DOD Financial Management: Significant Efforts Still Needed for Remediating Audit Readiness Deficiencies
Released: 2017-02-09T00:00:00

Letter

Background

DOD has acknowledged that long-standing deficiencies in its internal controls, business systems, and processes have prevented it from being able to demonstrate that its financial statements are reliable. DOD spends billions of dollars annually to maintain key business processes and operations and to acquire modern systems. However, progress in making system and process improvements has been slow and has hindered DOD’s ability to achieve financial audit readiness.

DOD has undertaken several financial management improvement initiatives over the years to address deficiencies in business systems, processes, and controls through its Financial Improvement and Audit Readiness (FIAR) Plan and financial management reform methodology contained in its FIAR Guidance. DOD’s FIAR Guidance provides a standard, multiphased methodology that DOD components should follow to assess their financial management processes and controls and in developing and implementing financial improvement plans. These plans, in turn, are intended to provide a framework for planning, executing, and tracking essential steps and related supporting documentation needed to achieve auditability.

Congress mandated in the National Defense Authorization Act (NDAA) for Fiscal Year 2010 that DOD develop and maintain a FIAR Plan that includes the specific actions to be taken and costs associated with (1) correcting the financial management deficiencies that impair DOD’s ability to prepare complete, reliable, and timely financial management information and (2) ensuring that DOD’s financial statements are validated as ready for audit by September 30, 2017. In addition, the 2010 NDAA required that DOD provide recurring, semiannual reports to the congressional defense committees not later than May 15 and November 15 on the status of the department’s implementation of the FIAR Plan. Additionally, the 2010 NDAA required the first semiannual report to address DOD’s actions to develop standardized guidance for DOD components’ financial improvement plans, define oversight roles, and assign accountability for carrying out the FIAR Plan to appropriate officials and organizations.

The NDAA for Fiscal Year 2013 additionally required that the FIAR Plan Status Reports include (1) a description of the actions that each military department has taken to achieve an auditable SBR for DOD no later than September 30, 2014, and (2) a determination by each military department’s Chief Management Officer on whether the unit would be able to achieve an auditable SBR no later than September 30, 2014, without an unaffordable or unsustainable level of onetime fixes and manual work-arounds and without delaying the auditability of the financial statements. In the event that the Chief Management Officer of a military department determined that the military department would not be able to achieve an auditable SBR by that date, the Chief Management Officer was required to explain why the military department could not meet that date and provide an alternative date for achieving an auditable SBR along with a plan to meet the alternative date.

In the November 2014 FIAR Plan Status Report, DOD acknowledged that it did not meet the September 30, 2014, target date for achieving audit readiness of the SBR (which reflects budgetary activity across multiple years), but stated that the three military services asserted audit readiness of their Budgetary Schedules for fiscal year 2015 (which reflect activity for 1 year) in the last quarter of fiscal year 2014. The NDAA for Fiscal Year 2014 mandated that the Secretary of Defense ensure that a full audit is performed on DOD’s fiscal year 2018 financial statements and submit the results of that audit to Congress no later than March 31, 2019. Further detail on the distinctions between the SBR and Budgetary Schedule is provided in appendix II.

Military Services’ Assertions of Audit Readiness

The FIAR Guidance was first issued by the DOD Comptroller in May 2010 and provides a standardized methodology for DOD components to follow for achieving financial management improvements and audit readiness objectives. However, according to DOD Comptroller officials, in applying this guidance during the initial years of discovery and documentation, they spent an inordinate amount of time validating the military services’ management assertions, which delayed an independent review by the DOD OIG or an IPA. As a result, DOD Comptroller officials revised their approach to leverage independent reviews by the auditors to focus resources and remediation efforts on most critical deficiencies. To emphasize the need for the military services to take ownership of their own audit readiness assertions for their Budgetary Schedules, this approach was applied to the decision to proceed with the audits of the fiscal year 2015 Budgetary Schedules. According to DOD Comptroller officials, they participated in ongoing dialogue with the military services at audit readiness oversight meetings and reviewed their progress in key areas, but the military services did not have to provide detailed documentation to the DOD Comptroller’s office in support of their assertions of audit readiness for their Budgetary Schedules. Instead, each military service submitted a memo to the DOD OIG prior to September 30, 2014, asserting that its Budgetary Schedule was either ready or would be ready for audit beginning with fiscal year 2015.

In their assertion memos, the Army stated that its Budgetary Schedule was ready for audit and the Air Force stated that its schedule would be ready. The Army and Air Force assertion memos stated that the assertions depended on planned corrective actions (e.g., producing a complete population of transactions and implementing service provider integration). The Navy’s assertion memo stated that its Budgetary Schedule was ready for audit based on the results of the multiyear effort to document, test, and remediate known control deficiencies related to its procedures, processes, controls, and financial systems.

Military Services’ Funds

Each military service is organized into two reporting entities: a general fund and a working capital fund. A military service’s general fund account structure includes five major groups: (1) military personnel; (2) operations, readiness and support; (3) procurement; (4) research, development, test and evaluation; and (5) family housing/military construction. Each military service’s programs are authorized by Congress in annual NDAAs, and each military service receives appropriations from Congress through annual appropriations acts. Table 1 presents information on each military service’s fiscal year 2015 general fund appropriations, personnel, and locations.

Audits of the Army’s, Navy’s, and Air Force’s Fiscal Year 2015 Budgetary Schedules Resulted in Disclaimers of Opinion

The Army, Navy, and Air Force asserted audit readiness for their Budgetary Schedules in 2014 and underwent their first Budgetary Schedule audits for fiscal year 2015. The IPAs for all three military services issued disclaimers of opinion on the respective services’ fiscal year 2015 Budgetary Schedules and identified material weaknesses in internal control. For example, all three IPAs reported findings related to the military services’ inability to (1) provide complete populations of transactions, (2) provide documentation to support transactions, (3) effectively implement information system controls to protect their financial data in both general ledgers and related feeder systems, and (4) exercise sufficient oversight of their service providers. The IPAs for all three military services reported each of these reportable findings as a stand-alone material weakness or as part of a larger, combined material weakness. Army, Navy, and Air Force management generally concurred with the findings in the respective IPA reports and stated that they will develop and execute corrective actions to address the IPAs’ related findings.

Army, Navy, and Air Force Were Unable to Provide Complete Populations of Transactions

The IPAs for all three military services reported that they were unable to identify complete populations of transactions for the respective services’ fiscal year 2015 Budgetary Schedules. This reportable finding contributed to each IPA’s disclaimer of opinion. For financial statements to be considered reliable, they must reflect the results of all significant financial activity (transactions) during the reporting period (e.g., 1 fiscal year for the Budgetary Schedules). When performing a financial statement audit, one of the assertions that the auditor evaluates is completeness, which pertains to whether all transactions and events that should have been recorded in the financial statements were recorded.

Most military service transactions are initially processed and recorded in information technology systems called feeder systems. For example, payroll transactions are processed in a military service’s payroll system. Transactions processed in feeder systems should eventually be transferred to the military service’s general ledger where all transactions are accumulated. At the end of a reporting period, each military service’s general ledger data are transferred to DOD’s financial reporting system, which summarizes the financial data according to the line items that are ultimately reported in the financial statements.

Figure 1 illustrates how financial data for the military services are initially processed, then combined with other data as they are transferred from one automated system to another, and ultimately result in the Budgetary Schedule.

When data are transferred from one system to another, interface controls should be in place to reasonably assure that the data are transferred accurately, timely, and completely. The objectives of interface controls are to implement effective (1) interface strategy and design and (2) interface processing procedures. Effective interface procedures reasonably assure that interfaces are processed completely, accurately, and only once in the proper period; interface errors are rejected, isolated, and corrected in a timely manner; and access to interface data and processes is properly restricted. The systems should be designed with balancing controls, such as control totals and record counts, to reasonably assure that data are controlled. Also, the entity should have effective procedures to reconcile control information between the two systems. If the reconciliation identifies differences, these differences should be researched to determine their causes and any errors corrected. This reconciliation process helps ensure that the results of all transactions occurring during the reporting period are accurately reported in the financial statements.

In conducting the audits of the military services’ Budgetary Schedules, the IPAs reviewed the military services’ reconciliation processes to determine whether all transactions were completely transferred from military services’ feeder systems to the general ledgers and, ultimately, to the DOD-wide financial reporting system. The IPAs reported that the military services did not have sufficient reconciliation processes in place to reasonably assure that the general ledgers included all of the transactions that should be included in the Budgetary Schedules, increasing the risk that the Budgetary Schedules did not reflect the results of all budgetary transactions that occurred.

The following are examples of completeness issues reported by the IPAs.

The Army was unable to reconcile the first quarter fiscal year 2015 population of civilian payroll transactions from a civilian pay feeder system to one of its four general ledger systems.

The Navy had no assurance that transactions were completely and accurately recorded in its four general ledger systems because it has not designed and implemented sustainable and recurring manual and automated reconciliations with its more than 100 feeder systems.

The Air Force’s nonintegrated information technology system environment requires both manual reentry of data into multiple systems and complex system interfaces. The auditors found that the Air Force did not always reconcile the data after entering the data manually or transferring the data from interfacing systems. The auditors reported that many of the reconciliations were newly implemented and not in place during the entire fiscal year or were not performed through the end of the fiscal year.

Army, Navy, and Air Force Were Unable to Provide Documentation to Support Transactions

The IPAs for all three military services noted the lack of adequate supporting documentation as a reportable finding on their Budgetary Schedule audits, which also contributed to each IPA’s disclaimer of opinion. Appropriate documentation for financial transactions allows the military services to support financial statement line items and allows auditors to test line items. For all three military services, auditors found that adequate documentation to support disbursements and obligations was not always available. The lack of adequate documentation increased the risk of a misstatement on the Budgetary Schedules.

According to Standards for Internal Control in the Federal Government, developing and maintaining thorough and accurate documentation to support financial transactions is essential to management’s ability to effectively monitor financial transactions and provide reasonable assurance that internal controls are in place and operating as intended. Accurate documentation also allows management to correct errors timely and safeguard assets. Additionally, appropriate documentation of financial transactions allows support to be readily available for examination by an auditor.

The following are examples of supporting documentation issues reported by the IPAs:

The Army did not have documentation readily available to demonstrate that specific transactions were properly reported in the Budgetary Schedule. Specifically, the auditors reported that documentation supporting contractual services, military payroll, civilian payroll, reimbursable authority, disbursement, and collection transactions was either not available, was insufficient, or did not agree to the general ledger detail.

The Navy did not always have the underlying detail for journal vouchers or sometimes lacked complete explanations for the purpose of journal vouchers. The auditors reported that in some cases, journal vouchers were used to adjust amounts to agree with Department of the Treasury (Treasury) or trading partner balances, without underlying support for the adjustment amounts.

The Air Force did not always maintain adequate documentation to support disbursements and obligations. The auditors reported a lack of adequate supporting documentation for transactions related to travel expenses and payments made to vendors and contractors for purchases of goods and services.

