DOD Financial Management: Additional Efforts Needed to Improve Audit Readiness of Navy Military Pay and Other Related Activities
Released: 2015-10-15T00:00:00

Letter

Background

DOD has been unable to prepare auditable information for department- wide financial statements as required by the Government Management Reform Act of 1994. The National Defense Authorization Act (NDAA) for Fiscal Year 2010 requires that DOD develop and maintain the Financial Improvement and Audit Readiness (FIAR) Plan, which includes, among other things, the specific actions to be taken and costs associated with (1) correcting the financial management deficiencies that impair DOD’s ability to prepare timely, reliable, and complete financial management information and (2) ensuring that DOD’s financial statements are validated as ready for audit by September 30, 2017. The NDAA for Fiscal Year 2013 required that the FIAR Plan state the specific actions to be taken and the costs associated with validating the audit readiness of DOD’s Statement of Budgetary Resources (SBR) no later than September 30, 2014. However, DOD acknowledged in its November 2014 FIAR Plan Status Report that it did not meet this date and, in response to difficulties in preparing for an SBR audit, reduced the scope of initial audits to focus only on current year budget activity to be reported on a Schedule of Budgetary Activity beginning in fiscal year 2015. This is an interim step toward achieving the audit of multiple-year budget activity required for an audit of the SBR.

We have previously reported our concerns regarding DOD’s emphasis on asserting audit readiness by a certain date rather than ensuring that effective processes, systems, and controls are in place to improve financial management information for day-to-day decision making. Further, according to its May 2015 FIAR Plan Status Report, DOD acknowledged that even though military departments have asserted Schedule of Budgetary Activity audit readiness, they are continuing to strengthen controls and take other steps to improve their readiness. The report also indicated that although DOD does not expect to receive unmodified (“clean”) opinions during the initial years, it determined that it is important to proceed with the audits as a means of uncovering any other remaining challenges.

In August 2014, the Navy asserted audit readiness for its fiscal year 2015 Schedule of Budgetary Activity. Military pay activity represents a significant portion of obligations and outlays reported on the Navy’s Schedule of Budgetary Activity and SBR. In addition to military pay, the Navy’s Schedule of Budgetary Activity and SBR will include financial activity and balances associated with other business processes, such as civilian pay, contract pay, and reimbursable work orders.

Navy Military Pay Audit Readiness

The Navy’s mission is to maintain, train, and equip combat-ready naval forces capable of winning wars, deterring aggression, and maintaining freedom of the seas. In February 2015, the Navy reported that it had about 326,000 active and 58,000 reserve servicemembers. For fiscal year 2015, Congress appropriated approximately $29 billion for Navy military pay for active and reserve servicemembers and other personnel-related costs. Appropriations for Navy and Navy Reserve personnel are 1-year appropriations available for pay, benefits, incentives, allowances, housing, subsistence, and travel primarily for Navy servicemembers.

DOD’s FIAR Guidance sets forth the goals, priorities, strategy, and methodology for the Navy (as well as other DOD reporting entities and service providers) to become audit ready. Based on the FIAR Guidance, the Navy has established separate assessable units for military pay and other business processes representing significant portions of budgetary resources and financial activity (e.g., obligations and outlays) reported in its SBR to help focus efforts to achieve audit readiness. Key stakeholders within the Navy with military audit readiness responsibilities include the Office of Financial Operations and the Bureau of Naval Personnel.

In March 2013, the Navy asserted audit readiness of its military pay assessable unit based on its determination that sufficient evidence existed and certain controls were operating effectively to meet specified financial reporting objectives. According to its assertion, the Navy placed additional reliance on testing of supporting documentation to meet financial reporting objectives in instances where controls were not operating effectively. In addition, based on limited tests performed prior to its assertion, the Navy identified extensive control deficiencies associated with certain key systems. For purposes of asserting audit readiness, the Navy determined that risks associated with these deficiencies were mitigated based on the results of substantive tests, reconciliations, and other tests performed in connection with its assertion efforts. Accordingly, the Navy excluded assessment of these systems from the scope of its IPA’s examination.

