DOD Financial Management: Continued Actions Needed to Address Congressional Committee Panel Recommendations
Released: 2015-09-28T00:00:00

Letter

Background

DOD’s Efforts to Strengthen Internal Control, Improve Financial Management, and Achieve Audit Readiness

DOD’s efforts to improve its financial management and achieve audit readiness have evolved over a number of years into its current FIAR effort. In 1995, we first designated DOD financial management as one of the federal government’s programs at high risk of waste, fraud, abuse, or mismanagement because of long-standing and pervasive weaknesses in DOD’s internal control, and it still carries that designation today. Over the past two decades, DOD has initiated efforts to strengthen its internal control, become auditable, and improve its financial management. However, as we stated in our most recent high-risk report, DOD has emphasized asserting audit readiness by set dates over assuring that processes, systems, and controls are effective, reliable, and sustainable. DOD submitted its biennial strategic plan for the improvement of financial management (Biennial Plan) to Congress on October 26, 1998, as required by section 1008 of the National Defense Authorization Act (NDAA) for Fiscal Year 1998. This Biennial Plan was an important first step toward DOD improving its financial management operations. The Biennial Plan included, for the first time, a discussion of the importance of the programmatic functions of personnel, acquisition, property management, and inventory management to the department’s ability to support consistent, accurate information flows to all information users. Although the Biennial Plan included a number of initiatives that would help improve DOD’s financial management plans, we reported that it lacked critical elements necessary for producing sustainable financial management improvement over the long term.

Another initiative that preceded the FIAR effort was DOD’s 2003 Financial Improvement Initiative, which was intended to fundamentally transform DOD’s financial management operations and achieve clean financial statement audit opinions. While DOD’s former Comptroller started the 2003 Financial Improvement Initiative with the goal of obtaining an unqualified audit opinion for fiscal year 2007 on DOD’s department-wide financial statements, the initiative lacked a clearly defined, well- documented, and realistic plan to make the goal a reality. As we previously reported, although most of the DOD components, including the Army, Navy, and Air Force, had submitted improvement plans to the DOD Comptroller, DOD had not yet developed an integrated departmental strategy, key milestones, accountability mechanisms, or departmental cost estimates for achieving its fiscal year 2007 audit opinion goal.

In 2005, the DOD Comptroller established the DOD FIAR Directorate to develop, manage, and implement a strategic approach for addressing the department’s financial management weaknesses and achieving auditability and to integrate those efforts with other improvement activities, such as the department’s business system modernization efforts. DOD’s first FIAR Plan was issued in 2005 and is updated semiannually through the FIAR Plan Status Reports, which also summarize the current status of DOD and its components in executing the FIAR Plan.

DOD’s FIAR strategy and approach have evolved since the issuance of the first FIAR Plan in 2005. The DOD Comptroller announced in August 2009 that in DOD’s effort to improve its financial management information, priority would be given to improving those processes and controls that produce information on which DOD managers rely most heavily to run the agency. Because budgetary information is widely and regularly used for management, the DOD Comptroller designated as one of DOD’s highest priorities the improvement of its budgetary information and processes underlying the Statement of Budgetary Resources (SBR). The United States Marine Corps was selected as the pilot military service for an audit of the SBR. The Secretary of Defense underscored the department’s SBR priority with an October 2011 memorandum directing the Comptroller to provide a revised plan for achieving audit readiness of the SBR by September 30, 2014, with the aim to provide DOD managers with auditable General Fund information to track spending, identify waste, and improve DOD’s business processes. In response to component difficulties in preparing for an audit of the SBR, the November 2014 FIAR Plan Status Report and the November 2013 revised FIAR Guidance included a revision to narrow the scope of initial audits to only current year budget activity and expenditures on a General Fund Schedule of Budgetary Activity.

Legislative Requirements and Time Frames

The NDAA for Fiscal Year 2002 required DOD to minimize the resources spent to develop, compile, report, and audit financial statements that the Secretary of Defense assesses as expected to be unreliable. Additionally, the NDAA for Fiscal Year 2008 designated the Deputy Secretary of Defense as the department’s Chief Management Officer (CMO), created a DCMO position, and designated the under secretary of each military department as the CMO for the respective department. The act also required the Secretary of Defense, acting through the CMO, to develop a strategic management plan that among other things would provide a detailed description of performance goals and measures for improving and evaluating the overall efficiency and effectiveness of DOD’s business operations and actions under way to improve operations.

To establish statutory objectives for DOD to achieve financial statements that are validated as ready for audit by a certain date, the NDAA for Fiscal Year 2010 mandated that DOD develop and maintain a FIAR Plan that includes, among other things, the specific actions to be taken and costs associated with (1) correcting the financial management deficiencies that impair the department’s ability to prepare timely, reliable, and complete financial management information and (2) ensuring that DOD’s financial statements are validated as ready for audit by not later than September 30, 2017. In addition, the 2010 NDAA required that DOD (1) provide semiannual reports by no later than May 15 and November 15 on the status of the department’s implementation of the FIAR Plan (which DOD provides as FIAR Plan Status Reports) to congressional defense committees, (2) develop standardized guidance for DOD components’ financial improvement plans (FIP), and (3) define oversight roles and assign accountability for carrying out the FIAR Plan to appropriate officials and organizations.

The NDAA for Fiscal Year 2013 amended the legal requirement to additionally require that the FIAR Plan Status Reports should include (1) a description of the actions military departments have taken to achieve an auditable SBR for DOD by September 30, 2014, and (2) a determination by each military department’s CMO on whether the unit is able to achieve an auditable SBR by September 30, 2014, without an unaffordable or unsustainable level of onetime fixes and manual work- arounds and without delaying the auditability of the financial statements. In the event that the CMO of a military department determines that the military department would not be able to achieve an auditable SBR by that date, the CMO is required to explain why the military department cannot meet that date and provide an alternative date for meeting the target date.

In the November 2014 FIAR Plan Status Report, DOD acknowledged that it did not meet the September 30, 2014, target date for achieving audit readiness of the SBR, but stated that the three military departments asserted Schedule of Budgetary Activity audit readiness in the last quarter of fiscal year 2014. In January 2015, independent public accountant (IPA) firms began auditing the military departments’ General Fund Schedules of Budgetary Activity for fiscal year 2015. For the first- year Schedule of Budgetary Activity audits, the scope is the schedules containing only current year appropriations and all related activity, such as obligations and outlays, against those appropriated funds approved on or after October 1, 2014. As a result, these first-year Schedule of Budgetary Activity audits exclude unexpended amounts, whether obligated or unobligated, carried over from prior years’ funding as well as information on the status and use of such funding in subsequent years (e.g., obligations incurred and outlays). These amounts will remain unaudited. Over the ensuing years, as the unaudited portion of SBR balances and activity related to this funding decline, the audited portion is expected to increase.

The NDAA for Fiscal Year 2014 mandates that upon the conclusion of fiscal year 2018, the Secretary of Defense shall ensure that a full audit is performed on DOD’s fiscal year 2018 financial statements and submit the results of that audit to Congress not later than March 31, 2019.

FIAR Plan

DOD’s FIAR Plan is DOD’s strategic plan and management tool for guiding, monitoring, and reporting on the department’s financial management improvement efforts. As such, the plan communicates incremental progress in addressing the department’s financial management weaknesses and achieving financial statement auditability. The plan focuses on several goals: 1. achieve and sustain unqualified assurance on the effectiveness of internal controls through the implementation of sustained improvements in business processes and controls addressing the material weaknesses in internal control, 2. develop and implement financial management systems that support effective financial management, and 3. achieve and sustain financial statement audit readiness.

The department has envisioned achieving financial statement auditability in four waves of concerted improvement activities described in its FIAR Plan. The activities of these four waves are within groups of end-to-end business processes, which are further broken down into discrete units, called assessable units. DOD defines an assessable unit as any part of the financial statements, such as a line item or a class of assets, a class of transactions, or a process or a system, that helps produce the financial statements. The four waves are as follows:

Wave 1: Appropriations Received Audit

Wave 2: Schedule of Budgetary Activity/SBR Audit

Wave 3: Mission Critical Asset Existence and Completeness Audit

Wave 4: Full Financial Statements Audit Waves 1 through 3 started concurrently, and an IPA firm validated Wave 1 as audit ready in August 2011. In the November 2013 FIAR Plan Status report, DOD defined the term audit ready as meaning that the department has strengthened internal controls and improved financial practices, processes, and systems so that there is reasonable confidence that the information can withstand an audit by an independent auditor. The department organized these audit readiness waves to use the interdependencies between budgetary and accounting information. FIAR priorities have required reporting entities to devote their resources and efforts toward completing audit readiness activities for Waves 1 through 3 before beginning work for Wave 4. DOD officials have stated that much of the audit readiness work required to complete Waves 1 through 3 affects Wave 4 requirements and objectives. For example, DOD has identified interdependencies between accounts included in Waves 2 (budgetary) and 4 (accounting information). DOD officials stated that the department has expanded its audit readiness priorities from budgetary data reported on the SBR to all financial transactions reported on the Balance Sheet and the Statements of Net Cost and Changes in Net Position. As stated in the May 2015 FIAR Plan Status Report, the focus of current FIAR activity includes (1) valuing and accurately reporting over $2.2 trillion in assets, (2) reporting over $2.4 trillion in liabilities, and (3) preparing full financial statements for audit.

FIAR Guidance

The FIAR Guidance, first issued in May 2010 and periodically updated, provides the standard methodology by which the components are to implement the FIAR Plan. DOD components are required to establish assessable units for all processes, systems, or classes of assets that result in material transactions and balances in their financial statements to focus their improvement efforts. Components are required to prepare FIPs for each assessable unit under the FIAR Guidance. According to the FIAR Guidance, component audit readiness assertions for assessable units are to specify that (1) control activities are suitably designed and implemented, operating effectively, and sufficiently documented to provide reasonable assurance that applicable financial reporting objectives are achieved; (2) key supporting documents are readily available for review; and (3) account balances and transactions are accurately recorded. DOD has established a mandatory set of five standardized phases for achieving audit readiness that its components are required to apply to each assessable unit. As of the April 2015 FIAR Guidance, these five phases were Discovery, Corrective Action, Assertion/Examination, Validation, and Audit.

In the FIAR Guidance, service providers, such as DFAS and DLA, are defined as components that are responsible for their systems and data, processes and internal controls, and supporting documentation that affect a reporting entity’s audit readiness. Service providers are to prepare documentation illustrating the financial reporting aspects of their operations through end-to-end business processes. Based on that documentation, the service providers are to identify and evaluate control activities and supporting documentation over those processes that affect the reporting entities’ financial reporting objectives (i.e., the outcomes needed to achieve proper financial reporting and serve as a point against which the effectiveness of internal controls over financial reporting can be evaluated). In accordance with the FIAR Guidance, service providers’ control activities and supporting documentation undergo examinations conducted in accordance with the Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization. Service providers, such as DFAS, with three or more customers working to become audit ready must obtain SSAE No. 16 examinations on their internal controls over financial reporting. According to DOD officials, the results of these examinations can then be relied upon by all of the customers, reducing audit time and therefore saving money.

The updated FIAR Guidance, issued in April 2015, provides specific tasks, work products, and deliverables for achieving and validating full financial statement auditability. As described in this FIAR Guidance, DOD has expanded its FIAR priorities from budgetary information and mission- critical asset information to include two other priorities—proprietary accounting data/information for the Balance Sheet and Statements of Net Cost and Changes in Net Position and valuation of assets and liabilities. It also includes newly established milestones that the components must meet to give DOD the best opportunity to succeed in achieving auditable financial statements by fiscal-year end 2017.

The Panel Report

The panel reviewed the following four areas and provided a total of 29 recommendations to DOD to resolve the issues it found in each area.