Army, Navy, and Air Force Did Not Have Adequate Information System Controls

The IPAs for all three military services identified a lack of adequate information systems general controls as another reportable finding, which precluded the IPAs’ ability to rely on the services’ financial data and thus contributed to their disclaimers of opinion. The military services’ ability to efficiently and effectively manage and oversee their day-to-day operations and programs relies heavily on the capacity of their financial management information systems to produce complete, reliable, timely, and consistent financial information. The IPAs for all three military services identified information systems general control deficiencies related to access controls, segregation of duties, and configuration management. In addition, the IPA for the Army identified information systems general control deficiencies in security management and contingency planning; the IPA for the Navy reported information system general control deficiencies in security management and information system control deficiencies related to interface controls; and the IPA for the Air Force reported information system control deficiencies related to interface controls.

The following are examples of information system control deficiencies reported by the IPAs.

The Army did not consistently perform effective daily operating system backup procedures or maintain evidence of operating system and database backups when performed for certain financial systems. As a result, the IPA concluded that this condition could affect the Army’s ability to provide financial data that are complete, valid, and accurate. Further, the IPA found that the Army and its service providers had not implemented sufficient, effective information system general controls to protect the Army’s general ledgers and related feeder systems’ financial data.

The Navy did not consistently implement effective interface controls between its systems and its service providers. As a result, the IPA found that the Navy was unable to reasonably assure the completeness and accuracy of financial data flowing between its systems and the service providers. The IPA found that the Navy also lacked effective information system controls over its general ledger systems and financial feeder systems and had pervasive control deficiencies in its decentralized information system environment.

The Air Force did not have controls in place to prevent certain individuals from controlling key aspects of computer-related operations; as a result, the IPA found that unauthorized access to systems and system information and unauthorized actions had occurred. Multiple systems allowed a significant number of administrator users the authority to complete an entire functional process by inputting, processing, and approving transactions. Additionally, the IPA reported that developers were granted inappropriate access to make modifications directly to the production environment and delete system files.

Army, Navy, and Air Force Did Not Exercise Sufficient Oversight of Their DOD Service Providers

The IPAs identified insufficient oversight by the Army, Navy, and Air Force of DOD service organizations, also referred to as service providers, as a reportable finding that also contributed to each IPA’s disclaimer of opinion. Specifically, the IPAs for all three military services found that the services did not exercise sufficient oversight of their service providers responsible for performing financial reporting activities to ensure completeness, accuracy, and validity of the financial data reported and evaluate the complementary user entity controls included in the Statement on Standards for Attestation Engagements (SSAE) No. 16 reports to determine design and operating effectiveness.

The Army, Navy, and Air Force utilize many service providers to improve efficiency and standardize business operations. Among the many service providers within DOD are the Defense Finance and Accounting Service (DFAS), Defense Information Systems Agency, Defense Logistics Agency, and Defense Contract Management Agency. According to the FIAR Guidance, the Army, Navy, and Air Force rely on these DOD service organizations to provide a variety of accounting, personnel, logistics, and system operations services.

Each of the reporting entities—the Army, Navy, and Air Force—is ultimately responsible for ensuring that all key processes, systems, internal controls (including those performed by service organizations), and supporting documentation affecting its financial reporting objectives are audit ready. However, service providers working with reporting entities are also responsible for executing audit readiness activities surrounding service provider systems and data, processes and internal controls, and supporting documentation that have a direct effect on the reporting entities’ audit readiness.

Therefore, to ensure successful completion of audit readiness tasks, the reporting entity and service provider must agree on the roles and responsibilities for the authorization, initiation, processing, recording, and reporting of transactions; the information technology controls affected by the service provider; or both. The FIAR Guidance states that a shared understanding and agreement between the service provider and reporting entity on these roles and responsibilities must be documented in a service-level agreement or memorandum of understanding. According to the FIAR Guidance, these mutual responsibilities include maintaining open communications and coordinating with one another; establishing common expectations in writing; providing additional system and financial information within agreed- providing access to subject matter experts or contractors supporting those organizations within agreed-upon time frames; working together to discover and correct audit impediments; and establishing a common, detailed understanding of the method for obtaining assurance.

According to the FIAR Guidance, reporting entity management is responsible for the internal control over their financial information and therefore must ensure that it understands what financially significant activities are outsourced to service providers and the effectiveness of the service providers’ related internal controls. In turn, each service provider is responsible for providing a description of its controls that may affect its customer reporting entities’ control environments, risk assessment, control activities, and information and communication systems. Appendix D to Office of Management and Budget (OMB) Circular A-123, “Compliance with the Federal Financial Management Improvement Act of 1996,” requires each service provider to provide a Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting to its customers or allow customer auditors to perform appropriate tests of internal controls at its organizations. These reports are an important tool for agency management and auditors to use in evaluating the effect of the controls at the service organization on the user entities’ controls for financial reporting.

The following are IPA-identified examples of insufficient oversight by the Army, Navy, and Air Force of their service providers.

The Army did not have policies and procedures to assess service providers that host or manage financial systems that support accounts reported on the Army's Budgetary Schedule. Specifically, the IPA found that the Army did not document its understanding of the services provided or the related SSAE No. 16 reports so that it could determine whether the scope of these reports met the Army’s needs for obtaining assurance regarding service provider controls.

The Navy did not implement effective controls over its service provider systems. As a result, the IPA (1) encountered difficulties in identifying key points of contact within the Navy, (2) reported that appropriate service-level agreements with the Navy’s service providers were not fully developed, and (3) noted that Navy personnel did not periodically review available SSAE No. 16 reports.

The Air Force compiled a list of complementary user entity controls; however, the IPA found that it did not validate the operating effectiveness of the controls or verify the accuracy and completeness of the complementary user entity controls list.

The Military Services Did Not Sufficiently Design Their Processes to Address Financial Management Deficiencies

The IPAs for the Army, Navy, and Air Force collectively issued over 700 notices of findings and recommendations to the respective military services during the course of the fiscal year 2015 Budgetary Schedule audits. Each notice had one or more findings and discussed deficiencies that the IPA identified during the audit along with a corresponding recommendation(s) for addressing the deficiencies. These deficiencies pertained primarily to internal control deficiencies, with almost 75 percent of these related to information systems. In addition, the military services received findings and recommendations related to financial management deficiencies identified during audits performed by other audit organizations, including the DOD OIG and GAO, which also must be remediated. Also, management may have identified financial management deficiencies, for example, through OMB Circular A-123 reviews or management studies.

Each military service is responsible for establishing its own processes for addressing these findings and recommendations by (1) identifying and tracking them, (2) prioritizing them, (3) developing corrective action plans (CAP) to address them, and (4) monitoring the status of CAP implementation. However, we found to varying degrees that each service did not have sufficient processes for doing so. While the military services should have already had such processes in place to manage findings and recommendations resulting from any audit, the need to effectively implement these processes has become more important in light of (1) the many findings and recommendations that resulted from the Budgetary Schedule audits, (2) future audits that will have a broader scope of work and may therefore identify additional findings, and (3) the short period remaining before the fiscal year 2018 audits must occur. For example, with the large number of findings resulting from the Budgetary Schedule audits and the effort it will take to address them all, prioritization of deficiencies that preclude the ability to audit the financial statements is crucial for the military services to achieve audit readiness.

We compared the military services’ existing processes to the guidance and standards defined in the Implementation Guide for OMB Circular A- 123, Management’s Responsibility for Internal Control, Appendix A, Internal Control over Financial Reporting (Implementation Guide for OMB Circular A-123); the FIAR Guidance; and Standards for Internal Control in the Federal Government. According to these sources, which we used as criteria in evaluating the design of the services’ existing processes, a sound approach to addressing financial management deficiencies would include the following four elements. 1. Identifying and tracking audit findings and recommendations.

Federal internal control standards require that managers (1) promptly evaluate findings from audits and other reviews, including those showing deficiencies and recommendations reported by auditors and others who evaluate agencies’ operations; (2) determine proper actions in response to findings and recommendations from audits and reviews; and (3) complete, within established time frames, all actions that are needed to correct or otherwise resolve the matters brought to management’s attention. To ensure that these actions are taken, management needs a means—that is, accurate and adequate documentation—to keep track of the findings and recommendations. 2. Prioritizing findings and recommendations. The Implementation Guide for OMB Circular A-123 and the April 2016 FIAR Guidance state that the extent to which corrective actions are tracked should be commensurate with the severity of the deficiency. The Implementation Guide for OMB Circular A-123 also states that an agency’s senior assessment team will work with the responsible officials and personnel to determine which deficiencies are cost beneficial to correct. 3. Developing CAPs. The Implementation Guide for OMB Circular A- 123 states that a CAP, including targeted milestones and completion dates, will be drafted and progress will be monitored. The elements of a CAP include a summary description of the deficiency; the year the deficiency was first identified; the target corrective action date (the date of management follow- up); the agency official responsible for monitoring progress; the indicators, statistics, or metrics used to gauge resolution progress (in advance of audit follow-up) in order to validate the resolution of the deficiency (referred to as outcome measures for assessing the effectiveness of the corrective actions for purposes of this report); and the quantifiable target or otherwise qualitative characteristic that reports how resolution activities are progressing (referred to as interim milestones for monitoring progress on interim actions for purposes of this report).

DOD’s FIAR Guidance states that CAPs should be developed for all material weaknesses and that progress in implementing these plans should be periodically assessed and reported to management, which should track progress to ensure timely and effective results. For significant deficiencies, as well as nonsignificant deficiencies that were not externally reported, CAPs should be developed and tracked internally at the appropriate level. 4. Monitoring the status of CAP implementation. Federal internal control standards state that the resolution process begins when audit or other review results are reported to management, and is completed only after action has been taken that (1) corrects identified deficiencies, (2) produces improvements, or (3) demonstrates that the findings and recommendations do not warrant management action. The Implementation Guide for OMB Circular A-123 states that an entity’s senior management council, or similar forum(s), has ownership and accountability for resolving deficiencies. These forums should use CAPs as a guide or road map for discussion as well as in determining when sufficient action has been taken to declare that a deficiency has been corrected.

According to DOD’s FIAR Guidance, management’s process for resolution and corrective action of identified material weaknesses in internal control must do the following:

Provide for appointment of an overall corrective action accountability official from senior agency management. The official should report to the agency’s senior management council, if applicable.

Maintain accurate records of the status of the identified material weaknesses through the entire process of resolution.

Assure that CAPs are consistent with laws, regulations, and DOD policy.

Assure that performance appraisals of appropriate officials reflect effectiveness in resolving or implementing corrective actions for identified material weaknesses.

The FIAR Guidance further states that a determination that a deficiency has been corrected should be made only when sufficient corrective actions have been taken and the desired results achieved. This determination should be in writing and, along with other appropriate documentation supporting the determination, should be available for review by appropriate officials.

After comparing the criteria under the four elements above with the design of the Army, Navy, and Air Force policies and procedures for tracking and resolving audit findings, we found that while Navy had sufficiently drafted policies and procedures to address three out of the four elements, the Army’s and Air Force’s policies and procedures did not sufficiently address any of the four elements, as detailed below.

