Financial Management: FFMIA Implementation Critical for Federal Accountability
Released: 2001-10-01T00:00:00

Letter

Background

FFMIA and other financial management reform legislation have emphasized the importance of improving financial management across the federal government. The primary purpose of FFMIA is to ensure that agency financial management systems routinely provide reliable, useful, and timely financial information. With such information, government leaders will be better positioned to invest resources, reduce costs, oversee programs, and hold agency managers accountable for the way they run government programs. Financial management systems’ compliance with federal financial management systems requirements, applicable accounting standards, and the SGL are building blocks to help achieve these goals.

Management Reform Legislation

FFMIA is part of a series of management reform legislation passed by the Congress over the past two decades. This series of legislation started with the Federal Managers’ Financial Integrity Act of 1982 (FIA), which the Congress passed to strengthen internal control and accounting systems throughout the federal government, among other purposes. Issued pursuant to FIA, the Comptroller General’s Standards for Internal Control in the Federal Government provide the standards that are directed at helping agency managers implement effective internal control, an integral part of improving financial management systems.

Effective internal control also helps in managing change to cope with shifting environments and evolving demands and priorities. As programs change and as agencies strive to improve operational processes and implement new technological developments, management must continually assess and evaluate its internal control to ensure that the control activities being used are effective and updated when necessary. While agencies had achieved some success in identifying and correcting material internal control and accounting system weaknesses, their efforts to implement the FIA had not produced the results intended by the Congress.

Therefore, in the 1990s, the Congress passed additional management reform legislation to improve the general and financial management of the federal government. As shown in figure 1, the combination of reforms ushered in by (1) the CFO Act of 1990, (2) the Government Management Reform Act (GMRA) of 1994, (3) FFMIA, (4) GPRA, and (5) the Clinger- Cohen Act of 1996, if successfully implemented, provides a basis for improving accountability of government programs and operations as well as routinely producing valuable cost and operating performance information, thereby making it possible to better assess and improve the government’s effectiveness, financial condition, and operating performance.

Financial Management Systems Requirements

The financial management systems policies and standards prescribed for executive agencies to follow in developing, operating, evaluating, and reporting on financial management systems are defined in OMB Circular A- 127, Financial Management Systems. Circular A-127 references the series of publications entitled Federal Financial Management System Requirements (FFMSR), issued by JFMIP as the primary source of governmentwide requirements for financial management systems. JFMIP systems requirements, among other things, provide a framework for establishing integrated financial management systems to support program and financial managers.

JFMIP also issues financial system requirements for both administrative and programmatic financial management systems. Administrative systems include those generally common to all federal agency operations such as budget, acquisition, travel, property, and payroll. Agencies implement programmatic systems as needed to fulfill the agency’s mission, such as inventory, grants, insurance and benefit payments, and loans. For example, SSA would need a benefit payment system to fulfill its mission of providing social security and disability payments to the elderly and disabled. However, SSA would not need to implement a loan system since it does not process loans. Figure 2 is the JFMIP model that illustrates how these systems interrelate in an agency’s overall systems architecture.

The first of JFMIP’s system requirements documents covering the core financial systems requirements was issued in 1988. Since then, JFMIP has been issuing system requirement documents covering specific functional areas, such as inventory systems. Most recently, JFMIP issued an exposure draft on Benefit System Requirements in May 2001, and has an ongoing project underway to develop system requirements for acquisition systems. Appendix I lists the current publications in the FFMSR series and their issue dates. JFMIP recently updated and revised the Core Financial System Requirements and issued an exposure draft in June 2001.

JFMIP tests vendor COTS packages and certifies that they meet current financial management system requirements for core financial management systems. To maintain a certificate of compliance, vendors with qualified software packages must successfully complete any incremental tests required by JFMIP. These tests are conducted to ensure that vendor software offerings are aligned with current federal financial management requirements.

Federal Accounting Standards

Federal accounting standards, which agency CFOs use in preparing financial statements and in developing financial management systems, are promulgated by the Federal Accounting Standards Advisory Board (FASAB). FASAB develops accounting standards after considering the financial and budgetary information needs of the Congress, executive agencies, and other users of federal financial information and comments from the public. FASAB forwards the standards to the three principals— the Comptroller General, the Secretary of the Treasury, and the Director of OMB—for a 90-day review. If there are no objections during the review period, the standards are considered final and FASAB publishes them on its Web site and in print.

The American Institute of Certified Public Accountants now recognizes the federal accounting standards promulgated by FASAB as being generally accepted accounting principles for the federal government. This recognition enhances the acceptability of the standards, which form the foundation for preparing consistent and meaningful financial statements both for individual agencies and the government as a whole.

Currently, there are 19 statements of federal financial accounting standards (SFFAS) and 3 statements of federal financial accounting concepts (SFFAC). The concepts and standards are the basis for OMB’s guidance to agencies on the form and content of their financial statements and the government’s consolidated financial statements. Appendix II lists the concepts, standards, and interpretations along with their respective effective dates.

FASAB’s Accounting and Auditing Policy Committee (AAPC) assists in resolving issues related to the implementation of accounting standards. AAPC’s efforts result in guidance for preparers and auditors of federal financial statements in connection with implementation of accounting standards and the reporting and auditing requirements contained in OMB’s Form and Content Bulletin and Audit Bulletin. To date, AAPC has released five technical releases, which are listed in appendix III along with their release dates.

Standard General Ledger

The SGL was established by an interagency task force through the direction of OMB and mandated for use by agencies in OMB and Treasury regulations in 1986. The SGL promotes consistency in financial transaction processing and reporting by providing a uniform chart of accounts and pro forma transactions used to standardize federal agencies’ financial information accumulation and processing, enhance financial control, and support budget and external reporting, including financial statement preparation. The SGL is intended to improve data stewardship throughout the government, enabling consistent reporting at all levels within the agencies and providing comparable data and financial analysis at the governmentwide level.

Remediation Plans

FFMIA requires an agency head to determine, based on a review of the auditor’s report on the agency’s financial statements and any other relevant information, whether the agency’s financial management systems substantially comply with the act. The agency head is required to make this determination no later than 120 days after (1) the receipt of the auditor’s report or (2) the last day of the fiscal year following the year covered by the audit, whichever comes first. If the agency head disagrees with the auditor’s determination that the systems do not substantially comply, the Director of OMB is to review the agency head’s determination and report to the Congress. If the agency head agrees that the systems do not substantially comply, FFMIA requires that the agency head, in consultation with the Director of OMB, establish a remediation plan to bring the systems into substantial compliance with FFMIA’s requirements.

According to FFMIA, remediation plans are to include corrective actions, intermediate target dates, and resources necessary to bring the financial management systems into substantial compliance with FFMIA’s requirements within 3 years of the date the agency head’s noncompliance determination is made. If, with the concurrence of the Director of OMB, the agency head determines that substantial compliance cannot be reached within 3 years, the remediation plan must specify the most feasible date by which the agency’s systems will achieve compliance and designate an official responsible for effecting the necessary corrective actions.

In accordance with the revisions to OMB guidance contained in Circular A- 11, Preparing and Submitting Budget Estimates, effective July 19, 2000, agencies are to include their remediation plans in their annual budget submissions due to OMB by December 15, 2000. The guidance requires that the plans include corrective actions, resources needed, and interim target dates to bring the financial management systems into substantial compliance within 3 years of the date of the agencies’ determination that their systems are not in substantial compliance. The plan must also list the officials responsible for bringing the systems into substantial compliance with FFMIA.

OMB Guidance Related to FFMIA

Under its mandate to set governmentwide financial management policies and requirements, OMB currently has two sources of guidance related to FFMIA. First, OMB Bulletin No. 01-02, Audit Requirements for Federal Financial Statements, prescribes specific language auditors should use when reporting on compliance with FFMIA. Second, in a January 4, 2001, memorandum, OMB revised its implementation guidance for agencies and auditors to use in assessing compliance with FFMIA.

The revised implementation guidance is to be used for financial reports and audits for fiscal year 2000 and thereafter. This guidance (1) describes the factors that should be considered in determining an agency’s systems compliance with FFMIA and (2) provides guidance to agency heads to assist in developing corrective action plans for bringing their systems into compliance with FFMIA. Examples are also provided on the types of indicators that should be used as a basis in assessing whether an agency is in substantial compliance with FFMIA.

Scope and Methodology

We reviewed fiscal year 2000 financial statement audit reports for the 24 CFO Act agencies to determine (1) which agencies had systems that their auditors found to be noncompliant with FFMIA requirements, (2) the reasons why the systems were found to be noncompliant, and (3) evidence of agencies’ progress in becoming compliant. Using structured interviews, we interviewed agency management and auditors for each of the 24 CFO Act agencies to obtain their perspectives on FFMIA implementation, including the factors that contributed to agencies’ systems compliance with FFMIA and the obstacles faced by management in becoming compliant. We also reviewed the auditors’ workpapers for the 24 CFO Act agencies to assess the nature and extent of FFMIA testing.

We reviewed OMB’s FFMIA guidance. To obtain an understanding of the fiscal year 2000 audit requirements, we analyzed OMB’s January 4, 2001, memorandum that revised FFMIA implementation guidance and reviewed OMB Bulletin No. 01-02, Audit Requirements for Federal Financial Statements and predecessor guidance. Further, we reviewed the guidance for preparing remediation plans for fiscal year 1999 contained in revisions to OMB Circular A-11, Preparing and Submitting Budget Estimates. We reviewed agencies’ fiscal year 1999 remediation plans to determine if they contained the required elements and if the corrective actions, if implemented successfully, had a reasonable likelihood of resolving agencies’ systems problems. We did not review the agencies’ fiscal year 2000 remediation plans because these plans were not due to OMB until September 10, 2001. We compared the fiscal year 1999 remediation plans to those for fiscal year 1998 to determine if they had improved. We held discussions with OMB officials to apprise them of the scope and nature of our work and reviewed applicable federal accounting standards and systems requirements documents. We made inquiries of JFMIP staff to determine recent developments in their respective efforts to issue new system requirements documents.