FIAR strategy and methodology (6 recommendations). While acknowledging that the department had a reasonable strategy and methodology for its FIAR effort, the panel stated that DOD’s strategy needed to be more detailed and refined. For example, according to the panel, DOD had not yet fully defined all of the elements of the strategy necessary to achieve audit readiness on all financial statements in 2017. Moreover, the panel was concerned that certain DOD components may not be effectively implementing the FIAR strategy and methodology.

Challenges to achieving financial management reform and auditability (9 recommendations). The panel recognized that DOD’s size and complexity contribute to the complicated and pervasive challenges to its financial management processes and related business operations and systems. In its report, the panel expressed concern about DOD’s progress in addressing long-standing weaknesses in internal controls. Specifically, the panel referred to the numerous material weaknesses in internal control over financial reporting—cited by the DOD IG in its reports since the mid-1990s—that have affected DOD’s ability to achieve a clean audit opinion. In addition, the panel noted that weaknesses in controls over the recording, accounting, and reporting of financial information jeopardize DOD’s ability to safeguard taxpayer dollars. For example, these weaknesses can result in improper payments, Antideficiency Act (ADA) violations, and problem disbursements. The panel also noted organizational challenges faced by the logistics community, military components, and DFAS. Specifically, the majority of transactions recorded in accounting systems are initiated by military components, including military commands, installations, and bases, and within nonfinancial functional communities, such as acquisition and logistics. The panel stated that continued emphasis must be placed on fully engaging both the military components and functional communities in audit readiness efforts.

Financial management workforce (5 recommendations). According to the panel, ensuring that the financial management workforce is adequately staffed, skilled, and well-trained is crucial to DOD’s ability to improve financial management. For example, the panel was concerned that DOD had not yet performed a complete department- wide systematic competency assessment, which would include analysis of the types and ranges of abilities, knowledge bases, and skills of the present financial management workforce and those that will be needed in the future.

ERP system implementation efforts (9 recommendations). While acknowledging that DOD has taken positive steps, the panel expressed five concerns about the department’s ERP system implementation efforts, including (1) reported schedule delays and cost overruns as well as the reliability of ERP schedule and cost estimates; (2) issues with the requirements process in that in some cases not enough requirements are identified and in some cases too many requirements are included in ERP systems; (3) ERP systems that may not provide the capabilities needed for achieving FIAR objectives; (4) poor execution of data conversion that could cause delays in the full implementation of the ERP systems; and (5) the numerous interfaces that exist between the legacy systems and the ERP systems and the problems associated with these interfaces that could compromise ERP functionality. In its report, the panel also recognized that because most financial information is maintained in computer systems, the reliability of the financial data in these systems depends on the effectiveness of information system controls over how those systems operate.

DOD Has Taken Actions to Implement the Panel’s Recommendations, but Significant Challenges Remain to Achieve Auditability

We determined that DOD’s actions have met 6 of the panel’s recommendations and partially met 23. In its May 2015 FIAR Plan Status Report, DOD stated that 9 recommendations were met and the remaining 20 were partially met. With regard to the 9 recommendations that DOD reported as met, we determined three to be partially met. Table 1 includes a list of the 29 panel recommendations, shown by the four areas reviewed by the panel, and our determination on the status of DOD’s implementation of each recommendation along with the status DOD reported in May 2015. See appendix I for detailed information on each of the 29 recommendations. While DOD is making progress, it is important to note that implementation of the panel’s recommendations may not include all of the actions that the department must take to achieve auditable financial statements. For example, as the DOD IG and the IPA firms perform examinations and audits, they may identify deficiencies in internal controls that were not previously known and therefore were not addressed by the panel’s recommendations.

DOD’s Actions Have Met Six of the Panel’s Recommendations

We agree with DOD’s status determinations that its actions have met six of the panel’s recommendations (see table 1, recommendations 2.5, 2.8, 3.2, 3.3, 3.4, and 3.5). Two of these relate to the area on challenges to achieving financial management reform and auditability. DOD has taken the actions recommended by the panel to reduce ADA violations by analyzing the causes of these violations; developing and implementing procedures to address them; and ensuring that key funds control personnel are adequately trained to prevent, detect, and report ADA violations (2.5). In addition, as recommended by the panel, DOD has developed forums for sharing lessons learned within commands of military departments as well as external to these departments (2.8). These information-sharing forums include newsletters, quarterly in- process reviews, and stakeholder meetings as well as the FIAR Governance Board, FIAR Committee, and FIAR Subcommittee. DOD has also met the requirements of four financial management workforce- related recommendations. Actions taken include using the expertise of certified public accountants with financial statement audit experience in its audit readiness efforts (3.2); developing and making financial management web-based courses available to both personnel in the financial management functional community and those outside of the financial management community, such as personnel in the logistics and acquisition functional communities (3.3); providing training programs for the department’s current ERP systems that users are to complete prior to obtaining access to these systems (3.4); and submitting a proposal to both the Senate and House Armed Services Committees for a financial management exchange program between DOD and the private sector (3.5). Further details on the specific recommendations made and DOD’s actions taken are discussed in appendix I.

DOD’s Actions Have Partially Met Three Recommendations That DOD Classified as Met

We determined that DOD’s actions partially met three of the panel’s recommendations for which DOD had reported the status as met (see table 1, recommendations 1.6, 2.1, and 2.2). Descriptions of the panel’s recommendations, the department’s actions, our reasons for disagreeing with DOD on the status of these recommendations, and the additional actions needed to fully address the panel recommendations are discussed below.

The panel recommended that the FIAR Governance Board attest to whether DOD is on track to achieve audit readiness in 2017 in each FIAR Plan Status Report (1.6). DOD reported this recommendation as met because each FIAR Plan Status Report is coordinated among FIAR Governance Board members, providing them with the opportunity to (1) formally attest to the accuracy and completeness and (2) determine if their components are on track to achieve audit readiness in 2017. DOD officials also stated that each military department’s CMO reports on audit readiness progress and challenges in signed statements in the FIAR Plan Status Report and indicates whether the military department is on track to achieve audit readiness by September 30, 2017. However, we consider this recommendation to be partially met because all FIAR Governance Board members need to attest for their individual components, and the DOD Comptroller needs to attest for the department, whether they are on track to achieve audit readiness in 2017 in each FIAR Plan Status Report to fully meet this recommendation. In making these attestations, it is critical that the FIAR Governance Board consider the effect of known factors (e.g., the lack of integrated systems) and other risks, such as weaknesses and deficiencies that may be identified in examinations and audits, on the status of their respective components’ financial statement audit readiness.

The panel required DOD to (1) include objective and measurable criteria regarding FIAR-related goals in its senior personnel performance plans and evaluations, (2) appropriately reward or hold officials accountable based on evaluated performance against the FIAR-related goals, and (3) document and track evaluated performances to measure progress over time (2.1). On April 9, 2013, the Deputy Secretary of Defense issued a memorandum, stating that most, if not all, of DOD’s executives have a role in its effort to achieve audit readiness and that Senior Executive Service (SES) performance plans were to be updated with FIAR-related goals by April 30, 2013. We consider this recommendation partially met because, although DOD components have inserted FIAR-related requirements in SES performance plans, they have not yet determined how to reward executives based on evaluated performance for FIAR-related goals and assessed the effect on accomplishing FIAR activities by tracking evaluated performances over time.

To improve oversight of the FIAR effort, the panel recommended that DOD require each component senior executive committee to review its corresponding component’s audit readiness assertion packages for compliance with FIAR Guidance before submitting those packages to the Office of the Under Secretary of Defense (Comptroller) for validation (2.2). DOD considers the recommendation to be met because the FIAR Guidance states that management’s audit readiness assertions must be signed by the person, individual, or representative of the organization responsible for the subject matter (assessable unit) and that this level of review and approval is appropriate. DOD requires review of the assertion package in accordance with the FIAR Guidance, but we consider this recommendation partially met because the FIAR Guidance does not require senior executive committee reviews of audit readiness assertion packages as the panel recommended.

DOD’s Actions Have Partially Met 20 of the Panel’s Remaining Recommendations

We agree with DOD that the department’s actions partially met the remaining 20 panel recommendations, described below by the four areas of the panel’s review, and continued actions are needed. However, additional actions beyond what DOD indicated is planned are needed in some cases to fully address the panel recommendations. See appendix I for details on all partially met recommendations, including actions under way or additional actions needed to meet these recommendations.

FIAR Strategy and Methodology

The panel made six recommendations in this area, including recommendation 1.6 discussed above that DOD considers met which we consider partially met and the remaining five for which we agree with DOD’s determination that these are partially met. Two of the five remaining partially met recommendations in this area specifically relate to DOD’s implementation of its FIAR strategy and methodology (1.1 and 1.4). In addition, one recommendation relates to the department’s process for consolidating the components’ financial statements to prepare the department-wide consolidated financial statements (1.2). Another recommendation is related to the valuation of mission-critical assets (1.3). The other remaining partially met recommendation relates to risk management activities associated with implementing the FIAR Plan (1.5).

Although some actions have been taken, continued actions are needed to address all recommendations in this area, and additional actions are needed for some. For example, the panel recommended that the Comptroller’s office, in consultation with DOD’s DCMO, the secretaries of the military departments, and the heads of the defense agencies and field activities, incorporate risk mitigation plans to support meeting future interim milestones in the FIAR Plan (1.5). As we reported in August 2013, DOD officials acknowledged that there is not a department-wide written risk management policy for its FIAR effort. DOD officials had stated earlier that a department-wide risk management plan would aid in assessing and integrating risk strategies across the department. However, instead of a department-wide risk management plan, DOD is using a three-pronged approach to address aspects of risk management, as stated in its May 2015 FIAR Plan Status Report. While DOD’s three- pronged approach to address risk management includes the use of “deal- breakers,” DOD’s critical path, and its centralized notices of findings and recommendations tracking database, a department-wide risk management plan, as DOD had previously planned to implement, is needed for developing and implementing consistent risk mitigation strategies across DOD and thus to support meeting future interim milestones as called for in the recommendation.

Challenges to Achieving Financial Management Reform and Auditability

The panel made nine recommendations in this area, including two recommendations previously discussed that DOD considers met and we consider partially met (2.1 and 2.2) and two recommendations that we agree have been met (2.5 and 2.8). For the remaining five recommendations, we agree with DOD’s determination that they are partially met. These five relate to addressing existing material weaknesses and those identified during the FIAR effort (2.3), reducing improper payments and problem disbursements (2.4 and 2.6), identifying and institutionalizing best practices (2.7), and ensuring that components and service providers working with them have consistent milestones (2.9).

Although DOD has taken some actions to address these recommendations, continued or additional actions are needed as detailed in appendix I. For example, the panel recommended that to reduce problem disbursements, the department should address the underlying causes of problem disbursements in its efforts to develop and implement ERP systems (2.6). According to a DOD official, the implementation of modern financial systems, including ERP systems, has increased the level of problem disbursements because of data quality issues and interfaces with legacy systems that are still in use. The DOD official also stated that when the ERP systems are fully implemented and operating in the stable end states, these systems should provide an automated, integrated environment that will significantly reduce the number of problem disbursements. In its May 2015 FIAR Plan Status Report, DOD officials stated that analyses to assist in identifying root causes and implementing corrective actions, as called for in the recommendation, will be performed on a recurring basis until the department can retire all legacy systems and fully implement the ERP systems’ capabilities.

Financial Management Workforce

The panel made five recommendations in this area, four of which have been met, as previously discussed, and one for which we agree with DOD’s partially met assessment. This recommendation relates to DOD performing a department-wide systematic skills assessment of its financial management workforce and that of all other functional areas that are performing financial management-related functions (3.1). The panel recognized the importance of having personnel within DOD’s other functional communities who are skilled in performing financial management-related tasks, because these communities initiate and maintain much of the financial information critical to the results of DOD’s operations. DOD completed its systematic competency assessment of certain occupations in its financial management workforce and has plans to assess the remaining financial management workforce in phases. However, at the time of our review, DOD had not yet assessed other functional communities as called for by the panel recommendation.

