (CFO)  Council, has issued federal financial management systems requirements  (FFMSR) for the core financial system and managerial cost accounting  system, and is in the process of issuing these requirements for the  administrative and programmatic systems.  Appendix II lists the federal  financial management systems requirements published to date.  Figure 5 is  the PMO model that illustrates how these systems interrelate in an agency’s  overall systems architecture.
OMB Circular No. A-127 requires agencies to purchase commercial off-the- shelf (COTS) software that has been tested and certified through the PMO  software certification process when acquiring core financial systems.   PMO’s certification process, however, does not eliminate or significantly  reduce the need for agencies to develop and conduct comprehensive  testing efforts to ensure that the COTS software meets their requirements.   Moreover, according to PMO, core financial systems certification does not  mean that agencies that install these packages will have financial  management systems that are compliant with the Federal Financial  Management Improvement Act (FFMIA) of 1996.  Many other factors can  affect the capability of the systems to comply with FFMIA, including  modifications made to the PMO-certified core financial management  systems software and the validity and completeness of data from feeder  systems.
section_title: Federal Accounting Standards
paragraphs: The Federal Accounting Standards Advisory Board (FASAB) promulgates  federal accounting standards that agency CFOs use in developing financial  management systems and preparing financial statements.  FASAB develops  the appropriate accounting standards after considering the financial and  budgetary information needs of the Congress, executive agencies, and  other users of federal financial information and comments from the public.   FASAB forwards the standards to the three Sponsors—the Comptroller  General, the Secretary of the Treasury, and the Director of OMB—for a 90- day review.  If there are no objections during the review period, the  standards are considered final and FASAB publishes them on its Web site  and in print.
The American Institute of Certified Public Accountants has recognized the  federal accounting standards promulgated by FASAB as generally accepted  accounting principles for the federal government.  This recognition  enhances the acceptability of the standards, which form the foundation for  preparing consistent and meaningful financial statements both for  individual agencies and the government as a whole.  Currently, there are 25  Statements of Federal Financial Accounting Standards (SFFAS) and 4  Statements of Federal Financial Accounting Concepts (SFFAC).  The  concepts and standards are the basis for OMB’s guidance to agencies on the  form and content of their financial statements and for the government’s  consolidated financial statements.  Appendix III lists the concepts,  standards, and interpretations along with their respective effective dates.
FASAB’s Accounting and Auditing Policy Committee (AAPC) assists in  resolving issues related to the implementation of accounting standards.   AAPC’s efforts result in guidance for preparers and auditors of federal  financial statements in connection with implementation of accounting  standards and the reporting and auditing requirements contained in OMB’s  Form and Content of Agency’s Financial Statements Bulletin and Audit  Requirements for Federal Financial Statements Bulletin.  To date, AAPC  has issued six technical releases, which are listed in appendix IV along with  their release dates.
section_title: U.S. Government Standard General Ledger
paragraphs: The U.S. Government Standard General Ledger (SGL) was established by  an interagency task force under the direction of OMB and mandated for use  by agencies in OMB and Department of the Treasury regulations in 1986.   The SGL promotes consistency in financial transaction processing and  reporting by providing a uniform chart of accounts and pro forma  transactions used to standardize federal agencies’ financial information  accumulation and processing throughout the year; enhance financial  control; and support budget and external reporting, including financial  statement preparation.  For example, agency use of the SGL accounts and  OMB’s new intergovernmental business rules for standardizing  intragovernmental activity and balances are key to removing one of the  material weaknesses that GAO has reported on the governmentwide  consolidated statements since fiscal year 1997.  The SGL is intended to  improve data stewardship throughout the federal government, enabling  consistent reporting at all levels within the agencies and providing  comparable data and financial analysis governmentwide.
section_title: Internal Control Standards
paragraphs: The Congress enacted legislation, 31 U.S.C. 3512(c),(d) (commonly  referred to as the Federal Managers’ Financial Integrity Act of 1982 (FIA)),  to strengthen internal controls and accounting systems throughout the  federal government, among other purposes.  Issued pursuant to FIA, the  Comptroller General’s Standards for Internal Control in the Federal  Government provides standards directed at helping agency managers  implement effective internal control, an integral part of improving financial  management systems.  Internal control is a major part of managing an  organization and comprises the plans, methods, and procedures used to  meet missions, goals, and objectives.  In summary, internal control, which  under OMB’s guidance for FIA is synonymous with management control,  helps government program managers achieve desired results through  effective stewardship of public resources.
