U.S. Government Financial Statements: FY 2000 Reporting Underscores the Need to Accelerate Federal Financial Management Reform
Released: 2001-03-30T00:00:00

Letter

Highlights of Major Issues Relating to the U.S. Government’s Consolidated Financial Statements for Fiscal Year 2000

As was the case for fiscal years 1997 through 1999,our report on the U.S. government’s consolidated financial statements for fiscal year 2000 states that certain significant financial systems weaknesses, problems with fundamental recordkeeping and financial reporting, incomplete documentation, and weak internal controls continued to hamper the government’s ability to accurately report a significant portion of its assets, liabilities, and costs.

Major challenges include the federal government’s inability to: properly account for and report (1) material amounts of property, equipment, inventories, materials, and supplies, and (2) certain stewardship assets, primarily at DOD; properly estimate the cost of certain major federal credit programs and the related loans receivable and loan guarantee liabilities, primarily at USDA; estimate and reliably report material amounts of environmental and disposal liabilities and related costs at DOD, and determine the proper amount of various reported liabilities, including postretirement health benefits for military employees and accounts payable and other liabilities for certain agencies; accurately report major portions of the net cost of government operations; ensure that all disbursements are properly recorded; and properly prepare the U.S. government’s consolidated financial statements, including balancing the statements, accounting for substantial amounts of transactions between governmental entities, fully ensuring that the information in the consolidated financial statements was consistent with the underlying agency financial statements, and reconciling operating results with budget results.

In addition, we found that (1) the government is unable to determine the full extent of improper payments—estimated to total billions of dollars annually—and therefore cannot develop effective strategies to reduce them, (2) serious, long-standing computer security weaknesses expose the government’s financial and other sensitive information to inappropriate disclosure, destruction, modification, and fraud, and critical operations to disruption, and (3) material control weaknesses affect the government’s tax collection activities. Further, the financial management systems of most CFO Act agencies were again reported by their auditors not to be in substantial compliance with certain FFMIA requirements.

I would now like to discuss in more detail the major issues identified by our work.

Ineffective Internal Control

In addition to the material weaknesses noted above, we found that (1) most agencies have not estimated the magnitude of improper payments in their programs and (2) material internal control weaknesses and systems deficiencies continue to affect the government’s ability to effectively manage its tax collection activities. We also found that widespread and serious computer control weaknesses, which are further discussed later in this testimony, affect virtually all federal agencies.

Improper Payments

Across government, improper payments occur in a variety of programs and activities, including those related to health care, contract management, federal financial assistance, and tax refunds, and include payments made for unauthorized purposes and for excessive amounts, such as overpayments to program recipients or contractors and vendors. The reasons for improper payments range from program design issues to inadvertent errors to fraud and abuse. While reported estimates of improper payments totaled approximately $20 billion for both fiscal years 2000 and 1999, the government did not estimate the full extent of improper payments.

As part of its annual financial statements, the Department of Health and Human Services (HHS) has been reporting a national estimate of improper Medicare Fee-for-Service payments since fiscal year 1996. In fiscal year 2000, HHS reported estimated improper Medicare Fee-for-Service payments of $11.9 billion, or about 7 percent of such benefits—down from $13.5 billion, or 8 percent, a year earlier and $23.2 billion, or 14 percent, for fiscal year 1996. HHS’ reporting and analysis of improper Medicare payments has helped lead to the implementation of several initiatives to identify and reduce such payments. Annual estimates of improper payments in future audited financial statements will provide information on the progress of these initiatives.

However, most agencies have not estimated the magnitude of improper payments in their programs and comprehensively addressed this issue in their annual performance plans under the Government Performance and Results Act. For example, the Earned Income Tax Credit (EITC) program—a refundable tax credit available to low-income, working taxpayers—has historically been vulnerable to high rates of invalid claims. During fiscal year 2000, the Internal Revenue Service (IRS) examined about 257,000 suspicious tax returns claiming about $587 million in EITCs and found that 173,000 of these returns claiming $395 million in EITCs (67 percent) were invalid. Additionally, during fiscal year 2000, IRS released the results of its study of EITC compliance for tax year 1997. In this study, which is not performed annually, IRS estimated that taxpayers filed returns claiming about $9.3 billion in invalid EITCs, of which $1.5 billion (16 percent) either was recovered or was expected to be recovered through compliance efforts. Although the full extent of refunds resulting from invalid EITCs is unknown, the IRS has not routinely estimated the potential magnitude of invalid refunds and has not disclosed an estimate of improper payments in its financial reports.

