DOD Financial Management: Additional Efforts Needed to Improve Audit Readiness of Navy Military Pay and Other Related Activities
Published: 2015-09-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: DOD continues to work toward achieving auditability of its financial statements. As part of that effort, the Navy in March 2013 asserted audit readiness of its military payroll activity, which represents a significant portion of its expenditures. Based on its examination, an IPA found that the Navy's assertion, which focused in part on a 1-month schedule of military pay activity, was fairly stated.
GAO was asked to assess the Navy's military pay audit readiness efforts. This report examines the extent to which (1) the Navy was able to provide sufficient documentation to support a complete and valid population of detailed transactions reconcilable to its schedule of military pay activity for April 2013 and (2) the Navy's military pay assertion and validation efforts contribute to future audit readiness. GAO reviewed the IPA's audit documentation and analyzed documentation that the Navy provided to the IPA; reviewed documentation on identified military pay control deficiencies and the status of the Navy's actions to address them; and interviewed Navy, IPA, and DFAS officials.
section_title: What GAO Found
paragraphs: Based on documentation provided by the Navy and the results of audit procedures, an independent public accountant (IPA) concluded that information reported on the Navy's schedule of military pay activity for April 2013 reconciled to a complete population of pay transactions that were adequately supported and valid. GAO reviewed the Navy's documentation and the IPA's related audit documentation. Nothing came to GAO's attention that raised concerns regarding the adequacy of the Navy's documentation beyond those the IPA identified and determined to be immaterial.
Both the IPA's examination and the Navy's assertion and validation efforts identified additional risks to the Navy's future audit readiness. For example, the IPA found that 14 of 34 military pay controls it examined were either not designed effectively or not operating effectively. Further, the Navy limited the scope of the IPA's examination to focus on 1 month of activity to address any deficiencies identified prior to the audit of its fiscal year 2015 Statement of Budgetary Activity, which is currently under way. However, because of the volume of transactions during a 12-month period, obtaining supporting documentation may be more challenging than supporting transactions limited to a 1-month period. In addition, the Navy identified extensive deficiencies in six personnel and other key systems it relies on to process and report military pay activity. Navy officials acknowledge that additional efforts are needed to fully address these deficiencies. Questions also exist regarding the audit readiness of certain related activities beyond the scope of the Navy's military pay activities—such as financial reporting controls related to reconciling the Navy's Fund Balance with Treasury—because of extensive deficiencies or because they have not been independently examined. Achieving audit readiness also requires coordination with the IPA, the Department of Defense (DOD) Office of Inspector General, and service providers; however, the Navy did not always effectively coordinate these activities. For example, GAO found that the Navy did not (1) establish milestones to assess the effectiveness of certain of its controls associated with payroll services provided by the Defense Finance and Accounting Service (DFAS) and (2) effectively coordinate efforts to ensure that the required management representation letter was provided to the IPA in a timely manner.
The audit of the Navy's fiscal year 2015 Schedule of Budgetary Activity, of which military pay activity represents a significant portion of reported obligations and outlays, is intended to help identify areas for additional focus, and facilitate efforts to achieve DOD's goal of financial statement auditability department-wide by September 30, 2017. However, without reliable controls and systems, auditors will likely need to perform additional, more costly procedures to obtain assurance in future audits, and the reliability of financial information for day-to-day decision making will remain at risk. GAO continues to stress the importance of addressing fundamental systems and control deficiencies, which will lead to lasting financial management improvements and, as a result, provide greater assurance of future audit readiness.
section_title: What GAO Recommends
paragraphs: GAO recommends that the Navy establish (1) milestones for assessing and implementing certain controls associated with payroll services provided by DFAS and (2) a policy to coordinate with auditors on providing required management representation letters in a timely manner. The Navy agreed with GAO's recommendations and described actions taken or under way to address them.

section_title: Letter
paragraphs: The U.S. Navy is the second largest reporting entity within the  Department of Defense (DOD), accounting for about $167 billion, or about  19 percent of DOD’s total reported expenditures for fiscal year 2014, and  military pay, totaling $29 billion in fiscal year 2015 appropriations,  represents a significant portion of the Navy’s expenditures. Since 1995,  GAO has designated DOD financial management as high risk because of  pervasive weaknesses in its financial and business management  systems, as well as control deficiencies that have adversely affected its  ability to (1) control costs; (2) ensure basic accountability; (3) anticipate  future costs and claims on the budget; (4) measure performance;   (5) maintain funds control; (6) prevent and detect fraud, waste, and  abuse; (7) address pressing management issues; and (8) prepare  auditable financial statements. As part of DOD’s ongoing financial  management reform efforts, in March 2013, the Navy asserted audit  readiness of its military payroll activity. An independent public  accountant (IPA) performed a validation examination of the Navy’s  assertion; the IPA’s work focused, in part, on a 1-month schedule of  military pay activity for April 2013. The IPA reported that in its opinion the  Navy’s assertion was fairly stated.