We conducted our work from January through August 2001 at the 24 CFO Act agencies, OMB, and JFMIP in the Washington, D.C., area in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Director of OMB or his designee. The Deputy Controller of OMB provided us with written comments. These comments are discussed in the “Agency Comments and Our Evaluation” section and reprinted in appendix V. We also requested oral comments from selected agency officials whose financial management systems or audit procedures are specifically discussed in the report. These comments have been incorporated as appropriate.

Continued System Weaknesses Prevent Full Financial Management Accountability

Overall, the government continues to face serious financial management systems weaknesses. Agencies have recognized the seriousness of their problems, and OMB has made financial systems reform a priority. Today, there are many ongoing initiatives to address the overarching financial management systems problems that are at the heart of the serious financial management weaknesses that are prevalent. Importantly, financial management systems reform is a part of one of the five governmentwide initiatives in the President’s Management Agenda.

Agencies continue to make progress in addressing their financial management system weaknesses. At the same time, they have a long way to go. The vast majority of these agencies are still not substantially complying with FFMIA’s requirements. Auditors for 19 of the 24 CFO Act agencies reported that for fiscal year 2000, the agencies’ systems did not comply substantially with one or more FFMIA requirements—federal systems requirements, federal accounting standards, or the SGL.

For fiscal year 2000, 7 agencies were reported not to be in substantial compliance with all 3 FFMIA requirements; 18 were reported not in substantial compliance with systems requirements; 12 were reported not in substantial compliance with accounting standards; and 8 were reported not in substantial compliance with the SGL. Auditors for five agencies—the Department of Energy, the National Aeronautics and Space Administration (NASA), the National Science Foundation (NSF), the Small Business Administration (SBA), and the General Services Administration (GSA)— reported that the results of tests disclosed no instances in which the agencies’ systems did not substantially comply with the three requirements of FFMIA. By reporting negative assurance, which is the form of reporting called for in OMB Bulletin No. 01-02, these auditors are not saying that the systems are in substantial compliance, but that the results of their tests disclosed no instances in which the agencies’ systems did not substantially comply with FFMIA. We discuss this issue further in this report. Figure 3 summarizes the auditors’ FFMIA determinations for fiscal year 2000.

Eighteen of the 24 CFO Act agencies received unqualified audit opinions on their financial statements for fiscal year 2000, up from 15 in fiscal year 1999, 12 in fiscal year 1998, and 6 in fiscal year 1997. This represents steady progress and a lot of hard work by the agency CFOs and their staffs, OMB, Treasury, and the audit community.

At the same time, auditors for 13 of the 18 agencies that received unqualified opinions reported that the agencies’ financial systems did not comply substantially with FFMIA’s requirements in fiscal year 2000. In many instances, agencies have been able to obtain unqualified audit opinions only through extensive labor-intensive efforts, which include expending significant resources to use extensive ad hoc procedures, and making billions of dollars in adjustments to derive financial statements. This is usually the case when agencies have inadequate systems that are not integrated and routinely reconciled. The President’s Management Agenda calls these efforts “extraordinary, labor-intensive assaults on financial records.” These time-consuming procedures must be combined with sustained efforts to improve agencies’ underlying financial management systems and controls. If agencies continue year after year to rely on significant costly and time-intensive manual efforts to achieve or maintain unqualified opinions, it can serve to mislead the public as to the true status of agencies’ financial management capabilities. In such a case, an unqualified opinion would become an accomplishment without much substance.

Although the CFO Act agencies face challenges, some formidable, in preparing financial statements, all issued their financial statements on time. In a prior report, we recommended that OMB work with the agencies to ensure that the agencies’ financial statements are audited and issued by the March 1 statutory deadline. For fiscal year 2000, all 24 of the CFO Act agencies met the March 1 statutory due date, 5 months after the end of the fiscal year. In comparison, in fiscal year 1999, 5 of the 24 CFO Act agencies issued their audited statements after the statutory due date. Going forward, we anticipate the timeframes becoming tighter and reporting requirements earlier, which will intensify the need to overhaul the financial management systems. The Director of OMB and the Secretary of the Treasury have indicated that more timely and more frequent financial statement reporting will be an objective to help improve financial management. As a first step, OMB recently proposed that agencies prepare and issue unaudited interim financial statements starting with the 6-month period ending March 31, 2002, and submit these statements to OMB by May 31, 2002. Beginning with fiscal year 2003, OMB will require agencies to prepare and submit unaudited interim financial statements on a quarterly basis. Also, for fiscal year 2002, OMB has moved the reporting date from March 1 to February 1. We support these actions by OMB.

Financial statement audit results are key indicators of the quality of agency financial data at year-end and provide an annual public scorecard on accountability. While the increase in the number of agencies that are receiving unqualified audit opinions is noteworthy, it is only one of three indicators of the quality of financial management information. Having effective internal controls to help managers better achieve agencies’ missions and program results and minimize operational problems along with financial management systems that routinely generate reliable, useful, and timely information are also key indicators of the quality of an agency’s financial management information. As shown in figure 4, fully integrated financial systems, reliable and timely financial statements, and effective internal control serve as indicators for an entity’s financial management health.

A clean audit opinion alone only provides credibility to an agency’s financial statements as of the date of the financial statements—the last day of the fiscal year. It provides no assurance about the effectiveness or efficiency of financial systems used to prepare the statements, the quality of internal control, or whether the systems can produce reliable data for decision-making purposes on demand throughout the year.

For example, the Department of the Treasury received its first unqualified opinion on its fiscal year 2000 departmentwide financial statements. However, like several other agencies, despite the unqualified opinion, Treasury’s IG reported that Treasury’s systems did not comply substantially with FFMIA. For example, the Internal Revenue Service (IRS) continues to face most of the pervasive systems and internal control weaknesses that we have reported each year since we began auditing IRS’ financial statements in fiscal year 1992.

As discussed in our report on the IRS fiscal year 2000 financial statements, IRS’ unqualified opinion was the culmination of 2 years of extraordinary efforts on the part of IRS senior management and staff to develop compensating processes to work around its serious systems and control weaknesses to derive year-end balances for its financial statements. Top management at IRS and its staff are to be applauded for their dedication that resulted in an unqualified opinion. While IRS’ efforts did address several management issues we raised in previous audits, its approach to obtaining an unqualified opinion on its fiscal year 2000 financial statements relied heavily on costly, time-consuming, and labor- intensive efforts, including the need for statistical projections, external contractor support, substantial adjustments, and monumental human efforts that extended well after the fiscal year-end. This was particularly the case for reporting amounts for both tax receivables and property and equipment.

Because IRS’ systems cannot accurately track amounts representing taxes receivable, IRS has for the past 4 years employed a complex statistical sampling process to derive the balance reported on its financial statements; this process takes months to complete, requires extensive human and financial resources, and results in tens of billions of dollars in adjustments annually to present a balance that is good for one day only. Additionally, because IRS does not have an adequate property management system, it had to use contractors to (1) perform statistical sampling procedures to derive a reliable balance for property and equipment in fiscal year 1999; and (2) analyze fiscal year 2000 transactions to derive the September 30, 2000, balance for property and equipment, a process that extended into February 2001.

Situations such as those at IRS demonstrate the tremendous efforts many agencies make to produce auditable annual financial statements. These agencies undertake far more work to prepare financial statements than would be necessary if they had basic financial systems in place to routinely provide both the data for financial statements and management information. The financial statement preparation and audit process puts a tremendous strain on the staff of the CFO and the auditors and diverts resources from correcting the underlying problems. To quote the Secretary of the Treasury, “it takes the federal government 5 months to close our books…This is not the stuff of excellence.”

As we discuss below, one of the main problems agencies face is the lack of an integrated financial management system. Having an effective, integrated financial management system that can produce financial information in a timely manner minimizes the need for time-consuming and costly procedures to prepare financial statements and, most importantly, provides the information needed to manage on an ongoing basis. To remedy their problems, agencies are in the process of either implementing new core financial systems or upgrading their current systems to lay the foundation for compliance with FFMIA.

In this regard, by far DOD faces the most complex and difficult challenges of any agency. Today, DOD relies on an overly complex and error prone network of systems that are not integrated. Millions of transactions must be manually keyed and rekeyed into the vast number of systems involved in any given DOD business process. Weak systems and controls leave DOD vulnerable to fraud and improper payments. In addition, as we recently testified, lacking an effective network of systems and the related inability to obtain reliable cost and budget information severely constrains DOD’s ability to maintain adequate funds control, measure performance, reduce costs, and maintain effective accountability over its estimated $1 trillion investment in weapon systems and inventories. Because of the unparalleled size and complexity of DOD’s operations along with the serious, deeply entrenched nature of its financial management system deficiencies, it will not be possible to fully implement an integrated system structure overnight. Such a dramatic transformation will require a sustained effort over a number of years. As discussed later in this report, the Secretary of Defense and the DOD Comptroller have stated that priority will be given to financial management reform.

Other agencies such as the Departments of Commerce, Agriculture, and Education, SBA, GSA, and AID are planning or are in the process of implementing new systems. And yet others, such as NASA, have failed in recent attempts to successfully implement new systems, and are starting over. One thing that stands out though is that across the board, agencies have recognized their shortcomings and assisted by OMB and with input from the audit community are working to modernize their financial management systems and processes.

In addition, several agencies have made progress in other areas aimed at improving their financial management systems. For example, in fiscal year 2000, the Department of Agriculture IG reported the establishment of a Senior Executives group to develop a corporate strategy, including a budget and timeframes, for administrative and financial system changes to the agency’s various systems. According to Agriculture officials, this was a clear sign that senior level executives for the department were acknowledging that there was a need to develop overall agency financial systems rather than continue to rely on multiple stand-alone subsystems. In another instance, auditors for the Department of Education reported that the agency made progress in strengthening controls over IT processes. The auditors also reported that the implementation of new controls and the reinforcement of existing controls increased the effectiveness of internal controls in areas such as IT planning and security management.

