DOD Financial Management: Challenges in Attaining Audit Readiness and Improving Business Processes and Systems
Released: 2012-04-18T00:00:00

Letter

Background

According to the fiscal year 2013 President’s Budget, DOD accounts for about 57 percent of the discretionary federal budget authority. (See figure 1.)

For fiscal year 2011, of the 24 agencies covered by the Chief Financial Officers Act of 1990 (CFO Act), DOD was the only agency to receive a disclaimer of opinion on all of its financial statements.Inspector General (IG) reported that the department’s fiscal year 2011 financial statements would not substantially conform to generally accepted accounting principles;

DOD’s financial management and feeder systems were unable to adequately support material amounts on the financial statements; and long-standing material internal control weaknesses identified in prior audits continued to exist, including material weaknesses in areas such as financial management systems, Fund Balance with Treasury, Accounts Receivable, and General Property, Plant, and Equipment.

In 2005, the DOD Comptroller first prepared the Financial Improvement and Audit Readiness (FIAR) Plan for improving the department’s business processes. The FIAR Plan is DOD’s strategic plan and management tool for guiding, monitoring, and reporting on the department’s financial management improvement efforts. As such, the plan communicates progress in addressing the department’s financial management weaknesses and achieving financial statement auditability. In accordance with the NDAA for Fiscal Year 2010, DOD provides reports to relevant congressional committees on the status of DOD’s implementation of the FIAR Plan twice a year—no later than May 15 and November 15.

The NDAA for Fiscal Year 2010 also mandated that the FIAR Plan include the specific actions to be taken to correct the financial management deficiencies that impair the department’s ability to prepare timely, reliable, and complete financial management information. 2010, the DOD Comptroller issued the FIAR Guidance to implement the FIAR Plan. The FIAR Guidance provides a standardized methodology for DOD components to follow for achieving financial management improvements and auditability. The FIAR Guidance requires DOD components to identify and prioritize their business processes into assessable units, and then prepare a Financial Improvement Plan (FIP) for each assessable unit in accordance with the FIAR Guidance. Many of the procedures required by the FIAR Guidance are consistent with selected procedures for conducting a financial audit, such as testing internal controls and information system controls. In September 2010, we reported that the department needed to focus on implementing its FIAR Plan and that the key to successful implementation would be the efforts of the DOD military components and the quality of their individual FIPs.

Pub. L. No.111-84, §1003(a)(2). components, such as the Army, Navy, and Air Force, are expected to develop and implement FIPs in accordance with the FIAR Guidance. The steps required for these plans include assessing processes, controls, and systems; identifying and correcting weaknesses; assessing, validating, and sustaining corrective actions; and ultimately achieving audit readiness. After a component’s management determines that an assessable unit is ready for audit, both the DOD Comptroller and the DOD Inspector General (IG) review the related FIP documentation to determine if they agree with management’s conclusion of audit readiness.

DOD intends to progress toward achieving financial statement auditability by executing the FIAR Guidance methodology for groups of assessable units across four waves. Under the FIAR Plan, successful execution of the FIAR Guidance methodology for groups of assessable units across these waves is intended to result in the audit readiness of various components’ financial statements through fiscal year 2017. The first two waves of the FIAR Plan focus on achieving the DOD Comptroller’s interim budgetary priorities, which DOD believes should lead to an auditable SBR. The third wave focuses on accountability for DOD’s mission-critical assets, and the fourth wave focuses on the remaining assessable units constituting DOD’s complete set of financial statements.

As mentioned earlier, the Secretary of Defense directed the department to achieve audit readiness for the SBR for General Fund activities by the end of fiscal year 2014. The NDAA for Fiscal Year 2012 reinforced this directive by requiring that the next FIAR Plan Status Report—to be issued in May 2012—include a plan, with interim objectives and milestones for each military department and the defense agencies, to support the goal of SBR audit readiness by 2014. The NDAA for Fiscal Year 2012 also requires the plan to include process and control improvements and business systems modernization efforts necessary for the department to consistently prepare timely, reliable, and complete financial management information.