Army’s Process for Addressing Financial Management-Related Audit Findings and Recommendations Was Not Comprehensive

The Army’s process for managing the remediation of financial management deficiencies was not comprehensive, and portions of it were evolving as it began to address the financial management-related findings and recommendations from the fiscal year 2015 Budgetary Schedule audit. The Army’s regulation regarding audits of the Army includes general guidance establishing responsibility for responding to audit findings from different sources, such as the Army Audit Agency, DOD OIG, GAO, and IPAs. This regulation primarily focuses on the role of the Army Audit Agency and states that the Army Audit Agency is responsible for forwarding external audit reports to the appropriate principal Army official who has responsibility for responding to a given report. In addition, the Army organization with overall responsibility for the results from the Budgetary Schedule audit has its own policies and procedures for responding to audit recommendations. However, the Army lacks procedures for reasonably assuring that it identifies and tracks all financial management findings and recommendations. In addition, the Army’s policies and procedures (1) did not provide sufficient details on how to prioritize financial management findings and recommendations, (2) were not consistent with the Implementation Guide for OMB Circular A-123 for developing CAPs, and (3) did not sufficiently describe how the status of corrective actions should be monitored.

Army’s Procedures for Identifying and Tracking Open Audit Findings and Recommendations Vary and Are Incomplete

The status of each open finding and recommendation pertaining to Army financial management issues is supposed to be tracked by one of two organizations. Specifically, under the Assistant Secretary of the Army, Financial Management and Comptroller (ASA(FM&C)), (1) the Accountability and Audit Readiness Directorate (hereafter referred to as the Audit Readiness Directorate) is responsible for tracking findings and recommendations from the Budgetary Schedule audit, as well as other financial statement-related audits and audit readiness activities, and (2) the Internal Review Directorate is responsible for tracking other financial management-related findings and recommendations, primarily from the DOD OIG and GAO but also some from the Army Audit Agency, that pertain to the ASA(FM&C). When they receive new audit recommendations, each of these directorates determines which Army organization is responsible for addressing each recommendation under its purview.

We reviewed the tracking procedures for each of these directorates and found that they varied. Specifically, the Audit Readiness Directorate uses a spreadsheet called a CAP tracker to keep track of the hundreds of findings and recommendations issued during the audit of the Army’s fiscal year 2015 Budgetary Schedule, as well as the status of CAPs developed to remediate them. During our audit, we looked at the CAP tracker in March 2016 and found that it consisted primarily of findings and recommendations from the Budgetary Schedule audit, but also included two findings and recommendations each from the DOD OIG and the Army Audit Agency. These other recommendations were included in the CAP tracker because they also pertained to audit readiness issues. The CAP tracker is mentioned in the Audit Readiness Directorate’s Standard Operating Procedure (SOP) for follow-up actions needed to respond to financial statement audits and other audit readiness activities, which it finalized in May 2016. However, the SOP does not provide any details about what information for each finding and recommendation should be in the CAP tracker, such as interim milestones and outcome measures.

The Internal Review Directorate also uses a spreadsheet to track the findings and recommendations that it is responsible for tracking. However, according to an Internal Review Directorate official, the directorate did not have an SOP or other written policies and procedures pertaining to its tracking of audit recommendations or to any other aspect of managing the audit remediation process and related corrective actions to address them. While reviewing the CAP tracker in March 2016, we identified 42 unresolved recommendations related to financial management that resulted from prior audits conducted by the Army Audit Agency, the DOD OIG, and GAO and that should have been tracked by the Internal Review Directorate. We found that as of August 2016, the Internal Review Directorate was tracking 37 of these recommendations while the other 5 open recommendations were not included in its tracker. An Internal Review Directorate official said that these 5 recommendations, all of which stemmed from a GAO report from fiscal year 2013, were made before he began working in the directorate, and therefore, he did not know why they were not included. According to this official, neither the Internal Review Directorate nor anyone else within ASA(FM&C) had established procedures to ensure that all financial management-related recommendations were being tracked within this organization.

Without policies and procedures that clearly specify how audit findings and recommendations should be tracked and which types of findings and recommendations should be tracked by each of the two Army organizations described above—the Audit Readiness Directorate and the Internal Review Directorate—it can be difficult to hold either organization accountable and reasonably assure that procedures are followed consistently, particularly when there is staff turnover. If findings and recommendations are overlooked and do not get tracked by either organization, they are less likely to be remediated in a timely manner or possibly at all.

Army’s SOP for Prioritizing Audit Findings and Recommendations Provides Only General Guidance

The Audit Readiness Directorate’s SOP includes general guidance for prioritizing audit findings that is based on direction and criteria outlined in the FIAR Guidance. Specifically, the SOP cites the following criteria for prioritization: severity of deficiencies (material weakness or significant deficiency); designation as a FIAR deal-breaker; findings that reference a documentation gap; findings that are pervasive across business processes; and finding sensitivity (e.g., failure of good stewardship of government resources). However, the SOP does not identify which of the criteria might be a higher priority than others. Consequently, if the Audit Readiness Directorate followed the SOP criteria for prioritization, most of the over 200 Budgetary Schedule audit findings would be considered a priority, which would defeat the intent of identifying priorities. To avoid this, Army officials said that based on input from the IPA they decided to narrow the criteria for prioritizing the Budgetary Schedule findings and recommendations to those related to the critical areas of completeness, documentation, Fund Balance with Treasury, and information systems. Using these criteria, Army officials said they identified specific findings and recommendations, and the related CAPs, as high priority. These criteria are a subset of the criteria in the Audit Readiness Directorate’s SOP as these issues were reported as material weaknesses by the IPA and three of the four areas are also considered deal-breakers in the FIAR Guidance. However, these more narrow criteria are not yet included in the Audit Readiness Directorate’s SOP.

The Internal Review Directorate does not have any policies or procedures for prioritizing the audit recommendations that it tracks. Instead, according to a directorate official, the action officers responsible for specific recommendations are in the best position to determine priorities as they are more familiar with the conditions that generated each recommendation. Without sufficiently detailed policies and procedures for consistently and systematically prioritizing audit findings, the Army is at increased risk of not identifying and focusing its efforts on its most critical financial management weaknesses, and thereby not taking the steps necessary to resolve them at the earliest possible date.

Army’s Guidance for Developing CAPs Was Not Complete

Only one of the two Army organizations responsible for remediating audit findings had documented guidance for developing CAPs. The Audit Readiness Directorate’s SOP describes the procedures for developing CAPs to address findings from financial statement audits and audit readiness activities. For example, it states that the Army official responsible for developing a CAP should identify the root cause of the finding related to the CAP. It also states that CAPs should be developed using the format and template provided by the Audit Readiness Directorate. This template includes most of the elements recommended in the Implementation Guide for OMB Circular A-123, including a description of the deficiency, the responsible official, interim milestones, outcome measures, and an estimated completion date.

However, the Internal Review Directorate does not have any policies requiring the development of CAPs or any other procedures that should be followed to remediate the audit recommendations that it tracks, according to a directorate official. Instead, the official said that after the Internal Review Directorate forwards a report to an action officer for remediation, the action officer will provide the directorate an estimated completion date for each recommendation that the officer is responsible for. When responsible organizations or officials believe that recommendations have been remediated, they send descriptions of the actions taken to the Internal Review Directorate with messages indicating that the recommendations can be closed. These procedures were not documented and do not include the elements recommended in the Implementation Guide for OMB Circular A-123. Without documented procedures for developing CAPs for all audit findings, the Army is at increased risk of not developing CAPs for all findings or developing CAPs that do not include all necessary elements.

Army’s Process for Monitoring the Status of CAP Implementation Was Not Fully Documented

Once a plan for a corrective action is complete, the CAP is expected to be carried out and monitored by senior management, as recommended by the Implementation Guide for OMB Circular A-123. According to Army officials, any detailed documentation of CAP implementation is maintained by the person responsible for carrying out the plan. We found that this was the case for the remediation of all financial management- related recommendations, whether they fell under the responsibility of the Audit Readiness Directorate or the Internal Review Directorate.

Because the Internal Review Directorate does not require CAPs for the audit recommendations under its purview, it also does not monitor the status of CAP implementation. Rather, it only maintains information about when the corrective actions for a given audit recommendation are considered complete and the recommendation can therefore be closed.

For the audit recommendations that fall under the Audit Readiness Directorate, the directorate’s SOP states that the directorate is responsible for monitoring the progress of the CAPs and provides some information on how the monitoring should be conducted. For example, it states that monitoring is carried out via regularly scheduled meetings during which the senior responsible officials for each CAP provide briefings about the status of corrective actions. The SOP mentions the following types of meetings:

Synchronization calls are held weekly between the Audit Readiness Directorate and one of two different groups that alternate every other week. According to Army officials, one group includes the Enterprise Resource Planning (ERP) managers, feeder system managers, and DFAS, while the other group includes the Army commands—that is, business process areas.

The Army Audit Committee meets bimonthly and is chaired by the ASA(FM&C). Army officials told us that these meetings include all of the Deputy ASAs, Army principals and major commands, as well as DOD management such as the DCMO and officials from the DOD Comptroller’s office, including the Deputy Chief Financial Officer.

However, the SOP does not provide complete information about all of the monitoring activities that take place. For example, Army officials told us that monitoring of the CAPs takes place at other meetings as well, although these meetings are not described in the SOP. These meetings included the following:

The Senior Level Steering Group/Senior Assessment Team, which represents senior Army management responsible for monitoring development and implementation of the CAPs. This group meets quarterly with Army commands and service providers to review the status of the CAPs.

Audit Status Update meetings, which are held biweekly, and during which the Audit Readiness Directorate provides updates to the Army Comptroller.

Audit Readiness Directorate’s “Stand-Up” meetings, which are held twice a week to communicate with the field on the status of the CAPs. One meeting per week focuses on Budgetary Schedule issues, while the other meeting focuses on the Balance Sheet.

According to Army officials, any decisions or action items resulting from these various meetings are documented, but we found that the requirements for documenting such decisions are not included in the Army’s SOP.

Further, the Army’s SOP did not describe or include specific procedures for the preparation of “scorecards” that the Audit Readiness Directorate uses to monitor the status of CAPs. These scorecards provide an overview of the status of CAPs at status meetings and other management oversight meetings. Army officials told us that a scorecard is prepared for the development of each high-priority CAP and indicates both the organization and the individual responsible for developing and implementing the CAP, as well as estimated and actual dates for completion of the CAP. After a CAP has been developed, the Army uses another scorecard to monitor the execution of the CAP. This scorecard includes some of the same information as the development scorecard, but instead of CAP completion dates, it includes estimated and actual dates for the execution and validation of each CAP. According to Army officials, the scorecards are updated every 2 weeks. However, the scorecards do not include any interim milestones or other metrics that could be used to gauge progress or any outcome measures for assessing the effectiveness of corrective actions. These types of metrics are an important tool for monitoring the status of CAPs. Instead of metrics, each scorecard uses color-coded symbols (i.e., red, yellow, blue, and green) to indicate the status of each CAP. For example, to indicate the status of CAP execution, green indicates that a CAP’s execution has been completed, while blue indicates that the completed CAP execution has been validated by an independent party.

