DOD Financial Management: Continued Actions Needed to Address Congressional Committee Panel Recommendations
Published: 2015-09-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: A congressional panel examined the capacity of DOD's financial management system for providing timely, reliable, and useful information for decision making and reporting. The panel, in its January 2012 report, included 29 recommendations addressed to DOD in four areas: (1) FIAR strategy and methodology, (2) challenges to achieving financial management reform and auditability, (3) financial management workforce, and (4) enterprise resource planning systems implementation.
GAO was asked to review the status of DOD's actions to implement these recommendations. This report examines the extent to which the recommendations have been implemented. GAO reviewed pertinent legislation, including the National Defense Authorization Acts for Fiscal Years 2010 through 2015 as well as the department's FIAR Guidance and FIAR Plan Status Reports. GAO analyzed relevant information and interviewed officials from the Office of the Secretary of Defense, the military departments, and two service providers. Using the three status categories developed for GAO's high-risk work—met, partially met, and not met—GAO determined the extent to which DOD implemented the panel's recommendations.
section_title: What GAO Found
paragraphs: The Department of Defense (DOD) has made progress toward implementing each of the 29 recommendations made by the House Armed Services Committee Panel on Defense Financial Management and Auditability Reform (the panel). GAO determined that DOD's actions met 6 of the panel's recommendations and partially met the other 23. In its May 2015 Financial Improvement and Audit Readiness (FIAR) Plan Status Report, DOD reported that 9 recommendations were met and 20 were partially met. The 3 recommendations for which GAO disagreed with DOD's reported status of met related to (1) attestations on audit readiness in each of the FIAR Plan Status Reports; (2) inclusion of FIAR-related goals in Senior Executive Service performance plans, and rewarding and evaluating performances over time based on those goals; and (3) the review of audit readiness assertions by component senior executive committees. For example, while each FIAR Plan Status Report is coordinated among FIAR Governance Board (Board) members, including the Comptroller/Chief Financial Officer among others, in these reports Board members do not explicitly attest to whether DOD is on track to achieve audit readiness in 2017 as called for by the panel's recommendation and not all Board members provide signed statements about component audit readiness in the reports.
GAO and DOD agree that the remaining 20 recommendations were partially met and continued actions are needed, but GAO found that additional actions are needed to address some recommendations. These 20 partially met recommendations cover such diverse topics as a strategy for the consolidation of component financial information, valuation of historical asset costs, and assessing the competencies of the civilian financial management workforce. For example, DOD has made progress in assessing the competencies of its civilian financial management workforce in the financial management community, but has not yet assessed the competencies of all civilian, military, and contracted personnel performing financial-related functions, as recommended by the panel. Other recommendations are related to the implementation of enterprise resource planning systems—automated systems that perform a variety of business-related financial management tasks. DOD officials have stated that these systems are critical to DOD's ability to achieve audit readiness, but none of these recommendations have been fully met.
The panel's report and its recommendations touch on some of the most critical challenges DOD faces in achieving lasting financial management improvements and financial statement audit readiness. However, it is important to note that implementation of the panel's recommendations may not include all of the actions needed for DOD to achieve auditable financial statements. As auditors perform examinations and audits, they may identify deficiencies that were not previously known and therefore were not addressed by the panel's recommendations. DOD is monitoring its progress for implementing the FIAR Plan against interim milestones included in its April 2015 FIAR Guidance. However, as the audit readiness date approaches, DOD has emphasized asserting audit readiness by set dates over assuring that processes, systems, and controls are effective, reliable, and sustainable. While time frames are important for measuring progress, DOD should not lose sight of the ultimate goal of implementing lasting financial management reform, among other things, to ensure that it can routinely generate reliable, auditable financial information.
section_title: What GAO Recommends
paragraphs: GAO is recommending that DOD reconsider the status of three panel recommendations that it determined to be met but that GAO determined to be only partially met. DOD concurred with the recommendation and described planned actions to address it.

section_title: Letter
paragraphs: Sound financial management practices and reliable, timely financial  information are important to ensuring accountability over the Department  of Defense’s (DOD) extensive resources. Achieving this goal is a  significant challenge given the worldwide scope of DOD’s mission and  operations; the diversity, size, and culture of the organization; and its  reported trillions of dollars in assets and liabilities and its hundreds of  billions of dollars in annual appropriations. Serious, continuing financial  management problems at DOD have precluded it from producing financial  statements that can be audited. To enhance its oversight of DOD financial  management, in July 2011, the House Armed Services Committee  (HASC) appointed seven of its members to a newly formed Panel on  Defense Financial Management and Auditability Reform (hereafter  referred to as the panel). The panel was asked to examine the capacity of  DOD’s financial management system for providing timely, reliable, and  useful information for decision making and reporting. In addition, the  panel was to identify possible ways for DOD to improve its financial  management and audit readiness effort.
As part of its 6-month review, the panel held seven hearings and two  briefings on issues related to DOD financial management. In January  2012, the panel issued its report with 30 recommendations. Of the 30  recommendations, 1 was addressed to the House Armed Services  Committee and 29 were addressed to DOD in the following four areas  reviewed by the panel:
Financial Improvement and Audit Readiness (FIAR) strategy and  methodology (6 recommendations).
Challenges to achieving financial management reform and auditability  (9 recommendations).
Financial management workforce (5 recommendations).
Enterprise resource planning (ERP) system implementation efforts (9  recommendations).
You asked us to review DOD’s actions to implement the panel’s  recommendations. This report examines the extent to which DOD has  implemented the 29 panel recommendations addressed to it. To meet this  audit objective, we analyzed relevant documentation and interviewed key  officials from the Office of the Under Secretary of Defense (Comptroller),  including its Human Capital and Resource Management and FIAR  Directorates, and the Office of the Deputy Chief Management Officer  (DCMO) to obtain DOD’s perspective on implementation of the  recommendations. We also analyzed supporting documents and  interviewed knowledgeable officials from the three military departments  and two service providers—the Defense Finance and Accounting Service  (DFAS) and the Defense Logistics Agency (DLA). To determine DOD’s  methodology and plans for achieving audit readiness, we reviewed DOD’s  FIAR Guidance and semiannual FIAR Plan Status Reports. To  determine the extent to which DOD had implemented the panel  recommendations, we also considered findings disclosed in recent DOD  Inspector General (IG) and GAO reports. We used three categories,  consistent with those developed for GAO’s high-risk work, to determine  the status of DOD’s implementation of each recommendation: met,  partially met, or not met.
We conducted this performance audit from June 2014 to September 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: DOD’s Efforts to Strengthen Internal Control, Improve Financial Management, and Achieve Audit Readiness
paragraphs: DOD’s efforts to improve its financial management and achieve audit  readiness have evolved over a number of years into its current FIAR  effort. In 1995, we first designated DOD financial management as one of  the federal government’s programs at high risk of waste, fraud, abuse, or  mismanagement because of long-standing and pervasive weaknesses in  DOD’s internal control, and it still carries that designation today. Over  the past two decades, DOD has initiated efforts to strengthen its internal  control, become auditable, and improve its financial management.  However, as we stated in our most recent high-risk report, DOD has  emphasized asserting audit readiness by set dates over assuring that  processes, systems, and controls are effective, reliable, and  sustainable. DOD submitted its biennial strategic plan for the  improvement of financial management (Biennial Plan) to Congress on  October 26, 1998, as required by section 1008 of the National Defense  Authorization Act (NDAA) for Fiscal Year 1998. This Biennial Plan was  an important first step toward DOD improving its financial management  operations. The Biennial Plan included, for the first time, a discussion of  the importance of the programmatic functions of personnel, acquisition,  property management, and inventory management to the department’s  ability to support consistent, accurate information flows to all information  users. Although the Biennial Plan included a number of initiatives that  would help improve DOD’s financial management plans, we reported that  it lacked critical elements necessary for producing sustainable financial  management improvement over the long term.
Another initiative that preceded the FIAR effort was DOD’s 2003 Financial  Improvement Initiative, which was intended to fundamentally transform  DOD’s financial management operations and achieve clean financial  statement audit opinions. While DOD’s former Comptroller started the  2003 Financial Improvement Initiative with the goal of obtaining an  unqualified audit opinion for fiscal year 2007 on DOD’s department-wide  financial statements, the initiative lacked a clearly defined, well- documented, and realistic plan to make the goal a reality. As we  previously reported, although most of the DOD components, including the  Army, Navy, and Air Force, had submitted improvement plans to the DOD  Comptroller, DOD had not yet developed an integrated departmental  strategy, key milestones, accountability mechanisms, or departmental  cost estimates for achieving its fiscal year 2007 audit opinion goal.
In 2005, the DOD Comptroller established the DOD FIAR Directorate to  develop, manage, and implement a strategic approach for addressing the  department’s financial management weaknesses and achieving  auditability and to integrate those efforts with other improvement  activities, such as the department’s business system modernization  efforts. DOD’s first FIAR Plan was issued in 2005 and is updated  semiannually through the FIAR Plan Status Reports, which also  summarize the current status of DOD and its components in executing  the FIAR Plan.
DOD’s FIAR strategy and approach have evolved since the issuance of  the first FIAR Plan in 2005. The DOD Comptroller announced in August  2009 that in DOD’s effort to improve its financial management  information, priority would be given to improving those processes and  controls that produce information on which DOD managers rely most  heavily to run the agency. Because budgetary information is widely and  regularly used for management, the DOD Comptroller designated as one  of DOD’s highest priorities the improvement of its budgetary information  and processes underlying the Statement of Budgetary Resources  (SBR). The United States Marine Corps was selected as the pilot  military service for an audit of the SBR. The Secretary of Defense  underscored the department’s SBR priority with an October 2011  memorandum directing the Comptroller to provide a revised plan for  achieving audit readiness of the SBR by September 30, 2014, with the  aim to provide DOD managers with auditable General Fund information to  track spending, identify waste, and improve DOD’s business processes.  In response to component difficulties in preparing for an audit of the SBR,  the November 2014 FIAR Plan Status Report and the November 2013  revised FIAR Guidance included a revision to narrow the scope of initial  audits to only current year budget activity and expenditures on a General  Fund Schedule of Budgetary Activity.
section_title: Legislative Requirements and Time Frames
paragraphs: The NDAA for Fiscal Year 2002 required DOD to minimize the resources  spent to develop, compile, report, and audit financial statements that the  Secretary of Defense assesses as expected to be unreliable.  Additionally, the NDAA for Fiscal Year 2008 designated the Deputy  Secretary of Defense as the department’s Chief Management Officer  (CMO), created a DCMO position, and designated the under secretary of  each military department as the CMO for the respective department.  The act also required the Secretary of Defense, acting through the CMO,  to develop a strategic management plan that among other things would  provide a detailed description of performance goals and measures for  improving and evaluating the overall efficiency and effectiveness of  DOD’s business operations and actions under way to improve operations.
To establish statutory objectives for DOD to achieve financial statements  that are validated as ready for audit by a certain date, the NDAA for Fiscal  Year 2010 mandated that DOD develop and maintain a FIAR Plan that  includes, among other things, the specific actions to be taken and costs  associated with (1) correcting the financial management deficiencies that  impair the department’s ability to prepare timely, reliable, and complete  financial management information and (2) ensuring that DOD’s financial  statements are validated as ready for audit by not later than September  30, 2017. In addition, the 2010 NDAA required that DOD (1) provide  semiannual reports by no later than May 15 and November 15 on the  status of the department’s implementation of the FIAR Plan (which DOD  provides as FIAR Plan Status Reports) to congressional defense  committees, (2) develop standardized guidance for DOD components’  financial improvement plans (FIP), and (3) define oversight roles and  assign accountability for carrying out the FIAR Plan to appropriate  officials and organizations.
The NDAA for Fiscal Year 2013 amended the legal requirement to  additionally require that the FIAR Plan Status Reports should include   (1) a description of the actions military departments have taken to achieve  an auditable SBR for DOD by September 30, 2014, and (2) a  determination by each military department’s CMO on whether the unit is  able to achieve an auditable SBR by September 30, 2014, without an  unaffordable or unsustainable level of onetime fixes and manual work- arounds and without delaying the auditability of the financial statements.  In the event that the CMO of a military department determines that the  military department would not be able to achieve an auditable SBR by  that date, the CMO is required to explain why the military department  cannot meet that date and provide an alternative date for meeting the  target date.
In the November 2014 FIAR Plan Status Report, DOD acknowledged that  it did not meet the September 30, 2014, target date for achieving audit  readiness of the SBR, but stated that the three military departments  asserted Schedule of Budgetary Activity audit readiness in the last  quarter of fiscal year 2014. In January 2015, independent public  accountant (IPA) firms began auditing the military departments’ General  Fund Schedules of Budgetary Activity for fiscal year 2015. For the first- year Schedule of Budgetary Activity audits, the scope is the schedules  containing only current year appropriations and all related activity, such  as obligations and outlays, against those appropriated funds approved on  or after October 1, 2014. As a result, these first-year Schedule of  Budgetary Activity audits exclude unexpended amounts, whether  obligated or unobligated, carried over from prior years’ funding as well as  information on the status and use of such funding in subsequent years  (e.g., obligations incurred and outlays). These amounts will remain  unaudited. Over the ensuing years, as the unaudited portion of SBR  balances and activity related to this funding decline, the audited portion is  expected to increase.
