The National Defense Authorization Act (NDAA) for Fiscal Year 2010 requires that DOD develop and maintain the FIAR Plan. The FIAR Plan must include specific actions to take and the costs associated with correcting the financial management deficiencies that impair DOD’s ability to prepare reliable and timely financial management information and ensure that its financial statements are validated as ready for audit by September 30, 2017. Further, the NDAA for Fiscal Year 2014 mandates an audit of DOD’s fiscal year 2018 department-wide financial statements and submission of those results to Congress by March 31, 2019. Since DOD management relies heavily on budget information for day-to-day management decisions, the DOD Comptroller designated the SBR as an audit priority. In response to difficulties encountered in preparing for an SBR audit, DOD reduced the scope of initial SBR audits beginning in fiscal year 2015 to focus on current-year budget activity reported on a Schedule of Budgetary Activity. This is an interim step toward achieving an audit of multiple-year budget activity required for an audit of the SBR. In the last quarter of fiscal year 2014, each military service, including the Navy, asserted audit readiness on its General Fund Schedule of Budgetary Activity. The fiscal year 2015 Schedule of Budgetary Activity reflects the balances and associated activity related only to budgetary authority on or after October 1, 2014. In December 2014, DOD contracted with an IPA, for the audit of the Navy’s fiscal year 2015 Schedule of Budgetary Activity. In February 2016, the IPA issued a disclaimer of opinion on the Navy’s Schedule of Budgetary Activity and identified pervasive control deficiencies in the Navy’s decentralized financial management and information technology environment. Navy management concurred with the findings in the IPA’s report and stated that it will develop and execute corrective actions to address the IPA’s recommendations, including those related to FBWT. In May 2010, the DOD Comptroller issued the FIAR Guidance to provide a standard methodology for DOD components to follow in developing an audit strategy and implementing FIPs. The FIAR Guidance defines DOD’s strategy, goals, roles and responsibilities, and procedures for the components to become audit ready. Specifically, the guidance provides a standard methodology that DOD components are required to follow in developing and implementing FIPs. These plans, in turn, provide a framework for planning, performing, documenting, and monitoring efforts to achieve auditability. To manage their improvement efforts, components may develop multiple FIPs, including plans related to specific assessable units, which can be information systems supporting financial statement line items or other discrete portions of the program. The FIAR Guidance describes the five audit readiness phases and activities that DOD reporting entities (including the Navy) should include in their FIPs. The five audit readiness phases are Discovery, Corrective Action, Assertion/Evaluation, Validation, and Audit. Each phase includes multiple tasks and activities that reporting entities should complete and the corresponding required deliverables. (App. II identifies the detailed FIAR tasks and required deliverables for each of these phases.) Most of the audit readiness process occurs in the Discovery and Corrective Action phases. In the Discovery phase, entities document their processes and identify, test, and assess their controls and evaluate and confirm the existence of documentation supporting relevant financial statement assertions. In the Corrective Action phase, entities develop and execute plans to address identified deficiencies and verify implementation of corrective actions. In the last three phases, a reporting entity (1) asserts its audit readiness, (2) has its assertion independently validated, and (3) employs an IPA firm to perform a financial audit. The Navy asserted audit readiness but did not complete the Corrective Action phase or validate the assertion because of time constraints and moved directly into an audit of its Schedule of Budgetary Activity by an IPA firm. The Navy’s FBWT FIP provides a framework for planning, executing, and tracking essential steps with supporting documentation to achieve audit readiness for its FBWT. Figure 1 shows important milestones and events in Navy’s FBWT FIP and overall audit readiness efforts. In April 2013, the Navy asserted that its FBWT process was audit ready. The scope of the Navy’s audit readiness assertion began with the feeder systems that provide collection and disbursement transactions and extended through posting these transactions to DFAS’s Defense Departmental Reporting System - Budgetary (DDRS-B). At the time of the Navy’s assertion in April 2013, the Navy reported that 21 of 33 key controls that it had identified for FBWT were operating effectively. The Navy further reported that it had developed corrective action plans for the remaining 12 controls and the corrective actions were under way. Subsequent to the Navy’s assertion, in May 2013, the DOD OIG initiated a review of the Navy’s FBWT assertion to determine audit readiness. Because of the significance of its findings, including that the Navy did not include in its assertion all significant systems affecting the FBWT line item, the DOD OIG did not complete its review. In August 2013, the DOD OIG provided the Navy with informal feedback, including areas for improving its FBWT audit readiness. In February 2014, in response to the DOD OIG’s feedback and to support the FBWT-related line items on its financial statements, the Navy expanded the scope of its FBWT audit readiness efforts to include all systems affecting the financial statement line items, including the Defense Departmental Reporting System - Audited Financial Statements (DDRS-AFS) system. Although the Navy expanded the scope of FBWT audit readiness efforts through financial statement compilation and reporting, it did not reassert FBWT audit readiness. In March 2014, the DOD OIG began another engagement, which involved a review of the Navy’s FBWT reconciliations. A DOD OIG official told us that this engagement did not include a review of the Navy’s FBWT assertion, but rather was to determine whether the Navy’s FBWT reconciliation was effective, supportable, and sustainable. In September 2014, DOD officials announced that all military services and many defense agencies had asserted General Fund Schedule of Budgetary Activity audit readiness. In December 2014, a contract was signed with an IPA to audit the Navy’s fiscal year 2015 General Fund Schedule of Budgetary Activity. For fiscal year 2015, the Navy’s Schedule of Budgetary Activity and FBWT were based on funding from 19 General Fund appropriation accounts. The IPA was to determine whether the Schedule of Budgetary Activity and related notes were fairly presented, in all material respects, in accordance with U.S. generally accepted accounting principles. In January 2015, after the Navy performed additional internal control testing, it reduced the total number of key