Without a systematic measurement of the extent of improper payments, agency management cannot determine (1) if the problem is significant enough to require corrective action, (2) how much to invest in preventative internal control, (3) the success of efforts implemented to reduce improper payments, or (4) the magnitude or trends of improper payments, which limits the ability to pinpoint or target mitigation strategies.

Tax Collection Activities

Material internal control weaknesses and systems deficiencies continue to affect the government’s ability to effectively manage its tax collection activities. This situation results in the need for extensive, costly, and time- consuming ad hoc programming and analyses, as well as material audit adjustments, to prepare basic financial information. As further discussed later in this testimony, this approach cannot be used to prepare such information on a timely, routine basis to assist in ongoing decision- making. Additionally, the severity of the system deficiencies that give rise to the need to resort to such procedures for financial reporting purposes, as well as deficient physical safeguards, result in burden on taxpayers and lost revenue.

The lack of appropriate subsidiary systems to track the status of taxpayer accounts affects the government’s ability to make informed decisions about collection efforts. Due to errors and delays in recording activity in taxpayer accounts, (1) taxpayers were not always being credited for payments made on their tax liabilities and (2) the government lost opportunities to retain or offset overpayments made by a taxpayer for one period to collect on outstanding amounts owed for another period. In addition, the government did not always follow up on potential unreported or underreported taxes and did not always pursue collection efforts against taxpayers owing taxes to the federal government. This could result in billions of dollars not being collected and adversely affect future compliance.

The federal government also continues to be vulnerable to loss of tax revenue due to weaknesses in preventive and detective controls over disbursements for tax refunds. Although the government does have detective controls in place, they are not applied to millions of tax returns estimated to have billions of dollars in underreported tax liabilities. These conditions expose the government to potentially billions of dollars in losses due to inappropriate refund disbursements.

Additionally, the government does not perform sufficient up-front verification procedures to ensure the validity of amounts claimed by taxpayers as overpayments prior to making disbursements for refunds. Finally, continued weaknesses in physical controls over cash, checks, and sensitive data received from taxpayers increase both the government’s and the taxpayers’ exposure to losses and increases the risk of taxpayers becoming victims of crimes committed through identity fraud.

IRS senior management continues to be committed to addressing many of these operational and financial management issues and has made a number of improvements to address some of these weaknesses. Successful implementation of long-term efforts to resolve these serious problems will require the continued commitment of IRS management as well as substantial resources and expertise.

Compliance With Applicable Laws and Regulations and FFMIA Requirements

Our work to determine compliance with selected provisions of laws and regulations related to financial reporting was limited by the material weaknesses discussed above. Instances of noncompliance, some of which the auditors reported were material to individual agency financial statements, are included in individual agency audit reports. However, none of these instances were material to the consolidated financial statements. Additionally, as further discussed later in this testimony, for most CFO Act agencies, the auditors reported that agencies’ financial management systems did not substantially comply with certain FFMIA requirements.

Need to Accelerate Financial Management Reform Efforts

Across government, we are seeing financial management improvement initiatives that could ultimately lead to an unqualified opinion on the U.S. government’s consolidated financial statements. However, accelerating the pace of completing ongoing and planned efforts to implement financial management reform is essential, as reports of Inspectors General and their contract auditors indicated that only 3 of the 24 CFO Act agencies had neither a material control weakness nor an issue involving compliance with applicable laws and regulations. While many of the pervasive and generally long-standing material weaknesses we have reported for the past 3 years remain to be fully resolved, some progress continues to be made in addressing the underlying causes of these problems—significant financial systems weaknesses, problems with fundamental recordkeeping and financial reporting, incomplete documentation, and weak internal controls.

The number of the 24 CFO Act agencies that were able to attain an unqualified audit opinion on their financial statements has increased. For fiscal year 2000, 18 of the 24 CFO Act agencies received unqualified opinions from their auditors, up from 6 agencies four years ago. Also, OMB has reported that, for the first time, all 24 CFO Act agencies met the March 1 reporting deadline. While the timeliness of agencies’ financial statement submissions has improved, agencies’ must work toward having their financial statements prepared and audited much closer to the end of a fiscal year, as March 1 is a reporting deadline rather than a benchmark indicating timely financial reporting. For example, auditors for SSA were able to report on SSA’s fiscal year 2000 financial statements on November 30, 2000, or 2 months after the close of the government’s fiscal year.