ERP System Implementation Efforts

The panel made nine recommendations in this area, and we agree with DOD that all of these recommendations have been partially met and none have been fully met. The first six include recommendations relating to ERP schedule delays and cost overruns, issues with the requirements process, and the capabilities of the ERP systems to achieve FIAR objectives. For example, the panel recommended that DOD develop ERP-related schedule and cost estimates based on best practices for future ERP deployments (4.3). While the Army had made some improvements to the schedule and cost estimates for Army’s Global Combat Support System (GCSS-Army), we reported in 2014 that DOD has not fully implemented best practices in its schedule estimates, cost estimates, or both for the Defense Enterprise Accounting and Management System and GCSS-Army. The panel also made two recommendations to address its concerns about DOD’s data conversion efforts and the numerous interfaces that exist and their possible compromising of ERP functionality. The panel’s final recommendation related to DOD’s assessment of information systems controls testing needs for all ERP systems being developed and determination of whether appropriate workforce levels and corresponding skill sets exist within DOD’s developmental and operational test communities.

As detailed in appendix I, the department needs to continue taking actions to address all of these recommendations and take additional actions for some. For example, as mentioned above, the panel recommended that among other things, DOD evaluate lessons learned from previous data conversion efforts and incorporate these lessons into its ERP conversion plans as well as assess the merits of designating a senior official to be responsible for the coordination and managerial oversight of data conversion (4.7). Although DOD assessed the merits of designating a senior official responsible for data conversion and identified lessons learned from previous data conversion efforts, as DOD implements ERP systems, the department needs to continue to incorporate lessons learned into its current and future ERP data conversion plans, as recommended by the panel. Given that DOD officials have stated that these ERP systems are critical to DOD’s ability to achieve audit readiness, fully implementing these recommendations will be necessary for achieving this goal.

Conclusions

The panel’s report and its recommendations touch on some of the most critical challenges the department faces in achieving lasting financial management improvements and financial statement audit readiness. As previously stated, DOD has defined audit readiness to mean that the department has strengthened internal controls and improved financial practices, processes, and systems so that there is reasonable confidence that the information can withstand an audit by an independent auditor. DOD’s actions to meet the panel’s 29 recommendations, if effectively designed and implemented, will bring the department closer to achieving these important goals. However, it is important to note that implementation of the panel’s recommendations may not include all of the actions that the department must take to achieve auditable financial statements. As the DOD IG and the IPA firms perform examinations and audits, they may identify deficiencies in controls that may not have previously been known and as such were not addressed by the panel’s recommendations. Nonetheless, without taking the actions needed to fully implement the panel recommendations, DOD is at increased risk of not achieving its financial management improvement and audit readiness goals. DOD is monitoring its progress implementing the FIAR Plan against interim milestones. However, as the target date for validating DOD’s audit readiness approaches, as we have previously stated, DOD has emphasized asserting audit readiness by set dates over assuring that processes, systems, and controls are effective, reliable, and sustainable. While time frames are important for measuring progress, DOD should not lose sight of the ultimate goal of implementing lasting financial management reform to ensure that it can routinely generate reliable, auditable financial information and other information critical to decision making and effective operations.

Recommendation for Executive Action

To help meet its financial management improvement and audit readiness goals, we recommend that the Secretary of Defense direct the Under Secretary of Defense (Comptroller) to reconsider the status of the three panel recommendations that DOD classified as met that we determined were partially met and take the necessary actions to reasonably assure that these recommendations have been met.

Agency Comments and Our Evaluation

We provided a draft of this report to DOD for comment. In its written comments, reprinted in appendix II, DOD concurred with our recommendation to reconsider whether further actions are needed to meet panel recommendations 1.6, 2.1, and 2.2. DOD also described planned actions that it will take to address the recommendations. For panel recommendation 2.2, DOD stated that it will update the FIAR Guidance to require dual signatures from both the senior executives in charge of financial and relevant functional areas for the subject assertions. As DOD updates its FIAR Guidance, DOD should require each component senior executive committee to review its corresponding component’s audit readiness assertion package as called for by the panel recommendation, rather than focus on dual signatures. DOD stated that it will continue to provide status updates on actions planned and completed for the remaining 23 panel recommendations in its semiannual FIAR Plan Status Report.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, and the Under Secretary of Defense (Comptroller). In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix III.

Appendix I: Status of DOD’s Actions to Implement the Panel on Defense Financial Management and Auditability Reform Recommendations

This appendix contains our assessment of the Department of Defense’s (DOD) progress in addressing the House Armed Services Committee (HASC) Panel on Defense Financial Management and Auditability Reform’s (the panel) recommendations, organized by the four areas the panel reviewed. Each section of the appendix covers the recommendations made for the four areas and includes (1) the panel recommendations, (2) statuses reported by GAO and DOD, (3) key background information, (4) DOD actions taken to address the recommendations, and (5) our assessment of the status of the recommendations. The status of each recommendation is based on our assessment of information received prior to or as of May 2015 and DOD’s reported status as of the May 2015 Financial Improvement and Audit Readiness (FIAR) Plan Status Report.

FIAR Strategy and Methodology

Background: The panel reported that DOD had a reasonable strategy and methodology for its FIAR effort, although its strategy needed to be more detailed and refined. While the panel noted that DOD’s December 2011 FIAR Guidance detailed the strategy and methodology for completing Wave 4, the components were instructed to continue their focus on implementing the requirements of Waves 1, 2, and 3. Additionally, the panel reported that the department, in its FIAR Guidance, instructed its components not to address Wave 4 requirements in their financial improvement plans (FIP) until the FIAR activities associated with Waves 1, 2, and 3 were complete. The panel stated its concern that this approach may affect the department’s ability to achieve financial statement auditability in 2017, because of DOD’s lack of analysis of the interdependencies among Waves 1, 2, 3, and 4. For example, the panel stated that by testing certain information on the Statement of Budgetary Resources (SBR) in Wave 2, assurance can be obtained on the reliability of certain data in the Balance Sheet in Wave 4.

DOD Actions: DOD first identified interdependencies in its December 2011 FIAR Guidance that can be leveraged to accelerate progress in Wave 4 and revised them in subsequent versions of the FIAR Guidance as follows:

Delivered Orders, reported on the SBR (covered in Wave 2), equates to a portion of Accounts Payable reported on the Balance Sheet (Wave 4).

Spending Authority from Offsetting Collections, reported on the SBR (covered in Wave 2), includes some of the amounts reported in Accounts Receivable—Intragovernmental on the Balance Sheet (Wave 4).

Unobligated Balances and Unpaid Obligations, reported on the SBR (covered in Wave 2), correlates to Fund Balance with Treasury, reported on the Balance Sheet (Wave 4).

Obligations Incurred, reported on the SBR (covered in Wave 2), equates to a substantial portion of Gross Costs reported on the Statement of Net Cost (Wave 4).

In its May 2015 FIAR Plan Status Report, DOD considered this recommendation as partially met and stated that its analysis of interdependencies will continue until the department achieves financial statement auditability. Also, in its April 2015 FIAR Guidance, DOD stated that partly because of interrelationships between financial statements, the department can leverage audit readiness efforts from previous waves to succeeding waves, much like the above interdependencies. For example, DOD officials stated that through Schedule of Budgetary Activity/SBR (Wave 2) audit readiness efforts, some portions of line items on other financial statements have been addressed.

GAO Status: We consider this recommendation partially met because as DOD continues its audit readiness activities, the department will likely identify additional interdependencies between accounts on its SBR, Balance Sheet, and Statement of Net Cost. For example, Wave 4 audit readiness activities include valuation of assets, liabilities, revenues, and costs and therefore will require DOD to determine the dollar values to be assigned to line items such as environmental liabilities; general property, plant and equipment; inventory; and operating materials and supplies. These audit readiness activities will involve interdependencies between the Balance Sheet and the Statement of Net Cost.

Background: The panel stated that the FIAR Plan did not address the process for ensuring that the DOD components’ financial information will be properly consolidated into DOD’s department-wide financial statements. The panel’s concern was that the lack of an articulated process for addressing financial statement consolidation may affect DOD’s ability to achieve financial statement auditability in 2017. In its recommendation, the panel suggested, as one option, that DOD create a DOD financial reporting element or wave for consolidation of DOD’s financial statements and report on this element’s audit readiness progress in the FIAR Plan Status Report.

DOD Actions: DOD reports on the status of Defense Finance and Accounting Service (DFAS) financial reporting, defined as the process by which DFAS organizes financial data and produces financial statements, in the FIAR Plan Status Reports. DFAS, one of DOD’s largest service providers, performs accounting and finance services for the department, including preparing the financial statements for its components as well as the consolidated department-wide financial statements. According to DOD officials, the department will continue to use the current DFAS reporting system and processes to produce the department-wide consolidated financial statements. In accordance with the FIAR Guidance, DFAS’s financial reporting system and processes have undergone a Statement on Standards for Attestation Engagements (SSAE) No. 16 examination by an independent auditor. As DOD officials stated in the May 2015 FIAR Plan Status Report, the department is addressing the SSAE No. 16 reported findings and implementing corrective actions. However, DOD officials stated in the report that the department will not know whether outstanding issues related to financial statement compilation have been resolved until an audit of DOD’s department-wide financial statements has been conducted.

GAO Status: DOD has established financial reporting assessable units for the military departments and service providers. However, we consider this recommendation partially met because DOD needs to take additional actions to fully develop a financial reporting wave or strategy for consolidating individual component financial statements into department- wide financial statements. In addition, DOD’s reporting system and processes do not allow for the elimination of intragovernmental transactions, which occur between federal entities and must be eliminated to prevent duplicate reporting of information. DFAS, in its SSAE No.16 financial reporting assertion package, stated that DOD’s current accounting systems generally do not capture trading partner information at the level needed to match and eliminate these intragovernmental transactions between trading partners. DOD officials stated that they have actions under way to address the issues affecting the proper elimination of intragovernmental transactions.

Background: When the panel made its recommendation, DOD had decided to wait to report the historical costs of real property, general equipment, inventory, and operating materials and supplies on its Balance Sheet until (1) initial FIAR priorities had been met and (2) the enterprise resource planning (ERP) systems under development were capable of recording and reporting transaction data. DOD’s decision was based on its business case in which DOD officials stated that with the exception of operating materials and supplies, historical acquisition cost information was used exclusively for financial reporting and not for managerial decision making. DOD officials, in its business case, also recognized that the ongoing implementation of ERP systems would enhance the recording of auditable historical costs for future acquisitions. Based on its business case, DOD also decided that it would expense the costs of military equipment and request that the Federal Accounting Standards Advisory Board change the federal accounting standards to allow this treatment, because DOD viewed capturing, recording, and reporting auditable costs for military equipment as extremely challenging and costly. In its report, the panel noted that federal accounting standards allow for the use of other methods to provide reasonable estimates for the costs of these assets, which led to its recommendation that the department reevaluate its position on accepting historical costs.

DOD Actions: DOD has reevaluated its position from that described in its business case, deciding to include historical cost valuations of general property, plant and equipment, including general equipment as well as real property, and internal use software on its Balance Sheet, without waiting until initial FIAR priorities are met and the implementation of the ERP systems is complete. In September 2013, DOD described its overall strategy for valuing assets (1) acquired prior to October 1, 2013, and (2) accepted by DOD and placed into service on or after October 1, 2013. In February 2014, DOD issued its general equipment valuation estimation methodologies. According to its May 2015 FIAR Plan Status Report, DOD has established five working groups that are addressing impediments to audit readiness, including the valuation of historical assets. DOD reported the status of this recommendation as partially met and stated that the valuation methods for various asset categories are being developed and that the department is working closely with the Federal Accounting Standards Advisory Board to leverage asset valuation methodologies allowed under Statement of Federal Financial Accounting Standards No. 35 to establish a historical cost baseline.