Reasons for Noncompliance

Based on our review of fiscal year 2000 audit reports for the 19 agencies’ systems that were reported to be substantially noncompliant with FFMIA, we identified 6 primary reasons either cited by the auditors or identified in our structured interviews with agency officials as to why their systems were noncompliant: lack of integrated financial management systems, inadequate reconciliation procedures, lack of accurate and timely recording of financial information, noncompliance with the SGL, lack of adherence to federal accounting standards and/or OMB weak security controls over information systems.

Figure 5 shows the relative frequency of these problems at the 19 agencies with noncompliant systems and the problems relevant to FFMIA that were reported by their auditors or obtained through interviews with agency officials. Auditors reported these problems among the weaknesses identified during the audits; however, the auditors may not have reported the problems as specific reasons for why they concluded that the agencies’ systems did not substantially comply with FFMIA. We included all weaknesses relevant to FFMIA identified by the auditors because such problems must be resolved in order for the agencies’ systems to generate the reliable, useful, and timely information needed for decision-making. Also, the reported problems may not be all inclusive. For some agencies, the problems are so serious and well known that the auditor can readily determine the systems to be noncompliant without examining every facet of FFMIA compliance.

Nonintegrated Financial Management Systems

One of the federal financial management systems requirements is that agencies’ financial management systems be integrated. The CFO Act calls for agencies to develop and maintain an integrated accounting and financial management system that complies with federal systems requirements and provides for (1) complete, reliable, consistent, and timely information that responds to the financial information needs of the agency and facilitates the systematic measurement of performance; (2) the development and reporting of cost information; and (3) the integration of accounting, budgeting, and program information. In this regard, OMB Circular A-127, Financial Management Systems, requires agencies to establish and maintain an integrated financial management system that conforms with JFMIP’s functional requirements.

An integrated financial system coordinates a number of functions to improve overall efficiency and control. When agencies do not have an integrated financial management system—which includes administrative and program systems that maintain financial information, such as budgeting, logistics, personnel, acquisition, and property systems—they are often forced to rely on ad hoc programming, analysis, or actions such as duplicative transaction entries. In these situations, agencies must expend major efforts and resources to generate financial information that their systems should be able to provide on a daily or recurring basis.

The lack of integrated financial systems is a continuing serious problem for most agencies. Based on discussions with agency officials at the 19 agencies that were reported to be noncompliant with FFMIA, lack of an integrated system and adequate funding to replace old systems were key obstacles in achieving compliance with FFMIA. Some agencies rely heavily on external consultants to develop financial information. The results of our work showed that 13 of the 24 CFO Act agencies used the assistance of contractors in preparing their financial statements because their systems were not able to produce this information. Many of these officials agree that a key to improving financial management and complying with FFMIA is to have an integrated financial system that provides reliable, useful, and timely information that managers can use for day-to-day operations. However, according to these officials, to upgrade or replace existing systems requires funding and a strong commitment from management, which many of them said they did not have in the past. In this regard, the President’s Management Agenda makes clear the commitment of the President to ensure that federal financial systems produce accurate and timely information.

As shown in figure 5, auditors for 13 of the 19 agencies with noncompliant systems reported lack of integrated systems as a problem. To illustrate, VA achieved an unqualified opinion on its fiscal year 2000 consolidated financial statements, but to do so required a significant amount of resources and manual processes. Auditors for VA noted continued difficulties related to the preparation, processing, and analysis of financial information to support the preparation of VA’s consolidated financial statements. Considerable manual work-arounds and “cuff,” or out-of-date feeder systems are still in place as VA has not yet completed its transition to a new fully integrated financial management system, Core Financial and Logistics System. As a result, significant efforts were made at the component and consolidated levels to assemble, compile, and review the necessary financial information for annual financial reporting requirements. Specifically, auditors noted that a significant number of adjustments were recorded as part of the year-end closing process, many to record additional activities—both budgetary and proprietary—not reflected in the general ledger prior to the year-end close. The general ledgers for some smaller funds are maintained outside the existing core financial management system. Thus, until the new system is successfully implemented and functional, a significant amount of resources will be devoted to preparing the financial statements.

We recently reported that NASA could not provide detailed support required in time for our audit of its space station or shuttle obligations because it does not have an integrated financial management system. According to NASA officials, transaction-level obligation data are available at NASA’s 10 space centers on separate and different financial systems. NASA officials also told us that NASA has long-term plans for implementing an integrated financial management system that will make access to detailed obligation data more readily available.

Further, as we discussed in our performance and accountability series report, according to NASA, the agency’s financial management environment is comprised of decentralized, nonintegrated systems with policies, procedures, and practices that are unique to its field centers. For the most part, data formats are not standardized, automated systems are not interfaced, and on-line financial information is not readily available to program managers. Thus, it is difficult to ensure contracts are being efficiently and effectively implemented and budgets are executed as planned. In addition, NASA has pointed out that the cost to maintain these systems has been high, since both data and software are replicated at each field center.

Deficiencies in agencies’ automated systems, including the lack of integrated systems, can also contribute to improper payments. The reported estimates of improper payments across the government totaled approximately $20 billion for both fiscal years 2000 and 1999. These improper payments frequently occur because agency personnel lack needed information, rely on inaccurate data, and/or do not have timely information.

For example, we identified issues related to the National Institutes of Health’s (NIH) oversight and monitoring of grant recipients—an area with over $17 billion appropriated in fiscal year 2000 to conduct and sponsor biomedical research. Among other things, there were discrepancies between the data in NIH’s management, payment, and accounting systems. These discrepancies affected the accuracy of grant award amounts. These system deficiencies could result in NIH’s erroneously awarding grants to ineligible grant receipts and in funds being used for improper purposes. If these systems were integrated, NIH would have fewer discrepancies in its data and would need to devote substantially less effort to assuring that the data across those three functions were consistent. According to HHS officials, NIH has implemented compensating controls to address these systems deficiencies. Moreover, system deficiencies are also a factor for DOD. DOD’s payment process suffers from nonintegrated computer systems that require data to be entered multiple times, sometimes manually, which poses substantial increases in the risk of incorrect payments and overpayments.

Inadequate Reconciliation Procedures

A reconciliation process, even if performed manually, is a valuable part of a sound financial management system. The general maxim would be that the less integrated the financial management system, the greater the need for adequate reconciliations because data for the same transaction may be separately entered in multiple systems. Reconciliation of records from the multiple systems would ensure that transaction data were entered correctly in each one. Reconciliation procedures are a control necessary in order to maintain and substantiate the accuracy of the data reported in an agency’s financial statements and reports. The Comptroller General’s Standards for Internal Control in the Federal Government highlight reconciliation as a key control activity.

As shown in figure 5, auditors for 16 of the 19 agencies with reported noncompliant systems reported that the agencies had reconciliation problems, including difficulty reconciling their Fund Balance with Treasury accounts with the Department of the Treasury’s records. Treasury policy requires agencies to reconcile their accounting records with Treasury records monthly, which is comparable to individuals reconciling their checkbooks to their monthly bank statements. However, such reconciliations are not being routinely performed.

For example, Agriculture’s Office of the Chief Financial Officer/National Finance Center’s (OCFO/NFC) Fund Balance with Treasury account had not been properly reconciled with Treasury records since 1992. In its audit report on Agriculture’s fiscal year 1998 financial statements, the IG reported that the absolute value of the differences between OCFO/NFC’s and Treasury’s records was $4.4 billion for disbursements and $383 million for deposits as of September 30, 1998. In fiscal year 2000, Agriculture contracted with a public accounting firm to assess OCFO/NFC’s reconciliation efforts, provide recommendations for resolving the reconciliation problem, assist in leading the actual reconciliations, as well as recommend ways to improve the overall reconciliation process. The IG recently reported that the absolute value of the out-of-balance amount for Agriculture’s Central Accounting System had been reduced to $226 million as of September 30, 2000. The OCFO proposed a one-time adjustment to write off $160 million of the total $226 million.

In another instance, the Department of Health and Human Services (HHS) made numerous adjustments at year-end to correct errors and to develop accurate financial statements. Many of these adjustments would not have been necessary had management routinely reconciled and analyzed accounts throughout the year. For example, the HHS IG reported that differences between the Administration for Children and Families’ (ACF) Fund Balance with Treasury account and Treasury’s records ranged from $200 million to $6.3 billion at various times during fiscal year 2000.

Lack of Accurate and Timely Recording of Financial Information

Accurate and timely recording of financial information is key to successful financial management. Recording transactions in the general ledger in a timely manner can facilitate accurate reporting in agencies’ financial reports and other management reports that are used to guide managerial decisionmaking. The Comptroller General’s Standards for Internal Control in the Federal Government state that transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. As shown in figure 5, auditors for 14 of the 19 agencies with reported noncompliant systems found that the agencies did not record transactions accurately and timely in the general ledger.

For example, the Department of Commerce IG reported that $270 million in appropriations for two of the agency’s programs was not recorded in the general ledger until 6 months after the apportionment for these appropriations was issued. According to SFFAS No. 7, Accounting for Revenue and Other Financing Sources, appropriations should be recognized when available to the agency to be apportioned. The IG reported that the apportionment for these two programs was issued on September 30, 1999, and should have been recorded in the general ledger at that time. According to the IG, the failure to record these appropriations was due to confusion among agency officials as to which fiscal year the program was established and where the program should be recorded. Because the agency did not include these appropriations in its fiscal year 1999 financial statements, during fiscal year 2000 a prior period adjustment of $270 million was made to properly recognize the budget authority for the two programs.

In other instances, auditors for five agencies reported that unliquidated obligations were not deobligated on a timely basis due to the lack of procedures for reviewing unliquidated obligations or the failure to follow these procedures. For example, auditors for the EPA reported that although EPA was aggressive during fiscal year 2000 in identifying and deobligating invalid obligations, EPA’s annual process for reviewing inactive unliquidated obligations for validity still needed improvement. The annual review by EPA management revealed that due to significant backlogs, EPA did not timely process and deobligate inactive unliquidated obligations. As a result of the weaknesses identified in its annual review, a special review was performed to obtain a more accurate accounting of its unliquidated obligations. In fiscal year 2000, the special review identified $26.5 million in open unliquidated obligations that should have been deobligated by September 30, 2000. EPA had to make a $26.5 million adjustment to more accurately present its Statements of Financing and Budgetary Resources.