In 2012, we reported that the U.S. Army could not readily provide a  complete and valid population of its active duty military payroll and lacked  supporting documentation for its military pay activity. Because the Navy  uses a similar pay system and has numerous systems for pay-related  data, you asked us to assess whether the Navy is effectively addressing  audit readiness issues similar to those experienced by the Army. This  report examines the extent to which (1) the Navy was able to provide  sufficient documentation to support a complete and valid population of  detailed transactions reconcilable to its schedule of military pay activity for  April 2013 and (2) the Navy’s military pay assertion and validation efforts,  which include the IPA’s examination, contribute to future audit readiness.  To address our objectives, we reviewed the IPA’s audit documentation  and analyzed the documentation that the Navy provided to the IPA to  assess the sufficiency of evidence to support the completeness and  validity of transactions on its 1-month schedule of military pay activity for  April 2013. We reviewed documentation on identified military pay control  deficiencies, the status of the Navy’s actions to address those  deficiencies, and audit readiness efforts of other assessable units  involving military pay-related activity. We also interviewed Navy, IPA, and  Defense Finance and Accounting Service (DFAS) officials to obtain  explanations and clarifications on documentation we reviewed.
Further information on our scope and methodology is provided in  appendix I. We conducted this performance audit from April 2014 to  September 2015 in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: DOD has been unable to prepare auditable information for department- wide financial statements as required by the Government Management  Reform Act of 1994. The National Defense Authorization Act (NDAA) for  Fiscal Year 2010 requires that DOD develop and maintain the Financial  Improvement and Audit Readiness (FIAR) Plan, which includes, among  other things, the specific actions to be taken and costs associated with   (1) correcting the financial management deficiencies that impair DOD’s  ability to prepare timely, reliable, and complete financial management  information and (2) ensuring that DOD’s financial statements are  validated as ready for audit by September 30, 2017. The NDAA for  Fiscal Year 2013 required that the FIAR Plan state the specific actions to  be taken and the costs associated with validating the audit readiness of  DOD’s Statement of Budgetary Resources (SBR) no later than  September 30, 2014. However, DOD acknowledged in its November  2014 FIAR Plan Status Report that it did not meet this date and, in  response to difficulties in preparing for an SBR audit, reduced the scope  of initial audits to focus only on current year budget activity to be reported  on a Schedule of Budgetary Activity beginning in fiscal year 2015. This is  an interim step toward achieving the audit of multiple-year budget activity  required for an audit of the SBR.
We have previously reported our concerns regarding DOD’s emphasis on  asserting audit readiness by a certain date rather than ensuring that  effective processes, systems, and controls are in place to improve  financial management information for day-to-day decision making.  Further, according to its May 2015 FIAR Plan Status Report, DOD  acknowledged that even though military departments have asserted  Schedule of Budgetary Activity audit readiness, they are continuing to  strengthen controls and take other steps to improve their readiness. The  report also indicated that although DOD does not expect to receive  unmodified (“clean”) opinions during the initial years, it determined that it  is important to proceed with the audits as a means of uncovering any  other remaining challenges.
In August 2014, the Navy asserted audit readiness for its fiscal year 2015  Schedule of Budgetary Activity. Military pay activity represents a  significant portion of obligations and outlays reported on the Navy’s  Schedule of Budgetary Activity and SBR. In addition to military pay, the  Navy’s Schedule of Budgetary Activity and SBR will include financial  activity and balances associated with other business processes, such as  civilian pay, contract pay, and reimbursable work orders.
subsections: section_title: Navy Military Pay Audit Readiness
paragraphs: The Navy’s mission is to maintain, train, and equip combat-ready naval  forces capable of winning wars, deterring aggression, and maintaining  freedom of the seas. In February 2015, the Navy reported that it had  about 326,000 active and 58,000 reserve servicemembers. For fiscal year  2015, Congress appropriated approximately $29 billion for Navy military  pay for active and reserve servicemembers and other personnel-related  costs. Appropriations for Navy and Navy Reserve personnel are 1-year  appropriations available for pay, benefits, incentives, allowances,  housing, subsistence, and travel primarily for Navy servicemembers.
DOD’s FIAR Guidance sets forth the goals, priorities, strategy, and  methodology for the Navy (as well as other DOD reporting entities and  service providers) to become audit ready. Based on the FIAR Guidance,  the Navy has established separate assessable units for military pay and  other business processes representing significant portions of budgetary  resources and financial activity (e.g., obligations and outlays) reported in  its SBR to help focus efforts to achieve audit readiness. Key  stakeholders within the Navy with military audit readiness responsibilities  include the Office of Financial Operations and the Bureau of Naval  Personnel.
In March 2013, the Navy asserted audit readiness of its military pay  assessable unit based on its determination that sufficient evidence  existed and certain controls were operating effectively to meet specified  financial reporting objectives. According to its assertion, the Navy placed  additional reliance on testing of supporting documentation to meet  financial reporting objectives in instances where controls were not  operating effectively. In addition, based on limited tests performed prior to  its assertion, the Navy identified extensive control deficiencies associated  with certain key systems. For purposes of asserting audit readiness, the  Navy determined that risks associated with these deficiencies were  mitigated based on the results of substantive tests, reconciliations, and  other tests performed in connection with its assertion efforts. Accordingly,  the Navy excluded assessment of these systems from the scope of its  IPA’s examination.
An IPA performed a validation examination of the Navy’s assertion and  reported in January 2015 that, in its opinion, the Navy’s assertion was  fairly stated. As specified in its contract with the Navy, the IPA was  required to perform an audit readiness validation examination to  determine (1) if adequate supporting documentation exists to address all  relevant financial statement assertions for all material transactions and  account balances reflected on the Navy’s schedule of military pay for April  2013 and (2) if business processes and internal control activities are  designed and operating effectively to limit the risk of material  misstatement of the financial statements by meeting applicable financial  reporting objectives. With regard to the Navy’s internal controls, the IPA  assessed 34 controls supporting the Navy’s assertion and determined  that, although certain controls for each financial reporting objective were  effective, 14 controls associated with these objectives were either not  designed effectively or not operating effectively. As a result, the IPA relied  primarily on substantive tests to assess whether amounts reported on the  Navy’s schedule of military pay activity for April 2013 were adequately  supported by sufficient evidence.