internal controls for FBWT from 33 to 31. At that time, the Navy reported that 25 of the 31 controls were deemed to be operating effectively and that corrective actions were under way for the remaining 6 key controls. In April 2015, the DOD OIG issued a report on the process the Navy uses to reconcile its FBWT accounts. Reconciling FBWT activity records with the Department of the Treasury (Treasury) is similar to reconciling a checkbook to a bank statement. The Treasury Financial Manual requires agencies to reconcile their FBWT accounts to Treasury balances on a monthly basis. In its report, the DOD OIG noted several findings, including that the Navy (1) did not use general ledger data as source data for FBWT reporting, (2) had difficulty identifying the universe of transactions supporting the FBWT balance, and (3) may have used unreliable computer-processed data from two FBWT-related systems with reported significant deficiencies in internal controls. Further, in February 2016, the IPA issued a disclaimer of opinion on the Navy’s Schedule of Budgetary Activity and identified material weaknesses in internal control. One of the material weaknesses included controls over FBWT reporting and reconciliations, including the Navy’s related controls over its third-party service provider. As noted above, Navy management concurred with the findings in the IPA’s report and stated that it will develop and execute corrective actions to address the IPA’s recommendations. Going forward, DOD’s goals are to assert audit readiness for existence and completeness of its mission-critical assets by June 2016 and to assert full financial statement audit readiness by September 30, 2017. FBWT audit readiness is a step in achieving full financial statement audit readiness. Although the Navy included all the required audit tasks for the Discovery phase in developing its FBWT FIP, it did not fully implement certain required activities within these tasks in accordance with the applicable FIAR Guidance. These included activities in all four key tasks of the Discovery phase, which requires the Navy to (1) perform statement-to- process (process) analysis, (2) prioritize audit readiness efforts, (3) assess and test internal controls, and (4) evaluate supporting documentation. The purpose of these tasks is to improve financial information for Navy management and provide information to support the financial statement audit. Completion of these tasks remains important because FBWT collections and disbursements are integral to the Navy’s Schedule of Budgetary Activity, which is currently undergoing a second year audit for fiscal year 2016. Further, the FBWT line item is included on the Navy’s balance sheet, which is expected to be audited when the Navy undergoes the full financial statement audit planned for fiscal year 2018. The FIAR Guidance states that reporting entities are to perform a process analysis. We found that the Navy did not implement certain tasks for documenting the FBWT process, as required by the FIAR Guidance. The process analysis includes tracing from a summary amount, such as a line item on a financial statement, to underlying support, such as accounts in the general ledger, and support for those accounts, such as subledgers and transactions. One of the purposes of the process analysis is to provide information on the flow of data through the various systems to the financial statements. To develop the process analysis, reporting entities are to identify assessable units, business processes, systems, and other characteristics associated with amounts reported in financial statement line items. A process analysis describes the process, such as military pay, and includes a system analysis depicting asset or transaction classes, underlying processes, assessable units and subunits, and associated systems. The Navy prepared two process analyses for the FBWT assertion package, one in April 2013 and the second in February 2014, when it expanded the scope of its FBWT audit readiness efforts to include DDRS-AFS and the FBWT-related financial statement line items. The Navy’s April 2013 process analysis identified collections and disbursements as assessable units for the FBWT process and the Navy’s general ledgers as sub-assessable units. While both of these analyses identify the key systems involved in the FBWT process, neither fully documents the flow of data through the various systems to the financial statements. Although the Navy provided narratives that describe the FBWT systems, the narratives did not include certain significant events in the flow of collection and disbursement transactions from feeder systems into the financial statements. Among the events not included was the reversal of general ledger amounts and other entries. Navy officials told us that the narratives they provided in the FBWT assertion were based on the original April 2013 FBWT scope, that is, from feeder systems to DDRS- B. In February 2014, in response to DOD OIG concerns regarding the lack of agreement of FBWT financial statement amounts to the general ledger and supporting transactions, the Navy expanded the scope of the FBWT audit readiness efforts through the financial statement line item. Navy officials said that they did not apply FIAR methodology to any new items included in the expanded scope of the FBWT audit readiness efforts. Because of the limited time remaining until the audit of the fiscal year 2015 Schedule of Budgetary Activity, the Navy did not pursue an additional FBWT validation of assertion. In the Navy’s case, the process analysis is particularly important for understanding the FBWT financial reporting process because the Navy’s transactions do not follow the typical flow of data used to produce financial statements. Generally, the flow is from subsidiary ledger to general ledger to trial balance to financial statements. Without a complete FBWT process analysis and system narratives, internal controls and risks for each of the systems in the process may not be readily identified and appropriately tested. As shown in figure 2, the Navy’s FBWT financial reporting process is complex, incorporates multiple information systems, and is based on systems originally created for budgetary reporting and support of other business functions. Figure 2 and the related narrative provide an overview of the Navy’s FBWT data flow for financial reporting. A more detailed description of the Navy’s FBWT data flow is included in appendix III. The original systems include subsidiary ledgers (Program Budget Information System (PBIS) and Defense Cash Accountability System (DCAS)), a budgetary reporting system (DDRS-B), and its general ledger systems. These systems were modified over time to provide financial reports and data for financial statement compilation. Our analysis found that the Navy’s FBWT process relies on subsidiary ledgers PBIS and DCAS to distribute (allocate) the Navy’s funds to the general ledgers; distribute collection and disbursement transaction information to the forward summary data to the DFAS budgetary reporting system (DDRS-B) for inclusion in the DFAS audited