The SBR is the only financial statement predominantly derived from an entity’s budgetary accounts in accordance with budgetary accounting rules, which are incorporated into generally accepted accounting principles (GAAP) for the federal government. The SBR is designed to provide information on authorized budgeted spending authority reported in the Budget of the United States Government (President’s Budget), including budgetary resources, availability of budgetary resources, and how obligated resources have been used.

Overview of DOD’s Accounting and Business Operations

In November 1990, DOD created the Defense Finance and Accounting Service (DFAS) as its accounting agency to consolidate, standardize, and integrate finance and accounting requirements, functions, procedures, operations, and systems. The military services continue to perform certain finance and accounting activities at each military installation. These activities vary by military service depending on what the services retained and the number of personnel they transferred to DFAS. As DOD’s accounting agency, DFAS is critical to DOD auditability as it records transactions in the accounting records, prepares thousands of reports used by managers throughout DOD and by the Congress, and prepares DOD-wide and service-specific financial statements. The military services play a vital role in that they authorize most of DOD’s expenditures and are the source of most of the financial information that DFAS uses to make payroll and contractor payments. The military services also have responsibility for most of DOD’s assets and the related information needed by DFAS to prepare annual financial statements required under the CFO Act.

To support its operations, DOD performs an assortment of interrelated and interdependent business functions, such as logistics, procurement, health care, and financial management. As we have previously reported, the DOD systems environment that supports these business functions has been overly complex, decentralized, and error prone, characterized by (1) little standardization across the department, (2) multiple systems performing the same tasks and storing the same data, and (3) the need for data to be entered manually into multiple systems. For fiscal year 2012, the department requested about $17.3 billion to operate, maintain, and modernize its business systems. DOD has reported that it relies on 2,258 business systems, including 335 financial management systems, 709 human resource management systems, 645 logistics systems, 243 real property and installation systems, and 281 weapon acquisition management systems.

Importance of Business Enterprise Architecture and Reengineering Business Processes

For decades, DOD has been challenged in modernizing its timeworn business systems. Since 1995, GAO has designated DOD’s business systems modernization program as high risk. In June 2011, we reported that the modernization program had spent hundreds of millions of dollars on an enterprise architecture and investment management structures that had limited value. As our research on public and private sector organizations has shown, two essential ingredients to a successful systems modernization program are an effective institutional approach to managing information technology (IT) investments and a well defined enterprise architecture. For its business systems modernization, DOD is developing and using a federated business enterprise architecture, which is a coherent family of parent and subsidiary architectures, to help modernize its nonintegrated and duplicative business operations and the systems that support them.

Section 1072 of the NDAA for Fiscal Year 2010 requires that programs submitted for approval under DOD’s business system investment approach be assessed to determine whether or not appropriate business process reengineering efforts have been undertaken. The act further states that these efforts should ensure that the business process to be supported by the defense business system modernization will be as streamlined and efficient as practicable and the need to tailor commercial off-the-shelf systems to meet unique requirements or incorporate unique interfaces has been eliminated or reduced to the maximum extent practicable.

Challenges in Achieving Audit Readiness

GAO’s recent work highlights the types of challenges facing DOD as it strives to attain audit readiness and reengineer its business processes and systems. DOD leadership has committed DOD to the goal of auditable financial statements and has developed FIAR Guidance to provide specific instructions for DOD components to follow for achieving auditability incrementally. The department and its components also established interim milestones for achieving audit readiness for various parts (or assessable units) of the financial statements. These efforts are an important step forward. The urgency in addressing these challenges has been increased by the recent efforts to accelerate audit readiness time frames, in particular attaining audit readiness for the department’s SBR by fiscal year 2014. Our September 2011 report highlights the types of challenges DOD may continue to face as it strives to attain audit readiness, including instances in which DOD components prematurely asserted audit readiness and missed interim milestones. Also, DOD’s efforts over the past couple of years to achieve audit readiness for some significant SBR assessable units have not been successful. However, these experiences can serve to provide lessons for DOD and its components to consider in addressing the department’s auditability challenges.