The Navy’s schedule of military pay activity for April 2013 reflected  obligations of $2.25 billion and outlays of $2.19 billion associated with  activities included in the scope of the Navy’s assertion; these obligations  and outlays were recorded in the Navy’s general ledger and included  activity related to basic pay and entitlements for allowances for officers,  enlisted personnel, and midshipmen, as well as certain other military  personnel costs. The schedule of military pay activity included  obligations associated with servicemembers’ gross pay and related  payroll taxes and associated outlays disbursed in April 2013. Obligations  for reserve servicemembers’ pay and related payroll taxes are recorded in  the month payroll is processed, while outlays are recorded in the month  they are paid. In contrast, obligations and outlays for active  servicemembers’ pay are recorded in different months based on when  each payroll is processed and when related outlays occur, as shown in  figure 1.
The Navy also relies on service providers to ensure the audit readiness of  service provider systems and business processes that support services  provided to the Navy and affect its Statement of Budgetary Activity and  SBR. For example, the DFAS office in Cleveland, Ohio, is responsible  for computing the Navy’s military payroll using the Defense Joint Military  Pay System-Active Component (DJMS-AC) and the Defense Joint Military  Pay System-Reserve Component (DJMS-RC) for active and reserve  servicemembers, respectively. In addition, DFAS provides significant  financial reporting, disbursement, and other services to the Navy in  support of the Navy’s efforts to meet essential financial management  responsibilities. The Navy also relies on a variety of personnel,  accounting, disbursing, and budgeting systems to process and report its  military payroll, as shown in figure 2.
In addition to military pay, the Navy also recorded $225 million of  obligations and related outlays in April 2013 for other activities associated  with its military personnel appropriations, including items such as certain  uniform allowances, subsistence-in-kind, permanent change of station  travel, and personnel-related reimbursable work orders. The scope of the  Navy’s assertion excluded these activities as well as certain other  processes involved in processing or reporting military pay financial activity  or balances, including fund balance with the U.S. Department of the  Treasury (Treasury); funds receipt and distribution; and certain financial  reporting-related journal vouchers, adjustments, and beginning  balances. According to Navy officials, readiness efforts associated with  these areas were either included in the scope of other assessable units or  will be assessed as part of the Navy’s fiscal year Schedule of Budgetary  Activity audit.
section_title: The IPA Determined That the Navy Provided Sufficient Documentation to Support the Navy’s Schedule of Military Pay Activity for April 2013
paragraphs: Based on documentation provided by the Navy and the results of the  IPA’s audit procedures, the IPA concluded that information reported on  the Navy’s schedule of military pay activity for April 2013 (April 2013  schedule) reconciled to a complete and valid population of transactions.  The IPA identified a total projected error of $6.8 million, which it  determined to be immaterial. We reviewed selected IPA audit  documentation and selected documentation provided by the Navy, and  nothing came to our attention that raised concerns beyond those  identified by the IPA regarding the adequacy of the Navy’s documentation  supporting the completeness and validity of the population of transactions  reflected on its April 2013 schedule.
subsections: section_title: The IPA Determined That the Navy Provided Sufficient Documentation to Support Reconciliations of Reported Activity to a Complete Population of Transactions
paragraphs: The IPA concluded that the Navy provided sufficient documentation to  support that amounts reported in the April 2013 schedule reconciled to a  complete population of military pay transactions. The GAO/President’s  Council on Integrity and Efficiency Financial Audit Manual (FAM) and  FIAR Guidance recognize the importance of comparing and reconciling  data produced by various systems and processes with reported amounts  to provide assurance on the completeness of populations of transactions  supporting them. The IPA’s determination was based on Navy-provided  documentation supporting the Navy’s reconciliation of personnel and  payroll data as well as documentation supporting other reconciliations  independently performed by the IPA. Key reconciliations supporting the  IPA’s conclusion are summarized below:
Personnel and payroll reconciliation. The Navy compared Social  Security numbers of servicemembers in the Navy personnel systems  to Social Security numbers of servicemembers in the Navy payroll  systems and identified, documented, and resolved differences  between the systems to provide assurance that payroll amounts were  disbursed to valid personnel.
Payroll and general ledger reconciliation. Although the Navy  performs monthly reconciliations of payroll and general ledger activity,  the IPA performed an independent reconciliation that compared  obligations and outlays in the Navy payroll systems to the obligations  and outlays recorded in the Navy general ledger system and  accounted for any significant disparities between data from these  systems and the obligation and outlay amounts reported in the April  2013 schedule to provide assurance that the reported amounts were  complete and reasonably stated.
Disbursements reconciliation. The IPA independently compared  disbursements from the Defense Cash Accountability System to  outlays on the April 2013 schedule and to documentation supporting  significant reconciling items to help ensure that reported  disbursements were complete and reasonably stated. According to  the IPA, the Navy performs similar reconciliations each month.