An IPA performed a validation examination of the Navy’s assertion and reported in January 2015 that, in its opinion, the Navy’s assertion was fairly stated. As specified in its contract with the Navy, the IPA was required to perform an audit readiness validation examination to determine (1) if adequate supporting documentation exists to address all relevant financial statement assertions for all material transactions and account balances reflected on the Navy’s schedule of military pay for April 2013 and (2) if business processes and internal control activities are designed and operating effectively to limit the risk of material misstatement of the financial statements by meeting applicable financial reporting objectives. With regard to the Navy’s internal controls, the IPA assessed 34 controls supporting the Navy’s assertion and determined that, although certain controls for each financial reporting objective were effective, 14 controls associated with these objectives were either not designed effectively or not operating effectively. As a result, the IPA relied primarily on substantive tests to assess whether amounts reported on the Navy’s schedule of military pay activity for April 2013 were adequately supported by sufficient evidence.

The Navy’s schedule of military pay activity for April 2013 reflected obligations of $2.25 billion and outlays of $2.19 billion associated with activities included in the scope of the Navy’s assertion; these obligations and outlays were recorded in the Navy’s general ledger and included activity related to basic pay and entitlements for allowances for officers, enlisted personnel, and midshipmen, as well as certain other military personnel costs. The schedule of military pay activity included obligations associated with servicemembers’ gross pay and related payroll taxes and associated outlays disbursed in April 2013. Obligations for reserve servicemembers’ pay and related payroll taxes are recorded in the month payroll is processed, while outlays are recorded in the month they are paid. In contrast, obligations and outlays for active servicemembers’ pay are recorded in different months based on when each payroll is processed and when related outlays occur, as shown in figure 1.

The Navy also relies on service providers to ensure the audit readiness of service provider systems and business processes that support services provided to the Navy and affect its Statement of Budgetary Activity and SBR. For example, the DFAS office in Cleveland, Ohio, is responsible for computing the Navy’s military payroll using the Defense Joint Military Pay System-Active Component (DJMS-AC) and the Defense Joint Military Pay System-Reserve Component (DJMS-RC) for active and reserve servicemembers, respectively. In addition, DFAS provides significant financial reporting, disbursement, and other services to the Navy in support of the Navy’s efforts to meet essential financial management responsibilities. The Navy also relies on a variety of personnel, accounting, disbursing, and budgeting systems to process and report its military payroll, as shown in figure 2.

In addition to military pay, the Navy also recorded $225 million of obligations and related outlays in April 2013 for other activities associated with its military personnel appropriations, including items such as certain uniform allowances, subsistence-in-kind, permanent change of station travel, and personnel-related reimbursable work orders. The scope of the Navy’s assertion excluded these activities as well as certain other processes involved in processing or reporting military pay financial activity or balances, including fund balance with the U.S. Department of the Treasury (Treasury); funds receipt and distribution; and certain financial reporting-related journal vouchers, adjustments, and beginning balances. According to Navy officials, readiness efforts associated with these areas were either included in the scope of other assessable units or will be assessed as part of the Navy’s fiscal year Schedule of Budgetary Activity audit.

The IPA Determined That the Navy Provided Sufficient Documentation to Support the Navy’s Schedule of Military Pay Activity for April 2013

Based on documentation provided by the Navy and the results of the IPA’s audit procedures, the IPA concluded that information reported on the Navy’s schedule of military pay activity for April 2013 (April 2013 schedule) reconciled to a complete and valid population of transactions. The IPA identified a total projected error of $6.8 million, which it determined to be immaterial. We reviewed selected IPA audit documentation and selected documentation provided by the Navy, and nothing came to our attention that raised concerns beyond those identified by the IPA regarding the adequacy of the Navy’s documentation supporting the completeness and validity of the population of transactions reflected on its April 2013 schedule.

The IPA Determined That the Navy Provided Sufficient Documentation to Support Reconciliations of Reported Activity to a Complete Population of Transactions

The IPA concluded that the Navy provided sufficient documentation to support that amounts reported in the April 2013 schedule reconciled to a complete population of military pay transactions. The GAO/President’s Council on Integrity and Efficiency Financial Audit Manual (FAM) and FIAR Guidance recognize the importance of comparing and reconciling data produced by various systems and processes with reported amounts to provide assurance on the completeness of populations of transactions supporting them. The IPA’s determination was based on Navy-provided documentation supporting the Navy’s reconciliation of personnel and payroll data as well as documentation supporting other reconciliations independently performed by the IPA. Key reconciliations supporting the IPA’s conclusion are summarized below:

Personnel and payroll reconciliation. The Navy compared Social Security numbers of servicemembers in the Navy personnel systems to Social Security numbers of servicemembers in the Navy payroll systems and identified, documented, and resolved differences between the systems to provide assurance that payroll amounts were disbursed to valid personnel.