financial statements system (DDRS-AFS), which ultimately creates the Navy’s consolidated financial statements. Another important activity in the process analysis is the quantitative drilldown, which provides the sources to support a summarized amount, such as a financial statement line item. The FIAR Guidance requires the preparation of a level I and level II quantitative drilldown depicting dollar activity or balances for each assessable unit. A level I quantitative drilldown provides the first level of data sources, the assessable units, that make up the summarized amount on a financial statement. A level II quantitative drilldown provides the sub-assessable units that make up the amounts in the level I quantitative drilldown. Navy officials told us that they did not prepare a level I quantitative drilldown for the Navy’s FBWT assessable units, showing how FBWT amounts are summarized for financial reporting, as they did not think this requirement was applicable for FBWT. The FIAR Directorate, in its review of the Navy’s FBWT assertion package, also determined that the quantitative drilldowns called for in the FIAR Guidance were not applicable. A FIAR Directorate official noted that the quantitative drilldown is intended to prioritize and disaggregate assessable units at the early stages of FIAR execution. A comprehensive reconciliation of the detailed transactions to the financial statements occurs later on. The FIAR Directorate official further noted that quantitative drilldowns by assessable unit were not necessary in this FIP because assessable units, such as military pay or contracts, are covered in other FIPs. Although the Navy and the FIAR Directorate said that a quantitative drilldown was not applicable, a level I quantitative drilldown for FBWT is critical for determining all the sources of transactions, including journal vouchers, comprising the population of transactions, as well as for prioritizing audit efforts. For example, system-generated entries and journal vouchers occur within DDRS-B. These journal vouchers are a source of activity affecting FBWT that according to FIAR Guidance, should be prioritized for testing. Without identification and an understanding of the entire population of transactions, including journal vouchers and other system- specific entries that a drilldown will help identify, Navy management and the auditor will not have information important for an understanding of the source of transactions, which is necessary to assess risk and determine the level of audit work necessary. Other audit readiness issues resulting from the Navy’s FBWT process are its reconciliations and transactions posted to suspense accounts. The Navy’s FBWT reconciliation process is both complex and time- consuming. The Navy has 19 general funds (appropriations) and a FBWT account for each general fund, each of which the Treasury Financial Manual requires to be reconciled monthly to Treasury accounts. The diverse nature of the numerous feeder systems provides a large volume of transactions, and the Navy’s complex FBWT process complicates the reconciliation process. The Navy’s reconciliation process is further described in appendix IV. Suspense accounts have been a long-standing problem at DOD. For example, in fiscal year 2003, Congress authorized DOD to write off long-standing debit and credit transactions reported in suspense accounts. DOD subsequently reported that it wrote off transactions with an absolute value of $35 billion. In April 2014, we reported that DOD had recorded billions of dollars of disbursement and collection transactions in suspense accounts over the years because the proper appropriation accounts could not be identified and charged, generally because of coding errors. More recently, in March 2015, the DOD OIG withdrew its opinion on the USMC fiscal year 2012 Schedule of Budgetary Activity because of suspense accounts held at Treasury that contained USMC transactions that had not been posted to valid appropriations. Appendix V provides more information on the issues and extent to which DOD and the Navy use suspense accounts. The Navy did not prioritize certain FBWT audit readiness efforts required by the FIAR Guidance to provide reasonable assurance that its audit readiness efforts were adequate. Because assessable units provide the focus for financial improvement efforts, FIAR Guidance requires the prioritization of audit readiness efforts, including ranking assessable units in order of quantitative materiality and developing qualitative factors affecting audit readiness. The FIAR Guidance also requires documenting the audit readiness strategy. However, the Navy did not prioritize its FBWT audit readiness efforts, quantitatively or qualitatively, or fully implement its audit readiness prioritization and strategy for key information systems prior to assertion. Without prioritization, the Navy cannot reasonably assure that it will first address the highest-risk areas within the FBWT process and information technology. Navy officials told us that they did not produce a prioritization and audit strategy document because they considered FBWT systems complete, as they each contained 100 percent of the transactions. DOD’s FIAR Directorate reviewed the Navy’s FBWT assertion documentation and agreed with Navy officials, indicating that the “comprehensive nature of the FBWT FIP assertion” (1) did not lend itself to prioritization within the SBR assessable unit or audit segment and (2) did not require any follow- up prior to examination. However, certain activity is unique to each system, including system-generated entries, adjustments to reconcile to Treasury, and consolidation and elimination entries. As previously noted, a level I quantitative drilldown is critical for audit readiness and would show how each FBWT system is unique and the extent of system-specific activity, and would allow each FBWT system to be prioritized for audit purposes and assessed for risk. The FIAR Guidance states that agencies should rank each assessable unit in terms of risk and in order of quantitative materiality, with largest dollar activity being the highest priority. Further, in connection with performing a financial statement audit, government auditing standards state that the auditor gains an understanding of the operating environment and assesses key controls over information systems. While the same or similar transactions flow through each of the Navy’s FBWT systems, each system also includes unique activity. For example, DDRS-B includes system-generated entries that are not in the lower-level system of DCAS. In addition, qualitative factors, such as system ownership, can affect risk to varying degrees. By assigning the same priority to all of the FBWT systems, without regard to quantitative and qualitative factors and their effects on risk, the Navy cannot reasonably assure that it initiates audit readiness efforts and corrective actions for the higher-risk systems first. For an audit readiness plan for key information technology systems, the Navy provided a schedule that identified 22 relevant systems, 16 of which the