To assess the reliability of the documentation, the IPA performed walk- throughs of key processes, made inquiries of Navy personnel, and  analyzed the documentation provided. In addition, the IPA considered the  results of its tests of the Navy’s controls for reconciling military pay  activity each month, as discussed further below. Based on its evaluation  of these reconciliations and documentation provided by the Navy, the IPA  concluded that the Navy’s population of military pay transactions was  complete. We reviewed the results of the IPA procedures to assess these  reconciliations; re-performed selected procedures, such as tracing  selected amounts to supporting documentation and performing  recalculations; and assessed the appropriateness of the reconciling  items. Based on our review, nothing came to our attention that raised  concerns regarding the adequacy of the Navy’s documentation supporting  the completeness of the population of transactions reflected on its April  2013 schedule.
section_title: The IPA Determined That Military Pay Transactions Were Adequately Supported by Navy Documentation
paragraphs: The IPA determined that the Navy provided sufficient documentation to  support the accuracy and validity of selected basic pay and entitlement  transactions the IPA tested. The IPA tested a statistical sample of 405  leave and earnings statements from the $1.8 billion of outlays associated  with basic pay and entitlements reflected on the April 2013 schedule.  The Navy provided more than 3,000 documents to support the sampled  leave and earnings statements, such as orders, promotion messages,  enlistment documents, and discharge documents. The IPA’s evaluation of  sample item tests resulted in a projected total error of $6.8 million, and  based on its determination of tolerable misstatement and materiality, the  IPA concluded that the estimate of errors was immaterial. In addition,  the IPA performed analytical procedures to test $400 million of activity  reflected in the Navy’s April 2013 schedule, representing the portion of  Federal Insurance Contributions Act (FICA) taxes and military retirement  contributions for servicemembers. The IPA compared reported amounts  to an estimate determined by multiplying basic pay included in the April  2013 schedule by applicable mandated rates and concluded that the  reported amounts were reasonable.
We reviewed the results of the IPA’s tests of military pay transactions and  re-performed selected procedures to assess the reasonableness of the  IPA’s conclusions. For example, we reviewed the IPA’s sampling  methodology and related error projection. We also re-performed tests  performed by the IPA for a nongeneralizable random sample of 21 (5  percent) of its 405 leave and earnings statement sample items, such as  recalculating payment amounts and reviewing documentation provided by  the Navy to assess whether transactions were adequately supported. We  also re-performed the IPA’s analytical procedures related to the Navy’s  portion of FICA taxes and the military retirement contributions and  reviewed the IPA’s related conclusions. Based on our review, nothing  came to our attention that raised concerns regarding the adequacy of the  Navy’s documentation supporting military pay transactions reflected in its  April 2013 schedule beyond those identified by the IPA.
section_title: The Navy’s Military Pay Assertion and Validation Efforts Identified Risks to Future Audit Readiness
paragraphs: While the IPA determined that the Navy provided sufficient documentation  to support its April 2013 schedule, the IPA also assessed the  effectiveness of 34 internal controls supporting the Navy’s assertion and  determined that 14 were either not designed effectively or not operating  effectively. Effective internal controls and financial systems are essential  for ensuring sound financial management and achieving sustainable  financial statement auditability. However, deficiencies in military pay  controls and selected systems identified through the Navy’s assertion and  validation efforts, including the IPA’s examination, if not effectively  addressed, present additional risks that could hamper the Navy’s ability to  ensure future auditability. Further, the audit readiness of certain activities  beyond the scope of these efforts—such as financial reporting and other  business processes—remains uncertain. We also found that the Navy’s  efforts to coordinate with key stakeholders and service providers  responsible for performing important audit readiness tasks were not  always effective.
subsections: section_title: Deficiencies in Military Pay Internal Controls Could Hamper Future Auditability
paragraphs: In connection with its audit readiness efforts, the Navy identified 34  control activities intended to reasonably assure the achievement of  important financial reporting objectives, such as ensuring that military pay  amounts do not exceed funding authority, obligations and disbursements  are properly approved and recorded, and payroll is calculated and  processed correctly. Based on its tests of these controls, the IPA  determined that although certain controls associated with each of the  Navy’s military pay-related financial reporting objectives were effective,  14 controls associated with these objectives were either not designed  effectively or not operating effectively. The Navy generally concurred with  the IPA’s conclusions. Examples of controls the IPA determined were  effectively operating included the following:  the Navy monitors personnel to ensure that they are reporting for duty  as assigned,  the Navy reconciles military pay obligations and outlays among its  various systems each month,  the Navy records a monthly adjustment for pay earned in one month  but disbursed in subsequent months, and  the Navy monitors military pay obligation amounts to verify it does not  exceed funding authority.
In contrast, examples of ineffectively operating controls as determined by  the IPA included the following:  the Navy did not consistently perform supervisory review of data entry  of personnel transactions for accuracy and timeliness before updating  the pay system, increasing the risk of misstatements in payroll  amounts for service members, and  the Navy did not adequately perform the triannual review of dormant  unliquidated obligations for timeliness, accuracy, and completeness,  and as a result, over $5 million associated with these transactions  was not deobligated in a timely manner.
According to the Navy, as of March 2015, its actions have addressed the  IPA-identified deficiencies in the design of military pay controls as well as  four of six corrective action plans intended to address deficiencies in the  operating effectiveness of controls. Navy documentation on the status of  corrective actions at that time indicated that efforts to address remaining  deficiencies were expected to be completed by April 2015. However, the  effectiveness of actions taken has not been fully verified by the Navy or  independently assessed by an IPA or the DOD Office of Inspector  General (OIG). As a result, the extent to which these actions have, or will,  resolve underlying causes of the issues identified is unclear. According to  Navy officials, the Navy is currently undergoing an IPA audit of its fiscal  year 2015 Schedule of Budgetary Activity and expects the results of this  audit will provide feedback on the effectiveness of the actions taken.