GAO Status: We consider this recommendation partially met because DOD has developed a strategy and is basing its asset valuation for the Balance Sheet on historical cost, but the department faces significant challenges in continuing to implement its strategy and develop auditable valuations for these assets. For example, DOD’s components must first determine the existence of these assets. In addition, DOD has cited the following challenges to asset valuation: numerous configurations of highly complex military equipment and military equipment and weapons systems that have been modified, upgraded, or overhauled; renovated or improved real property assets that have changed in value since originally placed in service; large inventories of missiles, ammunition and munitions, spare engines, equipment parts, supplies, and so forth; enormous quantities of deployed general equipment, inventory, and operating materials and supplies located in Afghanistan and worldwide; and identification and valuation of internal use software and DOD property with contractors.

Background: The panel’s concern was that without properly implementing the FIAR methodology, DOD components may be prematurely asserting audit readiness. In its report, the panel refers to our September 2011 report in which we stated that the Navy and Air Force did not adequately develop and implement their respective FIPs for civilian pay and military equipment in accordance with the FIAR Guidance. Our review of the FIPs found that the Navy and Air Force did not conduct sufficient control and substantive testing and reached conclusions that were not supported by the testing results, did not complete reconciliations of the population of transactions, and did not fully test information systems controls. Also, neither the Navy nor the Air Force had fully developed and implemented corrective action plans (CAPs) to address deficiencies identified during implementation of the FIPs. As a result of these deficiencies, we reported that these FIPs did not provide sufficient support for the components’ conclusions that the assessable units were ready to be audited.

DOD Actions: With regard to part 1 of the recommendation, DOD’s FIAR Directorate, according to DOD officials, worked with DOD’s components initially to overcome FIAR Plan implementation difficulties by reviewing and verifying that the FIPs were consistent with FIAR strategy and methodology. Based on this work, the FIAR Directorate identified causes of implementation difficulties, or what DOD refers to as deal-breakers— weaknesses that have prevented DOD components from demonstrating audit readiness or succeeding in audits.

With regard to part 2 of the recommendation, DOD’s March 2013 FIAR Guidance accelerated examination of audit readiness assertion packages by the DOD Inspector General (IG) or independent public accountant (IPA) firms to identify needed corrective actions based on auditor- identified notices of findings and recommendations by combining the Assertion and Evaluation phases into one phase. In addition to examinations of audit readiness assertion packages, audits of the military departments’ General Fund Schedules of Budgetary Activity for fiscal year 2015 began in January 2015. The FIAR Directorate has established a tracking database to monitor the implementation of corrective actions for findings and recommendations resulting from examinations and audits.

Finally, with regard to part 3 of the recommendation, DOD does not have a formal communications plan for sharing information on lessons learned, but the FIAR Directorate promotes this type of sharing. Lessons learned are shared at FIAR Committee, FIAR Subcommittee, and working group meetings, as well as other forums such as in-process review meetings and newsletters. According to the May 2015 FIAR Plan Status Report, the tracking database for notices of findings and recommendations will help in sharing lessons learned as deficiencies at one component are likely to exist at another component.

GAO Status: We consider this recommendation partially met because DOD components have not yet implemented all of the FIAR audit readiness activities to achieve its goal of department-wide financial statement auditability. Furthermore, the expansion of the FIAR priorities to include proprietary accounting and information as well as valuation will likely require additional corrective actions to address these areas. As recommended by the panel, the components will need to continue developing CAPs to address any identified weaknesses or deficiencies. Finally, DOD needs to develop a formal communications plan and components will need to communicate any lessons learned as the panel recommended.

Background: The panel raised concerns about DOD missing some of the interim milestones included in the May 2011 FIAR Plan Status Report. While recognizing that slippages of interim milestones will not necessarily compromise meeting audit readiness objectives, the panel stated that DOD must incorporate risk mitigation plans to remediate missed interim milestones and apply lessons learned toward achieving later milestones on schedule.

DOD Actions: The department, in its May 2015 FIAR Plan Status Report, stated that it has a three-pronged approach for addressing risk management in which DOD has (1) identified audit readiness deal- breakers by reviewing past audits, (2) defined the critical path to achieving financial statement auditability and included related tasks and milestones in the April 2015 FIAR Guidance, and (3) reinforced the importance of internal controls over areas of significant risk by including a new chapter on internal controls in the FIAR Guidance and implementing a centralized tracking database to monitor corrective actions developed in response to notices of findings and recommendations generated from examinations and audits.

GAO Status: We consider this recommendation partially met because DOD needs to take additional actions to develop a department-wide risk management plan. In August 2013, we recommended that DOD design and implement department-level policies and detailed procedures for FIAR Plan risk management, including the five guiding principles for effective risk management. DOD officials acknowledged that DOD did not have a written risk management policy for its FIAR effort and originally planned to develop one, but have recently stated that its three-pronged approach will address risk management. According to the May 2015 FIAR Plan Status Report, DOD’s three-pronged approach addresses aspects of risk management, including the use of deal-breakers, DOD’s critical path, and its notices of findings and recommendations tracking database. However, the lack of a department-wide risk management plan to assess risks specifically related to meeting future interim milestones will hinder developing and implementing consistent risk mitigation strategies across DOD.

Background: The FIAR Governance Board is charged with providing vision, leadership, oversight, and accountability for DOD’s FIAR effort. Members of the FIAR Governance Board include the Comptroller/Chief Financial Officer, the Deputy Chief Financial Officer, the Deputy Chief Management Officer, the military department assistant secretaries for financial management/comptroller and deputy chief management officers (DCMO), the DFAS Director, and Defense Logistics Agency (DLA) Deputy Director.

DOD Actions: DOD officials stated that each FIAR Plan Status Report is coordinated among FIAR Governance Board members, providing them with the opportunity to (1) formally attest to the accuracy and completeness and (2) determine if their components are on track to achieve audit readiness in 2017. In addition, DOD officials stated that each military department’s chief management officer reports on audit readiness progress and challenges in signed statements in the FIAR Plan Status Report and also indicates whether his or her military department is on track to achieve audit readiness by September 30, 2017.

GAO Status: The FIAR Plan Status Reports have included signed statements by the military department chief management officers as well as a signed statement from DOD’s Under Secretary of Defense (Comptroller)/Chief Financial Officer. However, we consider this recommendation partially met because not all FIAR Governance Board members (e.g., the DFAS Director and the DLA Deputy Director) provide signed statements and attest to audit readiness in the FIAR Plan Status Reports and thus additional actions are needed. In addition, the signed statements provided in the May 2015 FIAR Plan Status Report did not explicitly state whether DOD was on track to achieve audit readiness by September 30, 2017, as the panel recommended. Instead, the signed statements expressed commitment to continue making progress toward financial statement auditability by September 30, 2017, but did not clearly state whether DOD or the military departments are on target to meet that date. Moreover, because the panel recommendation is addressed to the department, the FIAR Governance Board members need to attest for their individual components and the DOD Comptroller needs to attest for the department whether they are on track to achieve audit readiness in 2017 in each FIAR Plan Status Report to fully meet this recommendation. In making these attestations, it is critical that the FIAR Governance Board consider the effect of known factors (e.g., the lack of integrated systems) and other risks, such as weaknesses and deficiencies identified in examinations and audits, on the status of its financial statement audit readiness.

Challenges to Achieving Financial Management Reform and Auditability

Background: The panel stated, in its report, that effective leadership and oversight are instrumental to bringing forth and sustaining substantial financial management improvement. In addition to financial management reform being a long-term undertaking, the panel stated that it requires the involvement of DOD leadership within, and outside of, financial management operations. In addition, according to the panel, leadership should extend from the top officials, including the offices that comprise the Secretary of Defense, the military departments’ chief management officers, and the military departments’ assistant secretaries (financial management and comptroller) to senior officials in other functional areas, such as logistics and acquisitions. The panel recognized that DOD requires that senior executive performance appraisals include financial audit goals among their evaluation criteria and that this requirement includes appraisals of senior executives in functional areas having a financial impact. The panel considered this requirement a positive step, but added that the effectiveness of this requirement depends on whether the evaluation criteria can be objectively measured, evaluated performances are appropriately rewarded, and senior officials are held accountable.

DOD Actions: On April 9, 2013, the Deputy Secretary of Defense issued a memorandum, stating that most, if not all, of DOD’s executives have a role in its effort to achieve audit readiness. In the memorandum, three categories of Senior Executive Service (SES) members were described and their performance plans were to be updated with objective and measurable criteria by April 30, 2013.

SES members in category 1 are responsible for managing resources or DOD business processes. The performance plans for these SES members are to include an agency-specific performance requirement for business acumen.

The second category is those SES members who have a direct role in their organizations’ FIAR efforts. This category includes headquarters- level financial managers with overall FIAR responsibility as well as SES members in financial management and other functional communities (such as acquisition, logistics, and personnel) who directly affect their organizations’ financial records and FIAR efforts. These SES members should include in their performance plans specific audit-related goals, tied to their organizations’ FIPs, as an agency-specific performance requirement for being results driven. Moreover, to the extent that these SES members manage resources or DOD business processes, the executive performance plans should also include the business acumen element described in the first category. In assessing performance for this element, rating officials are instructed to consider both the individual’s and the organization’s results.

The third category consists of SES members who do not manage resources or DOD processes, who do not have a direct role in their organizations’ audit readiness efforts, or both. According to the April 9, 2013, memorandum, these SES members are to request a waiver from having FIAR goals included in their executive performance plans. However, according to an April 19, 2013, memorandum, the instance of SES members falling into the third category should be rare.

With regard to the second part of this recommendation, DOD officials told us in December 2014 that officials were considering bonuses to award performance on the FIAR-related goals, but had not determined how to reward executives with bonuses based on evaluated performance for DOD-wide goals, such as the FIAR-related goals. With regard to part 3 of the panel’s recommendation, DOD officials stated that when the FIAR- related goals were first included in the SES performance plans, there was a perceived change in that leaders focused more attention on FIAR goals and efforts. However, DOD officials stated that it is difficult to determine the causality between the inclusion of the FIAR-related goals and achievement of these goals.

GAO Status: We consider this recommendation partially met because, although DOD components have inserted FIAR-related requirements in SES performance plans, additional actions are needed to determine how to reward executives based on evaluated performance for FIAR-related goals and to assess the effect of these requirements on accomplishing FIAR activities by tracking evaluated performances over several fiscal years. Without evaluating SES member performance relating to the FIAR goals, DOD only has anecdotal evidence on the effect of the inclusion of these goals.

Background: The panel based this recommendation on the fact that while DOD components had senior executive committees to oversee financial improvements efforts, their oversight responsibilities were not effectively being carried out, as demonstrated by the ineffective implementation of FIPs and insufficient evidence to support conclusions of audit readiness. In its report, the panel stated that effective oversight mechanisms must be implemented to ensure that DOD’s components are complying with FIAR Guidance.

DOD Actions: As shown in the May 2015 FIAR Plan Status Report, DOD officials determined this recommendation to be met because the FIAR Guidance requires that audit readiness management assertions be signed by the individual representing the organization responsible for the subject matter and that this level of review and approval is appropriate. By signing the audit readiness assertion letter for an assessable unit or line item, the responsible individual is asserting that the component has followed the FIAR Guidance to (1) document and evaluate internal controls and (2) define, assemble, and retain key supporting documentation to support transactions. In addition, the individual is also asserting that the supporting documentation can be retrieved and provided within a reasonable period of time to an IPA firm conducting an examination or subsequent audit. According to DOD officials, the department adopted an alternative action in response to the panel’s recommendation—the assignment of a functional lead to review the audit assertion package. While the functional leads do not sign off on the assertion packages, these leads do participate in the review process for the package. According to DOD officials, this alternative action demonstrates accountability and has addressed the intent of the panel’s recommendation.