While agencies are making some progress in obtaining unqualified audit opinions on annual financial statements, many of these opinions were obtained by expending significant resources to use extensive ad hoc procedures and making billions of dollars in adjustments to derive financial statements months after the end of a fiscal year. The need for such time-consuming procedures, which often represent “heroic efforts,” primarily result from inadequate financial management systems. Also, irrespective of the unqualified opinions on their financial statements, many agencies do not have timely, accurate, and useful financial information and sound controls with which to make informed decisions and to ensure accountability on an ongoing basis.

For example, IRS’ unqualified opinion on its overall financial statements for the first time in fiscal year 2000 was the culmination of several years of extraordinary effort on the part of IRS senior management and staff to develop compensating processes to work around its serious systems and control weaknesses to derive year-end balances for its financial statements. While IRS’ efforts did address several management issues we raised in previous audits, its approach to obtaining the unqualified opinion relied heavily on costly, time-consuming processes; statistical projections; external contractors; substantial adjustments; and monumental human efforts that extended well after the fiscal year-end. This was particularly the case with respect to reporting amounts for both taxes receivable and property and equipment. Because IRS’ systems cannot accurately track amounts representing taxes receivable, IRS has for the past 4 years employed a complex statistical sampling process to derive the balance reported on its financial statements; this process takes months to complete, requires extensive human and financial resources, and results in tens of billions of dollars in adjustments annually to present a balance that is good for one day only. Additionally, because IRS does not have an adequate property management system, it had to use contractors to (1) perform statistical sampling procedures to derive a reliable balance for property and equipment in fiscal year 1999 and (2) analyze fiscal year 2000 transactions to derive the September 30, 2000, balance for property and equipment, a process that extended into February 2001.

Another case involves the Department of Justice (DOJ). For fiscal year 1999, auditors expressed a qualified opinion on DOJ’s financial statements. DOJ’s Office of Inspector General (OIG) reported this year that removal of the qualification on DOJ’s balance sheet required tremendous efforts and cost. According to the OIG, because DOJ lacks automated systems to readily support ongoing accounting operations, financial statement preparation, and the audit process, many tasks had to be performed manually. For example, in order to determine deferred revenue at year end, the Immigration and Naturalization Service manually counted approximately 2 million applications, which the OIG said involved substantial preparation and several preliminary counts throughout the fiscal year and caused delays in the processing of applications. The OIG said also that DOJ incurred substantial costs and depended heavily on contractors to assist in the cleanup of accounting transaction backlogs and to provide other accounting support.

In addition, the Department of Transportation’s (DOT) Federal Aviation Administration (FAA) used alternative procedures and labor-intensive methods to prepare its fiscal year 1999 financial statements, which received an unqualified audit opinion from the DOT Inspector General. The need for these efforts stemmed primarily from FAA’s long-standing weaknesses in accounting for property caused by the lack of an integrated property system. The DOT Inspector General also reported that, if improvements to address this issue were not made, the Department would have to continue the same type of extraordinary, expensive, and labor- intensive efforts in the future and that such efforts are not sustainable for the long term.

In fiscal year 2000, when FAA converted its real property system to a new property system, the number of real property items unexpectedly increased from about 14,000 to about 18,000 as of September 30, 1999 and 2000, respectively. In addition, FAA inappropriately changed property acquisition dates in its database, which caused depreciation expense for fiscal year 2000 and the net value of property as of September 30, 2000, to be incorrectly reported. For example, of the 216 FAA property items, having a total value of $398 million, that were tested as part of the DOT Inspector General’s fiscal year 2000 DOT financial statement audit, 58 items (27 percent) were found to have incorrect acquisition dates, causing the net value of these tested items to be overstated by $78 million. Because the Inspector General could not substantiate FAA’s property account balances, both FAA and DOT received a qualified opinion on their fiscal year 2000 financial statements. We initially designated FAA’s financial management as a high-risk area in 1999 and continued that designation in 2001.

Situations such as these demonstrate the tremendous efforts, lasting 5 months or more, many agencies use to produce annual financial statements. These agencies undertake far more work to prepare financial statements, beginning at the close of a fiscal year, than would be necessary if they had basic financial systems in place to routinely provide the data. Information to compile agency financial statements should flow from their financial management systems. Agencies will continue to rely on significant costly and time-intensive manual efforts to achieve or maintain unqualified opinions until automated, integrated processes and systems are implemented that readily produce the necessary information. The need for agencies to improve financial management systems is further discussed later in this testimony.

These efforts prevent financial management staff from doing other financial-related work such as financial analyses, which could directly support strategic decision-making and ultimately improve overall business performance. In our Executive Guide: Creating Value Through World-class Financial Management (GAO/AIMD-00-134, April 2000), we identified the success factors, practices, and outcomes associated with world-class financial management efforts. We found that many leading finance organizations have a goal to reduce the time spent on routine accounting activities, such as financial statement preparation, so that financial management staff can spend more time on activities such as business performance analysis or cost analysis.