Navy deemed key FBWT systems. For these 16 systems, the Navy noted that to assess audit readiness, 11 systems would receive self- assessments, 4 systems would receive independent assessments, and for 1 system the assessment type had not yet been determined. However, the Navy indicated that only 6 of the self-assessments and all 4 of the independent assessments were completed. For the remaining 6 key FBWT systems, the Navy did not provide planned start dates or expected completion dates or indicate when it would obtain audit readiness assurance for these systems. Navy officials thought the systems inventory schedule provided with the assertion package met the FIAR requirement for prioritization of systems. However, in our view, the Navy’s schedule did not meet the FIAR Guidance requirement to prepare an assessable unit strategy document listing all assessable units prioritized by quantitative rank and adjusted for significant qualitative factors and scoping out legacy systems and processes that will not be part of the audit-ready environment. The Navy’s lack of prioritization of key information technology systems used in the FBWT process limits management’s ability to focus audit readiness efforts on the most important systems. Further, such a prioritization would also provide information to auditors on the effectiveness of controls for these systems. Further, we noted that independent reports and reviews of key FBWT systems identified serious internal control deficiencies with reporting (DDRS-B), accounting (DCAS), and budgetary systems (PBIS). Statement on Standards for Attestation Engagement No 16 reports on controls for a service organization incorporating DDRS-B included an adverse opinion for the period March 1 to November 30, 2014, and a qualified opinion for the period December 1, 2014, to July 31, 2015, due primarily to ineffective controls. The reviews of DCAS and PBIS identified significant deficiencies in internal controls. Without effective controls over key systems involved in the FBWT process, management may not have reasonable assurance that this financial statement line item is audit ready. The Navy did not fully implement certain FBWT internal control and assessment activities required by the FIAR Guidance. Specifically, the Navy did not document information technology general computer controls for significant systems or the hardware and software interfaces as required by the FIAR Guidance. In addition, as previously noted, the Navy did not sufficiently complete FIAR-required data flowcharts and system narratives. This includes an understanding of how data are processed and transferred in the various systems and how they interact with other data sources through the FBWT process to the financial statements. An important activity required in the key FIAR task of assessing and testing controls is the preparation of systems documentation to include or describe system narratives and flowcharts; risk assessments and internal control worksheets documenting its financial statement assertion risks; control activities and information technology general computer controls for significant systems, applications, or microapplications; system certifications or accreditations; system, end user, and systems documentation locations; and hardware, software, and interfaces. While the Navy prepared system narratives, flowcharts, financial reporting objectives, and control activities and included them in the FBWT assertion package, it did not prepare documentation of general computer controls for significant systems; system certifications or accreditations; system, end user, and systems documentation locations; or a description of hardware, software, and interfaces as required by the FIAR Guidance. Also, the system narratives and flowcharts the Navy provided did not sufficiently disclose the flow of data. This includes the Navy’s collection and disbursement activity through the financial statement line items, including FBWT on the balance sheet and outlays on the SBR. For example, as previously noted, the narratives did not include discussion of the reversal of general ledger transactions or other entries within DDRS-B. Navy officials told us that some of the missing systems documentation items might have been included in another audit segment or assertion package. However, the Navy did not provide evidence to support that claim, and no reference to another assertion package was made in the FBWT assertion package. According to the FIAR Guidance, documentation of performance of the required procedures for each FIP task must be completed and included in each applicable assertion package. Once the scope of the FBWT FIP was expanded to include all systems through the financial statement line item, FBWT audit readiness officials did not ensure that all required audit readiness procedures within the expanded scope were performed and the documentation supporting the procedures was available for auditors. Complete and accurate system narratives and flowcharts, and documentation of general computer controls, help to provide management and the auditor with information on the systems environment and data flow, which they use to prioritize audit efforts. Further, in preparing its April 2013 internal control assessment, the Navy identified key internal controls in the FBWT process, but it did not identify those controls by assessable unit as required by FIAR Guidance. The FIAR Guidance for this task requires (1) preparing an internal control assessment document for entity-level controls and for each assessable unit and (2) summarizing control activities that are appropriately designed and in place. Navy officials told us that several years ago they assembled a matrix of controls to be assessed. They organized the controls by the FBWT area that the controls supported or by control owner, and they thought that this met the FIAR Guidance requirement. Some of the internal controls the Navy identified and tested may be related to an assessable unit. However, the Navy did not identify controls for each assessable unit. Identifying controls by assessable unit is important for determining whether assessable units, sub-assessable units, and associated systems are producing reliable information and helps link systems and controls to the transaction flows. As a result, the Navy is missing an opportunity to identify and correct control deficiencies for the key systems that could affect its FBWT audit readiness. For example, DCAS is the primary subledger used to process the universe of collection and disbursement transactions for FBWT. Although the Navy did identify some controls involving DCAS, it did not identify internal controls by system or assessable unit. Therefore, the Navy does not have assurance that DCAS is operating as intended and that output from the system is reliable. The Navy’s substantive testing for key supporting documents may not provide sufficient evidence that its efforts to produce supporting documentation are sustainable for future audits. FIAR-required activities for this task include preparation of the transaction population, reviews of