The SOP states that the Audit Readiness Directorate will use a CAP tracker to track the progress of CAP development and implementation. However, as discussed previously, it does not provide any details about what should be in the CAP tracker. For example, the SOP does not specify which findings and recommendations, and related CAPs, should be included in the tracker. It also does not describe what information should be maintained in the tracker for each CAP. We obtained periodic updates of the CAP tracker and determined that while the tracker contained most of the elements recommended in the Implementation Guide for OMB Circular A-123, it did not include any interim milestones or other metrics that could be used to gauge progress, even though many of the CAPs themselves did. In addition, similar to the CAPs, the CAP tracker did not include any outcome measures for assessing the effectiveness of corrective actions.

While the Audit Readiness Directorate has an SOP that has some information about its monitoring procedures, it lacks certain details about procedures that are being performed as well as other monitoring procedures that should be performed. Moreover, the Internal Review Directorate does not have any SOP regarding such procedures. Without complete policies and procedures to describe all aspects of the Army’s process for monitoring the implementation status of CAPs, the Army is at increased risk that information about the status of CAPs will not be adequately documented and monitored.

Navy’s Process for Addressing Financial Management-Related Audit Findings and Recommendations Has Not Been Finalized but Is Generally Consistent with Guidance

Prior to April 2015, the Navy had a decentralized approach for identifying and tracking its findings and recommendations from audits or examinations, with primary responsibility for these activities assigned to the specific Navy program area under audit. In April 2015, in anticipation of the notices of findings and recommendations that the Navy expected would be issued as a result of the Budgetary Schedule audit, the Navy’s Office of Financial Operations established the Evaluation, Prioritization, and Remediation (EPR) Program. The purpose of this program is to build a centralized capability to manage and track known deficiencies (reported from both internal and external sources) and manage the related remediation process across the Navy. As part of the effort, the Navy drafted several SOPs for implementing its various remediation activities. Although the Navy has not finalized the SOPs related to this process, the draft guidance includes processes to identify and track its financial management-related deficiencies, prioritize its audit findings and recommendations, develop CAPs to address these deficiencies, and monitor and report its findings and recommendations.

While the design of these processes is generally consistent with the Implementation Guide for OMB Circular A-123, the Navy’s draft guidance for identifying and tracking findings from external sources such as DOD OIG and GAO and from the Naval Audit Service does not include specific details and procedures for reasonably assuring the (1) completeness of the universe of audit findings and recommendations from these sources and (2) accuracy of the status of these audit findings and recommendations, as discussed in detail below. Navy officials told us that they plan to finalize the draft SOPs by December 31, 2016.

Navy’s Process for Identifying and Tracking Open Audit Findings and Recommendations Results in Omissions and Inconsistencies

The Navy drafted its EPR Program: Deficiency Universe Guide to describe its process to centrally identify and track its financial management-related findings and recommendations from both internal and external sources. This draft guide includes procedures on steps the Navy is taking to gather data from internal and external stakeholders, the data structure used, activities to preserve the monthly integrity of these data, and the reporting requirements for keeping the information updated.

The Navy uses a detailed spreadsheet, called a Deficiency Universe Tracker (tracking spreadsheet), to keep track of the over 200 notices of findings resulting from the Budgetary Schedule audit, as well as to monitor the status of the related CAPs. The tracking spreadsheet also tracks deficiencies identified from other sources, such as GAO, DOD OIG, and the Naval Audit Service.

During our audit, we analyzed the tracking spreadsheet provided by the Navy in July 2016 and identified differences between the number of audit reports listed and the status of the deficiencies reported by the Navy on its tracking spreadsheet, and with the number of reports listed and the status of the deficiencies identified by GAO, the DOD OIG, and the Naval Audit Service. For example, our analysis of the DOD OIG audit reports listed on the Navy’s July 2016 tracking spreadsheet found that there was a DOD OIG report that was issued in fiscal year 2015 with 5 open financial management-related recommendations that was omitted from the Navy’s tracking spreadsheet. Our analysis of the tracking spreadsheet also found that the Navy was tracking 9 open financial management- related recommendations from three DOD OIG reports that were issued in fiscal year 2015. However, a report we received from the DOD OIG’s recommendation tracking system showed that the DOD OIG was tracking 10 open financial management-related recommendations from these same three reports. With regard to the DOD OIG report that was not entered into the tracking spreadsheet, Navy officials told us that they were focused on addressing the notice of findings and recommendations and did not enter this report. A Navy official also told us that going forward the Navy will review and update the tracking spreadsheet to account for this DOD OIG report and will also review other reports to help ensure the completeness of its tracking spreadsheet.

With regard to the status of DOD OIG deficiencies the Navy was tracking, Navy officials told us that they aggregate the recommendations from each DOD OIG report into one data field on their tracking spreadsheet. Therefore, all 3 recommendations from a DOD OIG report will be listed in one data field (not three data fields) on the tracking spreadsheet. This approach makes it difficult to determine the status of each recommendation separately and may result in inaccurate reporting by the Navy on the status of each audit recommendation. Another complication with this approach is that it will be difficult to assess the Navy’s progress in addressing those DOD OIG recommendations that are identified in the DOD OIG report as one recommendation, yet have multiple steps listed within that recommendation.

We believe that the omission of the DOD OIG audit report and the inconsistencies of the status of the deficiencies reported by the Navy on its tracking spreadsheet occurred because the Navy’s process for obtaining, consolidating, monitoring, and updating its audit findings from the DOD OIG, which involves conducting a monthly online search of audit reports, is not properly designed. Relying on a monthly online search of DOD OIG audit reports without periodically confirming with the external auditor (the DOD OIG in this example) that the (1) list of reports is complete and (2) status of audit findings and recommendations being tracked is consistent could result in incomplete and inconsistent information being reported on the Navy’s tracking spreadsheet. Furthermore, according to the Navy’s draft guidance, its process for gathering and monitoring audit findings from GAO and the Naval Audit Service is designed using the same approach (i.e., a monthly online search) and could therefore also result in similar incomplete and inconsistent information being reported on the Navy’s tracking spreadsheet.

Without detailed guidance and specific procedures in place for confirming and validating the completeness and consistency of the status of the financial management-related deficiencies it is tracking, the Navy is at risk of reporting incomplete and inconsistent information both internally and externally. If the Navy does not identify and track the status of the complete universe of its unresolved deficiencies related to financial management, it cannot provide reasonable assurance that all such deficiencies will be addressed in a timely manner; which can ultimately affect the reliability of its financial information and the auditability of its financial statements. As the Navy progresses toward a full financial statement audit for fiscal year 2018, completely identifying and consistently tracking reported audit results will become even more important, as audit coverage expands and additional deficiencies may be identified.

Navy Has Developed a Detailed Methodology for Prioritizing Audit Findings and Recommendations

The Navy drafted its EPR Program: Deficiency Prioritization Standard Operating Procedures (SOP) with details on its methodology for prioritizing audit findings and recommendations by weighing various factors, including the deficiency’s source; deficiency type; organizational impact; whether it is a FIAR deal-breaker; whether it is financial or information technology related; whether compensating controls exist; and materiality, or the potential financial statement dollar amount affected by the deficiency. According to the draft SOP, the EPR prioritization team will evaluate each audit finding and recommendation to identify high-priority deficiencies for remediation. As part of this process, the EPR team defines key deficiency data elements, prioritization criteria, methodology, scoring, risk factors, and qualitative considerations to assess what factors to include in the final prioritization determination. Our analysis of the tracking spreadsheet provided in July 2016 showed that the Navy had identified and applied three prioritization categories (high, medium, and low) to 82 percent of the recommendations from other sources that were being tracked.

Navy’s Guidance for Developing CAPs Was Consistent with OMB Guidance

Our review of the template that the Navy is using to develop its CAPs and the information presented on the tracking spreadsheet found that both of these documents included the elements recommended in the Implementation Guide for OMB Circular A-123. The template and tracking spreadsheet both included a description of the deficiency, officials responsible for addressing the deficiency, interim milestones for the various activities and steps to address that deficiency, and validation dates of when the CAP process is complete according to management. Although the template and tracking spreadsheet do not include specific outcome measures for assessing the effectiveness of the corrective actions, we found that the Navy does have a process for developing and reporting outcome measures as outlined in its draft reporting guidance.

According to the Navy’s draft EPR Program: Reporting and Reporting Metrics SOP, outcome measures (or operational reporting metrics) will be continuously collected and stored in the program’s EPR Program SharePoint Tool and will be the data source used to create both periodic and ad hoc reports as needed. Testing results and other pertinent data derived from the EPR’s program activities will be collected in a standardized format and stored in the tool. According to the draft reporting SOP, program metrics that are tracked may include, but are not limited to, notice of findings and recommendations response statuses, CAP action results, associated financial impact of deficiencies, and any additional reporting information relevant to effectively presenting the CAPs. This draft SOP also provides details regarding the process for approving any necessary thresholds that reporting metrics or other data should be measured against for report creation purposes.

In addition to the draft reporting metric SOP, the Navy has drafted its EPR Program: Corrective Action Plan Process SOP, which describes procedures for adding certain data elements into the CAP template and tracking spreadsheet. This SOP describes how the information flows to and from the offices of primary responsibility or action officers, system owners, and resource managers responsible for the CAP development process. Our review of the design of the Navy’s CAP development process found that it is consistent with guidance in the Implementation Guide for OMB Circular A-123. The Navy’s approach to CAP development involves a phased approach (i.e., planning and design, implementation, validation, and closeout); a description of the root cause analysis; an analysis of alternative CAPs; whether system or process changes are required; whether policy updates are necessary; and whether additional resources are needed to implement the CAPs. If effectively implemented, the Navy’s design for developing CAPs should provide it with information on the needed steps or activities for addressing identified deficiencies.

Navy Designed a Multilayered Process for Monitoring the Status of CAP Implementation

We found that the design for monitoring the status of corrective action implementation at the Navy involves several layers of management oversight and collaboration and various reporting activities. According to its draft EPR Guidebook, one of the Navy’s objectives for centralizing its remediation efforts and establishing the EPR Program is to facilitate a culture of collaboration, integration, and accountability across the Navy in support of its auditability milestones. To this end, the Navy has established its Senior Management Council at the most senior Navy management level comprising senior executive civilians and flag officers. According to its charter, the council is responsible for monitoring, assessing, and reporting to the Assistant Secretary of the Navy, Financial Management and Comptroller on the implementation of corrective actions to ensure that they are accurate and timely, and reporting the results of CAP implementation. At a minimum, this council meets quarterly each year, in part to review the Navy’s progress in correcting previously identified material weaknesses. In addition to periodic monitoring at the Navy’s senior management level, the Navy has identified other key personnel in its Office of Financial Operations who play critical roles in ongoing monitoring of its remediation efforts. These key personnel are the office of primary responsibility and the responsible action officer.

Office of primary responsibility. The office of primary responsibility is a senior executive civilian or flag officer responsible for facilitating the collaboration and communication necessary for the engagement of senior leaders and major stakeholders supporting CAP development and resource identification as needed. This person is the primary point of contact and driver for remediating a deficiency and should have the knowledge to assess the root cause of the deficiency.