The NDAA for Fiscal Year 2014 mandates that upon the conclusion of  fiscal year 2018, the Secretary of Defense shall ensure that a full audit is  performed on DOD’s fiscal year 2018 financial statements and submit the  results of that audit to Congress not later than March 31, 2019.
section_title: FIAR Plan
paragraphs: DOD’s FIAR Plan is DOD’s strategic plan and management tool for  guiding, monitoring, and reporting on the department’s financial  management improvement efforts. As such, the plan communicates  incremental progress in addressing the department’s financial  management weaknesses and achieving financial statement auditability.  The plan focuses on several goals:  1.  achieve and sustain unqualified assurance on the effectiveness of  internal controls through the implementation of sustained  improvements in business processes and controls addressing the  material weaknesses in internal control,  2.  develop and implement financial management systems that support  effective financial management, and  3.  achieve and sustain financial statement audit readiness.
The department has envisioned achieving financial statement auditability  in four waves of concerted improvement activities described in its FIAR  Plan. The activities of these four waves are within groups of end-to-end  business processes, which are further broken down into discrete units,  called assessable units. DOD defines an assessable unit as any part of  the financial statements, such as a line item or a class of assets, a class  of transactions, or a process or a system, that helps produce the financial  statements. The four waves are as follows:
Wave 1: Appropriations Received Audit
Wave 2: Schedule of Budgetary Activity/SBR Audit
Wave 3: Mission Critical Asset Existence and Completeness Audit
Wave 4: Full Financial Statements Audit  Waves 1 through 3 started concurrently, and an IPA firm validated Wave  1 as audit ready in August 2011. In the November 2013 FIAR Plan Status  report, DOD defined the term audit ready as meaning that the department  has strengthened internal controls and improved financial practices,  processes, and systems so that there is reasonable confidence that the  information can withstand an audit by an independent auditor. The  department organized these audit readiness waves to use the  interdependencies between budgetary and accounting information. FIAR  priorities have required reporting entities to devote their resources and  efforts toward completing audit readiness activities for Waves 1 through 3  before beginning work for Wave 4. DOD officials have stated that much  of the audit readiness work required to complete Waves 1 through 3  affects Wave 4 requirements and objectives. For example, DOD has  identified interdependencies between accounts included in Waves 2  (budgetary) and 4 (accounting information). DOD officials stated that the  department has expanded its audit readiness priorities from budgetary  data reported on the SBR to all financial transactions reported on the  Balance Sheet and the Statements of Net Cost and Changes in Net  Position. As stated in the May 2015 FIAR Plan Status Report, the focus  of current FIAR activity includes (1) valuing and accurately reporting over  $2.2 trillion in assets, (2) reporting over $2.4 trillion in liabilities, and   (3) preparing full financial statements for audit.
section_title: FIAR Guidance
paragraphs: The FIAR Guidance, first issued in May 2010 and periodically updated,  provides the standard methodology by which the components are to  implement the FIAR Plan. DOD components are required to establish  assessable units for all processes, systems, or classes of assets that  result in material transactions and balances in their financial statements  to focus their improvement efforts. Components are required to prepare  FIPs for each assessable unit under the FIAR Guidance. According to the  FIAR Guidance, component audit readiness assertions for assessable  units are to specify that (1) control activities are suitably designed and  implemented, operating effectively, and sufficiently documented to  provide reasonable assurance that applicable financial reporting  objectives are achieved; (2) key supporting documents are readily  available for review; and (3) account balances and transactions are  accurately recorded. DOD has established a mandatory set of five  standardized phases for achieving audit readiness that its components  are required to apply to each assessable unit. As of the April 2015 FIAR  Guidance, these five phases were Discovery, Corrective Action,  Assertion/Examination, Validation, and Audit.
In the FIAR Guidance, service providers, such as DFAS and DLA, are  defined as components that are responsible for their systems and data,  processes and internal controls, and supporting documentation that affect  a reporting entity’s audit readiness. Service providers are to prepare  documentation illustrating the financial reporting aspects of their  operations through end-to-end business processes. Based on that  documentation, the service providers are to identify and evaluate control  activities and supporting documentation over those processes that affect  the reporting entities’ financial reporting objectives (i.e., the outcomes  needed to achieve proper financial reporting and serve as a point against  which the effectiveness of internal controls over financial reporting can be  evaluated). In accordance with the FIAR Guidance, service providers’  control activities and supporting documentation undergo examinations  conducted in accordance with the Statement on Standards for Attestation  Engagements (SSAE) No. 16, Reporting on Controls at a Service  Organization. Service providers, such as DFAS, with three or more  customers working to become audit ready must obtain SSAE No. 16  examinations on their internal controls over financial reporting. According  to DOD officials, the results of these examinations can then be relied  upon by all of the customers, reducing audit time and therefore saving  money.
The updated FIAR Guidance, issued in April 2015, provides specific  tasks, work products, and deliverables for achieving and validating full  financial statement auditability. As described in this FIAR Guidance, DOD  has expanded its FIAR priorities from budgetary information and mission- critical asset information to include two other priorities—proprietary  accounting data/information for the Balance Sheet and Statements of Net  Cost and Changes in Net Position and valuation of assets and liabilities.  It also includes newly established milestones that the components must  meet to give DOD the best opportunity to succeed in achieving auditable  financial statements by fiscal-year end 2017.
section_title: The Panel Report
paragraphs: The panel reviewed the following four areas and provided a total of 29  recommendations to DOD to resolve the issues it found in each area.
FIAR strategy and methodology (6 recommendations). While  acknowledging that the department had a reasonable strategy and  methodology for its FIAR effort, the panel stated that DOD’s strategy  needed to be more detailed and refined. For example, according to  the panel, DOD had not yet fully defined all of the elements of the  strategy necessary to achieve audit readiness on all financial  statements in 2017. Moreover, the panel was concerned that certain  DOD components may not be effectively implementing the FIAR  strategy and methodology.
Challenges to achieving financial management reform and auditability  (9 recommendations). The panel recognized that DOD’s size and  complexity contribute to the complicated and pervasive challenges to  its financial management processes and related business operations  and systems. In its report, the panel expressed concern about DOD’s  progress in addressing long-standing weaknesses in internal controls.  Specifically, the panel referred to the numerous material weaknesses  in internal control over financial reporting—cited by the DOD IG in its  reports since the mid-1990s—that have affected DOD’s ability to  achieve a clean audit opinion. In addition, the panel noted that  weaknesses in controls over the recording, accounting, and reporting  of financial information jeopardize DOD’s ability to safeguard taxpayer  dollars. For example, these weaknesses can result in improper  payments, Antideficiency Act (ADA) violations, and problem  disbursements. The panel also noted organizational challenges  faced by the logistics community, military components, and DFAS.  Specifically, the majority of transactions recorded in accounting  systems are initiated by military components, including military  commands, installations, and bases, and within nonfinancial functional  communities, such as acquisition and logistics. The panel stated that  continued emphasis must be placed on fully engaging both the  military components and functional communities in audit readiness  efforts.
Financial management workforce (5 recommendations). According to  the panel, ensuring that the financial management workforce is  adequately staffed, skilled, and well-trained is crucial to DOD’s ability  to improve financial management. For example, the panel was  concerned that DOD had not yet performed a complete department- wide systematic competency assessment, which would include  analysis of the types and ranges of abilities, knowledge bases, and  skills of the present financial management workforce and those that  will be needed in the future.
ERP system implementation efforts (9 recommendations). While  acknowledging that DOD has taken positive steps, the panel  expressed five concerns about the department’s ERP system  implementation efforts, including (1) reported schedule delays and  cost overruns as well as the reliability of ERP schedule and cost  estimates; (2) issues with the requirements process in that in some  cases not enough requirements are identified and in some cases too  many requirements are included in ERP systems; (3) ERP systems  that may not provide the capabilities needed for achieving FIAR  objectives; (4) poor execution of data conversion that could cause  delays in the full implementation of the ERP systems; and (5) the  numerous interfaces that exist between the legacy systems and the  ERP systems and the problems associated with these interfaces that  could compromise ERP functionality. In its report, the panel also  recognized that because most financial information is maintained in  computer systems, the reliability of the financial data in these systems  depends on the effectiveness of information system controls over how  those systems operate.
section_title: DOD Has Taken Actions to Implement the Panel’s Recommendations, but Significant Challenges Remain to Achieve Auditability
paragraphs: We determined that DOD’s actions have met 6 of the panel’s  recommendations and partially met 23. In its May 2015 FIAR Plan Status  Report, DOD stated that 9 recommendations were met and the remaining  20 were partially met. With regard to the 9 recommendations that DOD  reported as met, we determined three to be partially met. Table 1 includes  a list of the 29 panel recommendations, shown by the four areas reviewed  by the panel, and our determination on the status of DOD’s  implementation of each recommendation along with the status DOD  reported in May 2015. See appendix I for detailed information on each of  the 29 recommendations. While DOD is making progress, it is important  to note that implementation of the panel’s recommendations may not  include all of the actions that the department must take to achieve  auditable financial statements. For example, as the DOD IG and the IPA  firms perform examinations and audits, they may identify deficiencies in  internal controls that were not previously known and therefore were not  addressed by the panel’s recommendations.
subsections: section_title: DOD’s Actions Have Met Six of the Panel’s Recommendations
paragraphs: We agree with DOD’s status determinations that its actions have met six  of the panel’s recommendations (see table 1, recommendations 2.5, 2.8,  3.2, 3.3, 3.4, and 3.5). Two of these relate to the area on challenges to  achieving financial management reform and auditability. DOD has taken  the actions recommended by the panel to reduce ADA violations by  analyzing the causes of these violations; developing and implementing  procedures to address them; and ensuring that key funds control  personnel are adequately trained to prevent, detect, and report ADA  violations (2.5). In addition, as recommended by the panel, DOD has  developed forums for sharing lessons learned within commands of  military departments as well as external to these departments (2.8).  These information-sharing forums include newsletters, quarterly in- process reviews, and stakeholder meetings as well as the FIAR  Governance Board, FIAR Committee, and FIAR Subcommittee. DOD has  also met the requirements of four financial management workforce- related recommendations. Actions taken include using the expertise of  certified public accountants with financial statement audit experience in its  audit readiness efforts (3.2); developing and making financial  management web-based courses available to both personnel in the  financial management functional community and those outside of the  financial management community, such as personnel in the logistics and  acquisition functional communities (3.3); providing training programs for  the department’s current ERP systems that users are to complete prior to  obtaining access to these systems (3.4); and submitting a proposal to  both the Senate and House Armed Services Committees for a financial  management exchange program between DOD and the private sector  (3.5). Further details on the specific recommendations made and DOD’s  actions taken are discussed in appendix I.
section_title: DOD’s Actions Have Partially Met Three Recommendations That DOD Classified as Met
paragraphs: We determined that DOD’s actions partially met three of the panel’s  recommendations for which DOD had reported the status as met (see  table 1, recommendations 1.6, 2.1, and 2.2). Descriptions of the panel’s  recommendations, the department’s actions, our reasons for disagreeing  with DOD on the status of these recommendations, and the additional  actions needed to fully address the panel recommendations are  discussed below.
The panel recommended that the FIAR Governance Board attest to  whether DOD is on track to achieve audit readiness in 2017 in each  FIAR Plan Status Report (1.6). DOD reported this recommendation  as met because each FIAR Plan Status Report is coordinated among  FIAR Governance Board members, providing them with the  opportunity to (1) formally attest to the accuracy and completeness  and (2) determine if their components are on track to achieve audit  readiness in 2017. DOD officials also stated that each military  department’s CMO reports on audit readiness progress and  challenges in signed statements in the FIAR Plan Status Report and  indicates whether the military department is on track to achieve audit  readiness by September 30, 2017. However, we consider this  recommendation to be partially met because all FIAR Governance  Board members need to attest for their individual components, and  the DOD Comptroller needs to attest for the department, whether they  are on track to achieve audit readiness in 2017 in each FIAR Plan  Status Report to fully meet this recommendation. In making these  attestations, it is critical that the FIAR Governance Board consider the  effect of known factors (e.g., the lack of integrated systems) and other  risks, such as weaknesses and deficiencies that may be identified in  examinations and audits, on the status of their respective  components’ financial statement audit readiness.
The panel required DOD to (1) include objective and measurable  criteria regarding FIAR-related goals in its senior personnel  performance plans and evaluations, (2) appropriately reward or hold  officials accountable based on evaluated performance against the  FIAR-related goals, and (3) document and track evaluated  performances to measure progress over time (2.1). On April 9, 2013,  the Deputy Secretary of Defense issued a memorandum, stating that  most, if not all, of DOD’s executives have a role in its effort to achieve  audit readiness and that Senior Executive Service (SES) performance  plans were to be updated with FIAR-related goals by April 30, 2013.  We consider this recommendation partially met because, although  DOD components have inserted FIAR-related requirements in SES  performance plans, they have not yet determined how to reward  executives based on evaluated performance for FIAR-related goals  and assessed the effect on accomplishing FIAR activities by tracking  evaluated performances over time.