Major Obstacles to Unqualified Opinion on Consolidated Financial Statements

As I mentioned earlier, the federal government has been required to prepare and have audited consolidated financial statements for the past 4 years. Successfully meeting this requirement is tightly linked to the requirement for the 24 CFO Act agencies to also produce auditable financial statements. This has stimulated extensive cooperative efforts and considerable attention by agency Chief Financial Officers, Inspectors General, Department of the Treasury and OMB officials, and the General Accounting Office. Those involved in these efforts understood that formidable challenges were ahead, as we had previously reported the need to overcome decades of neglect in addressing serious financial management and internal control problems across government. With the benefit of several years’ experience by the government in having the required financial statements subjected to audit, the time has come to focus even more intensified attention on the most serious obstacles to achieving an unqualified opinion on the U.S. government’s consolidated financial statements.

Reforming Financial Management at the Department of Defense (DOD)

The largest impediment to an opinion on the U.S. government’s consolidated financial statements is DOD’s serious financial management problems, which we have designated as high risk since 1995. To date, none of the military services, or the Department as a whole, have passed the test of an independent financial audit because of pervasive weaknesses in DOD’s financial management systems, operations, and internal control, including an inability to compile financial statements that comply with generally accepted accounting principles. The Department has made progress in a number of areas, but is far from solving a range of serious financial management problems. Their resolution, however, is key to having auditable consolidated financial statements because DOD has annual budget authority of about $310 billion, or about 16 percent of the entire federal budget, and is accountable for vast government assets worldwide.

Despite progress, ineffective asset accountability and lack of effective internal controls continue to adversely affect visibility over DOD’s estimated $1 trillion investment in weapon systems and inventories. These weaknesses can affect the Department’s ability to ensure that materials are on hand when needed and prevent the purchase of assets already on hand. Further, unreliable cost and budget information related to a reported nearly $1 trillion of liabilities and about $347 billion of net costs negatively affects DOD’s ability to effectively measure performance, reduce costs, and maintain adequate fund control. In addition, we are concerned that many of the planned financial management improvement initiatives are designed to result in a one-time, year-end number for financial statement purposes. As such, they will not result in the production of timely and reliable financial and performance information for ongoing use by management.

A visible, substantive, and sustained commitment from the Secretary of Defense and the Deputy Secretary of Defense, as well as from the military and civilian leadership, will be needed to overhaul DOD’s financial operations. Personnel throughout the Department must share a common goal of establishing modern and integrated financial management systems, processes, and controls that not only produce financial statements that can withstand the test of an audit, but more importantly routinely generate timely, reliable, and useful financial information for day-to-day management and operations purposes. The Secretary of Defense has indicated that he intends to include financial management reform among his top priorities. The Secretary of Defense’s personal commitment and involvement will be critical to the success of efforts to overhaul DOD’s financial management.

As we testified before you in May 2000 and the House Task Force on Defense and International Relations in July 2000, both short- and long- term actions will be needed to improve the Department’s financial management operations. In the short term, it will be essential to continue efforts to standardize, streamline, and simplify processes; to strengthen and enforce existing controls; to ensure basic transaction processing, which today is a major impediment, as well as a cost that can be greatly reduced; to develop more reliable estimates of future liabilities; to enhance human capital; and to oversee performance. At the heart of the Department’s long-term financial management challenge is hundreds of outdated and free-standing information systems. These systems are not integrated and have a range of individual weaknesses, some very serious, and collectively simply do not get the job done.

Thus, the ultimate resolution of DOD’s financial management problems— which are pervasive, deeply rooted, and complex in nature—must be closely tied to addressing its interrelated problems in the logistics, contract management, acquisition, strategic planning, support infrastructure, human capital, and information technology areas, including information security. As detailed in a January 2001 report on DOD’s performance and accountability, we have identified DOD financial management and these additional interrelated areas as the Department’s greatest challenges to developing world-class operations and activities to support its forces. To its credit, the Department has initiated a number of department-wide reform initiatives and other actions to improve its key business processes, not only in the financial area, but also in such areas as information management, weapon system acquisitions, and logistics reengineering. These initiatives have produced some positive results, but four key underlying causes of these problems within DOD have not yet been effectively addressed: (1) a lack of top-level management attention to and accountability for correcting problems, (2) cultural resistance to change, including service parochialism and stovepiped operations, (3) a lack of results-oriented goals and performance measures and monitoring, and (4) inadequate incentives for seeking change.