Action officer. The action officer is generally more at the working level and is responsible for hands-on remediation of a deficiency, and should have a strong understanding of the mission needs and capabilities. This officer’s tasks include conducting a root cause analysis of the deficiency, implementing and sustaining the CAPs, and reporting on the CAPs’ status.

To facilitate collaboration for addressing its remediation activities, the Navy also holds recurring meetings attended by the EPR Program team and Navy senior leadership to discuss CAP progress and milestones accomplished. According to Navy officials, the purpose of these meetings is to help drive accountability for CAPs, address potential challenges, and increase transparency in the EPR process. Navy officials told us that the EPR team meets regularly to assess prioritized deficiencies for action, discuss updates on CAP progress, and identify risks as reported by the office of primary responsibility. According to Navy officials, monthly meetings are also held with the Assistant Secretary of the Navy, Financial Management and Comptroller, and the Navy’s Office of Financial Operations senior management to review CAP status, approve CAP implementation, assess identified risks, and evaluate CAP mitigation plans as needed.

As discussed earlier, to provide guidance on the Navy’s reporting activities on the status of its CAPs, the Navy drafted an EPR Program: Reporting and Reporting Metrics SOP. This SOP establishes guidelines, policies, and procedures for the EPR Program to follow when creating reports and reporting metrics across program activities. According to this draft SOP, performing these procedures will help provide a high level of data integrity and minimize gaps of information across the Navy. The draft SOP also states that all of the aggregated CAP, deficiency, and findings and recommendations data will be stored in the EPR Program SharePoint Tool. This tool will serve as the source for all reporting and reporting metrics required by the EPR Program and will assist the EPR program manager in developing accurate reports and reporting metrics, when needed.

The Navy also drafted the EPR Program: CAP Validation SOP that establishes guidelines, policies, and procedures to validate CAPs and deficiencies through testing to determine if deficiencies have been remediated and the corrective actions are operating effectively. This SOP provides details on the CAP validation’s objectives, roles and responsibilities, and procedures. Results from the CAP validation process are compiled and reported in a CAP Testing Results Report and reported to the Navy’s Office of Financial Operations. This report includes the testing scope, pass rates, and recommendations for improvement.

The Navy’s draft guidance provides details on the roles and responsibilities, level of collaboration needed, and reporting framework that if implemented effectively should allow Navy management to sufficiently monitor implementation progress of its CAPs.

Air Force Did Not Design a Comprehensive Process for Addressing Financial Management-Related Audit Findings and Recommendations

The Air Force did not have a comprehensive process in place to identify and track all financial management-related findings and recommendations. The Air Force had written policies and procedures providing limited information for selected recommendations, such as those from the Air Force Audit Agency (AFAA), but the policies did not discuss the development of CAPs. The Air Force’s written policies and procedures did not provide specific details to support how (1) recommendations from all audit sources are identified and prioritized for tracking purposes, (2) CAPs are developed for these recommendations, and (3) CAPs are implemented and monitored. The Air Force provided guidance in the June 2016 CAPs Process Guide describing the Air Force’s process for developing and implementing CAPs to remediate self-identified deficiencies and its over 200 findings and recommendations issued by the IPA during the fiscal year 2015 Budgetary Schedule audit. This guidance describes at a high level the CAP development and implementation process, responsible organizations/stakeholders, and the steps required of each responsible party. However, even this guidance did not provide the information to resolve all the limitations we identified.

Air Force Did Not Have a Comprehensive Process for Identifying and Tracking All Open Audit Findings and Recommendations

The Air Force did not design comprehensive policies and procedures for how it identifies and tracks all of its financial management-related findings and recommendations. While the Air Force had developed a mechanism for identifying and tracking the findings and recommendations from AFAA, self-identified deficiencies, and its fiscal year 2015 Budgetary Schedule audit, it had not established a similar process for identifying and tracking most other findings and recommendations from other audits, such as those conducted by the DOD OIG and GAO. Therefore, the Air Force did not track the complete universe of its financial management-related findings and recommendations from all sources.

Moreover, the Air Force had policies and procedures for following up on DOD OIG and GAO reports, but these policies and procedures—which are described in Air Force Instructions 65-402, Financial Management: Relations with the Department of Defense, Office of the Assistant Inspector Generals for Auditing and Analysis and Follow Up, and 65- 401, Financial Management: Relations with the Government Accountability Office—primarily discussed the audit report processes and applicable roles and responsibilities, but did not assign the tracking of the DOD OIG and GAO audit findings and recommendations to anyone in the Air Force. Instead, the Air Force relies on the DOD OIG to track and follow up on any Air Force-related DOD OIG and GAO findings and recommendations. As noted previously, in accordance with the Implementation Guide for OMB Circular A-123, the Air Force is responsible for tracking and addressing any recommendations that the DOD OIG or GAO made to it. Unless the Air Force actively tracks findings and recommendations and reasonably assures that it has a complete universe of findings and recommendations from all audit sources and has assigned responsibility for addressing them, it increases the risk that it may not adequately address and remediate all deficiencies that could hinder it from becoming fully audit ready.

Without specific procedures in place for identifying and tracking financial management-related audit findings and recommendations from all sources, the Air Force is at risk of not addressing the complete universe of its findings and recommendations. If the Air Force does not identify and track the complete universe of its unresolved deficiencies related to financial management, it cannot provide reasonable assurance that all such deficiencies will be addressed in a timely manner, which can ultimately affect the reliability of its financial information and the auditability of its financial statements.

Air Force’s Process Does Not Reasonably Assure That Audit Findings and Recommendations Are Appropriately Prioritized

The Air Force policies and procedures for prioritizing its financial management-related audit findings and recommendations do not reasonably assure that all findings and recommendations are appropriately prioritized. This is because the CAPs Process Guide includes limited criteria for prioritizing Budgetary Schedule audit findings and self-identified deficiencies. The guidance also describes different priority designations (Priorities 1, 2, and 3) for the Budgetary Schedule audit findings and recommendations and self-identified financial management-related deficiencies. However, the guidance is silent on other financial management-related deficiencies from other sources, such as AFAA, DOD OIG, and GAO. Additionally, the Air Force guidance does not specify prioritizing recommendations based upon financial management impact but rather upon the source of the finding. For example, a self-identified deficiency is assigned a Priority 1 if the finding and recommendation align with an Air Force team working in specific areas. The Implementation Guide for OMB Circular A-123 and FIAR Guidance state that the extent to which corrective actions are tracked by the agency should be commensurate with the severity of the deficiency. Given the significant number of findings and recommendations that the Air Force has received from the various audit entities, it is important for the Air Force to appropriately prioritize them to help achieve audit readiness.

The Air Force has policies and procedures for following up on AFAA, DOD OIG, and GAO reports that are set forth in Air Force Instructions 65- 403, Financial Management: Followup on Internal Air Force Audit Reports, and Instructions 65-402 and 65-401, but these also do not describe prioritization. Without sufficiently detailed policies and procedures for identifying and prioritizing audit findings, the Air Force is at increased risk of not addressing its most critical financial management weaknesses and achieving audit readiness.

Air Force’s Guidance for Developing CAPs Is Incomplete

The Air Force does not have detailed policies and procedures for developing CAPs for its self-identified financial management-related deficiencies and financial management-related audit findings and recommendations issued by the 2015 Budgetary Schedule audit IPA, AFAA, the DOD OIG, and GAO. The CAPs Process Guide describes the Air Force’s process for developing CAPs to remediate both self-identified deficiencies and audit findings and recommendations issued during the fiscal year 2015 Budgetary Schedule audit. The guidance describes at a high level the process for developing CAPs and includes root causes, milestones, validation, and testing, but the guidance is not sufficiently detailed to include all of the elements recommended by the Implementation Guide for OMB Circular A-123. For example, while there are several start and end dates for interim milestones within the CAPs guidance, the guidance does not include a provision for the CAPs to include the targeted corrective action dates (the dates of management follow-up). Also, the guidance does not discuss outcome measures for assessing the effectiveness of the corrective actions. During our audit, we reviewed a status summary of the CAPs for the fiscal year 2015 Budgetary Schedule financial-related findings and recommendations and found that the CAPs did not include all elements recommended by the Implementation Guide for OMB Circular A-123, such as the targeted corrective action dates (the dates of management follow-up) or outcome measures.

The Air Force also has limited policies and procedures for following up on audit findings and recommendations from AFAA, the DOD OIG, and GAO, which are described in Air Force Instructions 65-403, 65-402, and 65-401. However, these documents do not provide detailed guidance on developing CAPs. While the Air Force has an Audit Recommendation Implementation Tracking policy memo and attached Air Force Audit Implementation Plan Guidance that pertains to AFAA recommendations, these documents only describe the process at a high level and do not provide specific details as to how CAPs for these audit findings and recommendations would be developed and monitored.

Without complete and sufficiently detailed policies and procedures for designing CAPs, the Air Force is at increased risk of developing CAPs that do not include all elements necessary for ensuring accountability and for effectively monitoring the development and implementation of CAPs. Also, without CAP information on AFAA, DOD OIG, and GAO financial management-related findings and recommendations, it is not clear how Air Force management can assess the progress being made toward achieving audit readiness.

Air Force’s Process for Monitoring the Status of CAP Implementation Is Incomplete

The Air Force does not have detailed policies and procedures for monitoring progress against the CAPs for its financial management- related audit findings and recommendations. The CAPs Process Guide describes at a high level the Air Force’s process for monitoring and reporting on the CAPs’ implementation to remediate both self-identified deficiencies and audit findings and recommendations issued during the fiscal year 2015 Budgetary Schedule audit. The guidance provides a brief description of the monitoring to be performed by the responsible organization, but the guidance is not complete. For example, the guidance describes that regular updates on progress of the CAPs should be provided to the Air Force financial management CAP lead by the office of primary responsibility. However, as recommended by the Implementation Guide for OMB Circular A-123, the guidance does not discuss specific details, such as the role of the Air Force’s Senior Assessment Team (Air Force Financial Improvement Executive Steering Committee) in resolving deficiencies, setting targeted corrective action dates, and determining outcome measures.

Without having complete policies and procedures to describe all aspects of the Air Force’s CAP monitoring process, the Air Force is at increased risk that CAP implementation will not be adequately monitored; this could result in some CAPs not receiving adequate attention and therefore not being implemented in a timely manner, which could negatively affect the Air Force’s efforts to achieve audit readiness.

DOD’s Process for Monitoring and Reporting on Audit Remediation Efforts Lacks Comprehensive Information

Although the DOD Comptroller’s office has established several elements of a department-wide audit readiness remediation process, it does not have the comprehensive information on the status of all CAPs throughout the department needed to fully monitor and report on the progress being made to resolve financial management-related deficiencies that preclude DOD from being auditable. Specifically, (1) the DOD Comptroller’s office is not able to fully assess the military services’ progress because it does not obtain complete, detailed information on all of their CAPs related to critical capabilities—those identified in the FIAR Guidance as necessary to achieve auditability—and (2) reports to internal stakeholders and external stakeholders, such as DOD OIG, OMB, GAO, and Congress, on the status of audit readiness do not provide comprehensive information. As a consequence, the DOD Comptroller’s office is unable to provide and prepare department-wide, comprehensive information on the status of all CAPs related to critical capabilities that are necessary to achieve auditability. Having comprehensive DOD-wide information on the CAPs related to critical capabilities will take on additional importance as DOD moves forward with audits that have broader scopes beyond its budgetary statements, potentially leading to other findings being identified.