To improve oversight of the FIAR effort, the panel recommended that  DOD require each component senior executive committee to review  its corresponding component’s audit readiness assertion packages for  compliance with FIAR Guidance before submitting those packages to  the Office of the Under Secretary of Defense (Comptroller) for  validation (2.2). DOD considers the recommendation to be met  because the FIAR Guidance states that management’s audit  readiness assertions must be signed by the person, individual, or  representative of the organization responsible for the subject matter  (assessable unit) and that this level of review and approval is  appropriate. DOD requires review of the assertion package in  accordance with the FIAR Guidance, but we consider this  recommendation partially met because the FIAR Guidance does not  require senior executive committee reviews of audit readiness  assertion packages as the panel recommended.
section_title: DOD’s Actions Have Partially Met 20 of the Panel’s Remaining Recommendations
paragraphs: We agree with DOD that the department’s actions partially met the  remaining 20 panel recommendations, described below by the four areas  of the panel’s review, and continued actions are needed. However,  additional actions beyond what DOD indicated is planned are needed in  some cases to fully address the panel recommendations. See appendix I  for details on all partially met recommendations, including actions under  way or additional actions needed to meet these recommendations.
subsections: section_title: FIAR Strategy and Methodology
paragraphs: The panel made six recommendations in this area, including  recommendation 1.6 discussed above that DOD considers met which we  consider partially met and the remaining five for which we agree with  DOD’s determination that these are partially met. Two of the five  remaining partially met recommendations in this area specifically relate to  DOD’s implementation of its FIAR strategy and methodology (1.1 and  1.4). In addition, one recommendation relates to the department’s  process for consolidating the components’ financial statements to prepare  the department-wide consolidated financial statements (1.2). Another  recommendation is related to the valuation of mission-critical assets (1.3).  The other remaining partially met recommendation relates to risk  management activities associated with implementing the FIAR Plan (1.5).
Although some actions have been taken, continued actions are needed to  address all recommendations in this area, and additional actions are  needed for some. For example, the panel recommended that the  Comptroller’s office, in consultation with DOD’s DCMO, the secretaries of  the military departments, and the heads of the defense agencies and field  activities, incorporate risk mitigation plans to support meeting future  interim milestones in the FIAR Plan (1.5). As we reported in August 2013,  DOD officials acknowledged that there is not a department-wide written  risk management policy for its FIAR effort. DOD officials had stated  earlier that a department-wide risk management plan would aid in  assessing and integrating risk strategies across the department.  However, instead of a department-wide risk management plan, DOD is  using a three-pronged approach to address aspects of risk management,  as stated in its May 2015 FIAR Plan Status Report. While DOD’s three- pronged approach to address risk management includes the use of “deal- breakers,” DOD’s critical path, and its centralized notices of findings and  recommendations tracking database, a department-wide risk  management plan, as DOD had previously planned to implement, is  needed for developing and implementing consistent risk mitigation  strategies across DOD and thus to support meeting future interim  milestones as called for in the recommendation.
section_title: Challenges to Achieving Financial Management Reform and Auditability
paragraphs: The panel made nine recommendations in this area, including two  recommendations previously discussed that DOD considers met and we  consider partially met (2.1 and 2.2) and two recommendations that we  agree have been met (2.5 and 2.8). For the remaining five  recommendations, we agree with DOD’s determination that they are  partially met. These five relate to addressing existing material  weaknesses and those identified during the FIAR effort (2.3), reducing  improper payments and problem disbursements (2.4 and 2.6), identifying  and institutionalizing best practices (2.7), and ensuring that components  and service providers working with them have consistent milestones (2.9).
Although DOD has taken some actions to address these  recommendations, continued or additional actions are needed as detailed  in appendix I. For example, the panel recommended that to reduce  problem disbursements, the department should address the underlying  causes of problem disbursements in its efforts to develop and implement  ERP systems (2.6). According to a DOD official, the implementation of  modern financial systems, including ERP systems, has increased the  level of problem disbursements because of data quality issues and  interfaces with legacy systems that are still in use. The DOD official also  stated that when the ERP systems are fully implemented and operating in  the stable end states, these systems should provide an automated,  integrated environment that will significantly reduce the number of  problem disbursements. In its May 2015 FIAR Plan Status Report, DOD  officials stated that analyses to assist in identifying root causes and  implementing corrective actions, as called for in the recommendation, will  be performed on a recurring basis until the department can retire all  legacy systems and fully implement the ERP systems’ capabilities.
section_title: Financial Management Workforce
paragraphs: The panel made five recommendations in this area, four of which have  been met, as previously discussed, and one for which we agree with  DOD’s partially met assessment. This recommendation relates to DOD  performing a department-wide systematic skills assessment of its  financial management workforce and that of all other functional areas that  are performing financial management-related functions (3.1). The panel  recognized the importance of having personnel within DOD’s other  functional communities who are skilled in performing financial  management-related tasks, because these communities initiate and  maintain much of the financial information critical to the results of DOD’s  operations. DOD completed its systematic competency assessment of  certain occupations in its financial management workforce and has plans  to assess the remaining financial management workforce in phases.  However, at the time of our review, DOD had not yet assessed other  functional communities as called for by the panel recommendation.
section_title: ERP System Implementation Efforts
paragraphs: The panel made nine recommendations in this area, and we agree with  DOD that all of these recommendations have been partially met and none  have been fully met. The first six include recommendations relating to  ERP schedule delays and cost overruns, issues with the requirements  process, and the capabilities of the ERP systems to achieve FIAR  objectives. For example, the panel recommended that DOD develop  ERP-related schedule and cost estimates based on best practices for  future ERP deployments (4.3). While the Army had made some  improvements to the schedule and cost estimates for Army’s Global  Combat Support System (GCSS-Army), we reported in 2014 that DOD  has not fully implemented best practices in its schedule estimates, cost  estimates, or both for the Defense Enterprise Accounting and  Management System and GCSS-Army. The panel also made two  recommendations to address its concerns about DOD’s data conversion  efforts and the numerous interfaces that exist and their possible  compromising of ERP functionality. The panel’s final recommendation  related to DOD’s assessment of information systems controls testing  needs for all ERP systems being developed and determination of whether  appropriate workforce levels and corresponding skill sets exist within  DOD’s developmental and operational test communities.
As detailed in appendix I, the department needs to continue taking  actions to address all of these recommendations and take additional  actions for some. For example, as mentioned above, the panel  recommended that among other things, DOD evaluate lessons learned  from previous data conversion efforts and incorporate these lessons into  its ERP conversion plans as well as assess the merits of designating a  senior official to be responsible for the coordination and managerial  oversight of data conversion (4.7). Although DOD assessed the merits of  designating a senior official responsible for data conversion and identified  lessons learned from previous data conversion efforts, as DOD  implements ERP systems, the department needs to continue to  incorporate lessons learned into its current and future ERP data  conversion plans, as recommended by the panel. Given that DOD  officials have stated that these ERP systems are critical to DOD’s ability  to achieve audit readiness, fully implementing these recommendations  will be necessary for achieving this goal.
section_title: Conclusions
paragraphs: The panel’s report and its recommendations touch on some of the most  critical challenges the department faces in achieving lasting financial  management improvements and financial statement audit readiness. As  previously stated, DOD has defined audit readiness to mean that the  department has strengthened internal controls and improved financial  practices, processes, and systems so that there is reasonable confidence  that the information can withstand an audit by an independent auditor.  DOD’s actions to meet the panel’s 29 recommendations, if effectively  designed and implemented, will bring the department closer to achieving  these important goals. However, it is important to note that  implementation of the panel’s recommendations may not include all of the  actions that the department must take to achieve auditable financial  statements. As the DOD IG and the IPA firms perform examinations and  audits, they may identify deficiencies in controls that may not have  previously been known and as such were not addressed by the panel’s  recommendations. Nonetheless, without taking the actions needed to fully  implement the panel recommendations, DOD is at increased risk of not  achieving its financial management improvement and audit readiness  goals. DOD is monitoring its progress implementing the FIAR Plan  against interim milestones. However, as the target date for validating  DOD’s audit readiness approaches, as we have previously stated, DOD  has emphasized asserting audit readiness by set dates over assuring that  processes, systems, and controls are effective, reliable, and sustainable.  While time frames are important for measuring progress, DOD should not  lose sight of the ultimate goal of implementing lasting financial  management reform to ensure that it can routinely generate reliable,  auditable financial information and other information critical to decision  making and effective operations.
section_title: Recommendation for Executive Action
paragraphs: To help meet its financial management improvement and audit readiness  goals, we recommend that the Secretary of Defense direct the Under  Secretary of Defense (Comptroller) to reconsider the status of the three  panel recommendations that DOD classified as met that we determined  were partially met and take the necessary actions to reasonably assure  that these recommendations have been met.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DOD for comment. In its written  comments, reprinted in appendix II, DOD concurred with our  recommendation to reconsider whether further actions are needed to  meet panel recommendations 1.6, 2.1, and 2.2. DOD also described  planned actions that it will take to address the recommendations. For  panel recommendation 2.2, DOD stated that it will update the FIAR  Guidance to require dual signatures from both the senior executives in  charge of financial and relevant functional areas for the subject  assertions. As DOD updates its FIAR Guidance, DOD should require  each component senior executive committee to review its corresponding  component’s audit readiness assertion package as called for by the panel  recommendation, rather than focus on dual signatures. DOD stated that it  will continue to provide status updates on actions planned and completed  for the remaining 23 panel recommendations in its semiannual FIAR Plan  Status Report.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, and the Under Secretary of  Defense (Comptroller). In addition, the report is available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices   of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff members who made key contributions to  this report are listed in appendix III.
section_title: Appendix I: Status of DOD’s Actions to Implement the Panel on Defense Financial Management and Auditability Reform Recommendations
paragraphs: This appendix contains our assessment of the Department of Defense’s  (DOD) progress in addressing the House Armed Services Committee  (HASC) Panel on Defense Financial Management and Auditability  Reform’s (the panel) recommendations, organized by the four areas the  panel reviewed. Each section of the appendix covers the  recommendations made for the four areas and includes (1) the panel  recommendations, (2) statuses reported by GAO and DOD, (3) key  background information, (4) DOD actions taken to address the  recommendations, and (5) our assessment of the status of the  recommendations. The status of each recommendation is based on our  assessment of information received prior to or as of May 2015 and DOD’s  reported status as of the May 2015 Financial Improvement and Audit  Readiness (FIAR) Plan Status Report.
subsections: section_title: FIAR Strategy and Methodology
paragraphs: Background: The panel reported that DOD had a reasonable strategy  and methodology for its FIAR effort, although its strategy needed to be  more detailed and refined. While the panel noted that DOD’s December  2011 FIAR Guidance detailed the strategy and methodology for  completing Wave 4, the components were instructed to continue their  focus on implementing the requirements of Waves 1, 2, and 3.  Additionally, the panel reported that the department, in its FIAR  Guidance, instructed its components not to address Wave 4 requirements  in their financial improvement plans (FIP) until the FIAR activities  associated with Waves 1, 2, and 3 were complete. The panel stated its  concern that this approach may affect the department’s ability to achieve  financial statement auditability in 2017, because of DOD’s lack of analysis  of the interdependencies among Waves 1, 2, 3, and 4. For example, the  panel stated that by testing certain information on the Statement of  Budgetary Resources (SBR) in Wave 2, assurance can be obtained on  the reliability of certain data in the Balance Sheet in Wave 4.
DOD Actions: DOD first identified interdependencies in its December  2011 FIAR Guidance that can be leveraged to accelerate progress in  Wave 4 and revised them in subsequent versions of the FIAR Guidance  as follows:
Delivered Orders, reported on the SBR (covered in Wave 2), equates  to a portion of Accounts Payable reported on the Balance Sheet  (Wave 4).
Spending Authority from Offsetting Collections, reported on the SBR  (covered in Wave 2), includes some of the amounts reported in  Accounts Receivable—Intragovernmental on the Balance Sheet  (Wave 4).
Unobligated Balances and Unpaid Obligations, reported on the SBR  (covered in Wave 2), correlates to Fund Balance with Treasury,  reported on the Balance Sheet (Wave 4).
Obligations Incurred, reported on the SBR (covered in Wave 2),  equates to a substantial portion of Gross Costs reported on the  Statement of Net Cost (Wave 4).
In its May 2015 FIAR Plan Status Report, DOD considered this  recommendation as partially met and stated that its analysis of  interdependencies will continue until the department achieves financial  statement auditability. Also, in its April 2015 FIAR Guidance, DOD stated  that partly because of interrelationships between financial statements, the  department can leverage audit readiness efforts from previous waves to  succeeding waves, much like the above interdependencies. For example,  DOD officials stated that through Schedule of Budgetary Activity/SBR  (Wave 2) audit readiness efforts, some portions of line items on other  financial statements have been addressed.