Effective internal control also helps in managing change to cope with  shifting environments and evolving demands and priorities.  As programs  change and agencies strive to improve operational processes and  implement new technological developments, management must  continually assess and evaluate its internal control to ensure that the  control objectives are being achieved.
section_title: Publications in the Federal Financial Management Systems Requirements Series
section_title: Statements of Federal Financial Accounting Concepts, Statements of Federal Financial Accounting Standards, and Interpretations
paragraphs: SFFAC No. 1 Objectives of Federal Financial Reporting SFFAC No. 2 Entity and Display SFFAC No. 3 Management’s Discussion and Analysis SFFAC No. 4 Intended Audience and Qualitative Characteristics for the  Consolidated Financial Report of the United States Government  SFFAS No. 1 Accounting for Selected Assets and Liabilities SFFAS No. 2 Accounting for Direct Loans and Loan Guarantees SFFAS No. 3 Accounting for Inventory and Related Property SFFAS No. 4 Managerial Cost Accounting Concepts and Standards SFFAS No. 5 Accounting for Liabilities of the Federal Government SFFAS No. 6 Accounting for Property, Plant, and Equipment SFFAS No. 7 Accounting for Revenue and Other Financing Sources SFFAS No. 8 Supplementary Stewardship Reporting SFFAS No. 9 Deferral of the Effective Date of Managerial Cost  Accounting Standards for the Federal Government in SFFAS No. 4 SFFAS No. 10 Accounting for Internal Use Software SFFAS No. 11 Amendments to Accounting for Property, Plant, and  Equipment—Definitional Changes SFFAS No. 12 Recognition of Contingent Liabilities Arising from  Litigation:  An Amendment of SFFAS No. 5, Accounting for Liabilities of  the Federal Government SFFAS No. 13 Deferral of Paragraph 65-2—Material Revenue-Related  Transactions Disclosures SFFAS No. 14 Amendments to Deferred Maintenance Reporting SFFAS No. 15 Management’s Discussion and Analysis SFFAS No. 16 Amendments to Accounting for Property, Plant, and  Equipment SFFAS No. 17 Accounting for Social Insurance SFFAS No. 18 Amendments to Accounting Standards for Direct Loans  and Loan Guarantees in SFFAS No. 2 SFFAS No. 19 Technical Amendments to Accounting Standards for Direct  Loans and Loan Guarantees in SFFAS No. 2 SFFAS No. 20 Elimination of Certain Disclosures Related to Tax  Revenue Transactions by the Internal Revenue Service, Customs, and  Others 2001 (Continued From Previous Page)
section_title: AAPC Technical Releases
paragraphs: TR-1 Audit Legal Letter Guidance TR-3 Preparing and Auditing Direct Loan and Loan Guarantee  Subsidies Under the Federal Credit Reform Act TR-4 Reporting on Non-Valued Seized and Forfeited Property TR-5 Implementation Guidance on SFFAS No. 10:  Accounting for  Internal Use Software TR-6 Preparing Estimates for Direct Loan and Loan Guarantee  Subsidies Under the Federal Credit Reform Act (Amendments to TR-3)
section_title: Checklists for Reviewing Systems under the Federal Financial Management Improvement Act
paragraphs: GAO/AIMD-00-21.2.3  Human Resources and Payroll Systems  Requirements  GAO-01-99G Seized Property and Forfeited Assets Systems  Requirements  GAO/AIMD-21.2.6  Direct Loan System Requirements  GAO/AIMD-99-21.2.9  System Requirements for Managerial Cost  Accounting              GAO-01-371G Guaranteed Loan System Requirements  GAO-01-911G Grant Financial System Requirements  GAO-02-171G Property Management Systems Requirements  GAO-04-650G Acquisition/Financial Systems Interface  Requirements GAO-04-763G Core Financial System Requirements (Exposure  Draft)
section_title: Comments from the Office of Management and Budget
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Acknowledgments
paragraphs: In addition to those named above, Alberto Garza, Lisa M. Knight, Michael S.  LaForge, W. Stephen Lowrey, Gina K. Ross, Sandra S. Silzer, and Bryan D.  Weisbard made key contributions to this report.
section_title: GAO’s Mission
paragraphs: The Government Accountability Office, the audit, evaluation and  investigative arm of Congress, exists to support Congress in meeting its  constitutional responsibilities and to help improve the performance and  accountability of the federal government for the American people. GAO  examines the use of public funds; evaluates federal programs and policies;  and provides analyses, recommendations, and other assistance to help  Congress make informed oversight, policy, and funding decisions. GAO’s  commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost  is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts  newly released reports, testimony, and correspondence on its Web site. To  have GAO e-mail you a list of newly posted products every afternoon, go to  www.gao.gov and select “Subscribe to Updates.”
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Congressional Relations
section_title: Public Affairs