Noncompliance with the SGL

Implementing the SGL at the transaction level is one of the specific requirements of FFMIA. Applying the SGL at the transaction level means that a financial management system will process transactions following the SGL definitions of the general ledger accounts. Specifically, compliance with the SGL at the transaction level requires that (1) data used in financial reports be consistent with the SGL, (2) transactions be recorded consistently with SGL accounting transaction definitions and processing rules, and (3) transaction detail supporting SGL accounts be directly traceable to specific SGL account codes. By not implementing the SGL, agencies are challenged to provide consistent financial information across their component entities and functions. The effect of such differences has contributed to our disclaimer of opinion on the U.S. government’s consolidated financial reports for the last 4 fiscal years because the government could not ensure that the information in its financial statements was properly and consistently compiled.

As shown in figure 5, auditors for 8 of the 19 agencies with noncompliant systems reported that the agencies’ systems did not comply with the SGL requirement for fiscal year 2000. This is compared to the 14 agencies that were reported in noncompliance with SGL requirements in fiscal year 1999. An example of improvement is the Department of Labor, where the IG reported that for fiscal year 2000, management took steps to improve the financial accounting for back wages with the design and implementation of Labor’s new Back Wage Collection and Disbursement System. With the improvements made, the IG concluded that the new system was substantially in compliance with the SGL.

Other agencies are working to become SGL compliant. For example, the HUD IG reported that HUD was not compliant with the SGL at the transaction level. The Federal Housing Administration (FHA), a major component of HUD, provides consolidated summary level data to HUD’s Central Accounting and Program System (HUDCAPS). FHA has 19 subsidiary systems that feed transactions to its own commercial general ledger system. To provide consolidated summary level data from FHA to HUDCAPS, FHA used numerous manual procedures, including the use of personal computer based software to convert its commercial accounts- based general ledger to the government SGL and then transfer the account balances to HUDCAPS. During fiscal year 2000, FHA purchased a COTS financial system to replace its current system. FHA management anticipates that the implementation of the new accounting system will result in FHA’s compliance with the requirement for automated posting of transactions to SGL accounts.

Lack of Adherence to Federal Accounting Standards

One of FFMIA’s requirements is that agencies’ financial management systems comply with federal accounting standards. Agencies face significant challenges implementing these standards. As shown in figure 5, auditors for 12 of the 19 agencies with reported noncompliant systems reported that the agencies had problems complying with one or more of these standards. Some agencies have experienced difficulty implementing the standards because their financial management systems are not capable of producing the financial data needed. The standards most often cited by the auditors relate to managerial cost accounting; property, plant, and equipment; accounting for inventory and related property; and accounting for revenue and other financing sources. FASAB continues to deliberate on new and emerging accounting issues that could result in its issuing additional standards; therefore, agencies’ systems also must be flexible enough to be able to accommodate any standards that may be issued in the future.

A major cornerstone of FFMIA is good cost accounting information that program managers can use in managing day-to-day operations. Managerial cost accounting is aimed at providing reliable and timely information on the full cost of federal programs, their activities, and outputs. The cost information can be used by the Congress and federal executives in making decisions about allocating federal resources, authorizing and modifying programs, and evaluating program performance. Developing the necessary information, which is needed as well to support GPRA implementation, will be a substantial undertaking.

Of the 12 agencies’ systems reported to be noncompliant with one or more of the federal accounting standards, 7 of these agencies were reported in noncompliance with SFFAS No. 4, Managerial Cost Accounting Concepts and Standards. However, as mentioned earlier, if an agency had serious problems overall, the auditor may not have reviewed every area for compliance so the extent of this specific shortcoming may be greater. Our sense is that today few agencies may have good cost accounting information. The seven agencies’ systems that were reported by their auditors as noncompliant with the cost accounting standard are not able to provide timely full cost accounting information and at best can only provide this information at the end of the fiscal year through periodic cost surveys or other cost finding techniques. The lack of timely cost information seriously impinges the capacity to make informed managerial decisions on a daily basis, precludes meaningful and timely reporting on performance measures, and could result in project cost overruns and program inefficiencies. Performance information is necessary to determine the value of government programs and their success in achieving their goals. Further, the move to implementation of performance-based budgeting highlights the need for cost accounting information at the program level. If program managers are going to be more accountable for the achievement of output targets, they will need timely, accurate information on the cost of their programs. At the present, program managers do not always have information on, or control of, the full costs of support services, retirement, and other nondirect costs associated with their programs.

For example, the IG for AID reported that the agency did not comply with the five fundamental elements of managerial cost accounting. AID’s current financial management system does not provide complete, reliable, timely, or consistent information. Specifically, missions cannot determine the cost of their program strategic objectives. Furthermore, AID does not have cost allocation tools to utilize detailed administrative and program cost information from overseas accounting stations. As a result, AID is not able to assign costs to organizations, locations, projects, programs, or activities.

The IG for DOT reported that the Federal Aviation Administration (FAA) has made progress implementing its cost accounting system, but still has much to do. FAA’s actual cost for air traffic controller and airways facilities maintenance labor, estimated at $3.4 billion for fiscal year 2001, cannot be broken down further to a specific shift of air traffic control or airways facilities maintenance. Therefore, FAA cannot develop potentially useful information such as the cost associated with a particular shift. FAA’s labor costs are more than half of its total costs. An effective cost accounting system that fully accounts for labor cost by activities and services would allow FAA to identify areas of low productivity and high cost, as well as high productivity and cost efficiency.

While we recently reported that NASA did not have needed cost accounting data for the actual costs of completed space station components, its auditors reported that the results of their tests disclosed no instances in which NASA’s systems did not comply substantially with FFMIA. The results of our work raise questions about NASA’s compliance with SFFAS No. 4, Managerial Cost Accounting Concepts and Standards. NASA systems do not track and maintain cost data for NASA’s completed space station components. Because NASA does not attempt to track these costs, the agency does not know the actual cost of completed space station components and is not able to re-examine its cost estimates for validity once costs have been realized. Further, as discussed earlier, NASA does not have an integrated financial management system. These issues raise questions about management’s assertion regarding compliance with FFMIA.

Weak Security Over Information Systems

Information security weaknesses are one of the primary causes for agencies’ systems noncompliance with FFMIA. As a result, federal assets continue to be at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. Significant computer security weaknesses in systems that handle the government’s unclassified information continue to be reported in each of the major federal agencies.

As shown in figure 5, auditors for the 19 agencies with reported noncompliant systems reported information security weaknesses as a problem in fiscal year 2000. Our high-risk series report shows that all of the 24 CFO Act departments and agencies have significant computer security weaknesses. The computer security weaknesses covered the full range of computer security controls. For example, physical and logical access controls were not effective in preventing and detecting system intrusions and misuse. In addition, software change controls were ineffective in ensuring that only properly authorized and tested software programs were implemented. Further, duties were not adequately segregated to reduce the risk that one individual could execute unauthorized transactions or software changes without detection. Finally, sensitive operating system software was not adequately controlled, and adequate steps had not been taken to ensure continuity of operations. The risks associated with these weaknesses are heightened because of the increasing interconnectivity of today’s computerized systems and use of the Internet that further exposes them to outside hackers.

The Standards for Internal Control in the Federal Government highlight the need for adequate control over automated information systems to ensure protection from inappropriate access and unauthorized use by hackers and other trespassers or inappropriate use by agency personnel. Unresolved information security weaknesses could adversely affect the ability of agencies to produce accurate data for decision-making and financial reporting because such weaknesses could compromise the reliability and availability of data that are recorded in or transmitted by an agency’s financial management system.

The degree of risk caused by security weaknesses is extremely high and places a broad array of federal operations and assets at risk of fraud, misuse, and disruption. For example, weaknesses at the Department of the Treasury increase the risk of fraud associated with billions of dollars of federal payments and collections, and weaknesses at DOD increase the vulnerability of various military operations. Further, information security weaknesses place enormous amounts of confidential data, ranging from personal and tax data to proprietary business information, at risk of inappropriate disclosure.

One of our most recent reports on computer security highlights significant and pervasive computer security weaknesses that place sensitive Department of Commerce systems at risk. Individuals both within and outside Commerce could gain unauthorized access to these systems and thereby read, copy, modify, and delete sensitive economic, financial, personnel, and confidential business data. Moreover, intruders could disrupt the operations of systems that are critical to the mission of the department. Poor detection and response capabilities at the Commerce bureaus we reviewed increase the likelihood that incidents of unauthorized access to sensitive systems will not be detected in time to prevent or minimize damage.

Commerce’s weaknesses were attributable to the lack of an effective information security program, that is, lack of centralized management, a risk-based approach, up-to-date security policies, security awareness and training, and the effectiveness of implemented controls. These weaknesses are exacerbated by Commerce’s highly interconnected computing environment in which the vulnerabilities of individual systems affect the security of systems in the entire department, since a compromise in a single poorly secured system can undermine the security of the multiple systems that connect to it.

Similarly, in another recent report, we reported that in spite of progress made in correcting computer security weaknesses previously identified by the Interior IG and other steps to improve security, our review of Interior’s information system general controls identified additional weaknesses at its National Business Center (NBC) in Denver, CO. These weaknesses affected the center’s ability to (1) prevent and detect unauthorized changes to financial information, including payroll and other payment data; (2) control electronic access to sensitive personnel information; and (3) restrict physical access to sensitive computing areas. The effect of these weaknesses is to place sensitive NBC-Denver financial and personnel information at risk of unauthorized disclosure, critical financial operations at risk of disruption, and assets at risk of loss. These weaknesses and risks also affect other agencies that use computer-processing services at NBC- Denver.