The IPA also reported additional deficiencies in a separate management  report resulting from its detailed tests of servicemembers’ leave and  earnings statements. Examples of these deficiencies included the  following.
The Navy’s document retention policies are inadequate in that certain  personnel action documentation is required to be retained for only 1  year. As a result, the Navy was unable to provide adequate  documentation supporting selected members’ rank or other  qualifications affecting pay.
A servicemember received duplicate pay for 2-1/2 months because  Navy personnel processed a transaction to correct a previous  incorrectly processed transaction to extend his service end date that  also erroneously created a system-generated debt owed by the  servicemember to the Navy. Navy officials indicated that the  correcting entry had to be processed in this manner because of a  DJMS limitation.
A member with over 3 years of service was incorrectly paid at a lower  rate associated with over 2 years of service because of a lack of  payroll system controls to prevent such errors.
The Navy established nine corrective action plans to address these  additional deficiencies, and Navy documentation on the status of  corrective actions as of March 2015 indicated that steps for seven of  these plans had been completed, and remaining actions were expected to  be completed by June 2015. However, the Navy’s ability to fully resolve  these findings in the short term was not always clear. For example,  although the Navy developed functional requirements for a new system to  help address identified document retention issues, it had not yet  determined the timeline associated with developing and implementing this  system. Until these deficiencies are fully resolved, the Navy will continue  to face risks that could affect its ability to achieve future financial  statement auditability.
section_title: Deficiencies in Selected Military Payroll Financial Systems Raise Additional Audit Readiness Concerns
paragraphs: Effective information system controls are also essential for ensuring the  integrity of information contained in and processed by these systems.  For example, the Navy’s personnel systems contain rank information and  other key data used to determine entitlements (e.g., basic pay and  allowances) and process servicemembers’ pay. As part of its audit  readiness assertion efforts, the Navy performed internal assessments of  six key military payroll financial systems using the Federal Information  System Controls Audit Manual and initially identified over 500 control  deficiencies. As a result, the Navy excluded assessments of these  systems from the scope of the IPA’s examination. These deficiencies  involved multiple types of controls—such as access, interface, and  business process controls—increasing the risk that financial activity may  not be properly processed, recorded, or secured. For example, without  effective access controls, unauthorized individuals can make undetected  changes or deletions to data and authorized users can intentionally or  unintentionally read, add, delete, or modify data or can execute changes  outside their span of authority. Also, without effective interface controls,  inaccurate or incomplete data may be shared among related systems,  such as those used to process and record military payroll activity.  Similarly, business process application controls are important for ensuring  the completeness, accuracy, validity, and confidentiality of transaction  data input, processing, and output.
According to briefing slides from the Navy’s November 2014 information  technology update presentation, challenges affecting the audit readiness  of key systems include a lack of guidance across all systems; deficiencies  in high-risk areas, such as interface control, access controls, and  configuration management; and staff and resource limitations. According  to this update, financial systems-related deficiencies ultimately degrade  the integrity and auditability of those systems and may result in an  increased effort on the part of the Navy to substantiate its activity and  balances. Further, the Navy also acknowledged that ineffective  information system controls could result in auditors needing to perform  additional substantive tests and review more documentation to gain  assurance on reported amounts rather than relying on effective controls.
According to documentation on the status of corrective actions provided  in February 2015, the Navy established 81 corrective action plans to  address control deficiencies identified for the six military pay financial  systems it assessed. Further, this documentation indicated that 23  corrective action plans had been completed. However, efforts to address  remaining deficiencies for two of these systems are not expected to be  completed until September 2015, and the Navy has not determined when  certain access controls for one system will be resolved. Navy officials also  stated that the Navy has not completed internal assessments to evaluate  the effectiveness of actions taken thus far and that it plans to assess  additional controls associated with these systems in the future. Until the  Navy has assurance regarding the effectiveness of key financial system  controls, it will continue to face risks that could affect its ability to ensure  future financial statement auditability.
section_title: The Navy’s Military Pay Assertion and Related IPA Examination Covered Limited Activity
paragraphs: According to its assertion, the Navy plans to prepare a schedule of  military pay activity in support of its fiscal year 2015 Schedule of  Budgetary Activity audit. However, because the Navy limited the scope of  the IPA examination to focus on a 1-month schedule of activity, its ability  to achieve auditability of a full year of activity, as required in future  Schedules of Budgetary Activity and SBRs, was not fully assessed.  Rather than extending the period of activity to a longer period of time to  more closely approximate future audits of Schedules of Budgetary  Activity, Navy officials told us that they limited the scope to 1 month to  provide the time necessary to address any deficiencies that might be  identified by the IPA prior to the fiscal year 2015 Schedule of Budgetary  Activity examination, which began in December 2014. However,  according to a FIAR Directorate official, assertion examinations should  generally cover at least a 3-month period and would provide a greater  level of audit readiness assurance than an examination focused on a 1- month period of activity. Further, because of the volume of transactions  during a 12-month period of activity, obtaining supporting documentation  may be more challenging than supporting transactions limited to a 1- month period of time. Accordingly, the Navy may be at risk concerning its  ability to provide documentation supporting transactions included in the  scope of future Statement of Budgetary Activity and SBR audits that  cover a full year of activity.