unusual or invalid transactions, and identification of key supporting documents. The FIAR Guidance also requires developing a test plan, selecting random samples from the population of transactions, and testing individual transactions and balances to confirm the existence and evaluate the quality of supporting documentation for relevant financial statement assertions. An evaluation of key supporting documentation is important for determining whether the Navy would be able to support amounts presented in the financial statements and provide an external auditor with sufficient and appropriate evidence to perform the audit. In the first round of substantive testing, the Navy identified significant deficiencies that resulted in the test failing. The Navy then performed another round of substantive testing, which, although it passed, may not provide sufficient evidence of the Navy’s ability to produce needed documentation in a sustained manner for future audits. In the second round of testing, the Navy completed 13 procedures, 3 of which involved statistical sampling while the other 10 relied on analytic or non-random sampling procedures. In both rounds of testing, documentation was limited to a 3-month period, which, even if successful, may not provide sufficient evidence of the consistent availability of supporting documentation for a 12-month period, or the ability to timely produce needed documentation over a sustained period. Because the Navy performed two rounds of substantive tests, Navy officials considered this FIAR task implemented. Further, Navy officials told us that after they asserted audit readiness, they anticipated that they would be under audit by an IPA soon thereafter, so time constraints did not permit further testing. However, lack of supporting documentation has historically been an issue on DOD audits. This was also the case in the audit of the Navy’s fiscal year 2015 Schedule of Budgetary Activity, in which the IPA disclaimed an opinion, in part, because the Navy could not provide sufficient, appropriate audit evidence to support transactions. Without performing adequate substantive testing, the Navy does not have reasonable assurance of the availability of key documentation to support amounts presented in the financial statements. Further, none of the procedures tested the supporting documentation for supplemental quarterly reconciliations. Supplemental quarterly reconciliations provide a secondary check on the accuracy of monthly reconciliations and on other monitoring procedures. Both monthly and quarterly reconciliations are key internal controls for FBWT and testing for these reconciliations provide reasonable assurance that supporting documentation is maintained and available for financial statement audits. In addition, the Navy did not perform reviews to identify unusual, invalid, or missing data as required by the FIAR Guidance. Specifically, the FIAR Guidance requires such reviews on the universe of transactions to identify and address (1) unusual or invalid transactions and (2) abnormal balances or missing data fields. Navy officials stated that these FIAR Guidance tasks were not performed because they thought these tasks would be performed in another FIP. However, we were not provided with evidence that such tasks were included in another FIP and no reference to another FIP was made in the FBWT assertion package. FIAR Guidance requires that documentation of performance of the required procedures for each FIP task be completed and included in each applicable assertion package. Without this testing, there is increased risk that errors may not be detected. The Navy has made progress in performing its key audit readiness activities, including the development of its FBWT FIP to help guide implementation of its General Fund SBR improvement efforts. However, the Navy did not fully complete certain tasks in accordance with the FIAR Guidance prior to asserting audit readiness for FBWT, a significant account for the Navy’s as well as DOD’s department-wide SBR auditability. FIAR Guidance Discovery phase tasks that the Navy did not fully complete include the FBWT process analysis, system narratives, quantitative and qualitative drilldowns, prioritization of audit readiness efforts, and documentation of general computer controls. In addition, although the Navy performed substantive tests for supporting documentation, such testing may not provide sufficient evidence of the Navy’s ability to produce needed documentation in a sustained manner for future audits. For the most part, the Navy did not complete these tasks because Navy officials believed that their efforts had satisfied the FIAR Guidance requirement, that certain tasks did not apply to the FBWT effort, or that time constraints prevented completion of the tasks. However, it is critical that FBWT tasks are adequately evaluated and documented. Although required audit readiness procedures for FBWT were not fully completed, the Navy decided to go forward with an audit of its Schedule of Budgetary Activity. The IPA’s fiscal year 2015 audit resulted in a disclaimer of opinion and the reporting of material weaknesses in internal control and related recommendations, including several recommendations pertaining to FBWT. Recommendations made in this report are in addition to the recommendations made in the IPA’s audit report. Successful completion of the FIAR Discovery phase tasks for FBWT may identify additional deficiencies that affect the auditability of the Navy’s financial statements. By not fully identifying and remediating its deficiencies specific to the FBWT effort, the Navy’s ability to achieve audit readiness and remediate internal control weaknesses is hindered. Resolution of these deficiencies is crucial to the Navy’s and DOD’s efforts to meet the September 30, 2017, statutory target date for validating audit readiness of DOD’s full financial statements. To improve the Navy’s implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, we recommend that the Secretary of the Navy direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to take the following seven actions in the Discovery phase. Update FBWT data flowcharts and narratives to fully describe the flow of data from the Navy’s receipt of collection and disbursement transaction information through the financial statement line items, including the reversal of general ledger trial balance data generated by the automated system and other entries made within DDRS-B. Prepare a level I quantitative drilldown in accordance with the FIAR Guidance. To prioritize audit readiness efforts for the key FBWT systems, prepare an audit strategy that identifies for each system (1) the Navy’s plan for assessing the system to gain assurance that the system can be relied on; (2) the assessment types, including prioritizing the assessments based on qualitative and quantitative factors for each system; and (3) planned start and completion dates of these assessments for each system. Prepare, in accordance with FIAR Guidance, the documentation of control activities and information technology general computer controls for