In May 2010, the DOD Comptroller issued the FIAR Guidance to provide a standard methodology for DOD components to follow in developing an audit strategy and implementing FIPs. The FIAR Guidance was most recently updated in November 2013 and describes the following five audit readiness phases and activities that DOD reporting entities (including the Army) are to include in their FIPs. Discovery Phase: Entities document their processes and identify, test, and assess their controls and evaluate and confirm the existence of documentation supporting relevant financial statement assertions. Corrective Action Phase: Entities develop and execute plans to address identified deficiencies and verify implementation of corrective actions. Assertion/Evaluation Phase: The FIAR Directorate reviews assertions by entity management that assessable units are audit ready. An IPA or the DOD Office of Inspector General (OIG) examines readiness, and entity management addresses any reported deficiencies. Validation Phase: The FIAR Directorate validates audit readiness based on its assessment of the IPA examination report and documentation supporting successful remediation of auditor-identified deficiencies. Audit Phase: An IPA or the DOD OIG performs an audit of the financial statements or specified elements of them and issues an opinion on whether they are fairly presented in accordance with generally accepted accounting principles. Appendix II provides more specific information on the phases, tasks, and deliverables that the FIAR Guidance requires reporting entities to include in their FIPs. In response to component difficulties in preparing for a full SBR audit, the November 2012 FIAR Plan Status Report and the March 2013 FIAR Guidance included a revision to narrow the scope of initial audits to only current year budget activity and expenditures on a Schedule of Budgetary Activity (SBA). Under this approach, beginning in fiscal year 2015, reporting entities are to undergo an examination of their SBAs by an IPA or the DOD OIG reflecting the balances and associated activity related only to funding approved on or after October 1, 2014. As a result, SBAs will exclude unobligated and unexpended amounts carried over from prior years’ funding as well as information on the status and use of such funding in subsequent years (e.g., obligations incurred and outlays). These amounts will remain unaudited. Over the ensuing years, as the unaudited portion of SBR balances and activity related to this funding decline, the audited portion is expected to increase. The NDAA for Fiscal Year 2010, as amended by the NDAA for Fiscal Year 2013, requires that the FIAR Plan describe specific actions to be taken and the costs associated with ensuring that DOD’s SBR is validated as ready for audit by not later than September 30, 2014. Further, the FIAR Plan Status Report is required to include a determination by the Chief Management Officer of each military department concerning its ability to achieve an auditable SBR by September 30, 2014, and if the department is unable to meet this deadline, an explanation as to why it is unable to meet the deadline as well as an alternative deadline and a description of the plan for achieving an auditable SBR by the alternative deadline. In addition, all material amounts reported on the SBR will need to be auditable in order to achieve the mandated goal of full financial statement audit readiness by September 30, 2017. The Army prepared its audit readiness strategy to provide a high-level overview for Army leaders and stakeholders to understand the Army’s approach for achieving audit readiness in accordance with the FIAR Guidance. In connection with this strategy, the Army’s approach for achieving General Fund SBR audit readiness includes four separate FIPs developed to guide improvement efforts in the following areas: (1) budget execution, (2) military pay, (3) financial reporting, and (4) FBWT. The Army also relies on service providers to ensure the audit readiness of service provider systems and business processes that support services In addition, as provided to the Army and affect its General Fund SBR.shown in figure 1, establishing the Army’s audit-ready systems environment is integral to the Army’s audit readiness strategy, including implementation of the General Fund Enterprise Business System (GFEBS) and other key enterprise resource planning (ERP) systems. GFEBS is absorbing more than 100 legacy accounting and other systems to standardize business processes and provide more accurate data on funds availability and execution. According to Army sources, GFEBS is one of the world’s largest ERP systems, supporting approximately 1 million transactions each day and over 53,000 users at over 200 locations in 71 countries in fiscal year 2013. Also, according to Army sources, obligations incurred associated with contracts, civilian pay, and other business activities that were processed in GFEBS represented about 52 percent of total obligations incurred reported in the Army’s General Fund SBR for fiscal year 2013. Based on efforts to record military pay expenditure and accounting data in GFEBS beginning in fiscal year 2014, Army officials stated that GFEBS is expected to be the primary system for processing Army obligations incurred for fiscal year 2014. The Army reported that it completed Discovery Phase audit readiness efforts for all four of its General Fund SBR FIPs, including the FIP for budget execution, in March 2013 and expects to complete the Corrective Action and Assertion/Evaluation Phases by June 2014 and September 2014, respectively. The Army’s FIP for budget execution, the focus of this report, is particularly important as it addresses improvement efforts involving significant budgetary resources and financial activity reported in its General Fund SBR across multiple business processes. Further, this FIP focuses on the development of GFEBS-based audit-ready processes, including those that affect obligations incurred reported in the Army’s General Fund SBR, and emphasizes incremental “waves” of audit readiness assertions and IPA examinations to assess progress of Army locations and business processes operating in the GFEBS environment. Originally, the Army planned four waves, but in fiscal year 2012 it compressed its assertions to three waves to meet the DOD time frame and NDAA mandate