In addition, preparing Schedules of Budgetary Activity or SBRs that  contain military pay balances and activity—as well as other amounts  associated with Military Personnel appropriations—involves other  processes not included in the scope of the Navy’s military pay assertion  and related IPA examination. For example, preparing financial statements  involves additional financial reporting processes, such as reconciling the  Navy’s Fund Balance with Treasury, performing funds receipt and  distribution activities, and recording certain journal vouchers. However,  the Navy’s assurance regarding the audit readiness of these other key  processes is limited. For example, although the Navy asserted the audit  readiness of its Fund Balance with Treasury reconciliation process in April  2013, the DOD OIG reported that the Navy’s process did not provide  reasonable assurance to support the accuracy, timeliness, and  completeness of the account’s auditability. The DOD OIG identified  issues affecting the Navy’s audit readiness, including the lack of detailed  support for amounts used in reconciling Navy’s Fund Balance with  Treasury account with Treasury’s accounts and significant information  system control deficiencies.
Additionally, the Navy has not asserted or undergone an examination for  processes specifically related to the audit readiness of its financial  statement and compilation activities. In December 2014, the Navy  reported extensive deficiencies in controls associated with these  activities. For example, key reconciliations were not always adequately  performed or documented to identify and resolve differences between  balances recorded in the Navy’s general ledger system and other Navy  financial systems and balances recorded in the Defense Departmental  Reporting System (DDRS). Further, amounts in DDRS are adjusted to  resolve out-of-balance amounts imported from the Navy’s systems  through the creation of journal vouchers without transaction-level  documentation to support them. Although the Navy indicated that  corrective action plans have been established to address these  deficiencies, it could not provide us with information on when efforts to  resolve them were expected to be completed.
In addition, according to its military pay reconciliations, the Navy incurred  obligations of $225 million in April 2013 associated with its military  personnel appropriations that were excluded from its military pay  assessable unit. Approximately $203 million, or 90 percent, of these  obligations were associated with three types of activity: permanent  change of station travel ($104 million), supply-related requisitions   ($52 million), and reimbursable work orders ($47 million). However,  independent examinations to assess these activities have not been  performed or have identified significant concerns about the audit  readiness of such activities. Specifically, Navy officials stated that  permanent change of station travel was not addressed in other audit  readiness assertions or IPA examinations and, as a result, will be tested  during the Navy’s fiscal year 2015 Schedule of Budgetary Activity audit. In  addition, although the Navy asserted audit readiness of its supply  requisition-related activity in December 2013, officials indicated that a  separate independent examination to validate this assertion will not be  performed. Further, in April 2013, the Navy asserted that its reimbursable  work orders assessable unit was audit ready. However, an IPA reported  in January 2015 that the Navy’s schedules of reimbursable work order  activity examined by the IPA were materially misstated because the Navy  was unable to isolate reimbursable work order transactions from the rest  of its financial transactions.
section_title: Navy Coordination with the IPA, OIG, and DFAS Was Not Always Effective
subsections: section_title: Management Representation Letter
paragraphs: Although the IPA completed its fieldwork in September 2014, its  examination report was not issued until January 2015, in part because of  the lack of effective coordination between the Navy and the IPA to ensure  that adequate management representations were provided to the IPA in a  timely manner. Specifically, the Navy did not provide a signed  management representation letter consistent with auditing standards until  more than 3 months after the IPA requested it.
The FAM requires auditors to obtain representation letters from  appropriate management officials. In addition, auditing standards list the  specific representations that management must make, which include, for  example, management’s responsibility for providing to the auditor all  financial records and related data and its responsibility for disclosing to  the auditors any known or suspected fraud. Such representations are  considered part of the evidence supporting the auditor’s opinion and are  to be provided prior to issuing the examination report. Further, the DOD  Financial Management Regulation (FMR) requires responsible senior  managers to prepare and submit management representation letters to  auditors prior to the conclusion of audits and requires that the date of the  letter should generally be the issuance date of the audit report. The  DOD FMR further states that coordinating these dates is essential and  that active cooperation and interaction between auditors and  management is expected so that the management representation letter  reaches the auditors in a timely manner.
However, according to Navy officials, the Navy does not have a policy to  ensure that these requirements are met. Rather, it relied on its standard  process for the review and approval for official correspondence, which  requires a minimum of 21 days to complete. In addition, the lack of  effective coordination concerning the date of this letter contributed  significantly to the amount of time required to provide the IPA with  acceptable management representations. Specifically, although the IPA  provided a properly dated draft management representation letter (to  coincide with the end of its fieldwork on September 26, 2014), the Navy  incorrectly dated its letter November 19, 2014. After noting this  discrepancy, the IPA requested that the Navy revise the date on the letter  to September 26, 2014, as originally indicated on the draft letter provided  to the Navy. As shown in figure 3, this resulted in another delay, and a  total of over 3 months elapsed before the Navy provided an accurate,  signed management representation letter to the IPA.