significant systems; system certifications or accreditations; system, end user, and systems documentation locations; and hardware, software, and interfaces. Prepare an internal control assessment document for each assessable unit, summarizing control activities that are appropriately designed and in place. Perform sufficient testing for supporting documentation to reasonably determine whether such documentation, including that for key reconciliations, is available in a sustainable manner for future audit efforts. For each fiscal year expected to be under audit, identify and address unusual and invalid transactions, abnormal balances, and missing data fields in the universe of collection and disbursement transactions. We provided a draft of this report to the Navy for review and comment. In its written comments, reprinted in appendix VI, the Navy concurred with our seven recommendations. In response to our recommendations, the Navy stated that it has actions planned, taken, or under way to (1) develop procedures and documentation that describe the processes associated with the flow of data; (2) prepare a quantitative drilldown; (3) prioritize audit readiness efforts for key FBWT systems; (4) document control activities, information technology general computer controls for significant systems, systems documentation locations, and hardware, software, and interfaces; (5) prepare an internal control assessment document; (6) test effectiveness of FBWT controls, which includes assessing the availability of supporting documentation; and (7) obtain monthly data from DFAS on invalid FBWT transactions. The Navy also provided technical comments, which we have incorporated as appropriate. We are sending copies of this report to the Secretary of Defense; the Deputy Chief Management Officer; the Under Secretary of Defense (Comptroller/Chief Financial Officer); the Deputy Chief Financial Officer; the Director, Financial Improvement and Audit Readiness; the Secretary of the Navy; the Assistant Secretary of the Navy; the Chief Management Officer of the Navy; the Directors of the Defense Finance and Accounting Service and Defense Finance and Accounting Service, Cleveland; the Director of the Office of Management and Budget; and interested congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix VII. The objective of our review was to determine the extent to which the Navy developed and implemented the Discovery phase for its General Funds’ Fund Balance with Treasury (FBWT) financial improvement plan (FIP) in accordance with the Financial Improvement and Audit Readiness (FIAR) Guidance. This objective was applied to FBWT for three of the Navy’s general ledgers—the Standard Accounting and Reporting System – Field Level, the Standard Accounting and Reporting System – Headquarter Claimant Module, and the Navy Enterprise Resource Planning. We excluded from our review the Navy’s fourth general ledger, Navy Systems Management Activity, because of its classified activity. To address our objective, we analyzed the Navy’s FBWT FIP to determine whether it contained the applicable elements and tasks to be performed for the Discovery phase of audit readiness as required by the FIAR Guidance. We identified and reviewed the Navy’s FBWT FIP key deliverables required by the FIAR Guidance, such as system narratives and flowcharts, internal control assessments, and the Navy’s test results. We performed a site visit to the Defense Finance and Accounting Service (DFAS), Cleveland, and walked through the FBWT process, reconciliations, and related systems. We interviewed Navy, DFAS, and FIAR Directorate officials within Department of Defense’s (DOD) Office of the Under Secretary of Defense (Comptroller) to obtain explanations and clarifications on documentation we reviewed. In addition, we reviewed the results of DOD’s Office of Inspector General audits as well as independent public accountant examinations of audit readiness efforts related to the Navy’s FBWT. We conducted this performance audit from April 2014 to August 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. Table 1 presents the reporting entity methodology in the Financial Improvement and Audit Readiness Guidance, which the Navy is required to follow in implementing its Fund Balance with Treasury financial improvement plan. The Navy’s Fund Balance with Treasury (FBWT) financial reporting process incorporates multiple information systems and is based on systems originally created for budgetary reporting and support of other business functions. The original systems include transaction-processing budget and reporting systems and its general ledger systems. These systems were modified over time to also provide financial reports and data for financial statement compilation. As a result, as shown in figure 2, the flow of the Navy’s transactional data does not follow the typical flow of data from subsidiary ledger to general ledger to trial balance to financial statements. The FBWT process relies on subsidiary ledgers to distribute and record the Navy’s funds and to record collection and disbursement transaction information to the general ledgers. Data are forwarded from subsidiary ledgers to the budgetary reporting system for inclusion in the financial statement system, which ultimately creates the Navy’s consolidated financial statements. This process results in some transactions flowing to the financial statements that are not posted in any of the general ledgers. This bypass of the general ledgers for financial statement preparation represents a significant audit challenge because the general ledgers do not agree with the Navy’s financial statements for FBWT. General ledgers are typically an entity’s primary system of record, where all transactions are recorded and from which financial statements are prepared. In an audit, for supporting FBWT financial statement line item amounts, it is essential that the Navy reconcile any differences between the financial statements and the general ledgers, and between the general ledgers and underlying transactions, to assure that all transactions in the financial statements are recorded in the general ledgers. Specifically: According to the Navy, the Defense Cash Accountability System (DCAS) contains the universe of collection and disbursement transactions, except for timing difference transactions. The Navy’s FBWT process begins when collection and disbursement transaction information from the Navy’s multiple disbursement feeder systems is posted to DCAS. When DCAS edit checks identify a transaction with missing or incorrect account coding information, the transaction is not distributed to the general ledgers and remains in DCAS as an “undistributed” transaction until it can be investigated and the necessary information obtained. DCAS distributes all other transactions to one of the Navy’s general ledgers. Each month, DCAS transmits summary collection and disbursement information, including undistributed transactions, to the Defense Departmental Reporting System - Budgetary (DDRS-B). DCAS is also used for the Navy’s fund balance reconciliation process with the