Payroll and general ledger reconciliation. Although the Navy performs monthly reconciliations of payroll and general ledger activity, the IPA performed an independent reconciliation that compared obligations and outlays in the Navy payroll systems to the obligations and outlays recorded in the Navy general ledger system and accounted for any significant disparities between data from these systems and the obligation and outlay amounts reported in the April 2013 schedule to provide assurance that the reported amounts were complete and reasonably stated.

Disbursements reconciliation. The IPA independently compared disbursements from the Defense Cash Accountability System to outlays on the April 2013 schedule and to documentation supporting significant reconciling items to help ensure that reported disbursements were complete and reasonably stated. According to the IPA, the Navy performs similar reconciliations each month.

To assess the reliability of the documentation, the IPA performed walk- throughs of key processes, made inquiries of Navy personnel, and analyzed the documentation provided. In addition, the IPA considered the results of its tests of the Navy’s controls for reconciling military pay activity each month, as discussed further below. Based on its evaluation of these reconciliations and documentation provided by the Navy, the IPA concluded that the Navy’s population of military pay transactions was complete. We reviewed the results of the IPA procedures to assess these reconciliations; re-performed selected procedures, such as tracing selected amounts to supporting documentation and performing recalculations; and assessed the appropriateness of the reconciling items. Based on our review, nothing came to our attention that raised concerns regarding the adequacy of the Navy’s documentation supporting the completeness of the population of transactions reflected on its April 2013 schedule.

The IPA Determined That Military Pay Transactions Were Adequately Supported by Navy Documentation

The IPA determined that the Navy provided sufficient documentation to support the accuracy and validity of selected basic pay and entitlement transactions the IPA tested. The IPA tested a statistical sample of 405 leave and earnings statements from the $1.8 billion of outlays associated with basic pay and entitlements reflected on the April 2013 schedule. The Navy provided more than 3,000 documents to support the sampled leave and earnings statements, such as orders, promotion messages, enlistment documents, and discharge documents. The IPA’s evaluation of sample item tests resulted in a projected total error of $6.8 million, and based on its determination of tolerable misstatement and materiality, the IPA concluded that the estimate of errors was immaterial. In addition, the IPA performed analytical procedures to test $400 million of activity reflected in the Navy’s April 2013 schedule, representing the portion of Federal Insurance Contributions Act (FICA) taxes and military retirement contributions for servicemembers. The IPA compared reported amounts to an estimate determined by multiplying basic pay included in the April 2013 schedule by applicable mandated rates and concluded that the reported amounts were reasonable.

We reviewed the results of the IPA’s tests of military pay transactions and re-performed selected procedures to assess the reasonableness of the IPA’s conclusions. For example, we reviewed the IPA’s sampling methodology and related error projection. We also re-performed tests performed by the IPA for a nongeneralizable random sample of 21 (5 percent) of its 405 leave and earnings statement sample items, such as recalculating payment amounts and reviewing documentation provided by the Navy to assess whether transactions were adequately supported. We also re-performed the IPA’s analytical procedures related to the Navy’s portion of FICA taxes and the military retirement contributions and reviewed the IPA’s related conclusions. Based on our review, nothing came to our attention that raised concerns regarding the adequacy of the Navy’s documentation supporting military pay transactions reflected in its April 2013 schedule beyond those identified by the IPA.

The Navy’s Military Pay Assertion and Validation Efforts Identified Risks to Future Audit Readiness

While the IPA determined that the Navy provided sufficient documentation to support its April 2013 schedule, the IPA also assessed the effectiveness of 34 internal controls supporting the Navy’s assertion and determined that 14 were either not designed effectively or not operating effectively. Effective internal controls and financial systems are essential for ensuring sound financial management and achieving sustainable financial statement auditability. However, deficiencies in military pay controls and selected systems identified through the Navy’s assertion and validation efforts, including the IPA’s examination, if not effectively addressed, present additional risks that could hamper the Navy’s ability to ensure future auditability. Further, the audit readiness of certain activities beyond the scope of these efforts—such as financial reporting and other business processes—remains uncertain. We also found that the Navy’s efforts to coordinate with key stakeholders and service providers responsible for performing important audit readiness tasks were not always effective.