DOD Component Compliance with FIAR Guidance Is Crucial to Ensuring Audit Readiness

DOD’s ability to achieve departmentwide audit readiness is highly dependent on its military components’ ability to effectively develop and implement FIPs in compliance with DOD’s FIAR Guidance. However, in our September 2011 report, we identified several instances in which the components did not prepare FIPs that fully complied with the FIAR Guidance, resulting in premature assertions of audit readiness.

Specifically, as we reported in September 2011, the FIAR Guidance provides a reasonable methodology for the DOD components to follow in developing and implementing their FIPs.responsibilities of the DOD components, and prescribes a standard, systematic approach that components should follow to assess processes, controls, and systems, and identify and correct weaknesses in order to achieve auditability. When DOD components determine that sufficient financial improvement efforts have been completed for an assessable unit in accordance with the FIAR Guidance and that the assessable unit is ready for audit, the FIP documentation is used to support the conclusion of audit readiness. Thus, complying with the FIAR Guidance can provide a consistent, systematic means for DOD components to achieve and verify audit readiness incrementally.

It details the roles and We found that when DOD components did not prepare FIPs that fully complied with the FIAR Guidance, they made assertions of audit readiness prematurely and did not achieve interim milestones. While the components initially appeared to meet some milestones by asserting audit readiness in a timely manner, reviews of supporting documentation for the FIPs of two assessable units and attempts to audit the Marine Corps’ SBR revealed that the milestones had not been met because the assessable units were not actually ready for audit. For example, the Navy asserted audit readiness for its civilian pay in March 2010 and the Air Force asserted audit readiness for its military equipment in December 2010. However, we reported that neither component had adequately developed and implemented their FIPs for these assessable units in accordance with the FIAR Guidance and were therefore not ready for audit. The Marine Corps first asserted financial audit readiness for its General Fund SBR on September 15, 2008. The DOD IG reviewed the Marine Corps’ assertion package and on April 10, 2009, reported that the assertion of audit readiness was not accurate, and that its documentation supporting the assertion was not complete. GAO has made prior recommendations to address these issues. DOD has generally agreed with these recommendations and is taking corrective actions in response.

Reported DOD Progress toward Audit Readiness for the Statement of Budgetary Resources

The Secretary of Defense’s direction to achieve audit readiness for the SBR by the end of 2014 necessitated that DOD’s components revise some of their plans and put more focus on short-term efforts to develop accurate data for the SBR in order to achieve this new accelerated goal. In August 2011, DOD’s military components achieved one milestone toward SBR auditability when they all received validation by an independent public accounting firm that their Appropriations Receipt and Distribution—a section of the SBR—was ready for audit. In addition, the November 2011 FIAR Plan Status Report indicated that the Air Force achieved audit readiness for its Fund Balance with Treasury (FBWT).

Further, in a February 2012 briefing on its accelerated plans, DOD indicated that 7 of 24 material general fund Defense Agencies and Other Defense Organizations are either already sustaining SBR audits or are ready to have their SBRs audited. These accomplishments represent important positive steps. Nevertheless, achieving audit readiness for the military components’ SBRs is likely to pose significant challenges based on the long-standing financial management weaknesses and audit issues affecting key SBR assessable units. Our recent reports highlight some of the difficulties that the components have experienced recently related to achieving an auditable SBR, including the Army’s inability to locate and provide supporting documentation for its military pay; the Navy’s and the Marine Corps’ inability to reconcile their Fund Balance with Treasury accounts; and the Marine Corps’ inability to provide sufficient documentation to auditors of its SBR.