Department of the Treasury’s (Treasury) Central Accounting Reporting System (CARS). DDRS-B has historically been used as a budgetary reporting tool for numerous Navy commands and Navy headquarters, but it has also been adapted for financial reporting. It receives budgetary information from the Program Budgetary Information System and proprietary information from DCAS. DDRS-B also receives summary information from the general ledgers. To avoid duplication of transactions, system-generated journal entries are made within DDRS-B that are intended to reverse the general ledger transactions, which were also posted by DCAS. The general ledger is typically the system of record for an entity’s financial reporting. However, since DCAS is considered to contain the universe of the Navy’s collection and disbursement transactions, DCAS transactions—not the summary transaction information from the general ledgers—flow through DDRS-B to the financial statements. Also, within DDRS-B, journal entries (forced- balance entries) are prepared and posted to temporarily make the balances in the Navy’s FBWT equal to the balances in Treasury’s CARS, until such differences can be reconciled as required by the Treasury Financial Manual. Navy officials said that forced-balance journal entries are eventually reconciled to transaction detail and are reversed in the following period; they are not posted to the Navy’s general ledgers. As a result, the Navy’s general ledger balances do not directly agree with the Navy’s financial statements. The Defense Departmental Reporting System - Audited Financial Statements (DDRS-AFS) receives an adjusted trial balance from DDRS-B. Consolidation and elimination entries are posted in DDRS- AFS to produce the Navy’s financial statements. For the Navy, net expenditure amounts on the Schedule of Budgetary Activity and financial statements are supported by DDRS-AFS, then DDRS-B, then DCAS, and then numerous feeder systems, while the general ledgers are omitted from this drilldown process. Journal entries posted in DDRS-B and undistributed transactions in DCAS are not posted in the Navy’s general ledgers, but are reflected in financial statement FBWT line item balances. The Navy’s Fund Balance with Treasury (FBWT) reconciliation process requires investigating thousands of undistributed transactions. The Navy has 19 general funds (appropriations) and a FBWT account for each general fund, which the Treasury Financial Manual requires to be reconciled monthly to Department of the Treasury (Treasury) accounts. The diverse nature of the numerous feeder systems providing the transaction information also complicates the FBWT reconciliation process. The Navy receives transaction information from both centralized and decentralized disbursement feeder systems, including the Centralized Automated Disbursing System, Intra-Governmental Payment and Collections, Mechanization of Contract Administrative Services, and other component reporting through the Defense Finance and Accounting Service (DFAS) Disbursing Station Symbol Numbers (DSSN) by Navy Shore DSSNs and Navy Ship DSSNs. The complexity of the overall financial reporting process leads to difficulties in the FBWT reconciliation process. With multiple systems used in the process and the Navy’s unique process flow, additional reconciliations are required. Consequently, each month the Navy completes four reconciliations for each of its 19 general funds. Each quarter, the Navy prepares reconciliations for each of the 19 general funds as well as consolidating schedules and reconciliations between financial systems. As of March 2015, it was taking the Navy from 2 to 3 months from the end of each fiscal quarter to complete its FBWT reconciliations. In the first quarter of fiscal year 2015, DFAS processed, through the Defense Cash Accounting System (DCAS), an average of 1.6 million nonpayroll Navy transactions per month. Of those transactions processed, an average of about 22,000 per month required intervention by DFAS and Navy FBWT reconciliation staff for them to be posted appropriately to a general ledger account. A transaction registered in the Navy’s DCAS and not distributed to one of the Navy’s general ledgers is a variance that requires human investigation and adjustment so it can be distributed and posted in one of the Navy’s general ledgers. Two types of variances are a recurring part of the Navy’s FBWT reconciliation process: (1) forced balance entries, which are necessary to agree the Navy’s balances with Treasury’s balances until timing difference transactions can be resolved, and (2) undistributed transactions, which come from feeder systems and contain insufficient or incorrect coding. Reconciling forced balance entries and investigating undistributed transactions contribute to the labor and time required to reconcile the Navy’s FBWT. Figure 3 shows the reconciliation of Navy Treasury accounts to the Navy’s general ledger for each of the quarters for fiscal year 2014 and the variance at the end of each quarter. As noted in figure 3, at the end of fiscal year 2014, the total of net forced balance entries and net undistributed transactions was $777 million, (1.0 percent of the Navy’s total net expenditures for the year). In fiscal year 2003, Congress authorized the Department of Defense (DOD) to write off long-standing debit and credit transactions that occurred before March 31, 2001, and could not be cleared from the department’s books because DOD lacked the supporting documentation necessary to record the transactions to the correct appropriations. DOD subsequently reported that it wrote off an absolute value of $35 billion, or a net value of $629 million, of suspense account amounts and check payment differences using this authority. Congress required GAO to review and report on DOD’s use of this write- off authority. DOD reported that as of December 31, 2004, after the write-off of $35 billion, it still had more than $1.3 billion (absolute value) of suspense amounts that were not cleared for more than 60 days, and DOD acknowledged that its suspense reports were incomplete and inaccurate. Our June 2005 audit report concluded that without compliance with existing laws and enforcement of its own guidance for reconciling, reporting, and resolving amounts in suspense and check differences on a regular basis, the buildup of current balances would likely continue, the department’s appropriation accounts would likely remain unreliable, and another costly write-off process could eventually be required. In April 2014, we reported that DOD had recorded billions of dollars of disbursement and collection transactions in suspense accounts because the proper appropriation accounts could not be identified and charged, generally because of coding errors. (Table 2 shows a comparison of the Navy’s suspense account balances compared to total DOD suspense account balances based on data in our April 2014 report.) In a letter dated March 23, 2015, the DOD Office of Inspector General (DOD OIG) withdrew its opinion on the U.S. Marine Corps’ (USMC) fiscal year 2012 Schedule of Budgetary Activity because of