DOD Does Not Obtain Detailed Information on All CAPs from the Military Services Related to Critical Capabilities to Fully Assess Progress

The Implementation Guide for OMB Circular A-123 states that the senior management council, or similar forums, has ownership and accountability for resolving deficiencies. Such forums should use CAPs as a road map for discussion as well as in determining when sufficient action has been taken to declare that a deficiency has been corrected. The Implementation Guide for OMB Circular A-123 also recommends that a senior assessment team communicate the status of CAPs developed for material weaknesses to the senior management council on a regular basis. The senior management council should be responsible for determining if the progress is sufficient or if additional action must be taken to expedite the remediation process. DOD Comptroller officials told us that the FIAR Governance Board is considered DOD’s equivalent of a senior management council as described in the Implementation Guide for OMB Circular A-123. Further, the Implementation Guide for OMB Circular A-123 recommends that an agency establish a CAP framework to facilitate stakeholder oversight and ensure accountability for results. For example, the agency could prepare a CAP management summary that is made available to external stakeholders and to the agency senior management council.

In addition, the April 2016 FIAR Guidance identifies the following seven capabilities as being critical to achieving audit readiness and therefore the highest priorities for corrective actions: (1) produce a universe of transactions; (2) reconcile its Fund Balance with Treasury; (3) provide supporting documentation for adjustments to its financial records; (4) validate the existence, completeness, rights, and obligations of its assets; (5) establish processes to manage and value its assets correctly; (6) establish an auditable process for estimating and recording its environmental and disposal liabilities; and (7) implement critical information technology controls for its financial systems.

DOD Comptroller officials told us that as part of their process to update the FIAR Guidance, generally about once a year, they also consider whether any additional critical capabilities should be identified in the guidance. Because the critical capabilities are the DOD Comptroller’s highest priorities for corrective actions, it is important that they are updated to reflect the audit findings that result from DOD’s audit readiness efforts. For example, one of the seven critical capabilities currently addresses the need for supporting documentation for adjustments to financial records. However, as stated previously, the IPAs for all three military services noted the lack of adequate supporting documentation for transactions, not just adjustments, as a reportable finding on their Budgetary Schedule audits, which also contributed to each IPA’s disclaimer of opinion. Appropriate documentation for financial transactions allows the military services to support financial statement line items and allows auditors to test the line items. Expanding the critical capabilities to reflect significant audit findings will increase the ability of the DOD Comptroller to monitor and report on the CAPs most likely to affect audit readiness.

DOD has designed a department-wide process to monitor and report on the department’s audit readiness and remediation efforts. According to DOD Comptroller officials, the department-wide process consists primarily of the following procedures: (1) obtaining periodic updates on summary- level interim milestones and percentages of completion for major processes related to critical capabilities (but not for specific CAPs related to these critical capabilities), (2) attending various meetings with the military services and other defense organizations to discuss and obtain high-level updates on the status of CAPs and other audit readiness efforts, (3) obtaining and tracking the status of all findings and recommendations from service providers and other defense organizations, and (4) reporting the status of audit readiness efforts to Congress and other stakeholders in semiannual FIAR Plan Status Reports.

According to DOD Comptroller officials, the offices of the DCMO and the DOD Comptroller are the main parties at the department level that are involved in monitoring financial management improvement and audit readiness efforts throughout DOD. To monitor the status of the military services’ remediation efforts, officials from both of these offices attend bimonthly (i.e., every other month) FIAR Governance Board meetings to discuss and obtain high-level updates on the status of military services’ CAPs and other audit readiness efforts. In addition, DOD Comptroller officials attend other, more frequent meetings (e.g., audit committee) with the military services regarding their audit readiness efforts. During these meetings, DOD officials receive briefing slides that provide high-level summaries of the military services’ audit readiness, including some information on the status of the CAPs relating to the Budgetary Schedule audits that each service, using its respective criteria, has determined to be high priority.

DOD Comptroller officials told us that they compile some of this summary-level information, such as the percentages of completion for critical capabilities by various DOD components, based on more detailed information that they receive from the components. However, even this more detailed information is based on some summarization of tasks that are part of the critical capabilities, as well as the percentages of completion for these tasks. Except for certain findings and recommendations related to DOD-wide issues, DOD Comptroller officials said that they do not receive detailed information on individual findings, recommendations, and CAPs from the military services. Although the DOD Comptroller developed a Notice of Findings and Recommendations Tracking Tool, it is used primarily to track the audit readiness findings and recommendations for the other defense organizations and findings and recommendations for the military services that pertain to DOD-wide issues that require action at the department level. DOD Comptroller officials said that because of resource constraints, they do not plan to obtain or track the detailed status of most of the military services’ findings, recommendations, and CAPs, but instead will rely on the information provided for various oversight meetings to monitor the status of audit readiness efforts. The officials also explained that they have obtained some detailed findings and recommendations related to DOD-wide issues that they are using to help develop policies to address these issues. As new policies are issued, then the military services will likely need to develop CAPs to implement the new policies.

As described above, the DOD Comptroller receives some details about the status of the seven critical capabilities at the military services. However, without obtaining all of the military services’ findings, recommendations, and related CAPs with consistent data elements pertaining to the seven critical capabilities, the DOD Comptroller’s office and other DOD officials could be limited in their ability to adequately monitor these issues. Further, without detailed, consistent, and timely updates (e.g., updates for the bimonthly FIAR Governance Board meetings) from the military services on the status of CAPs related to the critical capabilities, DOD officials will not have the consistent, readily available information needed to effectively monitor and report the status of these CAPs. Having consistent, readily available information on these types of CAPs will take on additional importance as DOD moves forward with more audits beyond its Budgetary Schedules, potentially leading to more findings being identified.

Reports on Audit Readiness Status Do Not Provide Comprehensive Information for Stakeholders

DOD is also responsible for reporting the status of audit readiness and remediation efforts to its internal stakeholders and its external stakeholders, such as the DOD OIG, OMB, GAO, and Congress. For example, the 2010 NDAA required that DOD provide recurring, semiannual reports by May 15 and November 15 on the status of the department’s implementation of the FIAR Plan to congressional defense committees. Federal internal control standards also require that an entity’s management communicate with and obtain quality information from external parties through established reporting lines. In these communications, management should include information relating to the entity’s activities that affect the internal control system. DOD’s FIAR Plan Status Reports are the department’s primary mechanism for reporting the status of its audit readiness, including audit remediation efforts, to Congress and other external parties. The reports include narratives on each military service’s audit readiness efforts, focusing on material weaknesses and the seven critical capabilities necessary to achieve audit readiness, and estimated completion dates for each of these areas. Over the years, as the military services have set target dates for asserting audit readiness, the target dates have been delayed, which we have reported increases the risk that DOD may not complete its audit readiness efforts within planned time frames, thereby affecting DOD’s ability to meet the statutory requirements. For example, we recently reported that the military services’ target dates for asserting audit readiness for real property were delayed by at least 2 years. In addition, we have reported that the military services’ SBR milestone dates had been delayed.

Further, although the FIAR Plan Status Reports appropriately provide summary-level information, they do not provide the detailed information that might be needed by some stakeholders. For example, even though the reports contain summary-level information regarding milestones for the seven critical capabilities, they do not include the detailed actions and interim milestones for the CAPs related to critical capabilities, which could provide a more complete picture of the status of corrective actions. The Implementation Guide for OMB Circular A-123 recommends that such detailed information about CAPs be provided to external stakeholders upon request. However, if DOD does not routinely obtain consistent and detailed information from the military services on the status of their CAPs, it cannot readily provide this type of information to stakeholders when requested and must instead rely on inefficient methods, such as data calls to collect detailed information for stakeholders.

As part of our past audits of the consolidated financial statements of the U.S. government, we have observed significant progress being made in improving federal financial management government-wide. For example, nearly all of the 24 Chief Financial Officers (CFO) Act agencies received unmodified or “clean” opinions on their fiscal year 2015 financial statements, up from 6 CFO Act agencies that received clean audit opinions in 1996 when the CFO Act agencies were first required to prepare audited financial statements. For example, the Department of Homeland Security (DHS) was able to overcome its numerous material weaknesses that had prevented its financial statements from being auditable. Since its creation in fiscal year 2003 when 22 separate agencies were brought together to form the new department, DHS was able to move from receiving disclaimers of opinion on its financial statements to first achieving an unqualified or “clean” opinion on all of its financial statements for fiscal year 2013, which has continued through fiscal year 2016. DHS policy on corrective action plans, issued in fiscal year 2012, indicates that its process included maintaining a department- wide accumulation of significant CAPs from all of its components; using standard data elements; and providing monthly updates on the status of CAPs to the CFO, and updates on an as-needed basis to the OIG and the Secretary.

As we have previously reported, many of the planned audit readiness actions and milestones reported by DOD and its components in FIAR Plan Status Reports have not been realized. Given the short amount of time remaining before the statutory deadline of March 31, 2019, for submitting to Congress the results of an audit of its fiscal year 2018 financial statements, having complete, reliable, and detailed information on the department-wide status of CAPs related to critical capabilities is essential for DOD and its stakeholders so that they can measure and communicate DOD’s progress in addressing the financial management deficiencies and determine if additional actions are necessary to expedite the remediation process.

Conclusions

DOD is moving forward with its efforts to achieve the goal of being audit ready by September 30, 2017, and as part of this effort, had the Army, Navy, and Air Force undergo their first audits of their Schedules of Budgetary Activity for fiscal year 2015. The IPAs for all three military services issued disclaimers of opinion on the respective services’ fiscal year 2015 Schedules of Budgetary Activity and identified material weaknesses in internal control. In response, the Army, Navy, and Air Force have all begun taking significant steps toward resolving their material weaknesses, such as developing and implementing CAPs to address the IPAs’ recommendations. However, none of the military services have complete policies and procedures to identify and sufficiently track all of their financial management-related findings and recommendations reported by audits, and only the Navy has drafted policies and procedures that effectively prioritize, develop, and monitor the status of its CAPs’ implementation. The DOD Comptroller and DCMO have also begun to take a more active role in monitoring the status of the military services’ CAPs to ensure that adequate progress is being made. However, DOD’s process for monitoring and reporting on its audit remediation efforts lacks some of the information recommended by the Implementation Guide for OMB Circular A-123. Specifically, DOD does not obtain comprehensive information from the military services on the status of their CAPs, such as interim milestones, completion dates, and other indicators or targets that facilitate management’s ability to fully determine how the resolution of CAPs is progressing. This type of detailed information is critical for DOD management and its external stakeholders to evaluate the progress that DOD military services are making in correcting the deficiencies that are preventing the department from obtaining an audit opinion on its financial statements. The lack of comprehensive information on the status of CAPs increases DOD’s risk that it will not be able to fully, timely, and efficiently correct its long- standing deficiencies.