Deficiencies in Military Pay Internal Controls Could Hamper Future Auditability

In connection with its audit readiness efforts, the Navy identified 34 control activities intended to reasonably assure the achievement of important financial reporting objectives, such as ensuring that military pay amounts do not exceed funding authority, obligations and disbursements are properly approved and recorded, and payroll is calculated and processed correctly. Based on its tests of these controls, the IPA determined that although certain controls associated with each of the Navy’s military pay-related financial reporting objectives were effective, 14 controls associated with these objectives were either not designed effectively or not operating effectively. The Navy generally concurred with the IPA’s conclusions. Examples of controls the IPA determined were effectively operating included the following: the Navy monitors personnel to ensure that they are reporting for duty as assigned, the Navy reconciles military pay obligations and outlays among its various systems each month, the Navy records a monthly adjustment for pay earned in one month but disbursed in subsequent months, and the Navy monitors military pay obligation amounts to verify it does not exceed funding authority.

In contrast, examples of ineffectively operating controls as determined by the IPA included the following: the Navy did not consistently perform supervisory review of data entry of personnel transactions for accuracy and timeliness before updating the pay system, increasing the risk of misstatements in payroll amounts for service members, and the Navy did not adequately perform the triannual review of dormant unliquidated obligations for timeliness, accuracy, and completeness, and as a result, over $5 million associated with these transactions was not deobligated in a timely manner.

According to the Navy, as of March 2015, its actions have addressed the IPA-identified deficiencies in the design of military pay controls as well as four of six corrective action plans intended to address deficiencies in the operating effectiveness of controls. Navy documentation on the status of corrective actions at that time indicated that efforts to address remaining deficiencies were expected to be completed by April 2015. However, the effectiveness of actions taken has not been fully verified by the Navy or independently assessed by an IPA or the DOD Office of Inspector General (OIG). As a result, the extent to which these actions have, or will, resolve underlying causes of the issues identified is unclear. According to Navy officials, the Navy is currently undergoing an IPA audit of its fiscal year 2015 Schedule of Budgetary Activity and expects the results of this audit will provide feedback on the effectiveness of the actions taken.

The IPA also reported additional deficiencies in a separate management report resulting from its detailed tests of servicemembers’ leave and earnings statements. Examples of these deficiencies included the following.

The Navy’s document retention policies are inadequate in that certain personnel action documentation is required to be retained for only 1 year. As a result, the Navy was unable to provide adequate documentation supporting selected members’ rank or other qualifications affecting pay.

A servicemember received duplicate pay for 2-1/2 months because Navy personnel processed a transaction to correct a previous incorrectly processed transaction to extend his service end date that also erroneously created a system-generated debt owed by the servicemember to the Navy. Navy officials indicated that the correcting entry had to be processed in this manner because of a DJMS limitation.

A member with over 3 years of service was incorrectly paid at a lower rate associated with over 2 years of service because of a lack of payroll system controls to prevent such errors.

The Navy established nine corrective action plans to address these additional deficiencies, and Navy documentation on the status of corrective actions as of March 2015 indicated that steps for seven of these plans had been completed, and remaining actions were expected to be completed by June 2015. However, the Navy’s ability to fully resolve these findings in the short term was not always clear. For example, although the Navy developed functional requirements for a new system to help address identified document retention issues, it had not yet determined the timeline associated with developing and implementing this system. Until these deficiencies are fully resolved, the Navy will continue to face risks that could affect its ability to achieve future financial statement auditability.

Deficiencies in Selected Military Payroll Financial Systems Raise Additional Audit Readiness Concerns

Effective information system controls are also essential for ensuring the integrity of information contained in and processed by these systems. For example, the Navy’s personnel systems contain rank information and other key data used to determine entitlements (e.g., basic pay and allowances) and process servicemembers’ pay. As part of its audit readiness assertion efforts, the Navy performed internal assessments of six key military payroll financial systems using the Federal Information System Controls Audit Manual and initially identified over 500 control deficiencies. As a result, the Navy excluded assessments of these systems from the scope of the IPA’s examination. These deficiencies involved multiple types of controls—such as access, interface, and business process controls—increasing the risk that financial activity may not be properly processed, recorded, or secured. For example, without effective access controls, unauthorized individuals can make undetected changes or deletions to data and authorized users can intentionally or unintentionally read, add, delete, or modify data or can execute changes outside their span of authority. Also, without effective interface controls, inaccurate or incomplete data may be shared among related systems, such as those used to process and record military payroll activity. Similarly, business process application controls are important for ensuring the completeness, accuracy, validity, and confidentiality of transaction data input, processing, and output.