GAO Status: We consider this recommendation partially met because as  DOD continues its audit readiness activities, the department will likely  identify additional interdependencies between accounts on its SBR,  Balance Sheet, and Statement of Net Cost. For example, Wave 4 audit  readiness activities include valuation of assets, liabilities, revenues, and  costs and therefore will require DOD to determine the dollar values to be  assigned to line items such as environmental liabilities; general property,  plant and equipment; inventory; and operating materials and supplies.  These audit readiness activities will involve interdependencies between  the Balance Sheet and the Statement of Net Cost.
Background: The panel stated that the FIAR Plan did not address the  process for ensuring that the DOD components’ financial information will  be properly consolidated into DOD’s department-wide financial  statements. The panel’s concern was that the lack of an articulated  process for addressing financial statement consolidation may affect  DOD’s ability to achieve financial statement auditability in 2017. In its  recommendation, the panel suggested, as one option, that DOD create a  DOD financial reporting element or wave for consolidation of DOD’s  financial statements and report on this element’s audit readiness progress  in the FIAR Plan Status Report.
DOD Actions: DOD reports on the status of Defense Finance and  Accounting Service (DFAS) financial reporting, defined as the process by  which DFAS organizes financial data and produces financial statements,  in the FIAR Plan Status Reports. DFAS, one of DOD’s largest service  providers, performs accounting and finance services for the department,  including preparing the financial statements for its components as well as  the consolidated department-wide financial statements. According to  DOD officials, the department will continue to use the current DFAS  reporting system and processes to produce the department-wide  consolidated financial statements. In accordance with the FIAR Guidance,  DFAS’s financial reporting system and processes have undergone a  Statement on Standards for Attestation Engagements (SSAE) No. 16  examination by an independent auditor. As DOD officials stated in the  May 2015 FIAR Plan Status Report, the department is addressing the  SSAE No. 16 reported findings and implementing corrective actions.  However, DOD officials stated in the report that the department will not  know whether outstanding issues related to financial statement  compilation have been resolved until an audit of DOD’s department-wide  financial statements has been conducted.
GAO Status: DOD has established financial reporting assessable units  for the military departments and service providers. However, we consider  this recommendation partially met because DOD needs to take additional  actions to fully develop a financial reporting wave or strategy for  consolidating individual component financial statements into department- wide financial statements. In addition, DOD’s reporting system and  processes do not allow for the elimination of intragovernmental  transactions, which occur between federal entities and must be eliminated  to prevent duplicate reporting of information. DFAS, in its SSAE No.16  financial reporting assertion package, stated that DOD’s current  accounting systems generally do not capture trading partner information  at the level needed to match and eliminate these intragovernmental  transactions between trading partners. DOD officials stated that they  have actions under way to address the issues affecting the proper  elimination of intragovernmental transactions.
Background: When the panel made its recommendation, DOD had  decided to wait to report the historical costs of real property, general  equipment, inventory, and operating materials and supplies on its  Balance Sheet until (1) initial FIAR priorities had been met and (2) the  enterprise resource planning (ERP) systems under development were  capable of recording and reporting transaction data. DOD’s decision  was based on its business case in which DOD officials stated that with  the exception of operating materials and supplies, historical acquisition  cost information was used exclusively for financial reporting and not for  managerial decision making. DOD officials, in its business case, also  recognized that the ongoing implementation of ERP systems would  enhance the recording of auditable historical costs for future acquisitions.  Based on its business case, DOD also decided that it would expense the  costs of military equipment and request that the Federal Accounting  Standards Advisory Board change the federal accounting standards to  allow this treatment, because DOD viewed capturing, recording, and  reporting auditable costs for military equipment as extremely challenging  and costly. In its report, the panel noted that federal accounting  standards allow for the use of other methods to provide reasonable  estimates for the costs of these assets, which led to its recommendation  that the department reevaluate its position on accepting historical costs.
DOD Actions: DOD has reevaluated its position from that described in its  business case, deciding to include historical cost valuations of general  property, plant and equipment, including general equipment as well as  real property, and internal use software on its Balance Sheet, without  waiting until initial FIAR priorities are met and the implementation of the  ERP systems is complete. In September 2013, DOD described its  overall strategy for valuing assets (1) acquired prior to October 1, 2013,  and (2) accepted by DOD and placed into service on or after October 1,  2013. In February 2014, DOD issued its general equipment valuation  estimation methodologies. According to its May 2015 FIAR Plan Status  Report, DOD has established five working groups that are addressing  impediments to audit readiness, including the valuation of historical  assets. DOD reported the status of this recommendation as partially met  and stated that the valuation methods for various asset categories are  being developed and that the department is working closely with the  Federal Accounting Standards Advisory Board to leverage asset valuation  methodologies allowed under Statement of Federal Financial Accounting  Standards No. 35 to establish a historical cost baseline.
GAO Status: We consider this recommendation partially met because  DOD has developed a strategy and is basing its asset valuation for the  Balance Sheet on historical cost, but the department faces significant  challenges in continuing to implement its strategy and develop auditable  valuations for these assets. For example, DOD’s components must first  determine the existence of these assets. In addition, DOD has cited the  following challenges to asset valuation: numerous configurations of highly complex military equipment and military equipment and weapons systems that have been modified,  upgraded, or overhauled;  renovated or improved real property assets that have changed in  value since originally placed in service;  large inventories of missiles, ammunition and munitions, spare  engines, equipment parts, supplies, and so forth; enormous quantities of deployed general equipment, inventory, and  operating materials and supplies located in Afghanistan and  worldwide; and  identification and valuation of internal use software and DOD property  with contractors.
Background: The panel’s concern was that without properly  implementing the FIAR methodology, DOD components may be  prematurely asserting audit readiness. In its report, the panel refers to our  September 2011 report in which we stated that the Navy and Air Force  did not adequately develop and implement their respective FIPs for  civilian pay and military equipment in accordance with the FIAR  Guidance. Our review of the FIPs found that the Navy and Air Force did  not conduct sufficient control and substantive testing and reached  conclusions that were not supported by the testing results, did not  complete reconciliations of the population of transactions, and did not fully  test information systems controls. Also, neither the Navy nor the Air  Force had fully developed and implemented corrective action plans  (CAPs) to address deficiencies identified during implementation of the  FIPs. As a result of these deficiencies, we reported that these FIPs did  not provide sufficient support for the components’ conclusions that the  assessable units were ready to be audited.
DOD Actions: With regard to part 1 of the recommendation, DOD’s FIAR  Directorate, according to DOD officials, worked with DOD’s components  initially to overcome FIAR Plan implementation difficulties by reviewing  and verifying that the FIPs were consistent with FIAR strategy and  methodology. Based on this work, the FIAR Directorate identified causes  of implementation difficulties, or what DOD refers to as deal-breakers— weaknesses that have prevented DOD components from demonstrating  audit readiness or succeeding in audits.
With regard to part 2 of the recommendation, DOD’s March 2013 FIAR  Guidance accelerated examination of audit readiness assertion packages  by the DOD Inspector General (IG) or independent public accountant  (IPA) firms to identify needed corrective actions based on auditor- identified notices of findings and recommendations by combining the  Assertion and Evaluation phases into one phase. In addition to  examinations of audit readiness assertion packages, audits of the military  departments’ General Fund Schedules of Budgetary Activity for fiscal  year 2015 began in January 2015. The FIAR Directorate has established  a tracking database to monitor the implementation of corrective actions  for findings and recommendations resulting from examinations and  audits.
Finally, with regard to part 3 of the recommendation, DOD does not have  a formal communications plan for sharing information on lessons learned,  but the FIAR Directorate promotes this type of sharing. Lessons learned  are shared at FIAR Committee, FIAR Subcommittee, and working group  meetings, as well as other forums such as in-process review meetings  and newsletters. According to the May 2015 FIAR Plan Status Report, the  tracking database for notices of findings and recommendations will help in  sharing lessons learned as deficiencies at one component are likely to  exist at another component.
GAO Status: We consider this recommendation partially met because  DOD components have not yet implemented all of the FIAR audit  readiness activities to achieve its goal of department-wide financial  statement auditability. Furthermore, the expansion of the FIAR priorities  to include proprietary accounting and information as well as valuation will  likely require additional corrective actions to address these areas. As  recommended by the panel, the components will need to continue  developing CAPs to address any identified weaknesses or deficiencies.  Finally, DOD needs to develop a formal communications plan and  components will need to communicate any lessons learned as the panel  recommended.
Background: The panel raised concerns about DOD missing some of the  interim milestones included in the May 2011 FIAR Plan Status Report.  While recognizing that slippages of interim milestones will not necessarily  compromise meeting audit readiness objectives, the panel stated that  DOD must incorporate risk mitigation plans to remediate missed interim  milestones and apply lessons learned toward achieving later milestones  on schedule.
DOD Actions: The department, in its May 2015 FIAR Plan Status Report,  stated that it has a three-pronged approach for addressing risk  management in which DOD has (1) identified audit readiness deal- breakers by reviewing past audits, (2) defined the critical path to  achieving financial statement auditability and included related tasks and  milestones in the April 2015 FIAR Guidance, and (3) reinforced the  importance of internal controls over areas of significant risk by including a  new chapter on internal controls in the FIAR Guidance and implementing  a centralized tracking database to monitor corrective actions developed in  response to notices of findings and recommendations generated from  examinations and audits.
GAO Status: We consider this recommendation partially met because  DOD needs to take additional actions to develop a department-wide risk  management plan. In August 2013, we recommended that DOD design  and implement department-level policies and detailed procedures for  FIAR Plan risk management, including the five guiding principles for  effective risk management. DOD officials acknowledged that DOD did  not have a written risk management policy for its FIAR effort and originally  planned to develop one, but have recently stated that its three-pronged  approach will address risk management. According to the May 2015 FIAR  Plan Status Report, DOD’s three-pronged approach addresses aspects of  risk management, including the use of deal-breakers, DOD’s critical path,  and its notices of findings and recommendations tracking database.  However, the lack of a department-wide risk management plan to assess  risks specifically related to meeting future interim milestones will hinder  developing and implementing consistent risk mitigation strategies across  DOD.
Background: The FIAR Governance Board is charged with providing  vision, leadership, oversight, and accountability for DOD’s FIAR effort.  Members of the FIAR Governance Board include the Comptroller/Chief  Financial Officer, the Deputy Chief Financial Officer, the Deputy Chief  Management Officer, the military department assistant secretaries for  financial management/comptroller and deputy chief management officers  (DCMO), the DFAS Director, and Defense Logistics Agency (DLA)  Deputy Director.
DOD Actions: DOD officials stated that each FIAR Plan Status Report is  coordinated among FIAR Governance Board members, providing them  with the opportunity to (1) formally attest to the accuracy and  completeness and (2) determine if their components are on track to  achieve audit readiness in 2017. In addition, DOD officials stated that  each military department’s chief management officer reports on audit  readiness progress and challenges in signed statements in the FIAR Plan  Status Report and also indicates whether his or her military department is  on track to achieve audit readiness by September 30, 2017.
GAO Status: The FIAR Plan Status Reports have included signed  statements by the military department chief management officers as well  as a signed statement from DOD’s Under Secretary of Defense  (Comptroller)/Chief Financial Officer. However, we consider this  recommendation partially met because not all FIAR Governance Board  members (e.g., the DFAS Director and the DLA Deputy Director) provide  signed statements and attest to audit readiness in the FIAR Plan Status  Reports and thus additional actions are needed. In addition, the signed  statements provided in the May 2015 FIAR Plan Status Report did not  explicitly state whether DOD was on track to achieve audit readiness by  September 30, 2017, as the panel recommended. Instead, the signed  statements expressed commitment to continue making progress toward  financial statement auditability by September 30, 2017, but did not clearly  state whether DOD or the military departments are on target to meet that  date. Moreover, because the panel recommendation is addressed to the  department, the FIAR Governance Board members need to attest for their  individual components and the DOD Comptroller needs to attest for the  department whether they are on track to achieve audit readiness in 2017  in each FIAR Plan Status Report to fully meet this recommendation. In  making these attestations, it is critical that the FIAR Governance Board  consider the effect of known factors (e.g., the lack of integrated systems)  and other risks, such as weaknesses and deficiencies identified in  examinations and audits, on the status of its financial statement audit  readiness.
section_title: Challenges to Achieving Financial Management Reform and Auditability
paragraphs: Background: The panel stated, in its report, that effective leadership and  oversight are instrumental to bringing forth and sustaining substantial  financial management improvement. In addition to financial management  reform being a long-term undertaking, the panel stated that it requires the  involvement of DOD leadership within, and outside of, financial  management operations. In addition, according to the panel, leadership  should extend from the top officials, including the offices that comprise  the Secretary of Defense, the military departments’ chief management  officers, and the military departments’ assistant secretaries (financial  management and comptroller) to senior officials in other functional areas,  such as logistics and acquisitions. The panel recognized that DOD  requires that senior executive performance appraisals include financial  audit goals among their evaluation criteria and that this requirement  includes appraisals of senior executives in functional areas having a  financial impact. The panel considered this requirement a positive step,  but added that the effectiveness of this requirement depends on whether  the evaluation criteria can be objectively measured, evaluated  performances are appropriately rewarded, and senior officials are held  accountable.