Recommendations for Executive Action

To improve processes for identifying, tracking, remediating, and monitoring financial management-related audit findings and recommendations, we are making the following eight recommendations.

Secretary of the Army

1. We recommend that the Secretary of the Army direct the Internal Review Directorate under the Assistant Secretary of the Army, Financial Management and Comptroller, to develop written policies and procedures for all financial management-related audit findings and recommendations under its purview that include the following: how the status of the recommendations will be tracked; the process and criteria to be followed for prioritizing the findings and recommendations; the process for developing CAPs to remediate the findings and recommendations, including the detailed CAP elements recommended by the Implementation Guide for OMB Circular A- 123; and the process for monitoring the status and progress of the CAPs, including the documentation to be maintained for monitoring CAP status and any actions to be taken if a lack of progress is found. 2. We recommend that the Secretary of the Army direct the Accountability and Audit Readiness Directorate under the Assistant Secretary of the Army, Financial Management and Comptroller, to enhance the directorate’s policies and procedures for (1) tracking and prioritizing all financial management-related audit findings and recommendations under its purview and (2) developing and monitoring CAPs for all such recommendations so that they include sufficient details, such as the criteria used to prioritize the CAPs, the recommended CAP elements, and the process for monitoring and documenting the progress and status of CAPs.

Secretary of the Navy

3. We recommend that the Secretary of the Navy, when finalizing the Navy’s policies and procedures for identifying and tracking its CAPs to remediate financial management-related audit findings and recommendations, enhance this guidance so it includes detailed steps and specific procedures for confirming and validating the completeness and accuracy of the status of these audit findings and recommendations.

Secretary of the Air Force

4. We recommend that the Secretary of the Air Force design and document a comprehensive process to ensure that the complete universe of all financial management-related findings and recommendations from all audit sources is identified and tracked. 5. We recommend that the Secretary of the Air Force update the Air Force’s written policies and procedures for prioritizing financial management-related audit findings and recommendations from all audit sources and for developing and monitoring CAPs so that they include sufficient details. These procedures should include the following details:

The process to be followed for prioritizing the financial management-related findings and recommendations from audit sources.

The guidance for developing CAPs for all financial management- related audit findings and recommendations from all audit sources to include complete details, including the elements recommended by the Implementation Guide for OMB Circular A-123.

The process for monitoring the status of the CAPs for all financial management-related audit findings and recommendations from all audit sources, including the documentation to support any corrective actions taken, as recommended by the Implementation Guide for OMB Circular A-123.

Secretary of Defense

6. To improve DOD management’s process for monitoring the military services’ audit remediation efforts and to provide timely and useful information to stakeholders as needed, we recommend that the Secretary of Defense direct the Secretary of the Army, the Secretary of the Navy, and the Secretary of the Air Force to prepare and submit to the Under Secretary of Defense (Comptroller), on at least a bimonthly basis for availability at the FIAR Governance Board meetings, a summary of key information included in the CAPs that at a minimum contains the data elements recommended by the Implementation Guide for OMB Circular A-123 for each CAP related to critical capabilities for achieving audit readiness. 7. To reasonably assure that DOD management and external stakeholders have a comprehensive picture of the status of corrective actions needed for audit readiness throughout the department, we recommend that the Secretary of Defense direct the Under Secretary of Defense (Comptroller) to prepare a consolidated CAP management summary on a bimonthly basis that includes the data elements referred to above on the status of all CAPs related to critical capabilities for the military services and for the service providers and other defense organizations.

Under Secretary of Defense (Comptroller)

8. To facilitate the development of a consolidated CAP management summary and the ability to efficiently respond to stakeholder requests, we recommend that the Under Secretary of Defense (Comptroller) develop and implement a centralized monitoring and reporting process that at a minimum (1) captures department-wide information on the military services’ and other defense organizations’ CAPs related to critical capabilities, including the standard data elements recommended in the Implementation Guide for OMB Circular A-123, and (2) maintains up-to-date information on the status of these CAPs.

Agency Comments and Our Evaluation

We provided a draft of this report to DOD and the military services for review and comment. In their written comments, reprinted in appendix IV, the Army, Navy, and Air Force concurred with our respective recommendations to them, while DOD concurred with one recommendation and partially concurred with two other recommendations that we made to it.

Army

The Army concurred with our recommendation that its Internal Review Directorate develop written policies and procedures for all financial management-related audit findings and recommendations under its purview. The Army stated that the Internal Review Directorate has completed updating its policies and procedures to include how the status of findings and recommendations will be tracked and prioritized as well as how CAPs will be developed and monitored. The Army also concurred with our recommendation that its Accountability and Audit Readiness Directorate enhance its policies and procedures for (1) tracking and prioritizing all financial management-related audit findings and recommendations under its purview and (2) developing and monitoring CAPs for all such recommendations so that they include sufficient details, such as the criteria used to prioritize the CAPs, the recommended CAP elements, and the process for monitoring and documenting the progress and status of CAPs. The Army stated that the Accountability and Audit Readiness Directorate has completed actions to enhance its current standard operating procedures to include (1) updating its CAP database and reporting tool, (2) documenting its reporting procedures, and (3) updating its CAP template to include additional elements recommended by the Implementation Guide for OMB Circular A-123. In addition, the Army stated that its policies and procedures include steps to incorporate external financial management-related audit findings assigned to the Accountability and Audit Readiness Directorate by the Internal Review Directorate and that the existing process the Army uses to prioritize findings and the related CAPs and to monitor the progress and status of CAPs has been documented.

Navy

The Navy concurred with our recommendation to enhance its guidance to include detailed steps and specific procedures for confirming and validating the completeness and accuracy of the status of financial management-related audit findings and recommendations. The Navy stated that it is (1) recording new findings and recommendations on a weekly basis in its deficiency database, (2) reviewing historical audits to ensure that previous findings and recommendations are recorded, and (3) collaborating with audit agencies to establish a process to reconcile the status of recommendations to ensure that its deficiency database accurately reports open and closed recommendations. The Navy also stated that these processes would be documented and implemented by January 31, 2017.

Air Force

The Air Force concurred with our recommendation that the Air Force design and document a comprehensive process to ensure that the complete universe of all financial management-related findings and recommendations from all audit sources is identified and tracked. The Air Force described planned actions that it will take to address the recommendation, including revising the existing process for identifying and tracking all financial management-related findings and recommendations from all audit sources and coordinating with all stakeholders. The Air Force plans to implement this recommendation by January 31, 2018. The Air Force also concurred with our recommendation to update its written policies and procedures for prioritizing financial management-related audit findings and recommendations from all audit sources, and for developing and monitoring CAPs so that they include sufficient details. The Air Force stated that it will revise its existing written policies and procedures to include (1) prioritizing findings and recommendations and (2) providing guidance for developing detailed and actionable CAPs and for monitoring the status and progress toward implementing and closing the CAPs, as recommended by the Implementation Guide for OMB Circular A-123. The Air Force plans to implement this recommendation by January 31, 2019. However, the Air Force’s planned implementation dates indicate that the changes to policies and procedures will not be in place before fiscal year 2018, the period that the department-wide financial statements will be under audit.

DOD concurred with our recommendation that the department direct the military services to prepare and submit, on at least a bimonthly basis, summaries of key information included in their CAPs that include, for each CAP related to critical capabilities, the data elements recommended by the Implementation Guide for OMB Circular A-123. Specifically, DOD stated that it is updating its template for the military services to use for reporting this information so that it will include the recommended standard data elements. In addition, it stated that the FIAR Guidance will be updated to explicitly state that the military services should include these data elements in their CAPs.

DOD partially concurred with our recommendation that the department direct the DOD Comptroller to prepare a bimonthly consolidated CAP management summary that includes the data elements outlined in the Implementation Guide for OMB Circular A-123 for all CAPs related to critical capabilities for the military services as well as for the service providers and other defense organizations. According to DOD, and as we stated in our report, the military services already provide summary-level updates on their critical capability CAPs at FIAR Governance Board meetings. It also stated that the template that is used to present CAPs to the FIAR Governance Board meetings at the summary level has been updated to align CAPs to critical capabilities. However, DOD’s response, while reiterating what is already being reported, does not address how all of the data elements from the Implementation Guide for OMB Circular A- 123 will be summarized or otherwise reported for all CAPs pertaining to critical capabilities across the department, as we recommended. In addition, DOD stated that because the DOD Comptroller takes responsibility for maintaining, monitoring, and reporting on the status of CAPs for the service providers and other defense organizations and of DOD-wide issues, the Comptroller will also summarize this information. However, it does not provide any further details about what information will be summarized, and as we note in the report, the Comptroller’s tracking does not include CAPs for the military services. Without developing a consolidated department-wide summary of CAPs, DOD will continue to lack a department-wide view of all CAPs pertaining to each critical capability. Therefore, we continue to believe that DOD needs to take actions to fully implement this recommendation.

DOD also partially concurred with our recommendation for the DOD Comptroller to develop and implement a centralized monitoring and reporting process that captures and maintains up-to-date information, including the standard data elements recommended in the Implementation Guide for OMB Circular A-123, for all CAPs department- wide that pertain to critical capabilities. In its response, DOD said that as outlined in the military services’ responses to our recommendations directed to them, the Army, Navy, and Air Force have agreed to take the responsibility for developing, maintaining, and monitoring all CAPs at the level recommended by the Implementation Guide for OMB Circular A- 123. Further, DOD stated that the information reported at FIAR Governance Board meetings, along with the CAP information maintained by the DOD Comptroller, provides the department the ability to efficiently respond to stakeholder requests for CAPs related to critical capabilities. As noted above, we acknowledge the important steps the military services have planned or taken to address our recommendations and improve their CAP monitoring processes. However, DOD’s actions do not address our recommendation to develop a centralized reporting process to capture department-wide information on the military services’ and other defense organizations’ CAPs related to critical capabilities.

As stated in our report, DOD does not routinely obtain consistent and detailed information from the military services on the status of their CAPs, and without such it cannot readily provide this type of information to stakeholders when requested and must rely on inefficient methods, such as data calls to collect the detailed information. In addition, many of the planned audit readiness actions and milestones reported by DOD and its components in the FIAR Plan Status Reports have not been realized. Given the short amount of time remaining before the statutory date of March 31, 2019, for submitting to Congress the results of an audit of DOD’s fiscal year 2018 financial statements, having complete and reliable, detailed information on the department-wide status of CAPs related to critical capabilities is essential for DOD and its stakeholders so that they can (1) measure and communicate DOD’s progress in addressing the financial management deficiencies and (2) determine if additional actions are necessary to expedite the remediation process. This type of detailed information is critical for DOD management and its external stakeholders to evaluate the military services’ progress in correcting the deficiencies that are preventing the department from obtaining an audit opinion on its financial statements. Moreover, the lack of comprehensive information on the status of CAPs increases DOD’s risk that it will not be able to fully, timely, and efficiently correct its long- standing deficiencies. Therefore, we continue to believe that DOD needs to take action to fully implement this recommendation.