According to briefing slides from the Navy’s November 2014 information technology update presentation, challenges affecting the audit readiness of key systems include a lack of guidance across all systems; deficiencies in high-risk areas, such as interface control, access controls, and configuration management; and staff and resource limitations. According to this update, financial systems-related deficiencies ultimately degrade the integrity and auditability of those systems and may result in an increased effort on the part of the Navy to substantiate its activity and balances. Further, the Navy also acknowledged that ineffective information system controls could result in auditors needing to perform additional substantive tests and review more documentation to gain assurance on reported amounts rather than relying on effective controls.

According to documentation on the status of corrective actions provided in February 2015, the Navy established 81 corrective action plans to address control deficiencies identified for the six military pay financial systems it assessed. Further, this documentation indicated that 23 corrective action plans had been completed. However, efforts to address remaining deficiencies for two of these systems are not expected to be completed until September 2015, and the Navy has not determined when certain access controls for one system will be resolved. Navy officials also stated that the Navy has not completed internal assessments to evaluate the effectiveness of actions taken thus far and that it plans to assess additional controls associated with these systems in the future. Until the Navy has assurance regarding the effectiveness of key financial system controls, it will continue to face risks that could affect its ability to ensure future financial statement auditability.

The Navy’s Military Pay Assertion and Related IPA Examination Covered Limited Activity

According to its assertion, the Navy plans to prepare a schedule of military pay activity in support of its fiscal year 2015 Schedule of Budgetary Activity audit. However, because the Navy limited the scope of the IPA examination to focus on a 1-month schedule of activity, its ability to achieve auditability of a full year of activity, as required in future Schedules of Budgetary Activity and SBRs, was not fully assessed. Rather than extending the period of activity to a longer period of time to more closely approximate future audits of Schedules of Budgetary Activity, Navy officials told us that they limited the scope to 1 month to provide the time necessary to address any deficiencies that might be identified by the IPA prior to the fiscal year 2015 Schedule of Budgetary Activity examination, which began in December 2014. However, according to a FIAR Directorate official, assertion examinations should generally cover at least a 3-month period and would provide a greater level of audit readiness assurance than an examination focused on a 1- month period of activity. Further, because of the volume of transactions during a 12-month period of activity, obtaining supporting documentation may be more challenging than supporting transactions limited to a 1- month period of time. Accordingly, the Navy may be at risk concerning its ability to provide documentation supporting transactions included in the scope of future Statement of Budgetary Activity and SBR audits that cover a full year of activity.

In addition, preparing Schedules of Budgetary Activity or SBRs that contain military pay balances and activity—as well as other amounts associated with Military Personnel appropriations—involves other processes not included in the scope of the Navy’s military pay assertion and related IPA examination. For example, preparing financial statements involves additional financial reporting processes, such as reconciling the Navy’s Fund Balance with Treasury, performing funds receipt and distribution activities, and recording certain journal vouchers. However, the Navy’s assurance regarding the audit readiness of these other key processes is limited. For example, although the Navy asserted the audit readiness of its Fund Balance with Treasury reconciliation process in April 2013, the DOD OIG reported that the Navy’s process did not provide reasonable assurance to support the accuracy, timeliness, and completeness of the account’s auditability. The DOD OIG identified issues affecting the Navy’s audit readiness, including the lack of detailed support for amounts used in reconciling Navy’s Fund Balance with Treasury account with Treasury’s accounts and significant information system control deficiencies.

Additionally, the Navy has not asserted or undergone an examination for processes specifically related to the audit readiness of its financial statement and compilation activities. In December 2014, the Navy reported extensive deficiencies in controls associated with these activities. For example, key reconciliations were not always adequately performed or documented to identify and resolve differences between balances recorded in the Navy’s general ledger system and other Navy financial systems and balances recorded in the Defense Departmental Reporting System (DDRS). Further, amounts in DDRS are adjusted to resolve out-of-balance amounts imported from the Navy’s systems through the creation of journal vouchers without transaction-level documentation to support them. Although the Navy indicated that corrective action plans have been established to address these deficiencies, it could not provide us with information on when efforts to resolve them were expected to be completed.