In recognition of these serious security weaknesses, we and the Inspectors General have issued numerous reports that identify computer security weaknesses in the federal government and have made recommendations to agencies regarding specific steps they should take to make their security programs more effective. Also, in 2001, we again reported information security as a high-risk area across government, as we did in our 1997 and 1999 high-risk series. In addition, we have identified best practices for improving information security management, which we published in two guides. Our guides are consistent with guidance on information security program management provided to agencies by OMB and the National Institute of Standards and Technology (NIST).

Further, recognizing the highly networked federal computing environment and the resulting need for improved security management measures, the Congress enacted the Government Information Security Reform (GISR) provisions as part of the fiscal year 2001 Defense Authorization Act. The legislation seeks to provide a comprehensive framework for establishing and ensuring the effectiveness of information security controls over information resources that support federal government operations and assets. GISR requires agencies to implement an information security program that is founded on a continuing risk management cycle and largely incorporates existing security policies found in OMB Circular A-130, Appendix III. GISR also added an important new requirement by calling for both annual management and independent evaluations of the information security program and practices of an agency. The results of these reviews, which are initially scheduled to become available in late 2001, will provide a more complete picture of the status of federal information security than currently exists, thereby providing the Congress and OMB an improved means of overseeing agency progress and identifying areas needing improvement.

Criteria for Assessing Compliance With FFMIA Should Be Made More Rigorous

OMB’s current FFMIA implementation guidance, which was revised on January 4, 2001, and was effective for fiscal year 2000 audits, provides information for auditors to consider in evaluating and reporting audit results. This guidance requires auditors to plan and perform their audit work in sufficient detail to enable them to determine the degree of compliance and report on instances of noncompliance for all of the applicable FFMIA requirements. We agree with this objective. The guidance describes specific minimum requirements that agency systems must meet to achieve compliance and provides indicators of compliance. The FFMIA implementation guidance also indicates that auditors should report on FFMIA compliance as part of the financial statement audit process based upon OMB Bulletin No. 01-02, Audit Requirements for Federal Financial Statements. OMB Bulletin No. 01-02 states that auditors shall perform tests of the entity’s compliance with FFMIA.

In providing guidance on reporting on substantial compliance with FFMIA, OMB Bulletin No. 01-02 states that auditors should report that “the results of our tests disclosed no instances in which the agency’s financial management systems did not substantially comply” . In contrast, FFMIA requires the auditors to “…report whether the agency financial management systems comply with the requirements of .” This is an important distinction because under auditing standards the terminology “disclosed no instances” means that the auditor is providing negative assurance. Under generally accepted government auditing standards, only limited incidental testing is necessary for an auditor to give negative assurance. However, to “report whether,” or to provide positive assurance, auditors need to perform sufficient testing to draw a conclusion. Auditors for the five agencies that were not reported to be noncompliant with FFMIA provided negative assurance in accordance with OMB guidance. If the readers of the report do not understand this distinction, they may have a false impression that the systems have been reported to be substantially compliant by the auditors.

Today for most agencies, because their systems deficiencies are well known and well documented and based on other audit work the auditor may have performed outside of the financial statement audit, the auditor may have sufficient knowledge to conclude that an agency is not in substantial compliance with FFMIA without performing additional testing beyond that needed for the financial statement audit opinion. The auditors for the 19 agencies that reported agencies’ systems to be noncompliant with FFMIA for fiscal year 2000 told us they relied on knowledge obtained from prior years’ audits or the internal control and compliance with laws and regulation testing performed during the current year financial statement audits.

However, to provide positive assurance when assessing substantial compliance with FFMIA requirements, sufficient testing is needed. Some of the promising audit procedures noted during our review included the use of detailed audit programs and an assessment of financial systems’ functionality. For example, auditors for 7 of the 24 agencies—the Department of Energy, AID, NSF, EPA, HUD, NRC, and OPM—designed and used separate FFMIA audit programs to test for compliance. Other procedures that auditors could perform to provide positive assurance when assessing compliance with FFMIA include using the GAO and JFMIP checklists that were developed as assessment tools. For example, the auditors for NRC used the GAO checklist to determine systems’ compliance with JFMIP systems requirements, while the auditors for the Department of Labor used the JFMIP checklist to determine the agency’s core financial system’s compliance with FFMIA. For both agencies, the auditor reported that the agency systems were not compliant with FFMIA.

GAO and the President’s Council on Integrity and Efficiency (PCIE) recently issued a joint Financial Audit Manual (GAO/PCIE FAM). This manual provides the methodology for performing financial statement audits of federal entities. Section 350 of this manual describes the procedures auditors should follow in determining the nature, timing, and extent of control tests and of tests for systems’ compliance with FFMIA requirements. Specifically, the manual states that the auditor should use any management-provided documentation of the work that management did for its assertion about the systems’ conformance with the agency’s annual Financial Integrity Act report and any work management may have done for FFMIA as a basis for determining the nature and extent of audit work needed. Management’s role is important and the comprehensive nature of its determination as to whether it is in substantial compliance is important in the audit process.

For example, if management provides the auditor with a checklist detailing the functions the systems are able to perform, the auditor generally should select some significant functions from the checklist and determine whether the systems perform them. Overlap exists between testing for FFMIA compliance and testing internal controls. The GAO/PCIE FAM cites a number of techniques, such as observation, inspection, and walkthroughs that the auditor can employ when performing this work. Further, to achieve maximum efficiency, these tests for FFMIA compliance generally should be done concurrently with other nonsampling control tests.

The nature of FFMIA will always require a certain degree of judgement on the part of auditors and management. OMB's revised implementation guidance provides examples for auditors and management to consider when assessing compliance with FFMIA. For example, the guidance states that an agency’s systems are substantially compliant with FFMIA, if they can, (1) prepare financial statements and other required financial and budget reports using information generated by the financial management systems; (2) provide reliable and timely financial information for managing current operations; (3) account for their assets reliably, so that they are properly protected from loss, misappropriation, or destruction; and (4) do all of the above in a way that is consistent with the federal accounting standards and the SGL. Nonetheless, auditors for 10 agencies and financial management officials at 4 agencies told us that they encountered problems in interpreting the guidance including OMB’s definition of “substantial compliance.” FFMIA states that agencies’ financial management systems should “comply substantially” with the systems’ requirements, accounting standards, and SGL requirements but does not elaborate on the meaning of “comply substantially.” Some in the CFO and audit communities believe that without further guidance, the interpretation and application of the guidance will likely remain inconsistent throughout the federal government.

Auditors for seven agencies told us that, in their view, OMB’s January 2001 revised guidance appeared to lower the threshold for determining compliance with FFMIA, providing more agencies an opportunity to become compliant with FFMIA. For example, the auditor for one agency believes that the revised guidance is too subjective, while the auditor for another agency told us that the guidance eliminated specific systems requirements. Further, officials at one agency told us that they believed the change in the guidance related to the systems security indicators lowered the threshold. In fact, according to the auditors and agency officials for this same agency, the change in OMB’s revised guidance, which was retroactive for fiscal year 2000, was the reason for the agency’s reported systems’ compliance in fiscal year 2000. In fiscal years 1999 and 1998, the auditor reported that the agency was not in substantial compliance with FFMIA because of reportable conditions related to IT security control weaknesses. OMB’s previous guidance characterized IT security controls that were considered reportable conditions as an indicator of an instance of noncompliance with FFMIA. In contrast, the revised guidance states that only material IT security control weaknesses should be considered as indicators of noncompliance with FFMIA. According to the auditors and agency officials, because the revised guidance no longer characterized IT security controls that were reportable conditions as indicators of instances of noncompliance, the auditors determined that the agency was compliant with FFMIA for fiscal year 2000.

Moreover, although the compliance indicators in OMB’s revised implementation guidance were meant only as examples of compliance, auditors for three of the agencies which ultimately reported the agencies’ systems to be noncompliant with FFMIA and two auditors that provided negative assurance used the indicators in OMB’s revised guidance as a prescriptive checklist for determining an agency’s systems compliance. These auditors compared the material weaknesses and reportable conditions identified through the financial statement audit process to the OMB compliance indicators, and if no deficiencies in a specifically listed indicator had been identified as part of the financial statement audit work, no noncompliance with FFMIA was reported. If a deficiency in a specific indicator was noted, noncompliance was reported. This was not the way the OMB indicators should have been used because just applying the indicators is too limiting and was not OMB’s intention. Without a comprehensive approach, key systems’ functionalities may not be assessed and the extent of noncompliance will remain uncertain. Without testing the functionality of a financial management system, auditors cannot be assured that the agencies’ systems are operating as designed and that the systems substantially comply with FFMIA.

Successful FFMIA Implementation Requires Top Management Commitment, Adequate Resources, and Redesigned Processes

Bringing agency financial management systems into compliance with FFMIA requirements is a formidable challenge that requires sustained top management commitment, adequate funding resources, skilled financial management staff, and meaningful management information. Our Executive Guide: Creating Value Through World-class Financial Management identifies these factors, among others, as key success factors and practices associated with world-class financial management. Agency officials we interviewed repeatedly emphasized the need for top management commitment and adequate resources to effect the changes needed to upgrade or replace financial management systems. To enhance their capabilities of providing meaningful information to decisionmakers, leading organizations included in GAO’s Executive Guide reengineered their business processes in conjunction with implementing new technology.

The Executive Guide further points out that at world-class financial management organizations, top executives demonstrate their commitment by ensuring that the necessary resources needed to effect the changes for improved financial management are available. However, 11 of the 19 agencies with reported noncompliant systems cited lack of funds as an obstacle in achieving compliance with FFMIA. Our interview results showed that agencies also need adequate human capital resources, which includes not just enough staff but also skilled staff for critical positions. Many of the officials we interviewed told us that having enough staff with the right skill mix was a problem for the agencies in achieving their FFMIA goals. Officials at 14 of the 19 agencies with noncompliant systems cited the lack of adequate human capital resources as an obstacle to achieving FFMIA compliance. It is crucial that the federal government has a qualified workforce with the right mix of skills to successfully implement financial systems. A key factor is having a well-qualified project manager to lead this effort. The Core Competencies for Project Managers Implementing Financial Systems in the Federal Government identifies competencies in three areas: financial management, human resources, and technical. Pursuit of these competencies will enable project managers to meet the challenge of today’s changing environment and prepare for the future.