We are sending copies of this report to the Secretary of Defense; the Under Secretary of Defense (Comptroller)/Chief Financial Officer; the Deputy Chief Financial Officer; the Director, Financial Improvement and Audit Readiness; the Secretary of the Army; the Secretary of the Navy; the Secretary of the Air Force; the Director of the Office of Management and Budget; and appropriate congressional committees. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) report the results of the audits of the fiscal year 2015 Schedules of Budgetary Activity (Budgetary Schedule) for the military services, (2) determine the extent to which each military service designed a process to address identified financial management-related findings and recommendations, and (3) determine the extent to which the Department of Defense (DOD) has designed a department-wide strategy to monitor and report on audit readiness remediation efforts.

To address our first objective, we monitored the audit work of the military services’ independent public accountants (IPA) by attending status meetings, participating in site visits, and coordinating with DOD Office of Inspector General (OIG) officials to discuss the audits’ progress and challenges resulting from these first-year audits. We also reviewed documentation of the audit work conducted by the IPAs. We reviewed documentation related to planning, internal controls, testing, and reporting on the audits. This included sampling plans, risk assessments, test plans and summaries, audit opinions, and reports on internal control and compliance with laws and regulations. In addition, we reviewed the audit reports on the Army, Navy, and Air Force Budgetary Schedules along with other audit reports addressed to Army, Navy, and Air Force management that detailed audit findings and recommendations and the services’ responses to these audit reports.

We reviewed the DOD OIG audit contracts (and contract modifications) for the Army, Navy, and Air Force and the related statements of work. We also reviewed the management representation letters from each military service, which contained management’s assertions about the reliability of its financial reporting in accordance with generally accepted accounting principles, as it related to the Fiscal Year 2015 Budgetary Schedules.

To address our second objective, we obtained information on the IPAs’ findings and recommendations from the Budgetary Schedule audits as well as other existing open recommendations or findings from other sources related to financial management at the Army, Navy, and Air Force. We met with applicable military service personnel to determine what policies and procedures were designed to (1) identify and track open findings and recommendations from all sources; (2) prioritize open findings and recommendations by risk or other factors, such as audit impediments identified in the Financial Improvement and Audit Readiness guidance; (3) develop corrective action plans (CAP) to remediate findings and recommendations; and (4) monitor the status of the CAPs’ implementation to confirm that deficiencies were remediated. We compared the military services’ policies and procedures with guidance for CAPs in the Implementation Guide for OMB Circular A-123, Management’s Responsibility for Internal Control, appendix A, “Internal Control over Financial Reporting.” We also reviewed relevant documentation pertaining to how the military services were carrying out the aforementioned procedures.

For the third objective, we held discussions with officials from the office of the DOD Deputy Chief Management Officer (DCMO), the military services’ respective DCMOs, and officials from the Office of the Under Secretary of Defense (Comptroller) to determine what department-wide strategy has been designed to monitor the military services’ development and implementation of CAPs, and what their roles and responsibilities were with respect to CAP oversight. We also reviewed DOD policies, procedures, and DOD management documentation to gain an understanding of how DOD management monitors the military services’ audit remediation activities.

We conducted this audit from March 2015 to February 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Relationship between the Schedule of Budgetary Activity and the Statement of Budgetary Resources

The fiscal year 2015 Schedule of Budgetary Activity (Budgetary Schedule) is an interim, military service-level special report intended to provide a building block toward an audit-ready Statement of Budgetary Resources (SBR) through audits of consecutive fiscal year schedules of budgetary activity. The Budgetary Schedule, like the SBR, is designed to provide information on budgeted spending authority as outlined in the President’s Budget, including budgetary resources, availability of budgetary resources, and how obligated resources have been used. However, instead of covering the full range of SBR activity on current and expired appropriations that have not been canceled, the first-year Budgetary Schedule covers only activity for current fiscal year appropriations. Subsequent fiscal year Budgetary Schedules would include activity for subsequent years’ appropriations, building toward an SBR. For example, in the second year, the fiscal year 2016 Budgetary Schedule would include fiscal year 2016 budgetary activity related to fiscal year 2015 and 2016 appropriations.

In making the shift to focus on audit readiness for a Budgetary Schedule, Department of Defense officials concluded—based on the difficulties encountered in obtaining documentation for prior-year transactions on the Marine Corps’ SBR audit—that the most effective path to an audit of the SBR would be to start with reporting and auditing only current-year activity for fiscal year 2015 appropriations and to expand subsequent audits to include current-year appropriations and prior appropriations going back to fiscal year 2015. Both the SBR and the Budgetary Schedule consist of four separate but related sections that provide information about budgetary resources, the status of budgetary resources, changes in obligated balances, and outlays for major budgetary accounts.

Budgetary resources. This section of a first-year Budgetary Schedule shows total budgetary resources made available to the agency for obligation during the current fiscal year only. It consists of new budget authority, reimbursements, and other income. The first- year Budgetary Schedule does not include amounts from prior periods, commonly referred to as beginning balances. In contrast, the SBR includes amounts available from prior reporting periods; transfers available from prior-year balances; and adjustments, such as recoveries of prior-year obligations. In addition, the SBR includes all other information provided in this section of the Budgetary Schedule.

Status of budgetary resources. This section of the Budgetary Schedule and the SBR shows the status of budgetary resources at the end of the period and consists of obligations incurred and the unobligated balances at the end of the period that are available for future use. For the Budgetary Schedule and the SBR, the total for this section must agree with the total for the budgetary resources section, as this section describes the status of total budgetary resources. In addition to the current-year activity, the SBR includes obligations that are unavailable except to adjust or liquidate obligations chargeable to prior period appropriations.

Change in obligated balance. This section of a first-year Budgetary Schedule consists of obligations incurred in the current year, less current-year outlays. In addition to current-year activity, the SBR would also include unpaid obligations brought forward from the prior years and recoveries of prior-year unpaid obligations.

Outlays. This section of the Budgetary Schedule shows the relationship between obligations and outlays (also referred to as disbursements or expenditures) and discloses payments made to liquidate obligations. Obligations are usually liquidated by means of cash payments (outlays), primarily by electronic fund transfers. This section reconciles outlays with obligations incurred and the change in obligated balances during the year. The content of this section is the same for the SBR and the Budgetary Schedule.

Appendix III: Information Systems and the Role of Service Providers at the Department of Defense

Department of Defense and Military Service Financial Information Systems Operating Environment

Automated information systems are essential for modern accounting and recordkeeping. The Department of Defense (DOD) is developing its Enterprise Resource Planning (ERP) systems as the backbone of its financial management improvement, and they are critical for transforming its business operations. Implementation of ERP systems is critical to ensuring that the department meets its statutory requirement to prepare and submit audited department-wide financial statements for fiscal year 2018. However, ERP implementation has been delayed because of deficiencies in functional capability and the need for remedial corrective actions, which may affect DOD’s ability to achieve audit readiness. According to the May 2016 Financial Improvement and Audit Readiness (FIAR) Plan Status Report, while DOD continues to make progress in addressing information technology system audit readiness challenges, many of these challenges will still exist for fiscal year 2018, which is when DOD is required to undergo a financial statement audit.

According to DOD officials, for the ERP systems that will not be fully deployed prior to the financial statement audit readiness milestone, the DOD components will need to identify effective work-around processes or modifications to legacy systems that will enable audit readiness. Without fully deployed ERPs, the department will be challenged to produce reliable financial data and auditable financial statements without resorting to labor-intensive efforts, such as data calls or manual work-arounds, or to provide reliable financial data on a recurring basis.

Role and Significance of Information Systems in Effective Financial Management

The department’s ability to improve its accounting, including accounting for budgetary information, has historically been hindered by its reliance on fundamentally flawed financial management systems and processes.

Effective information systems help provide reasonable assurance to management and auditors that data reported in the financial statements are accurate and complete. When information system controls are effective, auditors can rely on these controls; when information system controls are not effective, auditors must perform substantially more testing. DOD has identified its information system control deficiencies as an impediment to its components being able to demonstrate audit readiness or successfully completing an audit because under such conditions, neither management nor auditors can rely on automated application controls or system-generated reports. In addition, without adequate financial management processes, systems, and controls, the military services are at risk of having inaccurate and incomplete data for financial reporting and management decision making and potentially exceeding authorized spending limits. The lack of effective internal controls hinders management’s ability to provide reasonable assurance that allocated resources are used effectively, properly, and in compliance with budget and appropriations law.

Reporting Entity and Service Provider Roles and Responsibilities in the Audit Process

The complexities inherent in DOD reporting entity and service provider relationships and associated audit readiness interdependencies make it essential that DOD establish a common, detailed, written understanding regarding the mutual roles and responsibilities of the reporting entity and the service provider. To help ensure successful completion of audit readiness tasks, the reporting entity and service provider must agree on the roles and responsibilities for the authorization, initiation, processing, recording, and reporting of transactions; information technology controls affected by the service provider; or both. The FIAR Guidance points out that a shared understanding and agreement between the service provider and the reporting entity on these roles and responsibilities must be documented in a service-level agreement or memorandum of understanding. Details such as the types of supporting documentation that should be retained for each business process and transaction type, which organization will retain the specific documents, and the retention period for the documentation should be included in the service-level agreement/memorandum of understanding. In addition, the service provider must provide a description of the internal controls that may affect the reporting entity’s financial reporting objectives.

Areas in which service providers play a critical role on behalf of DOD that continue to pose significant risks to achieving full audit readiness include the ability to support journal vouchers and the existence, completeness, and valuation of assets reported on the Balance Sheet. To facilitate progress in such critical areas, the department has developed a list of critical capabilities along with interim milestone dates by which those milestones must be completed and the critical capabilities must be resolved department-wide. In addition to the critical capabilities, the department identified DOD-wide issues, including service provider processes and systems that affect customer audit readiness and the timing of service provider audit readiness activity.

As discussed in DOD’s FIAR Guidance, service providers working with reporting entities are responsible for audit readiness efforts surrounding service provider systems and data, processes and controls, and supporting documentation that have a direct effect on reporting entities’ auditability. The FIAR Guidance requires the service providers to have their control activities and supporting documentation examined by the DOD Office of Inspector General or an independent auditor in accordance with Statement on Standards for Attestation Engagements No.16 so that components have a basis for relying on the service provider’s internal controls for their financial statement audits. Service providers are subject to separate examination engagements on the service organization’s systems and the suitability of the design and operating effectiveness of the service organization’s controls to achieve stated control objectives for various business processes. Service providers design processes and related controls with the assumption that complementary user entity controls will be placed in operation by user entities. The application of these controls by user entities is necessary to achieve certain control objectives within the service organization reports.

Appendix IV: Comments from the Department of Defense

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, the following individuals made key contributions to this report: Arkelga Braxton (Assistant Director), Beatrice Alff, Tulsi Bhojwani, Gloria Cano, Francine DelVecchio, Doreen Eng, Peter Grinnell, Kristi Karls, Jason Kelly, Richard Larsen, Yvonne Moss, Chanetta Reed, Sabrina Rivera, Althea Sprosta, Roger Stoltz, Randy Voorhees, and Doris Yanger.