GAO Status: We consider this recommendation partially met because DOD’s FIAR Guidance does not require senior executive committee reviews of audit assertion packages for compliance with the FIAR Guidance as the panel recommended. DOD has taken alternative actions of having functional leads review audit assertion packages and individuals responsible for the subject matter review and approve the assertion packages. However, recent GAO reports have identified instances in which the Army and DFAS have not completed tasks required by the FIAR Guidance, which could result in premature assertions of audit readiness. For example, we found that DFAS had asserted audit readiness for its contract pay assessable unit even though a deal-breaker was present. As we reported in June 2014, DFAS had not established a general ledger reconciliation process at the time it implemented its contract pay FIP. Therefore, we concluded that as a result of the lack of a general ledger reconciliation process, additional errors may exist in the recorded transactions activity and balances for DFAS contract pay. If DOD were to take additional actions and require senior executive committee reviews of the assertion packages, as recommended by the panel, then the committee could make a collective decision and take responsibility for moving forward with an assertion, even though a deal- breaker exists, rather than an individual or functional lead making that decision alone. Similarly, the panel cited insufficient support for conclusions of audit readiness in its report, reinforcing the need for higher levels of review of the audit readiness assertion packages.

Background: In its report, the panel stated that since the mid-1990s, the DOD IG has reported numerous material weaknesses in internal control that affect the department’s ability to obtain a clean opinion on its financial statements. In its audit report for fiscal year 2014, the DOD IG reported previously identified material weaknesses in the following areas: (1) Financial Management Systems; (2) Fund Balance with Treasury; (3) Accounts Receivable; (4) Inventory; (5) Operating Materials and Supplies; (6) General Property, Plant and Equipment; (7) Government Property in Possession of Contractors; (8) Accounts Payable; (9) Environmental Liabilities; (10) Statement of Net Cost; (11) Intragovernmental Eliminations; (12) Other Accounting Entries; and (13) Reconciliation of Net Cost of Operations to Budget. Many of these material weaknesses are so serious that they contribute to GAO being unable to render an opinion on the U.S. government’s consolidated financial statements.

DOD Actions: According to DOD officials, components that undergo examinations or audits are required to develop and implement CAPs. The 13 material weaknesses identified by the DOD IG, as well as those self- reported by the department, will be addressed by specific reporting entity corrective actions, DOD-wide corrective actions, or DOD-wide policy initiatives that are carried out at the reporting entity level. Specific reporting entity-level corrective action timelines are included in the May 2015 FIAR Plan Status Report and the April 2015 FIAR Guidance. In addition, details on DOD-wide solutions and policy initiatives are included in the May 2015 FIAR Plan Status Report. With regard to material weaknesses identified through the FIAR effort, the FIAR Directorate, using its notices of findings and recommendations tracking database, is monitoring the implementation of corrective actions.

GAO Status: DOD has taken actions to develop CAPs at the component level. However, we consider this recommendation partially met because DOD needs to take additional actions to develop comprehensive CAPs for addressing material weaknesses at the department level. According to the United States Chief Financial Officers Council’s Implementation Guide for OMB Circular A-123, a comprehensive CAP lists the detailed actions that must be taken to resolve the weakness or deficiency, including (1) summary description of the deficiency and year first identified; (2) targeted corrective action date (the date for management follow-up); (3) agency official responsible for monitoring progress; (4) indicators, statistics, or metrics used to measure progress in resolving the weakness or deficiency; and (5) milestone or other characteristic used to report how resolution activities are progressing. Given the critical nature of the long-standing, material weaknesses in internal control reported for fiscal year 2014, their resolution will require a concerted effort by leadership at the component level to implement corrective actions with oversight from the Office of the Under Secretary of Defense (Comptroller), to monitor department-wide initiatives and implement component-level CAPs. DOD, to meet this recommendation, will also need to monitor the development and implementation of corrective actions for weaknesses identified from FIAR-related activities, such as audits and examinations, to ensure that comprehensive CAPs are developed and these weaknesses are fully addressed at both the component and department levels.

Background: The panel based this recommendation on GAO’s findings included in a July 2009 report that reported DOD may not be capturing the full extent of its improper payments. Specifically, we found in 2009 that DOD had not conducted risk assessments for all of its payment activities and $322 billion in outlays were excluded from the amounts assessed. In addition, at that time we stated that DOD had not estimated improper payments for commercial pay, its largest payment activity, in accordance with improper payment requirements. The then-DOD Comptroller testified before the panel that DOD is taking steps, based on the Improper Payments Elimination and Recovery Act of 2010, to initiate a statistical sampling program for commercial payments. In its report, the panel acknowledged DOD’s efforts to initiate statistical sampling for commercial payments but recommended that DOD take further action to address this issue.

DOD Actions: In its May 2015 FIAR Plan Status Report, DOD officials stated that the department continues to review its sampling methodologies for all payment types to ensure that it can properly estimate improper payment dollars. For example, DFAS reevaluated and enhanced its statistical sampling methodology for DFAS commercial payments for fiscal year 2014 improper payment reporting. Also, for fiscal year 2014, the Defense Health Agency modified its TRICARE improper payment calculation formula in response to our prior findings. DOD stated that the department will be reviewing the sampling methodologies for the other seven programs for which improper payment estimates are reported in its agency financial report. However, DOD stated in its fiscal year 2014 agency financial report that it cannot demonstrate that all payments subject to improper payment requirements were included in the population of payments to review.

GAO Status: DOD has taken some steps to improve its improper payment sampling methodologies for some programs, but we consider this recommendation partially met because DOD still needs to reevaluate its methodology for identifying and reporting improper payments for other types of programs. In addition, DOD cannot demonstrate that the payments subject to improper payment estimation that are included in the populations from which the samples are selected are complete, accurate, and valid. As we stated in May 2013, the foundation of reliable statistical sampling estimates is a complete, accurate, and valid population from which to sample. Furthermore, we stated that DOD did not maintain the supporting documentation needed to substantiate reported improper payment estimates.

Background: In its report, the panel noted that DOD’s poor internal controls put it at risk of violating the Antideficiency Act (ADA), referring to DOD IG and GAO testimonies. The Deputy IG for Auditing testified that DOD’s control environment weaknesses impaired its ability to determine the amount of funds that it had available to spend, and as a result, DOD was at risk of overobligating and overexpending its appropriations and violating the ADA. He added that a lack of adequate controls and training contributed to potential ADA violations. In 2011, we testified that because the ADA prohibits, and effective funds control should prevent, overobligations and overexpenditures of public funds, the number and dollar amount of ADA violations were indicators of the status of DOD’s funds control. In our testimony, we stated that DOD had issued and periodically updated policies that addressed responsibilities for preventing and identifying ADA violations. In addition, we testified that DOD’s guidance described frequent causes of ADA violations within the department and explained the actions necessary to avoid them, including (1) emphasizing management and supervisory duties, (2) training of key funds control personnel, and (3) effective systems and procedures.

DOD Actions: In its Financial Management Regulation (FMR), DOD includes the causes of ADA violations it has identified as well as the department’s policies and procedures to prevent these violations. With respect to ensuring that key funds control personnel are adequately trained, DOD officials, in a memorandum dated December 13, 2011, stated that beginning October 1, 2012, the frequency of training for ADA investigators will change from 5-year to 3-year intervals. According to the May 2015 revised chapter of DOD’s FMR on administrative control of funds, the components are required to submit a memorandum on their annual evaluation of overall administrative control processes and ADA violations. This memorandum is to include a statement that provides the number of key funds control personnel identified and trained as prescribed in the FMR. In the May 2015 FIAR Plan Status Report, DOD officials stated that the military departments and components are required to review and evaluate training records to ensure that personnel certifying and handling funds have financial management and fiscal law training. In addition to increasing the frequency of training for ADA investigators, DOD has implemented its Financial Management Certification Program, which includes training on fiscal law. This training on fiscal law covers funds control and ADA requirements.

GAO Status: We believe DOD’s actions have met the requirements of the recommendation.

Background: Problem disbursements include both unmatched disbursements and negative unliquidated obligations. Unmatched disbursements are disbursements that have been paid by an accounting office but have not been matched to the correct obligation records. A negative unliquidated obligation is a disbursement transaction that has been matched to an obligation, but the total recorded disbursement exceeds the recorded obligation. In its report, the panel stated that problem disbursements impede DOD’s performance of proper Fund Balance with Treasury reconciliations, which affects DOD’s ability to report reliable information on its financial statements.

DOD Actions: DOD’s Deputy Chief Financial Officer testified that problem disbursements are caused by errors or deficiencies that have occurred during the procure-to-pay process. According to DOD officials, problem disbursements can occur when the disbursing function is separated from the entitlement and accounting processes. DOD officials stated that the implementation of modern financial systems, including ERP systems, has temporarily increased the level of problem disbursements because of data quality issues and the need for interfaces with legacy systems that are still in use. However, the officials stated that by the time the ERP systems mature and their operations become stable, the data quality issues should be resolved. Moreover, DOD officials stated that these ERP systems should provide an automated, integrated environment that will significantly reduce the number of problem disbursements. DOD officials also stated that the auditors’ notices of findings and recommendations from examinations and audits should help in resolving issues causing problem disbursements. In its May 2015 FIAR Plan Status Report, DOD officials stated that analyses will be performed on a recurring basis until the department is able to retire all legacy systems and fully implement ERP capabilities. DOD officials added that these analyses and reconciliations should assist in identifying root causes of problem disbursements and implementing corrective actions.

GAO Status: We consider this recommendation partially met because DOD needs to continue to address the underlying causes of problem disbursements as it develops and implements ERP systems.

Background: In its report, the panel stated that it was encouraged by the testimony of DOD logistics community representatives about their role in efforts to improve financial management and achieve audit readiness. However, the panel stated that engaging the functional communities in the audit readiness effort must continue to be prioritized. The panel, in its report, referred to the Air Force’s testimony in which the Director of Logistics stated that one of the biggest challenges is ensuring that the logistics and acquisition functional communities understand their role in achieving audit readiness.

DOD Actions: DOD officials stated, in the May 2015 FIAR Plan Status Report, that the Office of the Under Secretary of Defense (Comptroller), through the FIAR governance process, is aware of solutions and best practices identified and implemented by DOD’s components, including those identified by the functional communities. As cited in the report, some of the best practices shared among the components, including the functional leads serving on the FIAR effort, are as follows:

Solution to be used by the military departments for valuing existing real property assets (deflated plant replacement value).

Army use of an Air Force environmental liability cost estimation tool.

Army and Air Force use of an audit response tool developed by the Navy.

Navy use of a Fund Balance with Treasury reconciliation tool developed by the Air Force.

GAO Status: We consider this recommendation partially met because the FIAR Directorate needs to take additional actions to validate whether identified best practices have been institutionalized department-wide. In addition, DOD did not comprehensively document lessons learned and best practices, and therefore the department is missing an opportunity to gain institutional knowledge that would facilitate future decision making. Federal internal control standards highlight the importance of documenting significant events in a timely manner. Specifically, these standards state that agencies should identify, record, and distribute pertinent information to the right people in sufficient detail, in the right form, and at the appropriate time to enable them to carry out their duties and responsibilities and ensure that communications are relevant, reliable, and timely. Institutionalizing identified best practices in writing may assist in consistent application and fully engaging functional communities outside of the financial management community in audit readiness efforts, as necessary.