To achieve SBR audit readiness by 2014, DOD and its components need accelerated, yet feasible, well-developed plans for identifying and correcting weaknesses in the myriad processes involved in producing the data needed for the SBR. While DOD has developed an accelerated FIAR Plan to provide an overall view of the department’s approach for meeting the 2014 goal, most of the work must be carried out at the component level.

The Army’s active duty military payroll, reported at $46.1 billion for fiscal year 2010, made up about 20 percent of its reported net outlays for that year. As such, it is significant to both Army and DOD efforts for achieving auditability for the SBR. For years, we and others have reported continuing deficiencies in the Army’s military payroll processes and controls. Moreover, other military components such as the Air Force and the Navy share some of these same military payroll deficiencies.

In March 2012, we reported that the Army could not readily identify a DOD’s complete population of its payroll accounts for fiscal year 2010. FIAR Guidance states that identifying the population of transactions is a key task essential to achieving audit readiness. However, the Army and DFAS-Indianapolis (DFAS-IN), which is responsible for accounting, disbursing, and reporting for the Army’s military personnel costs, did not have an effective, repeatable process for identifying the population of active duty payroll records. For example, it took 3 months and repeated attempts before DFAS-IN could provide a population of service members who received active duty Army military pay in fiscal year 2010. Further, because the Army does not have an integrated military personnel and payroll system, it was necessary to compare the payroll file to active Army personnel records. However, DOD’s central repository for information on DOD-affiliated personnel did not have an effective process for comparing military pay account files with military personnel files to identify a valid population of military payroll transactions.

In addition, the Army and DFAS-IN were unable to provide documentation to support the validity and accuracy of a sample of fiscal year 2010 payroll transactions we selected for review. For example, DFAS-IN had difficulty retrieving and providing usable Leave and Earnings Statement files and the Army was unable to locate or provide supporting personnel documents for a statistical sample of fiscal year 2010 Army military pay accounts. At the end of September 2011, 6 months after we had provided them with our sample of 250 items, the Army and DFAS-IN were able to provide complete documentation for only 2 of the sample items and provided only partial documentation for another 3 items; they were unable to provide any documentation for the remaining 245 sample items.

At of the time of our report, the Army had several military pay audit readiness efforts planned or under way. Timely and effective implementation of these efforts could help reduce the risk of DOD not achieving the SBR audit readiness goal of 2014. However, most of these actions are in the early planning stages. Moreover, these initiatives, while important, do not address (1) establishing effective processes and systems for identifying a valid population of military payroll records, (2) ensuring Leave and Earnings Statement files and supporting personnel documents are readily available for verifying the accuracy of payroll records, (3) ensuring key personnel and other pay-related documents that support military payroll transactions are centrally located, retained in service member Official Military Personnel Files, or are otherwise readily accessible, and (4) requiring the Army’s Human Resources Command to periodically review and confirm that service members’ Official Military Personnel File records are consistent and complete to support annual financial audit requirements. GAO has made prior recommendations to address these issues. DOD has agreed with these recommendations and is taking corrective actions in response.

A successful audit of the SBR is dependent on the ability to reconcile an agency’s Fund Balance with Treasury (FBWT) with the Treasury records. FBWT is an account that reflects an agency’s available budget spending authority by tracking its collections and disbursements. Reconciling a FBWT account with Treasury records is a process similar in concept to reconciling a check book with a bank statement. In December 2011, we reported that neither the Navy nor the Marine Corps had implemented effective processes for reconciling their FBWT.

The Navy and the Marine Corps rely on the DFAS location in Cleveland (DFAS-CL) to perform their FBWT reconciliations. We found numerous deficiencies in DFAS processes that impair the Navy’s and the Marine Corps’ ability to effectively reconcile their FBWT with Treasury records, including the following.