Without a policy that addresses the need to effectively coordinate with  auditors concerning the dates of management representation letters and  when they need to be provided to the auditors, the Navy remains at risk  that appropriate management representations required for future audits  may not be provided in a timely manner. This in turn could delay the  issuance of the audit reports and hamper the Navy’s ability to submit  audited financial statements within required time frames.
section_title: Classified Payroll Transactions
paragraphs: Processes to obtain and assess classified documentation supporting  certain military pay transactions selected by the IPA for testing require  coordination between the IPA, the Navy, and the DOD OIG. However,  because of the lack of effective procedures for coordinating these efforts  and other factors, the IPA was unable to conclude on the accuracy and  validity of selected sample item transactions involving classified  supporting documentation totaling about $1,500. Specifically, the Navy  did not effectively coordinate with the IPA to identify sample leave and  earning statements requiring classified documentation support within a  time frame needed for the DOD OIG and the IPA to coordinate  appropriate security procedures to access and assess the documentation  at affected classified environments prior to the IPA’s cutoff date for  testing.
Navy officials acknowledged that challenges affecting the Navy’s ability to  obtain and assess such documentation could be a significant roadblock in  future audits. To address this issue, the Navy developed a corrective  action plan to establish an effective process for addressing audit  coordination of classified documentation and is working to develop new  procedures requiring budget submitting offices to coordinate with the  DOD OIG and the IPA to determine appropriate security procedures for  accessing and obtaining required documentation supporting military pay  transactions selected for testing.
section_title: Complementary Controls
paragraphs: DFAS processes military pay for the Navy and other DOD reporting  entities and has established control objectives and control activities to  provide reasonable assurance on the effectiveness of its military pay  operations. In addition, DFAS also identified certain complementary  controls that the Navy and other user entities—that is, those that use  DFAS’s services—should also establish to provide reasonable assurance  that control objectives are achieved. DOD’s FIAR Guidance requires that  user entities coordinate with service providers, such as DFAS, to  understand service provider user control assumptions and test those  controls to ensure that they are operating effectively.
The Navy linked many of the complementary controls identified by DFAS  to relevant Navy control activities; however, it determined that it was not  responsible for the effectiveness of certain complementary controls for  approving and monitoring Navy personnel access to the Defense Joint  Military Pay System (DJMS) because DFAS subsequently approves and  grants DJMS access and Navy personnel have “view only” access.  Although Navy personnel access to DJMS may be limited, “view only”  access enables users to see and produce documentation from DJMS  containing certain personally identifiable information associated with Navy  servicemembers. According to Navy officials, in making its determination,  the Navy had not considered how such access increases the risk of  unauthorized disclosure of such information or could potentially lead to its  use for unintended purposes. We shared these concerns with Navy  officials, and they agreed that additional efforts were needed to further  assess these risks and the need for complementary controls to address  them. They also indicated that considerations of these controls will be  incorporated into their strategy to work with relevant Navy and DFAS  stakeholders to assess the controls and develop and implement  corrective action plans to address any identified deficiencies. However,  the Navy had not established milestones or set a date for when these  efforts are expected to be completed.
section_title: Conclusions
paragraphs: As part of its examination of the Navy’s military pay audit readiness  assertion, the IPA determined that the Navy provided sufficient  documentation to support its schedule of military pay activity for April  2013. However, given the limited scope of the IPA’s examination— because of the Navy limiting the audit to 1 month of activity and excluding  key areas from the examination—questions concerning the Navy’s future  audit readiness remain. Although the Navy has taken steps to improve  military pay auditability, the extent to which it has effectively addressed  deficiencies associated with key controls and selected financial systems  identified through its assertion and validation efforts, including the IPA  examination, remains unclear. Without effective internal controls and  systems, auditors will likely be required to perform additional, more costly  procedures to obtain required assurance in future financial statement  audits, and the Navy’s ability to consistently produce timely, reliable  financial information will remain at risk. In addition, the Navy’s effective  coordination with the IPA, the DOD OIG, and service providers is  essential for achieving audit readiness. However, the Navy did not  effectively coordinate certain important tasks—such as providing its  management representation letter to the IPA in a timely manner and  assessing and implementing certain complementary controls identified by  DFAS—that could hamper its ability to meet this goal. An audit of the  Navy’s fiscal year 2015 Schedule of Budgetary Activity, for which military  pay activity represents a significant portion of obligations and outlays, is  currently under way and is expected to provide feedback on efforts  necessary to achieve DOD’s goal of financial statement auditability  department-wide by September 30, 2017. While this audit provides a  milestone for measuring progress, we continue to stress the importance  of addressing fundamental systems and control deficiencies, which will  lead to lasting financial management improvements and, as a result,  provide greater assurance of future audit readiness.
section_title: Recommendations for Executive Action
paragraphs: To help improve the Navy’s audit readiness efforts for future Statement of  Budgetary Activity audits, we are making the following two  recommendations.
We recommend that the Secretary of the Navy direct the Assistant  Secretary of the Navy (Financial Management and Comptroller) to establish a policy to coordinate with auditors concerning the dating of  management representation letters and when they need to be  provided to auditors in future audits consistent with DOD FMR  requirements and establish milestones for assessing and effectively implementing  certain complementary controls identified by DFAS to help the Navy  achieve its military pay-related control objectives.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Navy for review and comment. In  written comments, reprinted in appendix II, the Navy concurred with our  two recommendations and concurred that continued efforts are needed to  address identified findings and corrective actions. The Navy also  described actions it has taken or has under way in response to our  recommendations, including actions to ensure that management  representation letters are provided within required time frames and to  establish milestones to ensure that military pay-related control objectives  are strengthened.