Background: In its report, the panel recognized that the majority of transactions recorded in accounting systems are initiated by military commands, installations, and bases. Based on this, the panel stated that for DOD to achieve its FIAR objectives, internal controls over, and the accounting of, these transactions must be improved at these locations. Based on testimony from the Commander of the Naval Air Systems Command, the panel stated that the lessons learned at Naval Air Systems Command should be shared with other military commands and vice versa.

DOD Actions: In its May 2015 FIAR Plan Status Report, DOD officials stated that the military departments and defense agencies regularly share lessons learned within their organizations in various forums, such as newsletters, quarterly reviews, and stakeholder meetings. The FIAR Subcommittee, FIAR Committee, and FIAR Governance Board meetings are forums that are regularly used to share information external to an individual DOD component.

GAO Status: We believe DOD’s actions have met the requirements of the recommendation.

Background: The panel recognized that because DFAS’s activities are integral to the financial activities reported in the DOD components’ financial statements, weaknesses in internal control at DFAS must be addressed for DOD to achieve auditability. In its report, the panel referred to the FIAR Guidance, which states that service providers, such as DFAS, that work with user entities are responsible for audit readiness efforts surrounding service provider systems and data, processes and controls, and supporting documentation that have a direct effect on user entities’ auditability. Therefore, according to the panel’s report, it is critical that these organizations provide documentation demonstrating that controls are properly designed and operating effectively and transactions are properly posted to the accounting records. The panel stated that DFAS should undergo an audit of its major processes that materially affect its users. In addition, timelines for establishing effective controls should be reported in future FIAR Plan Status Reports for all major processes.

DOD Actions: DOD included service providers’ FIAR status and milestones in its FIAR Plan Status Reports beginning with the May 2012 report. In the May 2015 FIAR Plan Status Report, DOD officials stated that in addition to including service provider milestones in DOD reports, the Office of the Under Secretary of Defense (Comptroller) and DOD’s components monitor service providers’ milestones, progress, and challenges during service provider working group meetings, as well as during other FIAR oversight meetings, such as FIAR Committee meetings. DOD also stated, in the May 2015 FIAR Plan Status Report, that integrating the audit readiness activities of the service providers with their customers is complex and is one of the challenges the department faces to achieving audit readiness. One reason for this complexity is that the components rarely control transactions from initiation to reporting on the component financial statements. Moreover, the components do not own and operate all of the information systems used to process their transactions. One example provided by the department relates to processing and recording contract pay, for which the components depend on over a dozen systems that are owned and operated by service providers.

GAO Status: We consider this recommendation partially met because DOD needs to take additional actions to show the comparison of the service provider milestones with those of their customers so that the consistency of the milestones between service provider and customer can be seen. Currently, the FIAR Plan Status Reports show the service providers’ status and plans for achieving audit readiness and conducting SSAE No. 16 examinations by assessable unit. Ensuring that the component milestones and service provider milestones are consistent for each process included in the FIAR effort remains challenging.

Financial Management Workforce

Background: The panel reported that at the time of its review, DOD had not yet performed a complete department-wide systematic competency assessment that included an analysis of the financial management workforce abilities, knowledge bases, and skill sets needed now and in the future. DOD developed and issued its department-wide (enterprise- wide) financial management competencies for its civilian workforce in November 2011, immediately preceding the panel report’s issuance. In issuing these competencies, DOD officials stated that they identify the critical knowledge, skills, and abilities that DOD financial managers need to meet the (1) complex 21st century national security mission and (2) unique requirements of the department, including analysis and audit readiness.

DOD Actions: DOD has taken steps toward completing a department- wide systematic competency assessment of its financial management workforce. The department plans to do a review or “refresh” of its department-wide financial management competencies for its civilian workforce in fiscal year 2016. With regard to identifying the gaps between current requirements and the competencies of the existing workforce, DOD has used its Defense Competency Assessment Tool to assess competency gaps in its civilian financial management workforce for its four civilian mission-critical financial management occupations in 2014 and its nine civilian non-mission-critical financial management occupations in 2015. As stated in the May 2015 FIAR Plan Status Report, DOD plans to research the feasibility of assessing the civilian financial management workforce in other functional areas. The panel recommended that DOD’s competency assessments be performed for its federal civilian, military, and contracted personnel performing financial- related functions. With regard to military personnel in financial management occupations, DOD officials stated that its research showed that the military departments, through the normal annual military performance review process, have an effective means of assessing the competencies of members of the military workforce in their given functional specialties. Moreover, DOD officials stated that assessing the competency gaps of contracted staff performing financial management- related functions is outside the financial management community’s scope of responsibility because required competencies are to be defined in each contract’s statement of work. In addition, the appropriate contracting officer’s technical representative has the responsibility to perform due diligence over the contractor’s performance.

GAO Status: We consider this recommendation partially met because the department has not yet assessed the competencies of all civilian, military, and contracted personnel performing financial management- related functions, as recommended by the panel. Furthermore, the Functional Community Manager for Financial Management concluded that there is not a legislative requirement for a competency skills gap assessment for the military financial management workforce. DOD, however, is required by law to submit a biennial strategic workforce management plan to Congress, which includes, among other things, an assessment of the critical skills and competencies that will be needed in the future. According to the law, this plan shall specifically address the shaping and improvement of DOD’s financial management workforce, including military and civilian personnel. This includes an assessment of the critical skills and competencies for both the civilian and military financial management workforces. As stated above, DOD’s competency assessments have only addressed the civilian workforce in the financial management community. When DOD conducts its review of the department-wide civilian financial management workforce competencies in fiscal year 2016, the department will need to consider projected future requirements (competencies) for its civilian financial management workforce, as the panel recommended. After the department has identified the projected future requirements (competencies), DOD will be in a position to identify the gaps between the projected future requirements for its civilian financial management workforce and those possessed by its existing workforce.

Background: In testimony before the panel, DOD stated that the department uses contractors to fill skill sets missing from its existing workforce in certain areas, including audit readiness. Industry officials testified on the importance of hiring certified public accountants (CPA)— either directly or through contracts—with financial audit experience. According to expert testimony, although hiring CPAs is an important aspect of improving the human capital necessary to achieve audit readiness, not all CPAs have the requisite audit readiness expertise. For example, CPAs who specialize in areas such as tax, budgets, or information systems may not have developed the tools necessary to productively participate in improving audit readiness. CPAs who have federal financial statement audit experience are trained to apply the judgment required by generally accepted government auditing standards to determine the relevancy and sufficiency of controls and documentation necessary to successfully prepare DOD for a financial statement audit.

DOD Actions: According to DOD officials, DOD uses the expertise of CPAs both as employees and contractors. The FIAR Directorate, within the Office of the Under Secretary (Comptroller), maintains a contractor staff of CPAs with financial audit experience. Among other things, these CPAs provide consulting services, including determining how to implement best business practices that are used in the private sector. The military departments have also contracted with IPA firms. For example, officials stated that the Air Force has contracted a recognized accounting firm with both auditing and audit readiness experience as its advisory and assistance services contractors. According to Navy officials, the Navy perceives a continued need to leverage private sector expertise in future years to support its FIAR efforts and has developed a flexible acquisition strategy to facilitate this leveraging of expertise. According to Army officials, the Army recognizes the importance of a variety of skills that are critical to accomplish the needed changes associated with audit readiness, including individuals with knowledge of the Army, audit and systems experience, and with certifications such as CPAs, certified information systems auditors, and project management professionals. The Army has a mix of these skills on its civilian audit readiness staff and supplements this knowledge base with contractor staff. The service providers are also using the expertise of IPA firms. DFAS has employed multiple IPA firms to conduct its audit readiness efforts, including IPA firms to perform a mock military pay SSAE No. 16 examination as well as its first SSAE No. 16 examination. DLA is leveraging an IPA firm as audit readiness advisors, which supports its audit readiness efforts with CPAs as well as audit and advisory professionals experienced in financial statement audit and information technology audit.

GAO Status: We believe DOD’s actions have met the requirements of the recommendation.

Background: In its report, the panel recognized the importance of having personnel within DOD’s functional communities, other than financial management, with the skills to perform financial management-related tasks. According to the panel, functional communities, such as the logistics and acquisitions communities, generate and maintain financial information critical to reporting the financial results of DOD operations accurately and reliably. For example, logistics personnel are responsible for entering asset information into inventory records, conducting inventories, and performing reconciliations. Acquisition personnel enter obligations for contracts into the accounting system. The panel concluded that the department must ensure that these personnel receive financial management training as part of the department’s FIAR efforts.

DOD Actions: According to DOD Human Capital and Resource Management officials, FIAR courses are available online for members of all DOD functional communities, including members of the financial management community. Specifically, DOD officials stated that the department has developed over 50 web-based financial management courses, and these courses provide credit applicable to the department’s Financial Management Certification Program requirements at the various levels. While one learning platform is restricted to members of the financial management community, the web-based courses on another platform are open to both members of the financial management community and members of other functional communities. Course evaluations are required for each web-based course completed and these evaluations are reviewed monthly. According to DOD officials, course evaluation averages are analyzed and tracked and used to evaluate training effectiveness. DOD officials have stated that DOD has consistently maintained an average course evaluation metric of 4.12 on a 5.0 scale for these courses.

GAO Status: We believe DOD’s actions have met the requirements of the recommendation.

Background: In its report, the panel stated that implementing effective training programs will be especially important as DOD transitions to increased use of ERP systems. For example, the Army testified that its General Fund Enterprise Business System (GFEBS) requires personnel to obtain proficiencies in skills that are not required in the legacy operating environment and that many of the more than 70,000 eventual users of GFEBS will not reside in the Army’s financial management community. The Army added that the majority of users operate among the acquisition, logistics, public works, and property management functions. The Air Force testified that its financial managers are learning about new ERP systems, including what these systems are designed to do and how to work within them. The Air Force is experiencing a major cultural change for much of its workforce by moving from primarily a bookkeeping financial management system to ERP systems that can produce auditable financial statements. Officials added that the Air Force is working to get ahead of the ERP deployments and is retooling its workforce.

DOD Actions: In the May 2015 FIAR Plan Status Report, DOD stated that training exists for all current ERP systems. Officials added that these training programs are coordinated with each ERP system owner and the component’s financial management office. In addition, the military departments require users to complete training prior to obtaining access to the ERP systems. For example, for its Defense Enterprise Accounting and Management System (DEAMS), the Air Force has a library of online training courses that must be taken as part of the process to request access to DEAMS. In addition, the Air Force has included user job aids in DEAMS that provide video demonstrations of common system functions. According to an Air Force official, the lack of well-geared training was identified as an underlying cause for earlier issues that occurred during the DEAMS implementation process because users performing everyday business tasks with DEAMS did not have a clear understanding of how to use the ERP to perform these tasks. Army officials stated that while GFEBS was being deployed, its GFEBS training team provided on-site and classroom training for end users, and that over the years, improvements were made to the tools provided and the courses. For example, the new job aids were improved as well as the scenario-specific training, based on lessons learned and feedback from the end users and the help desk. For the Navy ERP, a Navy official stated that users must complete web-based training or instructor-led training prior to obtaining access to perform financial roles. The Navy, according to this official, has web-based training and detailed knowledge-sharing content available as part of the overall Navy ERP program, but not uploaded to the Navy ERP application itself.

The military departments measure the effectiveness of this training in several ways, including end-of-course surveys and analysis of help desk tickets, to identify any gaps in training that need to be addressed. For example, for GFEBS, the Army Financial Management School requires end users to complete end-of-course evaluations. Air Force officials provided an example in which lessons learned and feedback from users resulted in changes to one of its DEAMS courses. During the June 2014 deployment training cycle, end users noted that the DEAMS program needed to adjust its project billing user reimbursement course to more closely align it with the typical scenarios and data combinations experienced at most bases. According to Air Force officials, given this, the DEAMS training team coordinated with the subject matter experts to reevaluate, adjust, and update the project billing user reimbursement course material to better support those end users’ needs. According to a Navy official, Navy ERP training uses several sources of information to continually improve the effectiveness of the training material, including lessons learned from student course evaluations, feedback from the end user community on topics where additional training may be needed, and analyzing help desk tickets for indications of training gaps.