DOD Actions: On April 9, 2013, the Deputy Secretary of Defense issued  a memorandum, stating that most, if not all, of DOD’s executives have a  role in its effort to achieve audit readiness. In the memorandum, three  categories of Senior Executive Service (SES) members were described  and their performance plans were to be updated with objective and  measurable criteria by April 30, 2013.
SES members in category 1 are responsible for managing resources  or DOD business processes. The performance plans for these SES  members are to include an agency-specific performance requirement  for business acumen.
The second category is those SES members who have a direct role in  their organizations’ FIAR efforts. This category includes headquarters- level financial managers with overall FIAR responsibility as well as  SES members in financial management and other functional  communities (such as acquisition, logistics, and personnel) who  directly affect their organizations’ financial records and FIAR efforts.  These SES members should include in their performance plans  specific audit-related goals, tied to their organizations’ FIPs, as an  agency-specific performance requirement for being results driven.  Moreover, to the extent that these SES members manage resources  or DOD business processes, the executive performance plans should  also include the business acumen element described in the first  category. In assessing performance for this element, rating officials  are instructed to consider both the individual’s and the organization’s  results.
The third category consists of SES members who do not manage  resources or DOD processes, who do not have a direct role in their  organizations’ audit readiness efforts, or both. According to the April  9, 2013, memorandum, these SES members are to request a waiver  from having FIAR goals included in their executive performance plans.  However, according to an April 19, 2013, memorandum, the instance  of SES members falling into the third category should be rare.
With regard to the second part of this recommendation, DOD officials told  us in December 2014 that officials were considering bonuses to award  performance on the FIAR-related goals, but had not determined how to  reward executives with bonuses based on evaluated performance for  DOD-wide goals, such as the FIAR-related goals. With regard to part 3 of  the panel’s recommendation, DOD officials stated that when the FIAR- related goals were first included in the SES performance plans, there was  a perceived change in that leaders focused more attention on FIAR goals  and efforts. However, DOD officials stated that it is difficult to determine  the causality between the inclusion of the FIAR-related goals and  achievement of these goals.
GAO Status: We consider this recommendation partially met because,  although DOD components have inserted FIAR-related requirements in  SES performance plans, additional actions are needed to determine how  to reward executives based on evaluated performance for FIAR-related  goals and to assess the effect of these requirements on accomplishing  FIAR activities by tracking evaluated performances over several fiscal  years. Without evaluating SES member performance relating to the FIAR  goals, DOD only has anecdotal evidence on the effect of the inclusion of  these goals.
Background: The panel based this recommendation on the fact that  while DOD components had senior executive committees to oversee  financial improvements efforts, their oversight responsibilities were not  effectively being carried out, as demonstrated by the ineffective  implementation of FIPs and insufficient evidence to support conclusions  of audit readiness. In its report, the panel stated that effective oversight  mechanisms must be implemented to ensure that DOD’s components are  complying with FIAR Guidance.
DOD Actions: As shown in the May 2015 FIAR Plan Status Report, DOD  officials determined this recommendation to be met because the FIAR  Guidance requires that audit readiness management assertions be  signed by the individual representing the organization responsible for the  subject matter and that this level of review and approval is appropriate.  By signing the audit readiness assertion letter for an assessable unit or  line item, the responsible individual is asserting that the component has  followed the FIAR Guidance to (1) document and evaluate internal  controls and (2) define, assemble, and retain key supporting  documentation to support transactions. In addition, the individual is also  asserting that the supporting documentation can be retrieved and  provided within a reasonable period of time to an IPA firm conducting an  examination or subsequent audit. According to DOD officials, the  department adopted an alternative action in response to the panel’s  recommendation—the assignment of a functional lead to review the audit  assertion package. While the functional leads do not sign off on the  assertion packages, these leads do participate in the review process for  the package. According to DOD officials, this alternative action  demonstrates accountability and has addressed the intent of the panel’s  recommendation.
GAO Status: We consider this recommendation partially met because  DOD’s FIAR Guidance does not require senior executive committee  reviews of audit assertion packages for compliance with the FIAR  Guidance as the panel recommended. DOD has taken alternative actions  of having functional leads review audit assertion packages and individuals  responsible for the subject matter review and approve the assertion  packages. However, recent GAO reports have identified instances in  which the Army and DFAS have not completed tasks required by the  FIAR Guidance, which could result in premature assertions of audit  readiness. For example, we found that DFAS had asserted audit  readiness for its contract pay assessable unit even though a deal-breaker  was present. As we reported in June 2014, DFAS had not established a  general ledger reconciliation process at the time it implemented its  contract pay FIP. Therefore, we concluded that as a result of the lack of  a general ledger reconciliation process, additional errors may exist in the  recorded transactions activity and balances for DFAS contract pay. If  DOD were to take additional actions and require senior executive  committee reviews of the assertion packages, as recommended by the  panel, then the committee could make a collective decision and take  responsibility for moving forward with an assertion, even though a deal- breaker exists, rather than an individual or functional lead making that  decision alone. Similarly, the panel cited insufficient support for  conclusions of audit readiness in its report, reinforcing the need for higher  levels of review of the audit readiness assertion packages.
Background: In its report, the panel stated that since the mid-1990s, the  DOD IG has reported numerous material weaknesses in internal control  that affect the department’s ability to obtain a clean opinion on its financial  statements. In its audit report for fiscal year 2014, the DOD IG reported  previously identified material weaknesses in the following areas:   (1) Financial Management Systems; (2) Fund Balance with Treasury;   (3) Accounts Receivable; (4) Inventory; (5) Operating Materials and  Supplies; (6) General Property, Plant and Equipment; (7) Government  Property in Possession of Contractors; (8) Accounts Payable;   (9) Environmental Liabilities; (10) Statement of Net Cost;   (11) Intragovernmental Eliminations; (12) Other Accounting Entries; and  (13) Reconciliation of Net Cost of Operations to Budget. Many of these  material weaknesses are so serious that they contribute to GAO being  unable to render an opinion on the U.S. government’s consolidated  financial statements.
DOD Actions: According to DOD officials, components that undergo  examinations or audits are required to develop and implement CAPs. The  13 material weaknesses identified by the DOD IG, as well as those self- reported by the department, will be addressed by specific reporting entity  corrective actions, DOD-wide corrective actions, or DOD-wide policy  initiatives that are carried out at the reporting entity level. Specific  reporting entity-level corrective action timelines are included in the May  2015 FIAR Plan Status Report and the April 2015 FIAR Guidance. In  addition, details on DOD-wide solutions and policy initiatives are included  in the May 2015 FIAR Plan Status Report. With regard to material  weaknesses identified through the FIAR effort, the FIAR Directorate,  using its notices of findings and recommendations tracking database, is  monitoring the implementation of corrective actions.
GAO Status: DOD has taken actions to develop CAPs at the component  level. However, we consider this recommendation partially met because  DOD needs to take additional actions to develop comprehensive CAPs  for addressing material weaknesses at the department level. According to  the United States Chief Financial Officers Council’s Implementation Guide  for OMB Circular A-123, a comprehensive CAP lists the detailed actions  that must be taken to resolve the weakness or deficiency, including   (1) summary description of the deficiency and year first identified;   (2) targeted corrective action date (the date for management follow-up);  (3) agency official responsible for monitoring progress; (4) indicators,  statistics, or metrics used to measure progress in resolving the weakness  or deficiency; and (5) milestone or other characteristic used to report how  resolution activities are progressing. Given the critical nature of the  long-standing, material weaknesses in internal control reported for fiscal  year 2014, their resolution will require a concerted effort by leadership at  the component level to implement corrective actions with oversight from  the Office of the Under Secretary of Defense (Comptroller), to monitor  department-wide initiatives and implement component-level CAPs.  DOD, to meet this recommendation, will also need to monitor the  development and implementation of corrective actions for weaknesses  identified from FIAR-related activities, such as audits and examinations,  to ensure that comprehensive CAPs are developed and these  weaknesses are fully addressed at both the component and department  levels.
Background: The panel based this recommendation on GAO’s findings  included in a July 2009 report that reported DOD may not be capturing  the full extent of its improper payments. Specifically, we found in 2009  that DOD had not conducted risk assessments for all of its payment  activities and $322 billion in outlays were excluded from the amounts  assessed. In addition, at that time we stated that DOD had not estimated  improper payments for commercial pay, its largest payment activity, in  accordance with improper payment requirements. The then-DOD  Comptroller testified before the panel that DOD is taking steps, based on  the Improper Payments Elimination and Recovery Act of 2010, to initiate  a statistical sampling program for commercial payments. In its report,  the panel acknowledged DOD’s efforts to initiate statistical sampling for  commercial payments but recommended that DOD take further action to  address this issue.
DOD Actions: In its May 2015 FIAR Plan Status Report, DOD officials  stated that the department continues to review its sampling  methodologies for all payment types to ensure that it can properly  estimate improper payment dollars. For example, DFAS reevaluated and  enhanced its statistical sampling methodology for DFAS commercial  payments for fiscal year 2014 improper payment reporting. Also, for fiscal  year 2014, the Defense Health Agency modified its TRICARE improper  payment calculation formula in response to our prior findings. DOD  stated that the department will be reviewing the sampling methodologies  for the other seven programs for which improper payment estimates are  reported in its agency financial report. However, DOD stated in its fiscal  year 2014 agency financial report that it cannot demonstrate that all  payments subject to improper payment requirements were included in the  population of payments to review.
GAO Status: DOD has taken some steps to improve its improper  payment sampling methodologies for some programs, but we consider  this recommendation partially met because DOD still needs to reevaluate  its methodology for identifying and reporting improper payments for other  types of programs. In addition, DOD cannot demonstrate that the  payments subject to improper payment estimation that are included in the  populations from which the samples are selected are complete, accurate,  and valid. As we stated in May 2013, the foundation of reliable statistical  sampling estimates is a complete, accurate, and valid population from  which to sample. Furthermore, we stated that DOD did not maintain the  supporting documentation needed to substantiate reported improper  payment estimates.
Background: In its report, the panel noted that DOD’s poor internal  controls put it at risk of violating the Antideficiency Act (ADA), referring to  DOD IG and GAO testimonies. The Deputy IG for Auditing testified that  DOD’s control environment weaknesses impaired its ability to determine  the amount of funds that it had available to spend, and as a result, DOD  was at risk of overobligating and overexpending its appropriations and  violating the ADA. He added that a lack of adequate controls and  training contributed to potential ADA violations. In 2011, we testified that  because the ADA prohibits, and effective funds control should prevent,  overobligations and overexpenditures of public funds, the number and  dollar amount of ADA violations were indicators of the status of DOD’s  funds control. In our testimony, we stated that DOD had issued and  periodically updated policies that addressed responsibilities for preventing  and identifying ADA violations. In addition, we testified that DOD’s  guidance described frequent causes of ADA violations within the  department and explained the actions necessary to avoid them, including  (1) emphasizing management and supervisory duties, (2) training of key  funds control personnel, and (3) effective systems and procedures.
DOD Actions: In its Financial Management Regulation (FMR), DOD  includes the causes of ADA violations it has identified as well as the  department’s policies and procedures to prevent these violations. With  respect to ensuring that key funds control personnel are adequately  trained, DOD officials, in a memorandum dated December 13, 2011,  stated that beginning October 1, 2012, the frequency of training for ADA  investigators will change from 5-year to 3-year intervals. According to  the May 2015 revised chapter of DOD’s FMR on administrative control of  funds, the components are required to submit a memorandum on their  annual evaluation of overall administrative control processes and ADA  violations. This memorandum is to include a statement that provides the  number of key funds control personnel identified and trained as  prescribed in the FMR. In the May 2015 FIAR Plan Status Report, DOD  officials stated that the military departments and components are required  to review and evaluate training records to ensure that personnel certifying  and handling funds have financial management and fiscal law training. In  addition to increasing the frequency of training for ADA investigators,  DOD has implemented its Financial Management Certification Program,  which includes training on fiscal law. This training on fiscal law covers  funds control and ADA requirements.
GAO Status: We believe DOD’s actions have met the requirements of  the recommendation.
Background: Problem disbursements include both unmatched  disbursements and negative unliquidated obligations. Unmatched  disbursements are disbursements that have been paid by an accounting  office but have not been matched to the correct obligation records. A  negative unliquidated obligation is a disbursement transaction that has  been matched to an obligation, but the total recorded disbursement  exceeds the recorded obligation. In its report, the panel stated that  problem disbursements impede DOD’s performance of proper Fund  Balance with Treasury reconciliations, which affects DOD’s ability to  report reliable information on its financial statements.
DOD Actions: DOD’s Deputy Chief Financial Officer testified that  problem disbursements are caused by errors or deficiencies that have  occurred during the procure-to-pay process. According to DOD officials,  problem disbursements can occur when the disbursing function is  separated from the entitlement and accounting processes. DOD officials  stated that the implementation of modern financial systems, including  ERP systems, has temporarily increased the level of problem  disbursements because of data quality issues and the need for interfaces  with legacy systems that are still in use. However, the officials stated that  by the time the ERP systems mature and their operations become stable,  the data quality issues should be resolved. Moreover, DOD officials  stated that these ERP systems should provide an automated, integrated  environment that will significantly reduce the number of problem  disbursements. DOD officials also stated that the auditors’ notices of  findings and recommendations from examinations and audits should help  in resolving issues causing problem disbursements. In its May 2015 FIAR  Plan Status Report, DOD officials stated that analyses will be performed  on a recurring basis until the department is able to retire all legacy  systems and fully implement ERP capabilities. DOD officials added that  these analyses and reconciliations should assist in identifying root causes  of problem disbursements and implementing corrective actions.