Strategic human capital management is a pervasive challenge in the federal government. To highlight the urgency of this governmentwide challenge, in January 2001 we added strategic human capital management to our list of federal programs and operations identified as high risk. As stated in the high-risk series report, human capital shortfalls are eroding and threatening the ability of many agencies to effectively, efficiently, and economically perform their missions. As a result, this area needs greater attention to ensure maximum government performance and accountability.

Another key success factor for world-class financial management is meaningful management information. Financial information is meaningful when it is reliable, useful, and timely. However, as discussed earlier, most federal agencies lack the systems and processes required to produce meaningful financial information needed for management decision-making. To remedy their financial management systems problems, many agencies are implementing COTS software packages. In this regard, JFMIP tests vendor COTS packages and certifies that they meet current financial management system requirements for core financial management systems. Agencies who have or are currently implementing COTS packages include the Departments of Agriculture, Education, Transportation, and Veterans Affairs, DOD components such as the Defense Finance and Accounting Service and the Military Sealift Command, HUD’s FHA, and AID.

A key to successful implementation of COTS systems, according to leading finance organizations, is reengineering business processes to fit the new software applications that are based on best practices. The Clinger-Cohen Act requires agency heads to modernize inefficient mission-related and administrative processes (as appropriate) before making a significant investment in IT systems to support them. Thus, an assessment of current processes should be completed before any decision is made about acquiring technology. As a result, federal agencies are beginning to consider the merits of information technology approaches that involve reengineering business processes in conjunction with implementing COTS software without significant modification.

Remediation Plans Improved but Continue To Lack Important Details

The CFO Act requires OMB to prepare and submit to the Congress a governmentwide 5-year financial management plan, including annual status updates. Among other requirements, the governmentwide plan is to describe strategies for improving financial management. To help compile the governmentwide 5-year plan, OMB uses agency-specific financial management plans that agencies prepare as part of their budget submissions and are also required by the CFO Act. FFMIA requires agency management to prepare remediation plans, in consultation with OMB, that describe the corrective actions they plan to take to resolve their instances of noncompliance, target dates, and resources necessary to bring financial systems into substantial compliance with FFMIA requirements. Further, the recently issued President’s Management Agenda for improving financial management states that OMB will work with agencies to ensure that federal financial systems produce accurate and timely information to support operating, budget, and policy decisions.

For our report on FFMIA compliance last year, we reviewed remediation plans agencies prepared to address problems identified in the fiscal year 1998 financial statement audits. We concluded that the majority of the plans lacked sufficient detail to be adequate tools for agency management and staff to use in resolving financial management problems. For this year’s report, we reviewed agencies’ fiscal year 1999 remediation plans. Overall the plans improved slightly over those for fiscal year 1998. While OMB has worked with many agencies to prepare or revise these plans, which helped improve the plans, many still lacked sufficient detail and descriptions of the resources needed for executing the corrective actions. Further, some of the corrective actions included in the remediation plans we reviewed did not fully address the problems they are intended to correct. As we reported last year, remediation plans need to be sufficiently detailed to provide a “road map” for agency management and staff to resolve financial management problems. The severity of problems facing agencies as they attempt to replace or overhaul old and outdated financial systems and resolve serious information security weaknesses, among other things, highlights the need for detailed remediation plans.

Of the 21 agencies whose systems were reported to be noncompliant with FFMIA in fiscal year 1999, 16 prepared remediation plans. Two agencies— SSA and FEMA—did not submit remediation plans for fiscal year 1999 to OMB because agency management determined that their systems were in substantial compliance with FFMIA. While SSA and FEMA management acknowledged that the weaknesses identified by the auditors exist, they did not agree with the auditors that the weaknesses resulted in lack of “substantial” compliance. However, SSA and FEMA have provided comments, including corrective actions, in response to the auditors’ recommendations.

In addition, 3 of 21 agencies—the Departments of Justice and State and GSA—did not prepare separate remediation plans to address reported fiscal year 1999 instances of noncompliance. The Department of Justice addressed instances of FFMIA noncompliance for both fiscal years 1999 and 2000 in its Financial Management Status Report and Five-Year Plan dated May 2001. Department of State officials decided not to issue a separate remediation plan for fiscal year 1999 but rather to focus on implementing actions in its March 2000 plan and on updating its remediation plan to address the fiscal year 2000 instances of noncompliance. Lastly, GSA officials told us that management did not prepare a remediation plan for fiscal year 1999 because the agency’s systems were determined to be in compliance for fiscal year 2000, and the severity of the problems for fiscal year 1999 no longer warranted development of a plan.

FFMIA provides that if the compliance determination made by the agency head differs from the auditors’ findings, the Director of OMB is to review the determinations and provide a report on the findings to the appropriate committees of the Congress. Further, although FFMIA does not require a remediation plan if an agency head determines the agency’s systems comply substantially, OMB Circular A-11 requires agencies to address systems weaknesses in their financial management improvement plans.

We reviewed the 16 available remediation plans to determine whether (1) they included all the instances of noncompliance identified in the fiscal year 1998 financial statement audit reports; (2) the planned corrective actions were accompanied by detailed steps; (3) the corrective actions, if successfully implemented, could potentially resolve the problems; (4) they included information about resources needed; and (5) they provided target dates for completing the corrective actions. Figure 6 presents the results of our analysis.

As shown in figure 6, 14 of the agencies’ remediation plans included corrective actions that covered all of the reported instances of noncompliance identified as a result of the fiscal year 1999 financial statement audit. The remediation plans for two agencies, HUD and DOD, did not include corrective actions to cover all of the instances of FFMIA noncompliance reported. While HUD’s remediation plan covered virtually all of its instances of noncompliance, it did not fully address computer security weaknesses over its information systems. The corrective actions in DOD’s plan, referred to as its Financial Management Improvement Plan (FMIP),could not be specifically related to the reported instances of FFMIA noncompliance.

Another limitation with a number of the remediation plans is that the corrective actions were broadly stated and did not include sufficient details describing how actions are to be accomplished. As shown in figure 6, corrective actions in 11 of the 16 remediation plans fell into this category. An example of a plan with sufficient details describing corrective actions is HUD’s remediation plan. In its plan, HUD included specific actions for addressing FHA’s compliance with the SGL at the transaction level, which includes completing the feeder system SGL financial transaction processes for 19 systems, validating extracts from existing feeder systems, and determining the appropriate SGL accounting treatment and data format.

In contrast, one of the corrective actions in AID’s remediation plan is to develop cost allocation models with cost drivers to attribute costs to the agency’s goals. Based on our review of AID’s remediation plan, we found no information that describes, even in general terms, the cost drivers and how the cost allocation models will be developed. As we discuss later, when an agency’s corrective actions involve implementing or replacing financial management systems, it is important to have a detailed plan that includes adopting sound IT investment and control processes.

While there is a substantial amount of professional judgment associated with assessing the adequacy of these plans, we determined that the corrective actions in the remediation plans of 15 agencies, if successfully implemented, could potentially resolve the problems, as shown in figure 6. For DOD, we determined that the corrective actions described in the agency’s remediation plan probably would not resolve the problems. For example, we recently reported that while DOD’s fiscal year 2000 FMIP is a significant effort and an improvement over prior plans, it largely represents a compilation of the military services’ and DOD components’ stovepiped approaches, and therefore is not an effective management tool that establishes a departmentwide strategic approach for developing an integrated DOD-wide financial management system. Such stovepiped approaches have been at the heart of previous DOD-wide reform initiatives that have produced some incremental improvements, but have not resulted in the fundamental reform necessary to resolve these long-standing management challenges. As we recently testified, DOD’s financial management challenges must be addressed as part of a comprehensive, integrated, DOD-wide business process reform, including an enterprisewide systems architecture to guide and direct its financial management modernization investment. If the hundreds of initiatives outlined in the plan are not implemented as part of an overall financial management architecture, DOD runs the risk that its system efforts will result in perpetuating a system environment that is duplicative, not interoperable, unnecessarily costly to maintain, and is unable to optimize financial management performance and accountability. We are encouraged that the Secretary of Defense has stated that he intends to include financial management reform among his top priorities. Most recently, DOD has initiated a number of actions that hold promise for addressing its long- standing serious problems in this area. For example, DOD recently announced plans to (1) dedicate significant funding to this area; (2) establish a top level steering committee that is to include leaders of its major components and Secretariat-level organizations; and (3) analyze ongoing and planned financial management systems initiatives across the Department to curtail high-risk efforts that will not lead to an integrated financial management structure.

OMB’s guidance and FFMIA state that remediation plans are to include resources and target dates necessary to achieve substantial compliance. As shown in figure 6, 10 of the 16 remediation plans we reviewed did not include a discussion of resources needed. Resource information is important for agencies and OMB to determine whether corrective actions can realistically be undertaken.

Finally, as shown in figure 6, all 16 of the remediation plans included timeframes. This is an improvement over fiscal year 1998, where 14 of the 19 remediation plans included timeframes. The plans would be further enhanced by including intermediate target dates. Setting specific intermediate target dates help keep agencies on track as they implement corrective actions. FFMIA, which was enacted 5 years ago, specifies that agencies have 3 years to bring their systems into compliance after a determination of noncompliance has been made.

FFMIA also provides for extending the time needed to complete the planned actions past 3 years with the concurrence of OMB. As mentioned earlier, in our discussion of the extent of long-term challenges facing DOD, 3 years will not be enough time for some agencies to address their remaining problems. Therefore, OMB’s continuing leadership and oversight of remediation efforts will be important.