suspense accounts held by the Department of the Treasury (Treasury) that contained USMC transactions that had not been posted to valid appropriations. Because these suspense accounts contained unrecorded transactions from all DOD components, the DOD OIG was unable to quantify the number and dollar amount of USMC transactions that resided in the accounts and whether those transactions were material to the fiscal year 2012 USMC Schedule of Budgetary Activity. In addition to the variances identified in the Navy’s reconciliation process presented in figure 3, figure 4 identifies other transactions posted to Navy general ledger suspense accounts and other fund suspense account transactions not yet identified as belonging to Navy. In addition to the undistributed transactions and forced-balance amounts shown in figure 3, the Navy has two types of suspense accounts: General ledger suspense accounts represent unmatched transactions for expenditures and collections. These transactions are distributed from the Defense Cash Accounting System and are recorded in a general ledger against valid fund accounts but lack sufficient information to match them with another data element, such as an obligation. Fund suspense accounts represent temporary holding accounts used to record unidentifiable general, revolving, special, or trust fund expenditures or collections that are not included in the Navy’s general ledgers. Fund suspense accounts can also include deposit accounts used to record money that the federal government owes to others, including state and local income taxes, security deposits, civilian pay allotments, foreign taxes, and estates of deceased service members. Balances in Navy suspense accounts totaled $191 million as of September 30, 2014, and represented only 0.3 percent of the Navy’s total net expenditures. The balances reported are net, meaning increases and decreases are added together, and do not reflect the gross amount in suspense accounts or the age of individual transactions. In addition to the contact named above, the following individuals made key contributions to this report: Francine DelVecchio, Doreen Eng, Maxine Hattery, Jason Kelly, Richard Kusman, Roger Stoltz (Assistant Director), and Chevalier Strong.

Summary: The National Defense Authorization Act for Fiscal Year 2014 mandates an audit of DOD's fiscal year 2018 department-wide financial statements. To help achieve this, the DOD Comptroller issued the FIAR Guidance to provide a standard methodology for DOD components to follow to improve financial management and achieve audit readiness, and designated the SBR as an audit priority. Full implementation of the Navy's General Fund FIP for FBWT is essential to achieving audit readiness for its General Fund SBR. The Navy asserted Statement of Budgetary Activity (SBA) audit readiness as of September 30, 2014, and in February 2016 received a disclaimer of opinion on the audit of its SBA for fiscal year 2015. GAO is mandated to audit the U.S. government's consolidated financial statements, which cover activities and balances of executive branch agencies, including DOD. GAO's objective in this report was to determine the extent to which the Navy developed and implemented the Discovery phase of its General Fund FBWT FIP in accordance with the FIAR Guidance. GAO analyzed the Navy's FBWT FIP to determine whether it contained the tasks and activities required by the FIAR Guidance for the Discovery phase. GAO also reviewed the Navy's FBWT FIP key deliverables, such as process narratives and flowcharts, internal control assessments, and test results. The Navy has made progress in performing audit readiness activities, including developing a financial improvement plan (FIP) for its Fund Balance with Treasury (FBWT). These activities are critical to the Navy's General Fund Statement of Budgetary Resources (SBR) improvement efforts. The Navy's FBWT FIP is particularly important as it addresses improvement efforts across multiple business processes, including contract and vendor payments and military and civilian payroll that provide significant input to the SBR. However, the Navy did not fully implement certain tasks in its FBWT FIP in accordance with the Department of Defense's (DOD) Financial Improvement and Audit Readiness (FIAR) Guidance. These included activities in all four key tasks of the Discovery phase, the first of the five FIAR guidance phases. In the Discovery phase, the reporting entity documents processes, prioritizes audit readiness efforts, assesses and tests controls, and evaluates supporting documentation. Document processes. The Navy did not fully document its FBWT process in system narratives and flowcharts. For example, the Navy's analysis did not explain the complex process that occurs within the Defense Departmental Reporting System - B, including merging data and deleting duplicative transactions. In the Navy's case, the process analysis is particularly important because the Navy's transactions do not follow the typical flow of data used to produce financial statements. Without a complete FBWT process analysis and system narratives, internal controls and risks for each of the systems in the process may not be readily identified and appropriately tested. Prioritize audit readiness efforts. The Navy did not prioritize FBWT audit readiness efforts or fully implement its audit readiness prioritization and strategy for key information systems prior to its assertion of audit readiness. The Navy's lack of prioritization of key information technology limits management's ability to focus audit readiness efforts on the systems with the highest risk. Assess and test internal controls. Within the FBWT assertion package, the Navy did not document information technology general computer controls for significant systems or the hardware and software interfaces, as required. Also, the Navy did not identify internal controls by assessable units (e.g., information systems supporting financial statement line items or other discrete portions of the program). Identifying controls by assessable unit is important for determining whether assessable units, sub-assessable units, and associated systems are producing reliable information and helps link systems and controls to the transaction flows. Evaluate supporting documentation. Although the Navy performed substantive tests for supporting documents, such testing may not provide sufficient evidence of the Navy's ability to produce documentation in a substantive manner for future audits. An evaluation of key supporting documentation is important for determining whether the Navy would be able to support amounts presented in the financial statements or provide an external auditor with sufficient and appropriate evidence to perform the audit. Addressing these shortfalls is critical to achieving audit readiness. GAO recommended that the Navy fully implement the FIAR Guidance for FBWT in the areas of process analysis, prioritization, internal control assessment and testing, and evaluation of supporting documentation to support audit readiness. The Navy concurred with all seven recommendations.