There are significant data reliability issues with the Defense Cash Accountability System (DCAS), which records daily collections and disbursements activity. The Navy and Marine Corps rely on DCAS to reconcile their FBWT to Treasury records.

DFAS-CL did not maintain adequate documentation for the sample items we tested to enable an independent evaluation of its efforts to research and resolve differences.

DFAS-CL recorded unsupported entries (plugs) to force Navy and Marine Corps appropriation balances to agree with those reported by Treasury instead of investigating and resolving differences between these two services’ appropriation balances and those maintained by Treasury.

Navy, Marine Corps, and DFAS-CL officials acknowledged that existing FBWT policies and procedures were inadequate. Navy and DFAS-CL officials stated that the base realignment and closure changes from 2006 through 2008 resulted in loss of experienced DFAS-CL personnel and that remaining staff have not received the needed training. In response to our recommendations, the Navy developed a plan of action and milestones (POAM) intended to address the Navy’s audit readiness weaknesses, including FBWT required reconciliations.

The Marine Corps received disclaimers of opinion from its auditors on its fiscal year 2010 and 2011 SBRs because it could not provide supporting documentation in a timely manner, and support for transactions was missing or incomplete. Further, the Marine Corps had not resolved significant accounting and information technology (IT) system weaknesses identified in the fiscal year 2010 SBR audit effort.

The auditors also reported that the Marine Corps did not have adequate processes and controls, including systems controls, for accounting and reporting on the use of budgetary resources. Further, the Marine Corps could not provide evidence that reconciliations for key accounts (such as FBWT) and processes were being performed on a monthly basis. The auditors also identified ineffective controls in key IT systems used by the Marine Corps to process financial data. During fiscal year 2011, however, the Marine Corps was able to demonstrate progress toward auditability. For example, its auditors confirmed that as of October 2011, the Marine Corps had fully implemented 32 out of 139 fiscal year 2010 audit recommendations.

The results of the audit for fiscal year 2010 provided valuable lessons on preparing for a first-time financial statement audit. In our September 2011 report, we identified five fundamental lessons that are critical to success. Specifically, the Marine Corps’ experience demonstrated that prior to asserting financial statement audit readiness, DOD components must (1) confirm completeness of populations of transactions and address any abnormal transactions and balances, (2) test beginning balances, (3) perform key reconciliations, (4) provide timely and complete responses to audit documentation requests, and (5) verify that key IT systems are compliant with the Federal Financial Management Improvement Act of 1996 and are auditable. GAO has made prior recommendations to address these issues. DOD has generally agreed with these recommendations and is taking corrective actions in response.

These issues are addressed in GAO’s Standards for Internal Control in the Federal Government and DOD’s FIAR Guidance. During our audit, Navy, Army, and Air Force FIP officials stated that they were aware of the Marine Corps lessons and were planning to, or had, incorporated them to varying degrees into their audit readiness plans.

In its November 2011 FIAR Plan, DOD provided an overall view of its accelerated FIAR Plan for achieving audit readiness of its SBR by the end of fiscal year 2014. In its February 2012 briefing, DOD recognized key factors that are needed to achieve auditability such as the consistent involvement of senior leadership as well as the buy-in of field commanders who ultimately must implement many of the changes needed. The plan also provided interim milestones for DOD components such as the Army, Navy, Air Force, Defense Logistics Agency, and other defense agencies. Acceleration substantially compresses the time allotted for achieving some of these milestones. For example, the May 2011 FIAR Plan Status Report indicated that the Air Force had planned to validate its audit readiness for many SBR-related assessable units in fiscal year 2016 and that its full SBR would not be ready for audit until 2017. However, the February 2012 briefing on the accelerated plans indicated that most of the Air Force’s SBR assessable units will be audit-ready in fiscal years 2013 or 2014. These revised dates reflect the need to meet the expedited audit readiness goal of 2014. (See figure 2.)