Systems Replacement Projects Emphasize a Need for Comprehensive Plans

The importance of having a good remediation plan becomes more evident when corrective actions in remediation plans involve IT investments, such as implementing or replacing financial management systems or software. Agencies invest more than $40 billion in IT for about 26,000 information systems. Technology now affects virtually every aspect of the way the government operates, and IT investments are extremely important to the success of e-government transforming the delivery of information and services. To ensure that IT dollars are directed toward prudent investments designed to achieve cost savings, increase productivity, and improve the timeliness and quality of service delivery, agencies need to apply the framework outlined in the Clinger-Cohen Act of 1996 and implementing guidance.

The Clinger-Cohen Act requires agencies to use a capital planning and investment control process to compare and prioritize all IT projects using explicit quantitative and qualitative decision criteria. Moreover, the Clinger-Cohen Act requires agencies to adopt an IT architecture, a well- defined and enforced blueprint for operational and technological change.

An enterprise architecture provides an agency with a clear and comprehensive picture of an entity and includes a capital investment road map for transitioning from the current to the target, or the planned future environment. In concert with an enterprise architecture, the Clinger-Cohen Act requires agencies to have disciplined approaches for developing or acquiring software, including an effective evaluation process for assuring that the contractor-developed software satisfies the defined requirements.

OMB officials told us that they are working with agencies regarding the application of the framework outlined in the Clinger-Cohen Act and that OMB’s review of agencies’ IT capital asset planning processes is linked to its review of agencies’ remediation plans. As discussed further in the next section, OMB’s continuing leadership is critical to the efforts across government to improve financial management systems. Many agencies are planning or are in the process of implementing new core financial management systems. Implementing or overhauling financial management systems can understandably take time, and the systems may not be operational for several years. For example, as previously discussed, VA is planning to replace its “patchwork” of computer systems and correct its FMFIA material systems weaknesses by implementing a single commercial financial management and logistics system. This system implementation effort, called the Core Financial and Logistics System, is targeted to be completed by the end of 2003. Similarly, the Centers for Medicare and Medicaid Services have efforts underway to implement the Integrated General Ledger Accounting System and expects to complete implementation in fiscal year 2007.

NASA has found implementation of new financial management systems to be a challenge. In describing its need for an integrated financial management system, NASA has stated that its financial management environment was comprised of decentralized, nonintegrated systems, with policies, procedures, and practices unique to its field centers. The Integrated Financial Management System (IFMS) is expected to correct these problems. NASA is undertaking its third attempt to implement an integrated financial management system. In a prior attempt, a former contractor working on the IFMS had difficulties upgrading its software to support new technologies and to meet all federal requirements. This contract was eventually terminated, and the program to implement the system has been changed so that implementation of the new system is broken into individual software modules. NASA CFO officials told us that NASA is now moving to a COTS package for its core financial system. NASA expects to implement the core financial system at its centers in fiscal year 2003.

Agriculture encountered problems in implementing a COTS package to provide a departmentwide accounting system, due to inadequate project planning and inexperienced management coupled with insufficient business process reengineering. According to PriceWaterhouseCoopers, Agriculture’s implementation of the COTS package was impacted by insufficient strategic planning. For example, Agriculture did not have a single, strong strategic plan to guide the implementation of its Foundation Financial Information System (FFIS). The strategic implementation plan should have been developed in concert with its component agencies and communicated throughout the Department. Moreover, Agriculture did not do sufficient analysis of its business processes before attempting to implement the FFIS at the Forest Service. As a result, significant effort was expended automating existing and complex business processes, some of which needed to be reengineered. Agriculture hired experienced financial systems program management staff in the fourth quarter of 1998. This staff reoriented the FFIS project and has implemented the FFIS in six major Agriculture agencies since the beginning of fiscal year 2000. Agriculture expects to implement the FFIS at another eight agencies on October 1, 2001. According to Agriculture officials, the keys to progress for this project, required knowledgeable staff, management support, and resources.

OMB Plays an Important Role By Providing Advice on FFMIA Remediation Plans

The advisory role FFMIA established for OMB with respect to agency remediation plans is important for addressing the types of problems we noted in the remediation plans we reviewed. Therefore, in a prior report we recommended that OMB work with the agencies to ensure that all remediation plans are prepared and submitted timely. We also recommended that OMB review agencies’ plans for (1) detailed corrective actions that fully address reported problems, (2) inclusion of resource requirements, and (3) specific time frames needed to implement and resolve problems.

OMB officials have told us that OMB is moving toward full implementation of its strategy to link financial management systems improvements detailed in FFMIA remediation plans to key agency plans. For example, OMB is planning to link its review of the remediation plans with agency 5-year financial management plans, IT plans, and capital planning and investment control processes. According to OMB officials, OMB is integrating its review of FFMIA remediation plans with its capital planning and investment control plans process. By incorporating FFMIA remediation reviews under this framework, OMB will be better able to analyze, track, and evaluate FFMIA improvement efforts as part of the budget process.

OMB officials have told us that they met with each of the CFO Act agencies to introduce OMB’s long-term strategy for incorporating FFMIA remediation plans into the agencies’ capital asset plans. In scheduling these meetings, OMB requires multiple agency officials to attend such as the Chief Financial Officers, Chief Information Officers, the Chief Procurement officials and, in some instances, the Budget Officer. In addition, changes were made to OMB Circular A-11 in July 2000 to provide guidance on integrating financial management systems improvements in FFMIA remediation plans with agency information on IT capital projects. Further, GAO and Treasury participate in annual meetings held by OMB with the CFOs and IGs of each CFO Act agency that did not have an unqualified audit opinion or had serious systems problems. At these meetings, financial management systems initiatives are discussed, and OMB stresses that the end game of the CFO Act is having systems that produce reliable, useful, and timely information on an ongoing basis.

A number of agency CFO officials we interviewed, though, generally seemed unsure about OMB’s strategy for integrating FFMIA remediation plans with agencies’ capital planning and investment control processes. Of the 16 agencies preparing remediation plans for fiscal year 1999, officials from 9 were certain that OMB had met with or contacted officials from their agencies to discuss its strategy related to remediation plans while 7 were unaware of the meetings. Officials from 5 of the 16 agencies did say that they implemented OMB’s strategy in preparing their fiscal year 1999 remediation plans due to OMB in December 2000, while 7 told us they had not done so, and officials from 4 agencies did not know if the strategy had been implemented. This lack of awareness of OMB’s strategy can result in agency officials providing less-than-expected attention to the critical issue of preparing and submitting remediation plans. Without appropriate attention, agencies have a greater risk of failure when attempting to implement the plans and the serious weaknesses in the financial management systems will remain. With the new Presidential Management Agenda, significant attention is expected to be devoted to these issues. OMB’s continued leadership will be important to foster effective results.

On August 13, 2001, the JFMIP principals—the Comptroller General, the Secretary of the Treasury, the Director of OMB, and the Director of OPM— met to discuss federal financial management reform issues. Commitment and cooperation among the highest levels of leadership in the federal financial management community can provide the impetus for accelerating changes to financial management reform in the federal government. This group is developing an agenda to address the long-standing challenges discussed in this report. We anticipate that a number of recommendations and action items will come from the initiatives contemplated by this group related to issues such as addressing impediments to an opinion on the U.S. government’s consolidated financial statements, defining success in financial management, and modernizing financial management systems.

Conclusions

Long-standing problems with agencies’ financial systems make it difficult for the agencies to produce reliable, useful, and timely financial information and hold managers accountable. Federal managers need this important information for developing and executing budgets, managing government programs based on results, and making difficult policy choices. The extraordinary efforts that many agencies go through to produce auditable financial statements are not sustainable in the long term. These efforts use significant resources that could be used for other important financial-related work.

For these reasons, the widespread systems problems facing the federal government need top management attention. Sustained management commitment at the highest levels of government is one of the most important factors in prompting attention and action on a widespread problem. In addition to top management commitment, additional refinements to OMB’s FFMIA implementation guidance are needed to assure consistent and effective implementation of FFMIA. OMB guidance should address the differing interpretations over (1) the meaning of substantial compliance, (2) the nature and extent of audit work necessary to assess compliance with FFMIA, and (3) whether to provide an opinion on agency’s systems FFMIA compliance.

The size and complexity of many federal agencies and the discipline needed to overhaul or replace their financial management systems present a significant challenge—not simply a challenge to overcome a technical glitch, but a demanding management challenge that requires attention from the highest levels of government along with sufficient human capital resources to effect lasting change. We recognize that it will take time, investment, and sustained emphasis on correcting deficiencies to improve federal financial management systems to the level required by FFMIA and to effectively manage government funds. The significance of the issues facing agencies, now and in the future, emphasizes the need for detailed remediation plans. As envisioned by the act, these remediation plans would help agencies establish seamless systems and processes to routinely generate reliable, useful, and timely information that would improve agencies’ accountability. Our analysis has shown that many agencies’ remediation plans lack key elements that could preclude the achievement of establishing seamless systems. Therefore, we reaffirm the recommendation we made in our prior report that OMB continue to work with agencies to ensure that the remediation plans include all required elements and are not making new recommendations at this time related to remediation plans.

Improvements in federal financial management systems are in some cases a long-term goal, but with sustained emphasis, the goals of the CFO Act and FFMIA can be achieved. As mentioned earlier, the heads of GAO, OMB, Treasury, and OPM recently met to discuss governmentwide financial management reform issues. The leadership commitment and spirit of cooperation among these top officials can provide the needed impetus to accelerate financial management reform in the federal government.

Recommendations for Executive Action

Given the ongoing efforts of the JFMIP Principals to develop an action plan, we are making no specific recommendations at this time regarding OMB’s overall financial management systems strategy, other than to reiterate the importance of OMB’s continuing leadership in improving financial management systems. We do recommend that the Director of the Office of Management and Budget revise OMB’s current FFMIA audit guidance to require agency auditors to provide a statement of positive assurance when reporting an agency’s systems to be in substantial compliance with FFMIA, which entails a more thorough examination of agencies’ systems and thus, amplifies financial managers’ awareness of the importance of an effective and efficient financial management system, develop additional guidance, in accordance with the FAM, to specify the expected procedures that auditors should perform when assessing FFMIA compliance, which clearly outlines (1) the minimum scope of work and (2) the procedures for auditors to perform in determining whether management has reliable, timely, and useful financial information for managing day-to-day operations.