In addition, according to its military pay reconciliations, the Navy incurred obligations of $225 million in April 2013 associated with its military personnel appropriations that were excluded from its military pay assessable unit. Approximately $203 million, or 90 percent, of these obligations were associated with three types of activity: permanent change of station travel ($104 million), supply-related requisitions ($52 million), and reimbursable work orders ($47 million). However, independent examinations to assess these activities have not been performed or have identified significant concerns about the audit readiness of such activities. Specifically, Navy officials stated that permanent change of station travel was not addressed in other audit readiness assertions or IPA examinations and, as a result, will be tested during the Navy’s fiscal year 2015 Schedule of Budgetary Activity audit. In addition, although the Navy asserted audit readiness of its supply requisition-related activity in December 2013, officials indicated that a separate independent examination to validate this assertion will not be performed. Further, in April 2013, the Navy asserted that its reimbursable work orders assessable unit was audit ready. However, an IPA reported in January 2015 that the Navy’s schedules of reimbursable work order activity examined by the IPA were materially misstated because the Navy was unable to isolate reimbursable work order transactions from the rest of its financial transactions.

Navy Coordination with the IPA, OIG, and DFAS Was Not Always Effective

Management Representation Letter

Although the IPA completed its fieldwork in September 2014, its examination report was not issued until January 2015, in part because of the lack of effective coordination between the Navy and the IPA to ensure that adequate management representations were provided to the IPA in a timely manner. Specifically, the Navy did not provide a signed management representation letter consistent with auditing standards until more than 3 months after the IPA requested it.

The FAM requires auditors to obtain representation letters from appropriate management officials. In addition, auditing standards list the specific representations that management must make, which include, for example, management’s responsibility for providing to the auditor all financial records and related data and its responsibility for disclosing to the auditors any known or suspected fraud. Such representations are considered part of the evidence supporting the auditor’s opinion and are to be provided prior to issuing the examination report. Further, the DOD Financial Management Regulation (FMR) requires responsible senior managers to prepare and submit management representation letters to auditors prior to the conclusion of audits and requires that the date of the letter should generally be the issuance date of the audit report. The DOD FMR further states that coordinating these dates is essential and that active cooperation and interaction between auditors and management is expected so that the management representation letter reaches the auditors in a timely manner.

However, according to Navy officials, the Navy does not have a policy to ensure that these requirements are met. Rather, it relied on its standard process for the review and approval for official correspondence, which requires a minimum of 21 days to complete. In addition, the lack of effective coordination concerning the date of this letter contributed significantly to the amount of time required to provide the IPA with acceptable management representations. Specifically, although the IPA provided a properly dated draft management representation letter (to coincide with the end of its fieldwork on September 26, 2014), the Navy incorrectly dated its letter November 19, 2014. After noting this discrepancy, the IPA requested that the Navy revise the date on the letter to September 26, 2014, as originally indicated on the draft letter provided to the Navy. As shown in figure 3, this resulted in another delay, and a total of over 3 months elapsed before the Navy provided an accurate, signed management representation letter to the IPA.

Without a policy that addresses the need to effectively coordinate with auditors concerning the dates of management representation letters and when they need to be provided to the auditors, the Navy remains at risk that appropriate management representations required for future audits may not be provided in a timely manner. This in turn could delay the issuance of the audit reports and hamper the Navy’s ability to submit audited financial statements within required time frames.

Classified Payroll Transactions

Processes to obtain and assess classified documentation supporting certain military pay transactions selected by the IPA for testing require coordination between the IPA, the Navy, and the DOD OIG. However, because of the lack of effective procedures for coordinating these efforts and other factors, the IPA was unable to conclude on the accuracy and validity of selected sample item transactions involving classified supporting documentation totaling about $1,500. Specifically, the Navy did not effectively coordinate with the IPA to identify sample leave and earning statements requiring classified documentation support within a time frame needed for the DOD OIG and the IPA to coordinate appropriate security procedures to access and assess the documentation at affected classified environments prior to the IPA’s cutoff date for testing.

Navy officials acknowledged that challenges affecting the Navy’s ability to obtain and assess such documentation could be a significant roadblock in future audits. To address this issue, the Navy developed a corrective action plan to establish an effective process for addressing audit coordination of classified documentation and is working to develop new procedures requiring budget submitting offices to coordinate with the DOD OIG and the IPA to determine appropriate security procedures for accessing and obtaining required documentation supporting military pay transactions selected for testing.

Complementary Controls

DFAS processes military pay for the Navy and other DOD reporting entities and has established control objectives and control activities to provide reasonable assurance on the effectiveness of its military pay operations. In addition, DFAS also identified certain complementary controls that the Navy and other user entities—that is, those that use DFAS’s services—should also establish to provide reasonable assurance that control objectives are achieved. DOD’s FIAR Guidance requires that user entities coordinate with service providers, such as DFAS, to understand service provider user control assumptions and test those controls to ensure that they are operating effectively.