As discussed earlier, the key to audit readiness is for DOD components to effectively develop and implement FIPs for SBR assessable units, and to meet interim milestones as they work toward the 2014 goal. According to Navy officials, the Navy plans to prepare a FIP for each of several assessable units that make up the SBR. For example, for its SBR, Navy officials told us they have identified assessable units for appropriations received, and for various types of expenditures for which funds are first obligated and then disbursed, such as military pay, civilian pay, contracts, and transportation of people. The Air Force will prepare FIPs for assessable units similar to those of the Navy. Army officials told us they are taking a different approach from the Navy. They said that instead of developing FIPs for discrete assessable units constituting the SBR, they are preparing only one FIP for one audit readiness date for the Army’s entire SBR, an approach similar to that of the Marine Corps.

Effective Implementation of Business Systems Is Critical

For years, DOD has been developing and implementing enterprise resource planning (ERP) systems, which are intended to be the backbone to improved financial management. DOD considers the successful implementation of these ERP systems critical to transforming its business operations and addressing long-standing weaknesses in areas such as financial and supply-chain management and business systems modernization. DOD officials have also stated that these systems are critical to ensuring the department meets its mandated September 30, 2017, goal to have auditable departmentwide financial statements. However, as we recently reported, six of these ERP systems are not scheduled to be fully deployed until either fiscal year 2017 or the end of fiscal year 2016.

The DOD IG reported that the Navy developed and approved deployment of the Navy ERP System without ensuring that the system complied with DOD’s Standard Financial Information Structure (SFIS) and the U.S. Government Standard General Ledger. The DOD IG further stated that as a result, the Navy ERP System, which is expected to manage 54 percent of the Navy’s obligation authority when fully deployed, might not produce accurate and reliable financial information.

DOD Inspector General, Navy Enterprise Resource Planning System Does Not Comply With the Standard Financial Information Structure and U.S. Government Standard General Ledger, DODIG-2012-051 (Arlington, Va.: Feb. 13, 2012).

Two ERP systems—the Army’s General Fund Enterprise Business System (GFEBS) and the Air Force’s Defense Enterprise Accounting and Management System (DEAMS)—are general ledger systems intended to support a wide range of financial management and accounting functions. However, DFAS users of these systems told us that they were having difficulties using the systems to perform their daily operations. Problems identified by DFAS users included interoperability deficiencies between legacy systems and the new ERP systems, lack of query and ad hoc reporting capabilities, and reduced visibility for tracing transactions to resolve accounting differences. For example:

Approximately two-thirds of invoice and receipt data must be manually entered into GFEBS from the invoicing and receiving system due to interface problems. Army officials explained that the primary cause of the problem was that the interface specification that GFEBS is required by DOD to use did not provide the same level of functionality as the interface specification used by the legacy systems. At the time of our review, Army officials stated that they are working with DOD to resolve the problem, but no time frame for resolution had been established.

DEAMS did not provide the capability—which existed in the legacy systems—to produce ad hoc query reports that could be used to perform data analysis needed for day-to-day operations. DFAS officials noted that when DEAMS did produce requested reports, the accuracy of those reports was questionable. According to DFAS officials, they are currently working with DEAMS financial management to design the type of reports that DFAS needs.

While we were told that as of February 2012, the Army and the Air Force had corrective actions under way to address identified deficiencies, specific timelines had not been developed so that progress could be monitored.

In February 2012, we reported that independent assessments of four ERPs—the Army’s GFEBS and Global Combat Support System (GCSS- Army), and the Air Force’s DEAMS and Expeditionary Combat Support System (ECSS)—identified operational problems, such as deficiencies in data accuracy, inability to generate auditable financial reports, the need for manual workarounds, and training. DOD oversight authority limited the deployment of GFEBS and DEAMS on the basis of the results of the independent assessments. However, in June 2011, DOD authorized continued deployment of GFEBS and delegated further GFEBS deployment decisions to the Under Secretary of the Army.