GAO Status: We consider this recommendation partially met because  DOD needs to continue to address the underlying causes of problem  disbursements as it develops and implements ERP systems.
Background: In its report, the panel stated that it was encouraged by the  testimony of DOD logistics community representatives about their role in  efforts to improve financial management and achieve audit readiness.  However, the panel stated that engaging the functional communities in  the audit readiness effort must continue to be prioritized. The panel, in  its report, referred to the Air Force’s testimony in which the Director of  Logistics stated that one of the biggest challenges is ensuring that the  logistics and acquisition functional communities understand their role in  achieving audit readiness.
DOD Actions: DOD officials stated, in the May 2015 FIAR Plan Status  Report, that the Office of the Under Secretary of Defense (Comptroller),  through the FIAR governance process, is aware of solutions and best  practices identified and implemented by DOD’s components, including  those identified by the functional communities. As cited in the report,  some of the best practices shared among the components, including the  functional leads serving on the FIAR effort, are as follows:
Solution to be used by the military departments for valuing existing  real property assets (deflated plant replacement value).
Army use of an Air Force environmental liability cost estimation tool.
Army and Air Force use of an audit response tool developed by the  Navy.
Navy use of a Fund Balance with Treasury reconciliation tool  developed by the Air Force.
GAO Status: We consider this recommendation partially met because  the FIAR Directorate needs to take additional actions to validate whether  identified best practices have been institutionalized department-wide. In  addition, DOD did not comprehensively document lessons learned and  best practices, and therefore the department is missing an opportunity to  gain institutional knowledge that would facilitate future decision making.  Federal internal control standards highlight the importance of  documenting significant events in a timely manner. Specifically, these  standards state that agencies should identify, record, and distribute  pertinent information to the right people in sufficient detail, in the right  form, and at the appropriate time to enable them to carry out their duties  and responsibilities and ensure that communications are relevant,  reliable, and timely. Institutionalizing identified best practices in writing  may assist in consistent application and fully engaging functional  communities outside of the financial management community in audit  readiness efforts, as necessary.
Background: In its report, the panel recognized that the majority of  transactions recorded in accounting systems are initiated by military  commands, installations, and bases. Based on this, the panel stated that  for DOD to achieve its FIAR objectives, internal controls over, and the  accounting of, these transactions must be improved at these locations.  Based on testimony from the Commander of the Naval Air Systems  Command, the panel stated that the lessons learned at Naval Air  Systems Command should be shared with other military commands and  vice versa.
DOD Actions: In its May 2015 FIAR Plan Status Report, DOD officials  stated that the military departments and defense agencies regularly share  lessons learned within their organizations in various forums, such as  newsletters, quarterly reviews, and stakeholder meetings. The FIAR  Subcommittee, FIAR Committee, and FIAR Governance Board meetings  are forums that are regularly used to share information external to an  individual DOD component.
GAO Status: We believe DOD’s actions have met the requirements of  the recommendation.
Background: The panel recognized that because DFAS’s activities are  integral to the financial activities reported in the DOD components’  financial statements, weaknesses in internal control at DFAS must be  addressed for DOD to achieve auditability. In its report, the panel referred  to the FIAR Guidance, which states that service providers, such as DFAS,  that work with user entities are responsible for audit readiness efforts  surrounding service provider systems and data, processes and controls,  and supporting documentation that have a direct effect on user entities’  auditability. Therefore, according to the panel’s report, it is critical that  these organizations provide documentation demonstrating that controls  are properly designed and operating effectively and transactions are  properly posted to the accounting records. The panel stated that DFAS  should undergo an audit of its major processes that materially affect its  users. In addition, timelines for establishing effective controls should be  reported in future FIAR Plan Status Reports for all major processes.
DOD Actions: DOD included service providers’ FIAR status and  milestones in its FIAR Plan Status Reports beginning with the May 2012  report. In the May 2015 FIAR Plan Status Report, DOD officials stated  that in addition to including service provider milestones in DOD reports,  the Office of the Under Secretary of Defense (Comptroller) and DOD’s  components monitor service providers’ milestones, progress, and  challenges during service provider working group meetings, as well as  during other FIAR oversight meetings, such as FIAR Committee  meetings. DOD also stated, in the May 2015 FIAR Plan Status Report,  that integrating the audit readiness activities of the service providers with  their customers is complex and is one of the challenges the department  faces to achieving audit readiness. One reason for this complexity is that  the components rarely control transactions from initiation to reporting on  the component financial statements. Moreover, the components do not  own and operate all of the information systems used to process their  transactions. One example provided by the department relates to  processing and recording contract pay, for which the components depend  on over a dozen systems that are owned and operated by service  providers.
GAO Status: We consider this recommendation partially met because  DOD needs to take additional actions to show the comparison of the  service provider milestones with those of their customers so that the  consistency of the milestones between service provider and customer can  be seen. Currently, the FIAR Plan Status Reports show the service  providers’ status and plans for achieving audit readiness and conducting  SSAE No. 16 examinations by assessable unit. Ensuring that the  component milestones and service provider milestones are consistent for  each process included in the FIAR effort remains challenging.
section_title: Financial Management Workforce
paragraphs: Background: The panel reported that at the time of its review, DOD had  not yet performed a complete department-wide systematic competency  assessment that included an analysis of the financial management  workforce abilities, knowledge bases, and skill sets needed now and in  the future. DOD developed and issued its department-wide (enterprise- wide) financial management competencies for its civilian workforce in  November 2011, immediately preceding the panel report’s issuance. In  issuing these competencies, DOD officials stated that they identify the  critical knowledge, skills, and abilities that DOD financial managers need  to meet the (1) complex 21st century national security mission and   (2) unique requirements of the department, including analysis and audit  readiness.
DOD Actions: DOD has taken steps toward completing a department- wide systematic competency assessment of its financial management  workforce. The department plans to do a review or “refresh” of its  department-wide financial management competencies for its civilian  workforce in fiscal year 2016. With regard to identifying the gaps between  current requirements and the competencies of the existing workforce,  DOD has used its Defense Competency Assessment Tool to assess  competency gaps in its civilian financial management workforce for its  four civilian mission-critical financial management occupations in 2014  and its nine civilian non-mission-critical financial management  occupations in 2015. As stated in the May 2015 FIAR Plan Status  Report, DOD plans to research the feasibility of assessing the civilian  financial management workforce in other functional areas. The panel  recommended that DOD’s competency assessments be performed for its  federal civilian, military, and contracted personnel performing financial- related functions. With regard to military personnel in financial  management occupations, DOD officials stated that its research showed  that the military departments, through the normal annual military  performance review process, have an effective means of assessing the  competencies of members of the military workforce in their given  functional specialties. Moreover, DOD officials stated that assessing the  competency gaps of contracted staff performing financial management- related functions is outside the financial management community’s scope  of responsibility because required competencies are to be defined in each  contract’s statement of work. In addition, the appropriate contracting  officer’s technical representative has the responsibility to perform due  diligence over the contractor’s performance.
GAO Status: We consider this recommendation partially met because  the department has not yet assessed the competencies of all civilian,  military, and contracted personnel performing financial management- related functions, as recommended by the panel. Furthermore, the  Functional Community Manager for Financial Management concluded  that there is not a legislative requirement for a competency skills gap  assessment for the military financial management workforce. DOD,  however, is required by law to submit a biennial strategic workforce  management plan to Congress, which includes, among other things, an  assessment of the critical skills and competencies that will be needed in  the future. According to the law, this plan shall specifically address the  shaping and improvement of DOD’s financial management workforce,  including military and civilian personnel. This includes an assessment of  the critical skills and competencies for both the civilian and military  financial management workforces. As stated above, DOD’s competency  assessments have only addressed the civilian workforce in the financial  management community. When DOD conducts its review of the  department-wide civilian financial management workforce competencies  in fiscal year 2016, the department will need to consider projected future  requirements (competencies) for its civilian financial management  workforce, as the panel recommended. After the department has  identified the projected future requirements (competencies), DOD will be  in a position to identify the gaps between the projected future  requirements for its civilian financial management workforce and those  possessed by its existing workforce.
Background: In testimony before the panel, DOD stated that the  department uses contractors to fill skill sets missing from its existing  workforce in certain areas, including audit readiness. Industry officials  testified on the importance of hiring certified public accountants (CPA)— either directly or through contracts—with financial audit experience.  According to expert testimony, although hiring CPAs is an important  aspect of improving the human capital necessary to achieve audit  readiness, not all CPAs have the requisite audit readiness expertise.  For example, CPAs who specialize in areas such as tax, budgets, or  information systems may not have developed the tools necessary to  productively participate in improving audit readiness. CPAs who have  federal financial statement audit experience are trained to apply the  judgment required by generally accepted government auditing standards  to determine the relevancy and sufficiency of controls and documentation  necessary to successfully prepare DOD for a financial statement audit.
DOD Actions: According to DOD officials, DOD uses the expertise of  CPAs both as employees and contractors. The FIAR Directorate, within  the Office of the Under Secretary (Comptroller), maintains a contractor  staff of CPAs with financial audit experience. Among other things, these  CPAs provide consulting services, including determining how to  implement best business practices that are used in the private sector. The  military departments have also contracted with IPA firms. For example,  officials stated that the Air Force has contracted a recognized accounting  firm with both auditing and audit readiness experience as its advisory and  assistance services contractors. According to Navy officials, the Navy  perceives a continued need to leverage private sector expertise in future  years to support its FIAR efforts and has developed a flexible acquisition  strategy to facilitate this leveraging of expertise. According to Army  officials, the Army recognizes the importance of a variety of skills that are  critical to accomplish the needed changes associated with audit  readiness, including individuals with knowledge of the Army, audit and  systems experience, and with certifications such as CPAs, certified  information systems auditors, and project management professionals.  The Army has a mix of these skills on its civilian audit readiness staff and  supplements this knowledge base with contractor staff. The service  providers are also using the expertise of IPA firms. DFAS has employed  multiple IPA firms to conduct its audit readiness efforts, including IPA  firms to perform a mock military pay SSAE No. 16 examination as well as  its first SSAE No. 16 examination. DLA is leveraging an IPA firm as audit  readiness advisors, which supports its audit readiness efforts with CPAs  as well as audit and advisory professionals experienced in financial  statement audit and information technology audit.
GAO Status: We believe DOD’s actions have met the requirements of  the recommendation.
Background: In its report, the panel recognized the importance of having  personnel within DOD’s functional communities, other than financial  management, with the skills to perform financial management-related  tasks. According to the panel, functional communities, such as the  logistics and acquisitions communities, generate and maintain financial  information critical to reporting the financial results of DOD operations  accurately and reliably. For example, logistics personnel are responsible  for entering asset information into inventory records, conducting  inventories, and performing reconciliations. Acquisition personnel enter  obligations for contracts into the accounting system. The panel concluded  that the department must ensure that these personnel receive financial  management training as part of the department’s FIAR efforts.
DOD Actions: According to DOD Human Capital and Resource  Management officials, FIAR courses are available online for members of  all DOD functional communities, including members of the financial  management community. Specifically, DOD officials stated that the  department has developed over 50 web-based financial management  courses, and these courses provide credit applicable to the department’s  Financial Management Certification Program requirements at the various  levels. While one learning platform is restricted to members of the  financial management community, the web-based courses on another  platform are open to both members of the financial management  community and members of other functional communities. Course  evaluations are required for each web-based course completed and these  evaluations are reviewed monthly. According to DOD officials, course  evaluation averages are analyzed and tracked and used to evaluate  training effectiveness. DOD officials have stated that DOD has  consistently maintained an average course evaluation metric of 4.12 on a  5.0 scale for these courses.
GAO Status: We believe DOD’s actions have met the requirements of  the recommendation.
Background: In its report, the panel stated that implementing effective  training programs will be especially important as DOD transitions to  increased use of ERP systems. For example, the Army testified that its  General Fund Enterprise Business System (GFEBS) requires personnel  to obtain proficiencies in skills that are not required in the legacy  operating environment and that many of the more than 70,000 eventual  users of GFEBS will not reside in the Army’s financial management  community. The Army added that the majority of users operate among the  acquisition, logistics, public works, and property management functions.  The Air Force testified that its financial managers are learning about new  ERP systems, including what these systems are designed to do and how  to work within them. The Air Force is experiencing a major cultural  change for much of its workforce by moving from primarily a bookkeeping  financial management system to ERP systems that can produce auditable  financial statements. Officials added that the Air Force is working to get  ahead of the ERP deployments and is retooling its workforce.