In this regard, DOD’s experience in addressing the Year 2000 (Y2K) computing challenge can serve as a guidepost to overhaul the Department’s financial management systems.

First, DOD recognized that Y2K was a Chief Executive Officer issue, not just a Chief Information Officer issue. The Deputy Secretary took direct control and exerted strong overall leadership. DOD’s financial management challenges cut across its operations, similar to Y2K. Given DOD’s corporate culture, strong, direct, and sustained financial management reform leadership must come from the top.

Second, Y2K had a date certain. But it also had a series of milestone dates, together with periodic self-reporting to gauge progress, to enable mid- course corrections, and to hold people accountable. To overhaul DOD’s financial management system, a clear plan with an end date and enforced interim milestones will be essential.

Third, for Y2K, DOD followed a standard, disciplined approach. Given the complexity of DOD’s financial management improvement challenge, it will be particularly important that DOD fully adhere to the information technology investment controls of the Clinger-Cohen Act.

Finally, for Y2K, DOD had extensive validation and verification by the Inspector General, as well as end-to-end testing. Meaningful testing and reporting by DOD must be critical components of a successful financial management system overhaul at DOD.

Focusing on Intragovernmental Transactions

As discussed earlier in this testimony, another major impediment that must be overcome is the government’s inability to properly account for billions of dollars of transactions between federal government entities; that is, intragovernmental transactions. Agencies’ accounts can be out of balance with each other, for example, when one or the other of the affected agencies does not properly record a transaction with another agency or the agencies record the transactions in different accounting periods. These out-of-balance conditions can be detected and corrected by instituting procedures for reconciling transactions between agencies on a regular basis and in a timely manner.

To help address this problem, for fiscal year 2000, OMB required CFO Act agencies to reconcile selected intragovernmental activity and balances with their trading partners. With full and proper implementation, the trading partner concept can begin to provide the government critical information with which to analyze the nature of intragovernmental account differences and develop effective solutions. However, numerous agencies did not complete reconciliations of intragovernmental activity and balances with their trading partners for fiscal year 2000. Using the detail of certain intragovernmental accounts by trading partner that was gathered by the government, we estimated that the amounts reported for agency trading partners for these specific intragovernmental accounts were out-of-balance by more than $250 billion.

The control weaknesses relating to unreconciled intragovernmental transactions, combined with the significant volume of transactions and number of reporting entities, can result in misstatements in the financial statements, hinder the ability of the government to identify misstatements that may exist, and may contribute to the amount of reported unreconciled transactions. The Joint Financial Management Improvement Program has initiated a study to further focus on identifying the causes of and solutions to the government’s intragovernmental transaction problem.

Resolving Financial Management Issues at the Department of Agriculture (USDA)

USDA is another major agency that continues to face challenges in correcting severe and long-standing financial management problems and achieving financial accountability over the billions of dollars of assets required to carry out its diverse missions. Since 1991, USDA’s Office of Inspector General has issued a series of unfavorable financial audit reports on USDA’s consolidated financial statements.

USDA Inspector General financial statement audits have, for example, determined that USDA continues to be unable to provide documentation to support numerous material financial statement line items. Also, the Inspector General has identified persistent internal control weaknesses over USDA’s financial management systems, food stamp receipt claims, and security controls for information technology.

In addition, since fiscal year 1994, the Inspector General has reported material weaknesses in the processes and procedures used by USDA’s lending agencies to estimate and reestimate loan subsidy costs for the Department’s net credit program receivables, which totaled a reported $73.8 billion as of September 30, 2000. As a result, USDA has been unable to implement the Federal Credit Reform Act of 1990 and related accounting standards. In addition, these problems materially affect USDA’s budget submissions because the same cost estimates are generally used for both budget preparation and financial reporting. Because the Inspector General can not provide assurance on USDA’s credit reform financial data, the Congress does not know whether the costs of USDA’s loan programs, estimated in excess of $24.1 billion, as of September 30, 2000, can be relied upon to base its decisions about whether to expand or scale back the agency’s loan programs.

Further, the Inspector General identified internal control and accounting problems involving $5.4 billion in general property, plant, and equipment reported by USDA in its fiscal year 2000 consolidated financial statements. For instance, the Inspector General reported material internal control weaknesses relating to personal property valued at a reported $597 million. Also, the Inspector General could not substantiate over $5.3 billion of real property reported by USDA on its fiscal year 2000 consolidated financial statements, most of which relates to assets that are the responsibility of the Forest Service.