In addition to functional issues, we found that training was inadequate. According to DFAS personnel as of February 2012, the training they received for GFEBS and DEAMS did not fully meet their needs. DFAS personnel informed us that the training focused on an overview of GFEBS and DEAMS and how the systems were supposed to operate. While this was beneficial in identifying how GFEBS and DEAMS were different from the existing legacy systems, the training focused too much on concepts rather than the skills needed for DFAS users to perform their day-to-day operations. GAO has made prior recommendations to address these issues. DOD has generally agreed with these recommendations and is taking corrective actions in response.

Challenges in Developing and Implementing DOD’s Business Enterprise Architecture and Investment Control Processes

Improving the department’s business environment through efforts such as DOD’s business enterprise architecture and improved business systems management is an important part of helping DOD achieve auditability. In June 2011, we reported that DOD had continued to make progress in implementing a comprehensive business enterprise architecture, transition plan, and improved investment control processes. However, we also reported that long-standing challenges had yet to be addressed. Specifically, we reported that while DOD continued to release updates to its corporate enterprise architecture, the architecture had yet to be augmented by a coherent family of related subsidiary architectures.example, we reported that while each of the military departments had developed aspects of a business architecture and transition plan, none of them had fully developed a well-defined business enterprise architecture For and transition plan to guide and constrain business transformation initiatives.

We also reported in June 2011 that DOD continued to improve its business system investment management processes, but that much remained to be accomplished to align these processes with investment management practices associated with individual projects and with portfolios of projects. military departments all had documented policies and procedures for identifying and collecting information about IT projects and systems to support their business system investment management processes. However, neither DOD nor the military departments had fully documented policies and procedures for selecting a new investment, reselecting ongoing investments, integrating funding with investment selection, or management oversight of IT projects and systems. With regard to portfolios of projects, DOD and the Departments of the Air Force and Navy had assigned responsibility for managing the development and modification of IT portfolio selection criteria. However, neither DOD nor the military departments had fully documented policies and procedures for creating and modifying IT portfolio selection criteria; analyzing, selecting, and maintaining their investment portfolios; reviewing, evaluating, and improving the performance of their portfolios; or conducting post implementation reviews. In addition, while DOD largely followed its certification and oversight processes, we reported that key steps were not performed. For example, as part of the certification process, DOD assessed investment alignment with the business enterprise architecture, but did not validate the results of this assessment, thus increasing the risk that decisions regarding certification would be based on inaccurate and unreliable information.

These best practices are identified in GAO IT investment management guidance. See GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, GAO-04-394G (Washington, D.C.: Mar. 2004). management.and is taking corrective actions in response. It is essential that DOD implement our recommendations aimed at addressing these long- standing challenges, as doing so is critical to the department’s ability to establish the full range of institutional management controls needed for its financial management as well as its overall business systems modernization high-risk program. We have ongoing work to evaluate the department’s efforts to comply with the NDAA for Fiscal Year 2012, as amended, including updating our evaluations of DOD’s comprehensive business enterprise architecture and transition plan and improved investment control processes.

DOD Has Begun Performing Business- Process Reengineering Assessments

Section 1072 of the NDAA for Fiscal Year 2010 requires that new DOD programs be assessed to determine whether or not appropriate business- process reengineering efforts have been undertaken. The act further states that these efforts should ensure that (1) the business process to be supported by the defense business system modernization will be as streamlined and efficient as practicable and (2) the need to tailor commercial-off-the-shelf systems to meet unique requirements or incorporate unique interfaces has been eliminated or reduced to the maximum extent practicable.investments we reviewed, DOD and the military departments used DOD’s Business Process Reengineering Guidance (dated April 2011) to assess In June 2011, we reported that, for those whether the investments complied with the business-process reengineering requirement. Consistent with the guidance, DOD and the military departments completed questionnaires to help them identify and develop approaches to streamlining and improving existing business processes. Once these assessments had been completed, the appropriate authorities asserted that business-process reengineering assessments had been performed.