We are also recommending that OMB work with the CFOs, the IGs, and GAO to explore further clarification of the definition of “substantial compliance” to assist auditors and agency management to consistently apply and evaluate an agency’s systems’ FFMIA compliance, and reiterate that the indicators of compliance in the January 4, 2001, FFMIA implementation guidance are not meant to be all inclusive.

We further recommend that because of the importance of cost accounting to managers for measuring the results of program performance, that OMB request that as part of the FFMIA review, auditors pay special attention to agencies’ ability to meet the requirements of the Managerial Cost Accounting Concepts and Standards and to report as to whether agencies’ systems comply with the standards.

Agency Comments and Our Evaluation

In written comments (reprinted in appendix V) on a draft of this report, OMB agreed with our overall observations and conclusions concerning the financial management systems weaknesses faced by the federal government and the need for sustained management commitment at the highest levels in order to overcome them. OMB stated that good financial management systems enable managers to have the financial and performance information necessary to measure and effect current day-to- day operations while fully meeting federal reporting requirements. OMB also stated, as discussed in our report, that improving financial management is one of five governmentwide initiatives included in the President’s Management Agenda.

OMB stated that it has begun to reexamine its fundamental approach to systems development and implementation in the federal government, including its FFMIA implementation guidance, and believes that more emphasis should be placed on system performance and results. OMB welcomed our participation on this effort and we look forward to working with them. As we discuss in our report, management reform legislation including the CFO Act, GPRA, and FFMIA, if fully and effectively implemented, will collectively help achieve strong financial management that provides reliable, timely, and useful information for decisionmakers.

In its comments, OMB expressed concern as to how our report characterized the level of testing currently contemplated by OMB Bulletin No. 01-02. This was not our intent, and we have clarified our report. OMB stated that required tests of FFMIA in OMB Bulletin No. 01-02, coupled with the requirement to test internal controls over significant systems, results in more than incidental testing. Our point is that under generally accepted government auditing standards, auditors need to perform only limited incidental testing to provide negative assurance. Our concern is that with negative assurance, the auditor is not saying that they determined the systems to be substantially compliant, but that the work performed did not identify instances of noncompliance. We view the law as requiring a definitive statement as to whether the systems susbstantially complied. It is important that readers of the audit report understand this distinction, or they may have a false impression that the auditor is stating that they found the systems to be substantially compliant. We will continue to work with OMB on this matter and recognize that we have differing views.

We agree with OMB that reorienting remediation plans towards measurable performance would force a more integrated enterprisewide approach that considers both financial and nonfinancial systems that support agency missions. This provides a needed perspective and helps agencies to adopt an information technology architecture that includes a well-defined blueprint for operational and technological change. The Clinger-Cohen Act provides a foundation that can be followed by agencies as they implement these important systems initiatives. Remediation plans with sufficient detail, that are linked to and support as agency’s strategic business plan, provide a “road map” for management and staff to resolve financial management problems and hold managers accountable for needed improvements. We reiterate the importance of OMB’s leadership as it moves towards bringing about needed changes in the federal financial management environment.

We also provided excerpts from a draft of this report to cognizant officials at the 24 CFO Act agencies to obtain oral comments. Officials from DOT, AID, and Interior expressed concern that the report did not fully recognize their efforts to address the systems weaknesses discussed in various parts of our report. In these instances, these corrective actions occurred after fiscal year 2000, which is subsequent to the timeframe covered by our report. Also, it was not our objective to independently assess specific management actions for the 24 CFO Act agencies. However, in our report we have acknowledged actions that have been taken throughout government and are underway to address systems weaknesses.

Interior officials suggested we acknowledge that the weak information security controls that were used as an example in the draft report have not compromised financial or personnel data. In this regard, we previously reported that the Interior’s National Business Center had not fully established a comprehensive program to routinely monitor access to its computer facilities and data and to identify and investigate unusual or suspicious access patterns that could indicate unauthorized access.

EPA officials were concerned that the example in the report related to EPA's backlog of unliquidated obligations was (1) not reported by EPA’s IG as an instance of noncompliance with FFMIA, and (2) not an example of the lack of accurate or timely recording of financial information as portrayed in the report. Regarding the first concern, as we state in the report, we included all weaknesses relevant to FFMIA identified by the auditors because such problems must be resolved in order for the agencies' systems to have the data to generate the reliable, useful, and timely information needed for decision-making. Regarding the second concern, EPA officials stated that the example in our report illustrates the lack of timely processing of the deobligation actions and is not an example of the lack of timely recording of a financial transaction. According to EPA officials, the deobligation can only take place after an authorizing official closes the obligating document. EPA officials stated that the closeout usually occurs after audits and other administrative requirements are satisfied. As a result, a large backlog of grants has been awaiting closeout. In our view, this example illustrates that the lack of timely deobligations, which trigger the final transactions, can result in misleading financial information, both at year-end and throughout the year.

NASA officials disagreed with our questioning of its compliance with FFMIA because of issues related to cost accounting and the lack of an integrated financial management system. NASA stated that contract cost reports provided to the agency by its contractors, combined with cost finding techniques that are permitted under Managerial Cost Accounting Concepts and Standards, allow NASA to capture all costs related to the multibillion dollar international space station program. However, as we highlight and discuss in more detail in our August 31, 2001 report, NASA's systems do not track the cost of individual space station subsystems or elements. According to agency officials, NASA manages and tracks space station costs by contract and does not need to know the cost of individual subsystems or elements to effectively manage the program. However, our work in this area found that NASA assigns potential and probable future costs in order to estimate the impact of canceling, deferring, or adding space station content.

These cost estimates often assign the cost of specific space station subsystems. However, because NASA does not attempt to track costs by element or subsystem, the agency does not know the actual cost of completed space station components and is not able to re-examine its cost estimates for validity once costs have been realized. Further, in the event of a cost overrun, it would be very difficult to identify which component prompted the overrun, thus hampering management's ability to make informed decisions. While cost finding techniques when clearly assigned to outputs are permitted under the Managerial Cost Accounting Concepts and Standards, NASA appears to not have clearly defined the outputs—in this case the space station components—to permit recognition and measurement of costs appropriate for intended purposes, such as holding managers accountable for differences between budgeted and actual costs. Therefore, it remains unclear how NASA can conclude it is in compliance with cost accounting standards.

NASA officials also stated that the fact that NASA does not have an integrated financial management system does not preclude substantial compliance with FFMIA. Specifically, they state that NASA's systems taken as a whole, meet the objectives of FFMIA and the supplemental, compensating procedures and practices employed by NASA substantially and materially achieve federal requirements. Nonetheless, NASA reports its financial management systems as a nonconforming significant area of management concern because the systems are not fully automated and not fully integrated. NASA’s labor-intensive, reconciliation/compilation processes are due to the fact that it has nonstandard systems that are not integrated and were not designed to include the SGL accounts. In our view, systems that are prone to errors and do not adhere to OMB's requirements for an integrated financial management system as outlined in OMB Circular A-127, preclude compliance with the goals and requirements of FFMIA. To illustrate the challenges faced by NASA in trying to provide relatively straightforward information, as we recently reported, for over 5 months NASA has been unable to provide us with detailed transaction-based support for amounts obligated against the space station and shuttle because it maintains a separate accounting system at each of its nine field centers and headquarters and cannot readily pull the information together.

NASA also took exception with the way the draft characterizes the centers' financial/accounting policies, procedures, and practices as unique. NASA stated that its Financial Management Manual prescribes standard financial policies, procedures and practices and ensures the centers comply with those through various quality assessment processes. NASA also added that the field centers have lower level policies, practices, and procedures unique to each center based on a center's mission and organization structure. We agree that NASA's Financial Management Manual prescribes standard financial policies, procedures, and practices, but our intent in the report is to convey that each center has a unique operating environment. This has permitted nonstandardized data formats, and nonintegrated systems, thus prohibiting the access to readily available reliable, useful, and timely financial information.

Several agencies also provided technical comments that we incorporated where appropriate.

We are sending copies of this report to the Chairman, and Ranking Minority Member, Subcommittee on Oversight of Government Management, Restructuring, and the District of Columbia, Senate Committee on Governmental Affairs; and to the Chairman, and Ranking Minority Member, Subcommittee on Government Efficiency, Financial Management, and Intergovernmental Relations, House Committee on Government Reform. We also sending copies to the Director of the Office of Management and Budget; the Secretary of the Treasury; the heads of the 24 CFO Act agencies; and agency CFOs and IGs. Copies will also be made available to others upon request.

This report was prepared under the direction of Sally E. Thompson, Director, Financial Management and Assurance, who may be reached at (202) 512-9450 or by e-mail at thompsons@gao.gov if you have any questions. Staff contacts and other key contributors to this report are listed in appendix VI.

Publications in the Federal Financial Management Systems Requirements Series

Statements of Federal Financial Accounting Concepts, Statements of Federal Financial Accounting Standards, and Interpretations

Checklists for Reviewing Systems Under the Federal Financial Management Improvement Act

Comments From the Office of Management and Budget

GAO Contacts and Staff Acknowledgements

GAO Contacts

Acknowledgements

In addition to those named above, Lee Carroll, Cary Chappell, Richard Harada, Rosa R. Harris, Lisa Knight, Steve Lowrey, Meg Mills, Karlin Richardson, and Sandra S. Silzer made key contributions to this report.

GAO’s Mission

The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics.

Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO E-mail this list to you every afternoon, go to our home page and complete the easy-to-use electronic order form found under “To Order GAO Products.”

Order by Mail or Phone

Visit GAO’s Document Distribution Center

To Report Fraud, Waste, and Abuse in Federal Programs

Web site: www.gao.gov/fraudnet/fraudnet.htm, E-mail: fraudnet@gao.gov, or 1-800-424-5454 (automated answering system).

Public Affairs