The inability to substantiate USDA’s real property, and thus contributing to the Inspector General’s disclaimer of opinion, occurred because the Forest Service was unable to produce auditable fiscal year 2000 financial statements within established timeframes. Since 1999, we have designated the Forest Service financial management as a high-risk area due to its serious financial management systems weaknesses and the major hurdles it faces in achieving financial accountability.

USDA has completed several actions and begun others that, if successfully implemented, represent important steps toward first achieving an unqualified opinion on its financial statements and ultimately obtaining overall financial accountability. With the commitment of the Secretary and senior management across the Department, attaining an unqualified opinion on USDA’s financial statements is achievable if USDA successfully implements an integrated financial management system; fundamentally improves its underlying internal controls, financial management systems, and operations to provide the capability for routine production of timely, accurate, and useful data; and continues to have additional resources devoted to addressing its financial management deficiencies.

Addressing Computer Security Weaknesses

Evaluations of computer security continue to show that federal computer security is fraught with serious and widespread weaknesses. As a result, federal assets continue to be at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. Significant computer security weaknesses in systems that handle the government’s unclassified information continue to be reported in each of the major federal agencies.

The computer security weaknesses covered the full range of computer security controls. For example, physical and logical access controls were not effective in preventing and detecting system intrusions and misuse. In addition, software change controls were ineffective in ensuring that only properly authorized and tested software programs were implemented. Further, duties were not adequately segregated to reduce the risk that one individual could execute unauthorized transactions or software changes without detection. Finally, sensitive operating system software was not adequately controlled, and adequate steps had not been taken to ensure continuity of operations. The risks associated with these weaknesses are heightened because of the increasing interconnectivity of today’s computerized systems and use of the Internet that further exposes them to outside hackers.

The government is not in a position to estimate the full magnitude of actual damage and loss resulting from federal computer security weaknesses because it is likely that many such incidents are either not detected or not reported. However, GAO and IG reports on agency computer security weaknesses highlight the potential for negative impacts.

For example, computer control weaknesses at DOD increased the vulnerability of its interconnected systems to unauthorized access to modify, steal, and destroy DOD data, including financial, procurement, and logistics data. Also, weaknesses identified at HHS’s Health Care Financing Administration, IRS, and the Department of Veterans Affairs place medical, tax, and other sensitive records at risk of unauthorized disclosure, modification, and destruction. Unauthorized disclosure of sensitive information has led to instances of identity theft, in which individuals use such information to commit financial crimes, such as fraudulently establishing credit and running up debts. In addition, pervasive computer security weaknesses at the Department of the Treasury placed billions of dollars of payments and collections at significant risk of loss or fraud in its role as the government’s central financial manager, disburser, and collection agency. Further, the vulnerability of mission-related systems, such as those at the Environmental Protection Agency and the Department of Energy, to tampering, disruption, and misuse increase the vulnerability of the agencies’ financial systems.

We and the Inspectors General have issued numerous reports that identify computer security weaknesses in the federal government and have made scores of recommendations to agencies regarding specific steps they should take to make their security programs more effective. Also, in 2001, we again reported information security as a high-risk area across government, as we did in our 1997 and 1999 high-risk series.

As we have reported in the past, information security problems continue to persist, in large part, because agency managers have not yet established comprehensive security management programs. An effective program would include guidance and procedures for assessing risks, establishing appropriate policies and related controls, raising awareness of prevailing risks and mitigating controls, and evaluating the effectiveness of established controls. While some agencies have taken steps to develop and implement security policies and have established security awareness programs, the other key elements of an effective security management program have not been implemented. The implementation of a comprehensive security management program at all agencies would provide the government with a framework for resolving computer security problems and managing computer security risks on an ongoing basis.

The Congress has expressed concern about the serious and pervasive nature of computer security weaknesses and the resulting risks to federal government systems. Most recently, government information security reform provisions in the fiscal year 2001 National Defense Authorization Act are intended to strengthen information security practices throughout the government. Specifically, this new legislation requires annual agency and Inspectors General evaluations of agency security programs. Further, it requires each agency to develop and implement an agencywide information security program to provide information security for all operations and assets of the agency.

In addition, other efforts have been initiated at the governmentwide level to improve information security. For example, the federal Chief Information Officers Council has taken steps to raise awareness, promote best practices, and provide agencies tools for improving their security program. During 2000, the Council sponsored development of a self- assessment guide for agencies to serve as a means of measuring progress in improving information security. Also, the Federal Computer Incident Response Capability (FedCIRC) at the General Services Administration and the National Infrastructure Protection Center located in the Federal Bureau of Investigation have both expanded their efforts to issue warnings of potential computer intrusions or misuse and to assist in responding to computer security incidents. It is important to maintain the momentum of these governmentwide efforts and ensure that the activities currently under way are coordinated under a comprehensive strategy and that the roles and responsibilities of the numerous organizations with central responsibilities are clearly defined.