The Navy linked many of the complementary controls identified by DFAS to relevant Navy control activities; however, it determined that it was not responsible for the effectiveness of certain complementary controls for approving and monitoring Navy personnel access to the Defense Joint Military Pay System (DJMS) because DFAS subsequently approves and grants DJMS access and Navy personnel have “view only” access. Although Navy personnel access to DJMS may be limited, “view only” access enables users to see and produce documentation from DJMS containing certain personally identifiable information associated with Navy servicemembers. According to Navy officials, in making its determination, the Navy had not considered how such access increases the risk of unauthorized disclosure of such information or could potentially lead to its use for unintended purposes. We shared these concerns with Navy officials, and they agreed that additional efforts were needed to further assess these risks and the need for complementary controls to address them. They also indicated that considerations of these controls will be incorporated into their strategy to work with relevant Navy and DFAS stakeholders to assess the controls and develop and implement corrective action plans to address any identified deficiencies. However, the Navy had not established milestones or set a date for when these efforts are expected to be completed.

Conclusions

As part of its examination of the Navy’s military pay audit readiness assertion, the IPA determined that the Navy provided sufficient documentation to support its schedule of military pay activity for April 2013. However, given the limited scope of the IPA’s examination— because of the Navy limiting the audit to 1 month of activity and excluding key areas from the examination—questions concerning the Navy’s future audit readiness remain. Although the Navy has taken steps to improve military pay auditability, the extent to which it has effectively addressed deficiencies associated with key controls and selected financial systems identified through its assertion and validation efforts, including the IPA examination, remains unclear. Without effective internal controls and systems, auditors will likely be required to perform additional, more costly procedures to obtain required assurance in future financial statement audits, and the Navy’s ability to consistently produce timely, reliable financial information will remain at risk. In addition, the Navy’s effective coordination with the IPA, the DOD OIG, and service providers is essential for achieving audit readiness. However, the Navy did not effectively coordinate certain important tasks—such as providing its management representation letter to the IPA in a timely manner and assessing and implementing certain complementary controls identified by DFAS—that could hamper its ability to meet this goal. An audit of the Navy’s fiscal year 2015 Schedule of Budgetary Activity, for which military pay activity represents a significant portion of obligations and outlays, is currently under way and is expected to provide feedback on efforts necessary to achieve DOD’s goal of financial statement auditability department-wide by September 30, 2017. While this audit provides a milestone for measuring progress, we continue to stress the importance of addressing fundamental systems and control deficiencies, which will lead to lasting financial management improvements and, as a result, provide greater assurance of future audit readiness.

Recommendations for Executive Action

To help improve the Navy’s audit readiness efforts for future Statement of Budgetary Activity audits, we are making the following two recommendations.

We recommend that the Secretary of the Navy direct the Assistant Secretary of the Navy (Financial Management and Comptroller) to establish a policy to coordinate with auditors concerning the dating of management representation letters and when they need to be provided to auditors in future audits consistent with DOD FMR requirements and establish milestones for assessing and effectively implementing certain complementary controls identified by DFAS to help the Navy achieve its military pay-related control objectives.

Agency Comments and Our Evaluation

We provided a draft of this report to the Navy for review and comment. In written comments, reprinted in appendix II, the Navy concurred with our two recommendations and concurred that continued efforts are needed to address identified findings and corrective actions. The Navy also described actions it has taken or has under way in response to our recommendations, including actions to ensure that management representation letters are provided within required time frames and to establish milestones to ensure that military pay-related control objectives are strengthened.

In its comments, the Navy recommended a modification to the title of our report to reflect the Navy’s ability to support its Schedule of Military Pay Activity for April 2013 with complete populations and sufficient documentation. In our report, we acknowledge that the Navy has taken steps to improve military pay auditability. However, significant concerns regarding its future audit readiness remain because of limitations the Navy placed on the scope of the IPA’s examination, such as the exclusion of selected systems the Navy relies on to process and report military pay activity, as well as uncertainty regarding the extent to which the Navy has effectively addressed deficiencies identified through its assertion and validation efforts. Based on our findings, we continue to stress the importance of addressing fundamental systems and control deficiencies, which will lead to lasting financial management improvements and, as a by-product, provide greater assurance of future audit readiness. As a result, we believe the title of our report appropriately focuses on efforts needed to address deficiencies discussed in this report and to improve Navy financial management, and consequently we have not revised the title as suggested by the Navy.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Defense, the Under Secretary of Defense (Comptroller)/Chief Financial Officer, the Secretary of the Navy, the Assistant Secretary of the Navy (Financial Management and Comptroller), the Director of the Defense Finance and Accounting Service, and appropriate congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine the extent to which (1) the Navy was able to provide sufficient documentation to support a complete and valid population of detailed transactions reconcilable to its schedule of military pay activity for April 2013, and (2) the Navy’s military pay assertion and validation efforts, which include the IPA’s examination, contribute to future audit readiness.