DOD Actions: In the May 2015 FIAR Plan Status Report, DOD stated  that training exists for all current ERP systems. Officials added that these  training programs are coordinated with each ERP system owner and the  component’s financial management office. In addition, the military  departments require users to complete training prior to obtaining access  to the ERP systems. For example, for its Defense Enterprise Accounting  and Management System (DEAMS), the Air Force has a library of online  training courses that must be taken as part of the process to request  access to DEAMS. In addition, the Air Force has included user job aids in  DEAMS that provide video demonstrations of common system functions.  According to an Air Force official, the lack of well-geared training was  identified as an underlying cause for earlier issues that occurred during  the DEAMS implementation process because users performing everyday  business tasks with DEAMS did not have a clear understanding of how to  use the ERP to perform these tasks. Army officials stated that while  GFEBS was being deployed, its GFEBS training team provided on-site  and classroom training for end users, and that over the years,  improvements were made to the tools provided and the courses. For  example, the new job aids were improved as well as the scenario-specific  training, based on lessons learned and feedback from the end users and  the help desk. For the Navy ERP, a Navy official stated that users must  complete web-based training or instructor-led training prior to obtaining  access to perform financial roles. The Navy, according to this official,  has web-based training and detailed knowledge-sharing content available  as part of the overall Navy ERP program, but not uploaded to the Navy  ERP application itself.
The military departments measure the effectiveness of this training in  several ways, including end-of-course surveys and analysis of help desk  tickets, to identify any gaps in training that need to be addressed. For  example, for GFEBS, the Army Financial Management School requires  end users to complete end-of-course evaluations. Air Force officials  provided an example in which lessons learned and feedback from users  resulted in changes to one of its DEAMS courses. During the June 2014  deployment training cycle, end users noted that the DEAMS program  needed to adjust its project billing user reimbursement course to more  closely align it with the typical scenarios and data combinations  experienced at most bases. According to Air Force officials, given this,  the DEAMS training team coordinated with the subject matter experts to  reevaluate, adjust, and update the project billing user reimbursement  course material to better support those end users’ needs. According to a  Navy official, Navy ERP training uses several sources of information to  continually improve the effectiveness of the training material, including  lessons learned from student course evaluations, feedback from the end  user community on topics where additional training may be needed, and  analyzing help desk tickets for indications of training gaps.
GAO Status: We believe DOD’s actions have met the requirements of  the recommendation.
Background: DOD testified, before the panel, that it would like to  implement a pilot program similar to the Information Technology  Exchange Program. According to DOD officials, the National Defense  Authorization Act (NDAA) for Fiscal Year 2010 authorized a pilot program  for the temporary exchange of information technology personnel between  DOD and the private sector. DOD officials asserted that a similar  exchange program involving the FIAR Directorate would benefit the  department’s FIAR Plan through the sharing of best practices, partnering  to address common challenges, and enhancing competencies. In its  report, the panel stated that it supports improving workforce  competencies and therefore welcomes the sharing of greater detail on the  proposed program with the committee.
DOD Actions: On April 1, 2014, DOD submitted a proposal for a pilot  Financial Management Exchange Program between DOD and the private  sector to both HASC and the Senate Armed Services Committee for their  consideration. The pilot, proposed for inclusion, but not enacted as part of  the Carl Levin and Howard P. “Buck” McKeon NDAA for Fiscal Year  2015, was modeled on section 1110 of the 2010 NDAA, authorizing a  pilot program for the temporary exchange of personnel working in  information technology. According to the proposal, a DOD employee  would be eligible for the exchange program only if the employee (1) works  in financial management, (2) is considered to be an exceptional  employee, and (3) is compensated at least at the General Schedule 11  grade level (or equivalent). According to DOD officials, Senate Armed  Services Committee members expressed their support for the program  during an April 2014 DOD briefing on this topic. However, in the May  2015 FIAR Plan Status Report, DOD officials stated that the department  has not yet received any formal comments from either HASC or the  Senate Armed Services Committee on its proposal. The legislative  proposal was included in the Senate version of the NDAA for Fiscal Year  2016. However, DOD officials said they were told in July 2015 that  HASC will not be proceeding with this proposal.
GAO Status: We believe DOD’s actions have met the requirements of  the recommendation.
section_title: ERP System Implementation Efforts
paragraphs: Background: In its report, the panel stated that ERP implementation is  instrumental to resolving DOD’s financial management weaknesses and  achieving audit readiness and included a table that showed, by military  department, the ERP systems that are critical to Wave 2 and Wave 3.  The panel noted that although information was provided for select ERP  systems in the May 2011 FIAR Plan Status Report, full deployment dates  were not included for certain ERP systems. For example, the panel noted  that the Air Force did not provide a full deployment date for the  Expeditionary Combat Support System (ECSS), which was needed for its  SBR and mission-critical assets existence and completeness audit.
DOD Actions: According to the May 2015 FIAR Plan Status Report, DOD  officials agreed with the panel that the FIAR Plan Status Reports should  include more detail regarding the ERP programs to better evaluate  progress toward auditability and timely implementation of corrective  measures and increase confidence in the management of the  department’s investments in ERP systems. Consequently, DOD has  included separate sections with information on ERP systems and audit  readiness, starting with the November 2012 FIAR Plan Status Report and  through its November 2014 report. For its May 2015 FIAR Plan Status  Report, the information on ERP systems and audit readiness was  included in a section on the information technology systems critical to  audit readiness. Additional information that has been provided in the FIAR  Plan Status Reports includes (1) overview of the ERP systems,   (2) program cost, (3) impact on legacy systems, (4) information  technology controls, (5) implementation milestones and audit readiness  information, (6) financial reporting impact, and (7) status of financial  reporting objectives by assessable unit. While the department has  considered including additional risk management and remediation action  information in the FIAR Plan Status Reports, DOD officials have found  that the most effective reporting of the specific risks and potential  consequences of failure to meet ERP functionality requirements is  achieved through the acquisition governance and oversight reporting.  With regard to acquisition governance, the department is managing its  business systems, including ERP systems, as portfolios of investments.  The goal is to aggregate data from authoritative data sources and tools to  track and manage the overall performance of systems portfolios, including  ERP systems. For effective control, planning, mitigation, and remediation,  the department manages risk as part of acquisition oversight for each of  the ERP systems.
GAO Status: We consider this recommendation partially met because  DOD still needs to include risks and potential consequences of failing to  satisfy outstanding ERP functionality requirements or incurring future  milestone delays and related mitigation measures in the FIAR Plan Status  Reports. Moreover, the department still needs to provide information on  actual schedule slippages, cost increases, or both. While the existence of  these risks and the resulting effects on audit readiness may be known to  DOD management, external readers of the FIAR Plan Status Reports,  including those with oversight responsibility, do not have an accurate  picture of how much DOD’s financial auditability efforts rely on ERP  systems.
Background: The panel stated that it was concerned about reported  ERP schedule delays and cost overruns because the ERP systems are  critical to (1) resolving DOD’s financial management weaknesses and   (2) achieving audit readiness.
DOD Actions: According to the military departments, their ERP program  offices are integrating FIAR requirements and corresponding milestones  into the ERP schedules through their normal process of requirements  identification and technical solution development. According to the  Director, Business Integration, Office of the Deputy Chief Financial  Officer, the FIAR requirements are incorporated into the master set of  functional needs, business operations, and technical requirements and  appropriately integrated into the master program schedules in order to  meet the overall program scope and function. Moreover, ERP program  managers are accountable to their respective departments, services, and  agency organizations, and as such, their performance is evaluated  through the plans and performance objectives established within those  operations and business functions.
In its May 2015 FIAR Plan Status Report, DOD officials stated that each  ERP system program office is responsible for including all requirements,  including FIAR requirements, in its program schedules for its ERP  system. According to the report, the military departments have self- reported that they have included FIAR milestones and requirements in  their schedules for those ERP systems still in the acquisition process,  such as the Defense Agencies Initiative and the Air Force’s DEAMS.
ERP system programs that are in the development phases have been  given the FIAR requirements to include in the program schedules.
In the May 2015 FIAR Plan Status Report, DOD officials added that the  Office of the Under Secretary of Defense (Comptroller) has developed a  methodology to include audit readiness in the Investment Decision  Memorandum and the Acquisition Decision Memorandum. As stated in  the report, during the Investment Decision Memorandum process, and for  all systems that affect financial reporting, the Office of the Deputy Chief  Financial Officer will provide input on each investment decision approval.  The approval decision for each investment decision will depend on the  DOD component’s demonstration that audit readiness and related  compliance considerations have been included in the work products for  each ERP. In addition, according to the report, Acquisition Decision  Memorandums represent important checkpoints in the life cycles of DOD  systems and are critical to ensuring that the expected outcomes are  realized. Further, according to the report, for those systems that affect  financial reporting, the Office of the Deputy Chief Financial Officer  provides input for each acquisition decision approval at each business  capability life cycle milestone.
GAO Status: DOD officials have stated that the department has taken  actions to integrate FIAR milestones into ERP program schedules and  hold program managers accountable throughout the life cycles of the  ERP systems. However, we consider this recommendation partially met  because, for ERP programs that are still in the development phases, each  program office must still incorporate the provided FIAR requirements into  its program schedule as recommended by the panel. Moreover, the ERP  program managers still need to be continually evaluated on their ability to  maintain FIAR milestones as well as program acquisition-related  milestones as recommended by the panel. These two actions will need to  continue until DOD has completed its FIAR Plan audit readiness  activities.
Background: In its report, the panel expressed its concern about  reported ERP schedule delays and cost overruns and questioned whether  ERP schedule and cost estimates were reliable. The panel’s statements  were partly based on our October 2010 report in which we stated that the  department had identified nine ERP systems under development as  critical to transforming the department’s business operations and  addressing some of its long-standing weaknesses. The panel stated  that our analysis of the schedules and cost estimates for four ERP  programs—DEAMS, ECSS, GFEBS, and the Army’s Global Combat  Support System (GCSS-Army)—found that none of the programs were  fully following best practices for developing reliable schedules and cost  estimates. More specifically, none of the programs had developed a fully  integrated master schedule that reflected all activities, including both  government and contractor activities. In addition, none of the programs  established a valid critical path or conducted a schedule risk analysis.
DOD Actions: In the May 2015 FIAR Plan Status Report, DOD officials  stated that the department agrees that better methods are needed for  estimating ERP implementation costs and scheduling. However, DOD  officials added that the department’s experience with these programs  over the past 10 years, along with industry best practices, has helped  shape the strategies that are now being used in the management and  oversight of ERP implementations, including the following, among others:  Increasing discipline in requirements management.
Reengineering business processes before focusing on solutions.
Reducing customizations to commercial software.
Sustaining leadership involvement throughout the life cycle.
Emphasizing organizational change management to ensure that end  users understand the impact to their jobs.
Using end-to-end processes to better guide and constrain ERP  development and interoperability.
Measuring business performance consistently to assess ERP  impacts.
Incorporating portfolio management methods to make the right  investment decisions.
GAO Status: We consider this recommendation partially met because,  while DOD has taken actions to implement best practices in developing  reliable schedule and cost estimates, issues remain and additional  actions are needed to fully address the recommendation. In February and  September 2014, we reported that DOD has not fully implemented best  practices in its schedule and cost estimates for DEAMS and GCSS- Army, respectively. We found that the schedule for DEAMS did not meet  best practices, although the cost estimate did meet best practices. We  reported that the issues associated with the schedule could negatively  affect the cost estimate. For example, if there are schedule slippages, the  costs for the program could be greater than currently estimated. DOD  officials concurred with our recommendation that DOD consider and  make any necessary adjustments to the DEAMS cost estimate after  addressing our prior recommendation to adopt scheduling best  practices. In our review of the schedule and cost estimates for GCSS- Army, we reported that while the Army had made some improvements to  the schedule and cost estimates that supported the full deployment  decision, the Army did not fully meet best practices in developing cost  and schedule estimates for GCSS-Army and we recommended corrective  actions with which DOD concurred.
Background: The panel made this recommendation based on testimony  that the issues surrounding changes to systems requirements are the  cause of delays in ERP implementation. The panel noted in its report that  the requirements process tends to be underinclusive or overinclusive.  Including too many requirements can make ERP systems more  complicated than needed; too few requirements may result in ERP  systems that do not provide the needed functionality.
DOD Actions: In the May 2015 FIAR Plan Status Report, DOD officials  stated that the department agrees that ERP requirements must be  managed throughout ERP development, both within the program and  through involved oversight. DOD officials added that each ERP program  and the related “customer” DOD component has experienced project  scope creep and user-specific requirements that have driven cost and  schedule challenges. According to DOD officials, the lesson learned from  these experiences has been to strengthen management discipline  through change control boards and engaged knowledgeable senior- leader steering groups. In addition, the Milestone Decision Authority  (MDA) monitors the programs at a macro level for cost, schedule, and  performance and takes appropriate actions to address risks. The MDA  can establish specific criteria in an Acquisition Decision Memorandum  that an ERP program manager must meet before a program is authorized  to proceed to the next phase of development or limited or full deployment.  For example, the MDA signed two separate Acquisition Decision  Memorandums on April 18, 2014, that (1) identified decision criteria that  the Defense Agencies Initiative ERP must meet before moving forward  with a limited deployment and (2) gave specific exit criteria for the  Integrated Personnel and Pay System-Army Increment I program to meet  before the Army can fully deploy it to all locations. DOD officials stated  that each military department has change control boards and senior- leader steering groups to control requirements for ERP systems. The  MDA can set specific criteria in an Acquisition Decision Memorandum that  must be met by the ERP program manager before the decision is made  authorizing a program to proceed to (1) the next phase of development,  (2) limited fielding, or (3) full deployment.