Improving Financial Management Systems

As I stated earlier, and it bears repeating because it represents the ultimate goal of the CFO Act, a central challenge is the need for agencies to generate timely, accurate, and useful data throughout the year by overhauling financial and related management information systems. The CFO Act calls for the modernization of financial management systems, including the systematic measurement of performance, the development of cost information, and the integration of systems—program, budget, and financial.

To help stimulate attention to this challenge, the Congress passed the Federal Financial Management Improvement Act (FFMIA) of 1996, which requires auditors performing financial audits to report whether agencies’ financial management systems comply substantially with federal accounting standards, federal financial management systems requirements, and the government’s standard general ledger at the transaction level. For fiscal year 2000, reports of Inspectors General and their contract auditors indicated that only 5 of the 24 CFO Act agencies’ financial management systems were in substantial compliance with the three federal financial management systems requirements of FFMIA.

Noncompliance with FFMIA, which we further discuss in our report, Financial Management: Federal Financial Management Improvement Act Results for Fiscal Year 1999 (GAO/AIMD-00-307, September 29, 2000), is indicative of the overall continuing poor condition of many financial systems across government. We reported that the reasons for systems’ noncompliance included nonintegrated systems, inadequate reconciliation procedures, noncompliance with the government’s standard general ledger, lack of adherence to accounting standards, and weak security over information systems. We have also reported that agency remediation plans, required by FFMIA, may not adequately address the system deficiencies. As required by FFMIA, GAO will report to the Congress by October 1, 2001, on agencies’ FFMIA implementation for fiscal year 2000.

Bringing financial management systems into compliance with the requirements of FFMIA is a complex and difficult challenge. Through the rigors of the financial statement audit process and the requirements of FFMIA, agencies have gained a better understanding of their financial management weaknesses and the impetus to resolve problems caused by those weaknesses. At the same time, agencies are slowly making progress in addressing their problems.

Facing the Year 2000 (Y2K) challenge of ensuring that systems functioned properly at the turn of the century understandably took priority for federal agencies and resulted in some agencies delaying financial systems changes. Now that the federal government has made the successful conversion to Year 2000, it can apply those valuable lessons to financial systems modernization. As I mentioned earlier, among the lessons learned were the importance of (1) providing high-level congressional and executive branch leadership, (2) understanding the importance of computer-supported operations, (3) providing standard guidance, (4) establishing partnerships, (5) facilitating progress and monitoring performance, and (6) implementing fundamental information technology improvements and disciplined processes.

Significant time and wise investments are needed for agencies to address and correct long-standing financial management systems problems. Over the longer term, agencies must address their serious systems problems by applying the framework outlined in the Clinger-Cohen Act and implementing guidance. This includes (1) adopting sound information technology investment and control processes, (2) designing well- developed architectures to guide information flows for financial and other related management information, and (3) establishing disciplined approaches for developing and acquiring computer software. Strong partnerships between Chief Financial Officers, Chief Information Officers, and program managers are essential to achieve these goals.

Ultimately, to fully meet the goals of financial management reform legislation, agencies will need to be able to generate timely, accurate, and useful financial and management information, including reporting performance results, to make decisions and monitor government performance every day. Agencies will also need to have effective internal control in place and must ensure compliance with applicable laws and regulations.

Moving From Balancing the Budget to Balancing Fiscal Risk

Meeting legislative financial management reforms and modernizing financial management systems will be especially important to provide the Congress and other policymakers timely, accurate, and useful information in deliberations involving the long-range fiscal policy challenges facing our nation. As I recently testified before the Senate Committee on the Budget, the government today is moving from balancing the budget to balancing fiscal risk.

This Congress and the President face a very different set of budget choices than did their predecessors. For over 15 years, fiscal policy has been seen in the context of the need to reduce the deficit. The policies and procedures put in place to achieve a balanced budget do not provide guidance for fiscal policy in a time of surplus.

While considerable uncertainty surrounds both short- and long-term budget projections, we know two things for certain: the population is aging and the baby boom generation is approaching retirement age. Although the 10-year horizon looks better in the Congressional Budget Office’s (CBO) January 31, 2001, projections than it did in July 2000, the long-term fiscal outlook looks worse. In the longer term—beyond the 10- year budget window of CBO’s projections—the share of the population over 65 will begin to climb, and the federal budget will increasingly be driven by demographic trends and rising health care costs.