In its comments, the Navy recommended a modification to the title of our  report to reflect the Navy’s ability to support its Schedule of Military Pay  Activity for April 2013 with complete populations and sufficient  documentation. In our report, we acknowledge that the Navy has taken  steps to improve military pay auditability. However, significant concerns  regarding its future audit readiness remain because of limitations the  Navy placed on the scope of the IPA’s examination, such as the exclusion  of selected systems the Navy relies on to process and report military pay  activity, as well as uncertainty regarding the extent to which the Navy has  effectively addressed deficiencies identified through its assertion and  validation efforts. Based on our findings, we continue to stress the  importance of addressing fundamental systems and control deficiencies,  which will lead to lasting financial management improvements and, as a  by-product, provide greater assurance of future audit readiness. As a  result, we believe the title of our report appropriately focuses on efforts  needed to address deficiencies discussed in this report and to improve  Navy financial management, and consequently we have not revised the  title as suggested by the Navy.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Defense,  the Under Secretary of Defense (Comptroller)/Chief Financial Officer, the  Secretary of the Navy, the Assistant Secretary of the Navy (Financial  Management and Comptroller), the Director of the Defense Finance and  Accounting Service, and appropriate congressional committees. In  addition, the report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff members who made key contributions to  this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of our review were to determine the extent to which (1) the  Navy was able to provide sufficient documentation to support a complete  and valid population of detailed transactions reconcilable to its schedule  of military pay activity for April 2013, and (2) the Navy’s military pay  assertion and validation efforts, which include the IPA’s examination,  contribute to future audit readiness.
To address our first objective, we analyzed Navy and Defense Finance  and Accounting Service (DFAS) documentation to gain an understanding  of the Navy’s military pay audit readiness assertion and the processes,  procedures, and systems used to process, report, and document Navy  military pay. We also analyzed IPA and Navy documentation supporting  the Navy’s schedule of military pay activity for April 2013, including  reconciliations of reported amounts to relevant documentation produced  by payroll, personnel, and disbursement systems and results of IPA  procedures, to assess the sufficiency of evidence the Navy provided the  IPA to support a complete and valid population of military payroll  transactions to support its schedule of military pay activity for April 2013.  In addition, we recalculated the reconciliations, traced selected amounts  to supporting documentation, and assessed the appropriateness of  selected reconciling items.
In addition, we reviewed the IPA’s plan, testing, projections, and  conclusions for whether the Navy provided sufficient documentation to  support the accuracy of transactions reflected in its schedule of military  pay activity for April 2013. The IPA selected a sample of 405 leave and  earnings statements for testing using a stratified random sample, with the  stratification based upon transaction dollar amount. We randomly  selected a 5 percent nongeneralizable sample of 21 leave and earnings  statements from the IPA’s sample of 405 and re-performed the IPA  procedures to assess the reliability of its work. We examined Navy  documentation supporting pay and entitlement transactions included on  the 21 leave and earning statements sample items we tested and re- performed the pay and entitlement calculations. We also re-performed the  IPA’s error projection calculations. We used the Department of Defense  (DOD) Financial Improvement and Audit Readiness guidance to assess  whether documentation supporting pay and entitlement transactions met  established requirements. We also interviewed IPA officials to understand  test case results. We also reviewed the results of the IPA’s analytical  review procedures to assess the Navy’s portion of Federal Insurance  Contributions Act and retirement pay contribution amounts reflected in the  Navy’s schedule of military pay activity for April 2013 and recalculated  and re-performed other selected IPA procedures.
To address our second objective, we reviewed documentation provided  by the Navy concerning (1) the Navy’s internal controls supporting its  military pay audit readiness assertion; (2) the status of the Navy’s actions  to address identified military pay-related internal control and information  technology system deficiencies; (3) audit readiness efforts of selected  military pay-related areas the Navy identified as outside of the scope of its  military pay audit readiness assertion; and (4) the Navy’s coordination  with the IPA, the DOD Office of Inspector General, and service providers  on selected matters, such as the management representation letter and  complementary controls, to identify areas where further improvements  can be made to contribute to future audit readiness. We also reviewed  documentation provided by the IPA, including reports related to its  examination of the Navy’s military pay audit readiness assertion, results  of internal control test procedures, and other audit documentation to  determine the nature and extent of findings and recommendations  identified by the IPA based on its examination.
To assess the reasonableness of the IPA’s internal control testing, we re- performed the IPA procedures for (1) a nongeneralizable sample of 10 of  the 20 controls the IPA concluded were effective and (2) the 14 controls  the IPA identified as not designed or operating effectively. We also  interviewed officials from DOD, the IPA, DFAS, and the Navy’s Office of  Financial Operations and Bureau of Naval Personnel to obtain  explanations and clarifications associated with our evaluation of the  documentation. In accordance with the relevant sections of the Financial  Audit Manual on relying on the work of others, we obtained and reviewed  the IPA’s most recent peer review, the IPA’s statement of independence,  and qualifications of key IPA personnel. We reviewed the contract,  contract modifications, and statements of work for the IPA’s examination  of the Navy’s military pay assertion. We attended various key meetings  between the IPA and the Navy related to the IPA’s examination of the  Navy’s military pay assertion. The IPA performed its work from  September 2013 through September 2014 and issued its opinion report in  January 2015.
We conducted this performance audit from April 2014 to September 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of the Navy
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, James Kernen (Assistant  Director), Carl Barden, Robert Dacey, Francine DelVecchio, Wilfred  Holloway, Jason Kelly, Gregory Loendorf, Sheila Miller, Jared Minsk,  Marc Oestreicher, Matthew Ward, and Matthew Zaun made key  contributions to this report.