GAO Status: This recommendation is applicable to DOD’s ongoing and  future ERP program efforts, and we consider it partially met because  DOD still needs to evaluate changes to ERP requirements as those  systems are developed, implemented, and utilized, as the panel  recommended.
Background: As for recommendation 4.4, the panel was concerned that  the requirements process was either underinclusive or overinclusive. For  example, the Army’s Chief Management Officer (CMO) stated that  underinclusiveness contributed to delays in implementing GFEBS.  Conversely, DOD’s DCMO stated that there is a tendency to overrequire,  supported by an institutional mindset that there is only one opportunity to  establish requirements for an ERP.
DOD Actions: According to its May 2015 FIAR Plan Status Report, DOD  has evaluated and modified its requirement processes for defense  business systems. DOD’s Business Capability Lifecycle, which requires  disciplined delivery of capabilities to end users in 18 months, operates  within DOD’s governance framework comprising the Investment Review  Boards and Defense Business Systems Management Committee, which  in turn advise the MDA for the ERP programs. Working through the Major  Acquisition Information System MDA for systems, the Deputy Chief  Financial Officer can ensure that requirements are being met. DOD  officials added that the Office of the DCMO and the military CMOs will  continue to assess current practices for governing requirements and  implement needed changes.
GAO Status: We consider this recommendation partially met because, in  accordance with the panel recommendation, DOD needs to continue to  assess the requirement decision-making processes at every level of  authority for its ongoing and future ERP implementation efforts.
Background: The panel was concerned that ERP systems may not  provide the capabilities needed to achieve FIAR objectives. For example,  we testified before the panel that some ERP systems do not function as  intended. According to the panel’s report, if the ERP systems do not  provide the intended capabilities, DOD components must continue to rely  on legacy systems and manual processes. Therefore, DOD’s goals of  modernizing and streamlining its business processes and strengthening  its financial management capabilities—leading to financial statement  auditability—could be jeopardized.
DOD Actions: According to its May 2015 FIAR Plan Status Report, DOD  agrees with the panel that effective information technology acquisition  requires thorough risk management, including the identification, analysis,  and mitigation of risks. DOD officials stated in the report that its FIAR  methodology identifies ERP systems and associated feeder systems that  relate to achieving FIAR goals. Each military department has established  a risk management approach in which major risks are tracked and  mitigation plans are developed to identify measures for resolving  weaknesses associated with the development, implementation, and use  of its ERP systems that could affect the achievement of FIAR goals.
Each of the military departments reports on its respective ERP system  program, for which it is responsible for resolving weaknesses, at the  regularly scheduled FIAR review sessions. Officials from the military  departments described the efforts to mitigate risks associated with ERP  implementations. For example, Air Force officials stated that the risk  management plan for DEAMS describes a comprehensive risk  management process. According to Air Force officials, specific risks  associated with FIAR compliance have been identified, are currently  being assessed, and will be reported and tracked through the DEAMS  risk management program.
According to Army officials, each Army ERP program has developed its  own risk management procedure, based on existing Army regulations. In  addition, each Army ERP program has developed documentation on  applicable FIAR-related processes, risks, and controls to mitigate risks.  The Army’s ERP program offices provide periodic acquisition and  program reviews at the MDA level. These reviews include programmatic  and audit-related risks associated with an ERP program as well as risk  mitigation steps associated within the program. Army officials stated that  additional requirements and actions are identified to mitigate risk if a risk  is outside of the program’s direct control.
Navy officials stated that its Enterprise Business Solutions (formerly the  Navy ERP Program Office) has a risk management program consisting of  two components: (1) the Risk Committee, which allows any individual to  bring a risk to program leadership’s attention, and (2) the Risk Board,  which is the program’s senior leadership review and mitigation planning  forum for identified risks.
GAO Status: DOD has developed risk mitigation plans for its ERP  systems. However, we consider this recommendation partially met  because DOD and its components need to continually monitor ERP and  FIAR efforts to identify actual and potential weaknesses or deficiencies  associated with developing, implementing, and using ERP systems that  could affect the achievement of FIAR goals. Moreover, DOD components  need to identify implementation steps and assign responsibilities for the  performance of these steps to resolve the potential weaknesses or  deficiencies, as the panel recommended. Further, time frames need to be  established for taking these steps. The identification of any alternative  arrangements needed outside of the ERP environment to meet FIAR  objectives is critical to ensuring that a DOD component will be able to  make these arrangements and not hinder DOD’s audit readiness goals.
Background: In its report, the panel stated that conversion of data from  the legacy systems to the new ERP systems is a difficult and challenging  effort. The panel noted that each military department had taken its own  approach to data conversion and expressed its concern that poor  execution of data conversion efforts could cause delays in implementing  ERP systems.
DOD Actions: In its May 2015 FIAR Plan Status Report, DOD stated that  the military departments have learned from past experience. For  example, the Air Force, after its initial data conversion for DEAMS at  Scott Air Force Base, decided not to convert legacy data into DEAMS, but  instead to use a dual-processing approach. Under this approach, newly  initiated transactions are entered into DEAMS, but transactions already  initiated in legacy systems continue to be processed in the legacy system  until contract closeout. The Director of Business Integration, Office of the  Under Secretary of the Comptroller, stated that since 2012, when the  panel issued its report, data conversions from legacy systems to ERP  systems have become part of standard protocols performed between an  individual ERP program office and the deploying DOD component or  organization. Data conversions to ERP systems focus on open  transactions only for the purposes of providing matching transactions  when the disbursements and matching outlays occur. According to this  official, since 2012, the data conversions for the Defense Agencies  Initiative ERP and Navy ERP, for example, have gone smoothly. With  regard to the panel’s recommendation that DOD assess the merits of  designating a senior official responsibility for coordinating and overseeing  data conversion, a DOD official stated that while the recommendation  may have made sense in 2012, when the panel’s report was issued, it is  no longer relevant given the quality of data conversions over the last 3  years and the standard protocols used for data conversions for each  individual ERP deployment.
GAO Status: DOD has evaluated lessons learned from previous data  conversion efforts and considered these lessons in its current data  conversion efforts. However, we consider this recommendation partially  met because the department will need to periodically update its data  conversion plans. According to the panel, these updates will need to  include assessments of (1) the progress made in converting data into the  ERP environment, (2) whether that progress supports the satisfaction of  existing requirements, and (3) whether additional data conversion  requirements would facilitate achieving FIAR objectives.
Background: In its report, the panel stated that the DOD Deputy IG  testified that the numerous interfaces between ERP systems and legacy  systems may be overwhelming and may not be adequately defined. As  stated in the panel’s report, the number of interfaces is driven by the  number of legacy systems. The panel is concerned that problems  associated with these interfaces could be compromising functionality.  According to the panel report, DOD should make every effort to reduce  reliance on those legacy system activities that can be effectively and  efficiently conducted by ERP systems. The panel also stated that DOD  should complete and validate its business process reengineering analysis  to ensure that those business processes supported by the ERP systems  will be as streamlined and efficient as practicable and that the need to  tailor ERP systems to meet unique requirements or to incorporate unique  interfaces has been eliminated or reduced to the extent practicable.
DOD Actions: According to DOD’s May 2015 FIAR Plan Status Report,  the department is increasingly approaching investment decisions with a  portfolio view to reduce or eliminate unique requirements and interfaces.  As DOD also stated in that report, DOD has begun to implement process  improvements across all systems by implementing key strategic  initiatives, including its use of the global exchange to increase the  interoperability and exchange of standardized data between systems. In  its report, DOD also stated that there is a strategy to reduce the number  of existing legacy systems over the next several years, which will lessen  the need for a large number of interfaces. The military department CMOs  and the DCMOs (for the other defense organizations) examine and  validate the need for unique requirements and interfaces as they develop  their respective organizational execution plans in preparation for review  by the Defense Business Council.
GAO Status: We consider this recommendation partially met because  DOD, through its business process reengineering, needs to ensure that  unique requirements and interfaces are reduced to the minimum extent  practicable. As the military departments and components proceed with  FIAR activities related to ERP systems, the organizational execution plan  reviews and other actions to implement these key strategic initiatives will  be critical in identifying the causes of interface issues, determining how  many and which interfaces can be reduced, and the improvements that  can be made to support more effective interfaces. Furthermore, in  implementing this recommendation, the department needs to ensure that  its components are reengineering current business practices rather than  customizing commercial ERP systems. For example, the DOD IG has  reported that DOD has not reengineered its business processes to the  extent necessary; instead, it has often customized commercial ERP  systems to accommodate existing business processes. This  customization creates a need for system interfaces and weakens controls  built into an ERP. The ERP systems were designed to replace numerous  subsidiary systems, reduce the number of interfaces, standardize data,  eliminate redundant data entry, and provide an environment for end-to- end business processes, while being a foundation for sustainable audit  readiness. However, the DOD IG stated that the numerous interfaces  between the ERP systems and existing systems may be overwhelming  and inadequately defined. Each interface presents a risk that a system  might not function as designed, and each prevents the linking of all  transactions in an end-to-end process.
Background: In its report, the panel stated that the FIAR Guidance calls  for the DOD components to test information systems controls for key  systems and processes. Because most financial information is maintained  in computer systems, the controls over how those systems operate are  integral to the reliability of financial data. For example, the panel noted  that if auditors are able to rely on information system controls, the extent  of substantive testing can be significantly reduced. According to the  panel, DOD should continue to subject its systems, both legacy systems  and ERP systems, to information systems controls testing, but it must  also ensure that a priority is placed on this testing and that sufficient  numbers of appropriately skilled personnel exist within the test and  evaluation community. In addition, when implementing ERP systems,  DOD should ensure that the systems satisfy the computer control  objectives established in GAO’s Federal Information System Control Audit  Manual.
DOD Actions: According to the May 2015 FIAR Plan Status Report,  officials from the Office of the Director, Operational Test and Evaluation  (OT&E), do not perform testing for all systems, but provide guidance to  assist organizations in performing testing. Officials from OT&E stated that  assessing information system control testing needs is difficult because of  the different interpretations of information system controls. As a result of  these inconsistencies, gaps exist in the types of testing that are actually  accomplished. Nevertheless, OT&E officials stated that they are not  specifically concerned with testing individual information systems  controls, but rather that (1) a typical user can perform operational tasks  with the production-representative system in an operationally realistic  computing environment and (2) the system has the appropriate computer  network defense capabilities.
According to OT&E officials, DOD’s components implementing ERP  systems, including the military departments, are involved in the  information systems control testing of their ERP systems by developing  the test and evaluation master plans. According to these officials, these  plans, provided by ERP program managers and approved by OT&E  officials, specify appropriate testing for ERP systems. For example, Navy  officials said that the Navy will coordinate with OT&E and others to  ensure that the appropriate workforce and skill sets have been identified  for evaluation and testing. OT&E officials stated that they anticipate the  department’s increasing need to improve the cybersecurity of its ERP  systems and other programs and networks will require increased test  resources, especially for cyber ranges. According to these officials, there  are three groups of organizations that play a critical role in the information  systems control testing of ERP systems.  1.  User/requirements communities. It is critical for the user/requirements  communities to identify the specific ERP information systems control  requirements beginning with the request for proposal.  2.  Operational test agencies. These agencies are responsible for  executing operational tests for each ERP.  3.  ERP program managers. The program managers develop the test and  evaluation master plans for approval from the Director, Operational  Test and Evaluation.
GAO Status: We consider this recommendation partially met because  OT&E officials, in consultation with the DCMO and components, will need  to continue assessing their role in evaluating information system controls  for all ERP systems being deployed by the department and examine  necessary skill sets to accomplish such testing to determine if additional  training is required within the developmental and operational test  communities, as recommended by the panel. In addition, DOD has not  yet ensured the testing of general and application controls for its ERP  systems that are critical to DOD’s financial audit readiness efforts. As  DOD stated in its May 2015 FIAR Plan Status Report, the department  must evaluate and remediate controls for hundreds of information  technology systems that materially affect the financial statements to  achieve and sustain an audit ready systems environment. However,  additional actions are needed because DOD’s approach for testing ERP  systems may not result in the benefits of testing envisioned by the panel  because the focus of DOD’s testing is based more on the operational  capability of the systems and their security from attack than the specific  application controls of the ERP systems. For example, the panel noted  that if auditors are able to rely on information system controls, the extent  of substantive testing can be significantly reduced. Under DOD’s broad  approach, specific application controls for ERP systems that affect the  information under audit may not be tested.
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Michael S. LaForge (Assistant  Director), Sandra S. Silzer (Auditor-in-Charge), and Laura S. Pacheco  made key contributions to this report. Also contributing to this report were  Doreen S. Eng, Francine M. DelVecchio, Maxine L. Hattery, and Jared D.  Minsk.