In this regard, I have consistently stressed that without meaningful reform, demographic and cost trends will drive Medicare spending to unsustainable levels but that today’s projected surpluses provide an opportunity to act before these trends make needed changes more painful and disruptive. On March 19, 2001, the Trustees of the Social Security and Medicare trust funds reported on the current and projected status of these programs over the next 75 years. The near-term financial conditions of both Social Security and Medicare have improved since last year’s report. This should not distract from focusing on the more important long-term perspective. The Medicare Trustees’ latest projections incorporate more realistic assumptions about long-term health care spending and, as a result, the long-term outlook for Medicare’s financial future has deteriorated substantially since the last Trustees’ Annual Report.

Last week, I testified before the Senate Committee on Finance that we must capitalize on momentum gathering in the Congress and elsewhere to take action to adopt effective cost containment reforms alongside potential benefit expansions. The new consensus that Medicare is likely to cost more than previously estimated serves to reinforce the need to take prompt action. This issue, in part, must be dealt with from the standpoint of starting to take incremental steps to close the Trustees’ projected $4.6 trillion Hospital Insurance (Medicare Part A) 75-year funding gap. Also, it is important that any benefit expansion efforts be coupled with adequate program reforms so as not to worsen Medicare’s long-range financial condition. Congressional deliberations on modernizing the Medicare benefits package to include prescription drug coverage must focus attention on incremental solutions, concentrating on meeting targeted and legitimate needs rather than on unlimited wants.

While current budget surpluses offer an opportunity to address today’s needs and the many pent-up demands held in abeyance during years of fighting deficits, they do not eliminate our obligation to prepare for the future. Today’s choices must be seen not only in terms of how they respond to today’s needs, but also how they affect the future capacity of the nation and its ability to meet the very real and significant fiscal challenges associated with the approaching demographic tidal wave. Without a change in entitlement programs, demographics will overwhelm the surplus and drive us back into escalating deficits and debt. In this regard, for entitlement programs, the key question is not trust fund solvency but overall program sustainability.

The question before this Congress is how to balance today’s wants and needs against our nation’s long-term challenges. Surpluses challenge our nation to move beyond a focus on reducing annual deficits to a broader agenda. They offer us an opportunity to look more closely at what government does and how government does business. The budget surpluses before us offer policymakers the opportunity to strike a balance between addressing today’s needs and the obligation to hand a strong economy and sustainable fiscal policies on to our children, our grandchildren, and future generations.

As we look ahead, it will be essential for the government to begin strengthening its financial reporting to make more meaningful information available to the Congress, other policymakers, and the American public. Financial reports must continue to strive to further report on long-range financial commitments and contingencies, which will be useful in highlighting the long-range fiscal policy challenges facing the nation. Also, enhanced reporting in certain key areas, including performance information (i.e., results and outcomes), will be central to managing government operations more efficiently, effectively, and economically and in supporting the Government Performance and Results Act. In addition, enhanced disclosures on the government’s most valuable assets, its own employees—or human capital, is needed to draw further attention to the need to revamp federal strategic human capital management and assess the government’s capability to perform its missions in the future.

In closing Mr. Chairman, I want to underscore the importance of the President and the new Administration emphasizing and giving priority to (1) addressing the problems preventing us from being able to express an opinion on the government’s consolidated financial statements, (2) having effective internal control, and (3) modernizing financial management systems. As I stated at the outset of my testimony today, my recent meetings with the Treasury Secretary and the OMB Director have been most encouraging. I look forward to working closely and cooperatively with them in developing the short- and long-term strategies and plans necessary to address the problems I have discussed this morning.

Finally, I want to reiterate the value of sustained congressional interest in these issues, as demonstrated by this hearing and those held to oversee financial management reform at particular agencies. Your work and that of the committee over the past years to facilitate government management reform have been a catalyst to the progress we have seen to date and will be critical to ultimately restoring the confidence of citizens in the federal government as a financial steward that is accountable for its finances. It will be key that the appropriations, budget, authorizing, and oversight committees hold agency top leadership accountable for resolving these previously intractable problems and support improvement efforts.

I thank you for the opportunity to testify before you today, and I would be pleased to answer questions you or the members of the Subcommittee may have at this time.

GAO Contacts

For future contacts regarding this testimony, please call Jeffrey C. Steinhoff, Managing Director, or Gary T. Engel, Director, Financial Management and Assurance, on (202) 512-2600. (198046)