We also reported in June 2011 that while DOD and the military departments largely followed DOD’s guidance, they did not perform the key step of validating the results of these reengineering assessments to ensure that they, among other things, accurately assessed process weaknesses and identified opportunities to streamline and improve affected processes. The reason DOD did not follow key aspects of the certification process—primarily not validating assessment results—was attributed in part to unclear roles and responsibilities. According to military department officials responsible for the investments we reviewed, validation activities did not occur because DOD policy and guidance did not explicitly require them to be performed. In addition, there was no guidance that specified how assessments should be validated. According to DOD officials, the oversight and designated approval authorities did not validate the DOD level assessments and assertions because DOD policy and guidance had not yet been revised to require these authorities to do so. We have work underway to evaluate DOD’s efforts to improve its business system investment process, including its efforts to address the act’s business process reengineering requirement. GAO has made prior recommendations to address these issues. DOD has agreed with these recommendations and is taking corrective actions in response.

Concluding Observations

In closing, DOD has demonstrated leadership and sustained commitment since the first issuance of its FIAR Plan in 2005 and through improvements and responsiveness to our recommendations since then. DOD has made progress through the FIAR Guidance, with the development of a methodology for implementing the FIAR strategy. Full compliance with the guidance can provide a consistent, systematic process to help DOD components achieve and verify audit readiness. Without full compliance, as we have seen in our work, components may assert audit readiness while process deficiencies prevent validation, require corrective actions, and delay an audit for another fiscal year.

Automated information systems are essential for modern accounting and recordkeeping. DOD is developing its ERP systems as the backbone of its financial management improvement and they are critical for transforming its business operations. To be fully successful, implementation of ERP systems should be consistent with an effective corporate enterprise architecture and the development of streamlined business processes. DOD officials have stated that these systems are critical to ensuring that the department meets its mandated September 30, 2017, goal to have auditable departmentwide financial statements. However, implementation has been delayed by deficiencies in performance and the need for remedial corrective actions. DOD components will evaluate cost-effective modifications to legacy systems and implement any necessary changes. According to DOD officials, for the ERP systems that will not be fully deployed prior to the audit readiness goals, the DOD components will need to identify effective workaround processes or modifications to legacy systems that will enable audit readiness.

DOD faces considerable implementation challenges and has much work to do if it is to meet the goals of an auditable SBR by fiscal year 2014 and a complete set of auditable financial statements by fiscal year 2017. It is critical that DOD continue to build on its current initiatives. Oversight and monitoring will also play a key role in making sure that DOD’s plans are implemented as intended and that lessons learned are identified and effectively disseminated and addressed. Absent continued momentum and necessary future investments, the current initiatives may falter, similar to previous well-intended, but ultimately failed, efforts.

We will continue to monitor the progress and provide feedback on the status of DOD’s financial management improvement efforts. We currently have work in progress to assess (1) the FIAR Plan’s risk management process for identifying, assessing, and addressing risks that may impede DOD’s ability to achieve the 2017 financial audit readiness goal; (2) DOD’s funds control in relation to the reliability of its financial statements; (3) the schedule and cost of Army’s GCSS; (4) components’ efforts to prepare for SBR and full financial statement audits; and (5) DOD’s actions in response to our recommendations. As a final point, I want to emphasize the value of sustained congressional interest in the department’s financial management improvement efforts, as demonstrated by this subcommittee’s leadership.

Chairman McCaskill, Ranking Member Ayotte, and members of the subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

GAO Contacts and Staff Acknowledgments

If you or your staff have any questions about this testimony please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. GAO staff who made key contributions to this testimony include Valerie Melvin, Director; Cindy Brown Barnes, Assistant Director; Mark Bird, Assistant Director; Kristi Karls; Michael Holland, Chris Yfantis, and Maxine Hattery.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.