To address our first objective, we analyzed Navy and Defense Finance and Accounting Service (DFAS) documentation to gain an understanding of the Navy’s military pay audit readiness assertion and the processes, procedures, and systems used to process, report, and document Navy military pay. We also analyzed IPA and Navy documentation supporting the Navy’s schedule of military pay activity for April 2013, including reconciliations of reported amounts to relevant documentation produced by payroll, personnel, and disbursement systems and results of IPA procedures, to assess the sufficiency of evidence the Navy provided the IPA to support a complete and valid population of military payroll transactions to support its schedule of military pay activity for April 2013. In addition, we recalculated the reconciliations, traced selected amounts to supporting documentation, and assessed the appropriateness of selected reconciling items.

In addition, we reviewed the IPA’s plan, testing, projections, and conclusions for whether the Navy provided sufficient documentation to support the accuracy of transactions reflected in its schedule of military pay activity for April 2013. The IPA selected a sample of 405 leave and earnings statements for testing using a stratified random sample, with the stratification based upon transaction dollar amount. We randomly selected a 5 percent nongeneralizable sample of 21 leave and earnings statements from the IPA’s sample of 405 and re-performed the IPA procedures to assess the reliability of its work. We examined Navy documentation supporting pay and entitlement transactions included on the 21 leave and earning statements sample items we tested and re- performed the pay and entitlement calculations. We also re-performed the IPA’s error projection calculations. We used the Department of Defense (DOD) Financial Improvement and Audit Readiness guidance to assess whether documentation supporting pay and entitlement transactions met established requirements. We also interviewed IPA officials to understand test case results. We also reviewed the results of the IPA’s analytical review procedures to assess the Navy’s portion of Federal Insurance Contributions Act and retirement pay contribution amounts reflected in the Navy’s schedule of military pay activity for April 2013 and recalculated and re-performed other selected IPA procedures.

To address our second objective, we reviewed documentation provided by the Navy concerning (1) the Navy’s internal controls supporting its military pay audit readiness assertion; (2) the status of the Navy’s actions to address identified military pay-related internal control and information technology system deficiencies; (3) audit readiness efforts of selected military pay-related areas the Navy identified as outside of the scope of its military pay audit readiness assertion; and (4) the Navy’s coordination with the IPA, the DOD Office of Inspector General, and service providers on selected matters, such as the management representation letter and complementary controls, to identify areas where further improvements can be made to contribute to future audit readiness. We also reviewed documentation provided by the IPA, including reports related to its examination of the Navy’s military pay audit readiness assertion, results of internal control test procedures, and other audit documentation to determine the nature and extent of findings and recommendations identified by the IPA based on its examination.

To assess the reasonableness of the IPA’s internal control testing, we re- performed the IPA procedures for (1) a nongeneralizable sample of 10 of the 20 controls the IPA concluded were effective and (2) the 14 controls the IPA identified as not designed or operating effectively. We also interviewed officials from DOD, the IPA, DFAS, and the Navy’s Office of Financial Operations and Bureau of Naval Personnel to obtain explanations and clarifications associated with our evaluation of the documentation. In accordance with the relevant sections of the Financial Audit Manual on relying on the work of others, we obtained and reviewed the IPA’s most recent peer review, the IPA’s statement of independence, and qualifications of key IPA personnel. We reviewed the contract, contract modifications, and statements of work for the IPA’s examination of the Navy’s military pay assertion. We attended various key meetings between the IPA and the Navy related to the IPA’s examination of the Navy’s military pay assertion. The IPA performed its work from September 2013 through September 2014 and issued its opinion report in January 2015.

We conducted this performance audit from April 2014 to September 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of the Navy

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, James Kernen (Assistant Director), Carl Barden, Robert Dacey, Francine DelVecchio, Wilfred Holloway, Jason Kelly, Gregory Loendorf, Sheila Miller, Jared Minsk, Marc Oestreicher, Matthew Ward, and Matthew Zaun made key contributions to this report.