GAO Status: We believe DOD’s actions have met the requirements of the recommendation.

Background: DOD testified, before the panel, that it would like to implement a pilot program similar to the Information Technology Exchange Program. According to DOD officials, the National Defense Authorization Act (NDAA) for Fiscal Year 2010 authorized a pilot program for the temporary exchange of information technology personnel between DOD and the private sector. DOD officials asserted that a similar exchange program involving the FIAR Directorate would benefit the department’s FIAR Plan through the sharing of best practices, partnering to address common challenges, and enhancing competencies. In its report, the panel stated that it supports improving workforce competencies and therefore welcomes the sharing of greater detail on the proposed program with the committee.

DOD Actions: On April 1, 2014, DOD submitted a proposal for a pilot Financial Management Exchange Program between DOD and the private sector to both HASC and the Senate Armed Services Committee for their consideration. The pilot, proposed for inclusion, but not enacted as part of the Carl Levin and Howard P. “Buck” McKeon NDAA for Fiscal Year 2015, was modeled on section 1110 of the 2010 NDAA, authorizing a pilot program for the temporary exchange of personnel working in information technology. According to the proposal, a DOD employee would be eligible for the exchange program only if the employee (1) works in financial management, (2) is considered to be an exceptional employee, and (3) is compensated at least at the General Schedule 11 grade level (or equivalent). According to DOD officials, Senate Armed Services Committee members expressed their support for the program during an April 2014 DOD briefing on this topic. However, in the May 2015 FIAR Plan Status Report, DOD officials stated that the department has not yet received any formal comments from either HASC or the Senate Armed Services Committee on its proposal. The legislative proposal was included in the Senate version of the NDAA for Fiscal Year 2016. However, DOD officials said they were told in July 2015 that HASC will not be proceeding with this proposal.

GAO Status: We believe DOD’s actions have met the requirements of the recommendation.

ERP System Implementation Efforts

Background: In its report, the panel stated that ERP implementation is instrumental to resolving DOD’s financial management weaknesses and achieving audit readiness and included a table that showed, by military department, the ERP systems that are critical to Wave 2 and Wave 3. The panel noted that although information was provided for select ERP systems in the May 2011 FIAR Plan Status Report, full deployment dates were not included for certain ERP systems. For example, the panel noted that the Air Force did not provide a full deployment date for the Expeditionary Combat Support System (ECSS), which was needed for its SBR and mission-critical assets existence and completeness audit.

DOD Actions: According to the May 2015 FIAR Plan Status Report, DOD officials agreed with the panel that the FIAR Plan Status Reports should include more detail regarding the ERP programs to better evaluate progress toward auditability and timely implementation of corrective measures and increase confidence in the management of the department’s investments in ERP systems. Consequently, DOD has included separate sections with information on ERP systems and audit readiness, starting with the November 2012 FIAR Plan Status Report and through its November 2014 report. For its May 2015 FIAR Plan Status Report, the information on ERP systems and audit readiness was included in a section on the information technology systems critical to audit readiness. Additional information that has been provided in the FIAR Plan Status Reports includes (1) overview of the ERP systems, (2) program cost, (3) impact on legacy systems, (4) information technology controls, (5) implementation milestones and audit readiness information, (6) financial reporting impact, and (7) status of financial reporting objectives by assessable unit. While the department has considered including additional risk management and remediation action information in the FIAR Plan Status Reports, DOD officials have found that the most effective reporting of the specific risks and potential consequences of failure to meet ERP functionality requirements is achieved through the acquisition governance and oversight reporting. With regard to acquisition governance, the department is managing its business systems, including ERP systems, as portfolios of investments. The goal is to aggregate data from authoritative data sources and tools to track and manage the overall performance of systems portfolios, including ERP systems. For effective control, planning, mitigation, and remediation, the department manages risk as part of acquisition oversight for each of the ERP systems.

GAO Status: We consider this recommendation partially met because DOD still needs to include risks and potential consequences of failing to satisfy outstanding ERP functionality requirements or incurring future milestone delays and related mitigation measures in the FIAR Plan Status Reports. Moreover, the department still needs to provide information on actual schedule slippages, cost increases, or both. While the existence of these risks and the resulting effects on audit readiness may be known to DOD management, external readers of the FIAR Plan Status Reports, including those with oversight responsibility, do not have an accurate picture of how much DOD’s financial auditability efforts rely on ERP systems.

Background: The panel stated that it was concerned about reported ERP schedule delays and cost overruns because the ERP systems are critical to (1) resolving DOD’s financial management weaknesses and (2) achieving audit readiness.

DOD Actions: According to the military departments, their ERP program offices are integrating FIAR requirements and corresponding milestones into the ERP schedules through their normal process of requirements identification and technical solution development. According to the Director, Business Integration, Office of the Deputy Chief Financial Officer, the FIAR requirements are incorporated into the master set of functional needs, business operations, and technical requirements and appropriately integrated into the master program schedules in order to meet the overall program scope and function. Moreover, ERP program managers are accountable to their respective departments, services, and agency organizations, and as such, their performance is evaluated through the plans and performance objectives established within those operations and business functions.

In its May 2015 FIAR Plan Status Report, DOD officials stated that each ERP system program office is responsible for including all requirements, including FIAR requirements, in its program schedules for its ERP system. According to the report, the military departments have self- reported that they have included FIAR milestones and requirements in their schedules for those ERP systems still in the acquisition process, such as the Defense Agencies Initiative and the Air Force’s DEAMS.

ERP system programs that are in the development phases have been given the FIAR requirements to include in the program schedules.

In the May 2015 FIAR Plan Status Report, DOD officials added that the Office of the Under Secretary of Defense (Comptroller) has developed a methodology to include audit readiness in the Investment Decision Memorandum and the Acquisition Decision Memorandum. As stated in the report, during the Investment Decision Memorandum process, and for all systems that affect financial reporting, the Office of the Deputy Chief Financial Officer will provide input on each investment decision approval. The approval decision for each investment decision will depend on the DOD component’s demonstration that audit readiness and related compliance considerations have been included in the work products for each ERP. In addition, according to the report, Acquisition Decision Memorandums represent important checkpoints in the life cycles of DOD systems and are critical to ensuring that the expected outcomes are realized. Further, according to the report, for those systems that affect financial reporting, the Office of the Deputy Chief Financial Officer provides input for each acquisition decision approval at each business capability life cycle milestone.

GAO Status: DOD officials have stated that the department has taken actions to integrate FIAR milestones into ERP program schedules and hold program managers accountable throughout the life cycles of the ERP systems. However, we consider this recommendation partially met because, for ERP programs that are still in the development phases, each program office must still incorporate the provided FIAR requirements into its program schedule as recommended by the panel. Moreover, the ERP program managers still need to be continually evaluated on their ability to maintain FIAR milestones as well as program acquisition-related milestones as recommended by the panel. These two actions will need to continue until DOD has completed its FIAR Plan audit readiness activities.

Background: In its report, the panel expressed its concern about reported ERP schedule delays and cost overruns and questioned whether ERP schedule and cost estimates were reliable. The panel’s statements were partly based on our October 2010 report in which we stated that the department had identified nine ERP systems under development as critical to transforming the department’s business operations and addressing some of its long-standing weaknesses. The panel stated that our analysis of the schedules and cost estimates for four ERP programs—DEAMS, ECSS, GFEBS, and the Army’s Global Combat Support System (GCSS-Army)—found that none of the programs were fully following best practices for developing reliable schedules and cost estimates. More specifically, none of the programs had developed a fully integrated master schedule that reflected all activities, including both government and contractor activities. In addition, none of the programs established a valid critical path or conducted a schedule risk analysis.

DOD Actions: In the May 2015 FIAR Plan Status Report, DOD officials stated that the department agrees that better methods are needed for estimating ERP implementation costs and scheduling. However, DOD officials added that the department’s experience with these programs over the past 10 years, along with industry best practices, has helped shape the strategies that are now being used in the management and oversight of ERP implementations, including the following, among others: Increasing discipline in requirements management.

Reengineering business processes before focusing on solutions.

Reducing customizations to commercial software.

Sustaining leadership involvement throughout the life cycle.

Emphasizing organizational change management to ensure that end users understand the impact to their jobs.

Using end-to-end processes to better guide and constrain ERP development and interoperability.

Measuring business performance consistently to assess ERP impacts.

Incorporating portfolio management methods to make the right investment decisions.

GAO Status: We consider this recommendation partially met because, while DOD has taken actions to implement best practices in developing reliable schedule and cost estimates, issues remain and additional actions are needed to fully address the recommendation. In February and September 2014, we reported that DOD has not fully implemented best practices in its schedule and cost estimates for DEAMS and GCSS- Army, respectively. We found that the schedule for DEAMS did not meet best practices, although the cost estimate did meet best practices. We reported that the issues associated with the schedule could negatively affect the cost estimate. For example, if there are schedule slippages, the costs for the program could be greater than currently estimated. DOD officials concurred with our recommendation that DOD consider and make any necessary adjustments to the DEAMS cost estimate after addressing our prior recommendation to adopt scheduling best practices. In our review of the schedule and cost estimates for GCSS- Army, we reported that while the Army had made some improvements to the schedule and cost estimates that supported the full deployment decision, the Army did not fully meet best practices in developing cost and schedule estimates for GCSS-Army and we recommended corrective actions with which DOD concurred.

Background: The panel made this recommendation based on testimony that the issues surrounding changes to systems requirements are the cause of delays in ERP implementation. The panel noted in its report that the requirements process tends to be underinclusive or overinclusive. Including too many requirements can make ERP systems more complicated than needed; too few requirements may result in ERP systems that do not provide the needed functionality.

DOD Actions: In the May 2015 FIAR Plan Status Report, DOD officials stated that the department agrees that ERP requirements must be managed throughout ERP development, both within the program and through involved oversight. DOD officials added that each ERP program and the related “customer” DOD component has experienced project scope creep and user-specific requirements that have driven cost and schedule challenges. According to DOD officials, the lesson learned from these experiences has been to strengthen management discipline through change control boards and engaged knowledgeable senior- leader steering groups. In addition, the Milestone Decision Authority (MDA) monitors the programs at a macro level for cost, schedule, and performance and takes appropriate actions to address risks. The MDA can establish specific criteria in an Acquisition Decision Memorandum that an ERP program manager must meet before a program is authorized to proceed to the next phase of development or limited or full deployment. For example, the MDA signed two separate Acquisition Decision Memorandums on April 18, 2014, that (1) identified decision criteria that the Defense Agencies Initiative ERP must meet before moving forward with a limited deployment and (2) gave specific exit criteria for the Integrated Personnel and Pay System-Army Increment I program to meet before the Army can fully deploy it to all locations. DOD officials stated that each military department has change control boards and senior- leader steering groups to control requirements for ERP systems. The MDA can set specific criteria in an Acquisition Decision Memorandum that must be met by the ERP program manager before the decision is made authorizing a program to proceed to (1) the next phase of development, (2) limited fielding, or (3) full deployment.

GAO Status: This recommendation is applicable to DOD’s ongoing and future ERP program efforts, and we consider it partially met because DOD still needs to evaluate changes to ERP requirements as those systems are developed, implemented, and utilized, as the panel recommended.

Background: As for recommendation 4.4, the panel was concerned that the requirements process was either underinclusive or overinclusive. For example, the Army’s Chief Management Officer (CMO) stated that underinclusiveness contributed to delays in implementing GFEBS. Conversely, DOD’s DCMO stated that there is a tendency to overrequire, supported by an institutional mindset that there is only one opportunity to establish requirements for an ERP.

DOD Actions: According to its May 2015 FIAR Plan Status Report, DOD has evaluated and modified its requirement processes for defense business systems. DOD’s Business Capability Lifecycle, which requires disciplined delivery of capabilities to end users in 18 months, operates within DOD’s governance framework comprising the Investment Review Boards and Defense Business Systems Management Committee, which in turn advise the MDA for the ERP programs. Working through the Major Acquisition Information System MDA for systems, the Deputy Chief Financial Officer can ensure that requirements are being met. DOD officials added that the Office of the DCMO and the military CMOs will continue to assess current practices for governing requirements and implement needed changes.

GAO Status: We consider this recommendation partially met because, in accordance with the panel recommendation, DOD needs to continue to assess the requirement decision-making processes at every level of authority for its ongoing and future ERP implementation efforts.

Background: The panel was concerned that ERP systems may not provide the capabilities needed to achieve FIAR objectives. For example, we testified before the panel that some ERP systems do not function as intended. According to the panel’s report, if the ERP systems do not provide the intended capabilities, DOD components must continue to rely on legacy systems and manual processes. Therefore, DOD’s goals of modernizing and streamlining its business processes and strengthening its financial management capabilities—leading to financial statement auditability—could be jeopardized.

DOD Actions: According to its May 2015 FIAR Plan Status Report, DOD agrees with the panel that effective information technology acquisition requires thorough risk management, including the identification, analysis, and mitigation of risks. DOD officials stated in the report that its FIAR methodology identifies ERP systems and associated feeder systems that relate to achieving FIAR goals. Each military department has established a risk management approach in which major risks are tracked and mitigation plans are developed to identify measures for resolving weaknesses associated with the development, implementation, and use of its ERP systems that could affect the achievement of FIAR goals.

Each of the military departments reports on its respective ERP system program, for which it is responsible for resolving weaknesses, at the regularly scheduled FIAR review sessions. Officials from the military departments described the efforts to mitigate risks associated with ERP implementations. For example, Air Force officials stated that the risk management plan for DEAMS describes a comprehensive risk management process. According to Air Force officials, specific risks associated with FIAR compliance have been identified, are currently being assessed, and will be reported and tracked through the DEAMS risk management program.

According to Army officials, each Army ERP program has developed its own risk management procedure, based on existing Army regulations. In addition, each Army ERP program has developed documentation on applicable FIAR-related processes, risks, and controls to mitigate risks. The Army’s ERP program offices provide periodic acquisition and program reviews at the MDA level. These reviews include programmatic and audit-related risks associated with an ERP program as well as risk mitigation steps associated within the program. Army officials stated that additional requirements and actions are identified to mitigate risk if a risk is outside of the program’s direct control.

Navy officials stated that its Enterprise Business Solutions (formerly the Navy ERP Program Office) has a risk management program consisting of two components: (1) the Risk Committee, which allows any individual to bring a risk to program leadership’s attention, and (2) the Risk Board, which is the program’s senior leadership review and mitigation planning forum for identified risks.

GAO Status: DOD has developed risk mitigation plans for its ERP systems. However, we consider this recommendation partially met because DOD and its components need to continually monitor ERP and FIAR efforts to identify actual and potential weaknesses or deficiencies associated with developing, implementing, and using ERP systems that could affect the achievement of FIAR goals. Moreover, DOD components need to identify implementation steps and assign responsibilities for the performance of these steps to resolve the potential weaknesses or deficiencies, as the panel recommended. Further, time frames need to be established for taking these steps. The identification of any alternative arrangements needed outside of the ERP environment to meet FIAR objectives is critical to ensuring that a DOD component will be able to make these arrangements and not hinder DOD’s audit readiness goals.

Background: In its report, the panel stated that conversion of data from the legacy systems to the new ERP systems is a difficult and challenging effort. The panel noted that each military department had taken its own approach to data conversion and expressed its concern that poor execution of data conversion efforts could cause delays in implementing ERP systems.

DOD Actions: In its May 2015 FIAR Plan Status Report, DOD stated that the military departments have learned from past experience. For example, the Air Force, after its initial data conversion for DEAMS at Scott Air Force Base, decided not to convert legacy data into DEAMS, but instead to use a dual-processing approach. Under this approach, newly initiated transactions are entered into DEAMS, but transactions already initiated in legacy systems continue to be processed in the legacy system until contract closeout. The Director of Business Integration, Office of the Under Secretary of the Comptroller, stated that since 2012, when the panel issued its report, data conversions from legacy systems to ERP systems have become part of standard protocols performed between an individual ERP program office and the deploying DOD component or organization. Data conversions to ERP systems focus on open transactions only for the purposes of providing matching transactions when the disbursements and matching outlays occur. According to this official, since 2012, the data conversions for the Defense Agencies Initiative ERP and Navy ERP, for example, have gone smoothly. With regard to the panel’s recommendation that DOD assess the merits of designating a senior official responsibility for coordinating and overseeing data conversion, a DOD official stated that while the recommendation may have made sense in 2012, when the panel’s report was issued, it is no longer relevant given the quality of data conversions over the last 3 years and the standard protocols used for data conversions for each individual ERP deployment.

GAO Status: DOD has evaluated lessons learned from previous data conversion efforts and considered these lessons in its current data conversion efforts. However, we consider this recommendation partially met because the department will need to periodically update its data conversion plans. According to the panel, these updates will need to include assessments of (1) the progress made in converting data into the ERP environment, (2) whether that progress supports the satisfaction of existing requirements, and (3) whether additional data conversion requirements would facilitate achieving FIAR objectives.

Background: In its report, the panel stated that the DOD Deputy IG testified that the numerous interfaces between ERP systems and legacy systems may be overwhelming and may not be adequately defined. As stated in the panel’s report, the number of interfaces is driven by the number of legacy systems. The panel is concerned that problems associated with these interfaces could be compromising functionality. According to the panel report, DOD should make every effort to reduce reliance on those legacy system activities that can be effectively and efficiently conducted by ERP systems. The panel also stated that DOD should complete and validate its business process reengineering analysis to ensure that those business processes supported by the ERP systems will be as streamlined and efficient as practicable and that the need to tailor ERP systems to meet unique requirements or to incorporate unique interfaces has been eliminated or reduced to the extent practicable.

DOD Actions: According to DOD’s May 2015 FIAR Plan Status Report, the department is increasingly approaching investment decisions with a portfolio view to reduce or eliminate unique requirements and interfaces. As DOD also stated in that report, DOD has begun to implement process improvements across all systems by implementing key strategic initiatives, including its use of the global exchange to increase the interoperability and exchange of standardized data between systems. In its report, DOD also stated that there is a strategy to reduce the number of existing legacy systems over the next several years, which will lessen the need for a large number of interfaces. The military department CMOs and the DCMOs (for the other defense organizations) examine and validate the need for unique requirements and interfaces as they develop their respective organizational execution plans in preparation for review by the Defense Business Council.

GAO Status: We consider this recommendation partially met because DOD, through its business process reengineering, needs to ensure that unique requirements and interfaces are reduced to the minimum extent practicable. As the military departments and components proceed with FIAR activities related to ERP systems, the organizational execution plan reviews and other actions to implement these key strategic initiatives will be critical in identifying the causes of interface issues, determining how many and which interfaces can be reduced, and the improvements that can be made to support more effective interfaces. Furthermore, in implementing this recommendation, the department needs to ensure that its components are reengineering current business practices rather than customizing commercial ERP systems. For example, the DOD IG has reported that DOD has not reengineered its business processes to the extent necessary; instead, it has often customized commercial ERP systems to accommodate existing business processes. This customization creates a need for system interfaces and weakens controls built into an ERP. The ERP systems were designed to replace numerous subsidiary systems, reduce the number of interfaces, standardize data, eliminate redundant data entry, and provide an environment for end-to- end business processes, while being a foundation for sustainable audit readiness. However, the DOD IG stated that the numerous interfaces between the ERP systems and existing systems may be overwhelming and inadequately defined. Each interface presents a risk that a system might not function as designed, and each prevents the linking of all transactions in an end-to-end process.

Background: In its report, the panel stated that the FIAR Guidance calls for the DOD components to test information systems controls for key systems and processes. Because most financial information is maintained in computer systems, the controls over how those systems operate are integral to the reliability of financial data. For example, the panel noted that if auditors are able to rely on information system controls, the extent of substantive testing can be significantly reduced. According to the panel, DOD should continue to subject its systems, both legacy systems and ERP systems, to information systems controls testing, but it must also ensure that a priority is placed on this testing and that sufficient numbers of appropriately skilled personnel exist within the test and evaluation community. In addition, when implementing ERP systems, DOD should ensure that the systems satisfy the computer control objectives established in GAO’s Federal Information System Control Audit Manual.

DOD Actions: According to the May 2015 FIAR Plan Status Report, officials from the Office of the Director, Operational Test and Evaluation (OT&E), do not perform testing for all systems, but provide guidance to assist organizations in performing testing. Officials from OT&E stated that assessing information system control testing needs is difficult because of the different interpretations of information system controls. As a result of these inconsistencies, gaps exist in the types of testing that are actually accomplished. Nevertheless, OT&E officials stated that they are not specifically concerned with testing individual information systems controls, but rather that (1) a typical user can perform operational tasks with the production-representative system in an operationally realistic computing environment and (2) the system has the appropriate computer network defense capabilities.

According to OT&E officials, DOD’s components implementing ERP systems, including the military departments, are involved in the information systems control testing of their ERP systems by developing the test and evaluation master plans. According to these officials, these plans, provided by ERP program managers and approved by OT&E officials, specify appropriate testing for ERP systems. For example, Navy officials said that the Navy will coordinate with OT&E and others to ensure that the appropriate workforce and skill sets have been identified for evaluation and testing. OT&E officials stated that they anticipate the department’s increasing need to improve the cybersecurity of its ERP systems and other programs and networks will require increased test resources, especially for cyber ranges. According to these officials, there are three groups of organizations that play a critical role in the information systems control testing of ERP systems. 1. User/requirements communities. It is critical for the user/requirements communities to identify the specific ERP information systems control requirements beginning with the request for proposal. 2. Operational test agencies. These agencies are responsible for executing operational tests for each ERP. 3. ERP program managers. The program managers develop the test and evaluation master plans for approval from the Director, Operational Test and Evaluation.

GAO Status: We consider this recommendation partially met because OT&E officials, in consultation with the DCMO and components, will need to continue assessing their role in evaluating information system controls for all ERP systems being deployed by the department and examine necessary skill sets to accomplish such testing to determine if additional training is required within the developmental and operational test communities, as recommended by the panel. In addition, DOD has not yet ensured the testing of general and application controls for its ERP systems that are critical to DOD’s financial audit readiness efforts. As DOD stated in its May 2015 FIAR Plan Status Report, the department must evaluate and remediate controls for hundreds of information technology systems that materially affect the financial statements to achieve and sustain an audit ready systems environment. However, additional actions are needed because DOD’s approach for testing ERP systems may not result in the benefits of testing envisioned by the panel because the focus of DOD’s testing is based more on the operational capability of the systems and their security from attack than the specific application controls of the ERP systems. For example, the panel noted that if auditors are able to rely on information system controls, the extent of substantive testing can be significantly reduced. Under DOD’s broad approach, specific application controls for ERP systems that affect the information under audit may not be tested.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Michael S. LaForge (Assistant Director), Sandra S. Silzer (Auditor-in-Charge), and Laura S. Pacheco made key contributions to this report. Also contributing to this report were Doreen S. Eng, Francine M. DelVecchio, Maxine L. Hattery, and Jared D. Minsk.