for achieving audit readiness. The activity and timing of these waves are as follows. Wave 1. In June 2011, the Army asserted audit readiness at 3 of 227 locations with five business processes.examination in November 2011 and reported that the Army did not effectively design test plans for evaluating the operating effectiveness of key controls for several processes. The IPA also reported that the An IPA completed an Army did not (1) properly identify all key control objectives and activities and risks of misstatement related to its processes or consider the control environment as a whole and (2) properly identify the financial statement risks related to key control activities and objectives within its processes. Wave 2. In June 2012, the Army asserted audit readiness at 10 of 227 with eight locations (3 Wave 1 locations and 7 additional locations)business processes. An IPA completed an examination in April 2013 and reported several inadequacies in the Army’s Wave 2 readiness assertion, as discussed later in our report. Wave 3. In June 2013, the Army asserted audit readiness for eight GFEBS processes and activities at remaining locations. An IPA is to complete an examination by May 2014. Full General Fund SBA. The Army is to assert audit readiness for all current year activity and funding by June 2014. To help prioritize and guide its efforts, the Army developed its FIP for budget execution emphasizing the implementation of effective GFEBS processes for achieving SBR audit readiness. However, the Army did not fully complete key tasks to help ensure that its FIP adequately considered the scope of efforts required to achieve audit readiness and addressed significant qualitative risks or other factors affecting its efforts, as required by FIAR Guidance. For example, the Army’s analysis identifying Army and service provider business processes and systems supporting its General Fund SBR FIP for budget execution was incomplete. In accordance with the March 2013 FIAR Guidance, the Army limited the scope of its efforts to focus on achieving SBA audit readiness by September 30, 2014. Therefore, the Army excluded measures to ensure the readiness of beginning balances associated with funding received in, and carried forward from, prior years and activity processed in certain legacy systems. While achieving SBA audit readiness can provide a meaningful indicator of progress, the amounts excluded are material to the Army’s SBR and may continue to represent material portions of future SBRs. Further, the Army had not performed an assessment to adequately demonstrate the expected magnitude of these amounts in future years and address risks associated with them as required. As a result, the Army lacks important assurance that it will achieve audit readiness goals as planned. Also, the Army did not address whether it will meet the September 30, 2014, deadline for an auditable SBR in its determination of audit readiness included in DOD’s November 2013 FIAR Plan Status Report and did not clearly indicate an alternative date for achieving full SBR audit readiness, as required by the NDAA for Fiscal Year 2013. Per the FIAR Guidance, Discovery Phase Task 1 (statement to process analysis) requires reporting entities to identify the assessable units, business processes, systems, and other characteristics associated with amounts reported in each financial statement line item. Also, because of the significant reliance placed on service providers, the FIAR Guidance also requires reporting entities to (1) coordinate with them to ensure that the statement to process analysis identifies significant assessable units associated with service provider processes and systems supporting each line item and (2) formalize and document their relationship with the service providers in a memorandum of understanding (MOU). Completing these tasks is essential for understanding the relative importance and multifaceted nature of audit readiness efforts and for developing an effective strategy. However, we found that the Army had not effectively completed these tasks as discussed below. Statement to process analysis. For this task, the Army prepared a General Fund SBR statement to process analysis supporting its FIP for budget execution Wave 2 readiness assertion, which identified the portions of obligations-incurred activity processed in GFEBS that were attributable to key assessable units, such as civilian pay, contracts, and supplies. However, this analysis did not show the linkage of key SBR financial statement line items to all significant assessable units and therefore was incomplete. Specifically, the Army’s analysis focused only on obligations-incurred activity processed in GFEBS, which, as of September 30, 2013, represented about 52 percent, or $119 billion, of total reported General Fund obligations, as shown in figure 2. Assessable units and related amounts associated with remaining obligations incurred activity processed in non-GFEBS systems, totaling $109 billion for fiscal year 2013, were not included in the Army’s analysis. Further, other SBR activity attributable to service provider business processes and systems was also excluded. According to Army officials, they excluded these amounts because of the Army’s expectation that (1) service providers will ensure the readiness of their systems and processes and (2) the Army’s reliance on certain legacy systems will decline significantly in connection with its further implementation of GFEBS. In addition, unobligated and unpaid obligated amounts carried forward from prior years—or beginning balances—were excluded from its analysis, which, according to Army officials, was consistent with the March 2013 FIAR Guidance revision to narrow the focus of initial audits to SBAs. Further, Army officials indicated that devoting significant resources to ensure the readiness of these legacy systems and beginning balances was not cost effective, and accordingly, they excluded efforts to ensure their auditability from the scope of the Army’s readiness strategy. The Army’s consideration of the cost-effectiveness of its readiness efforts is important. However, its exclusion of these amounts and processes did not eliminate the FIAR Guidance requirements to identify all assessable units with processes that result in transactions and balances—including beginning balances—material to the SBR and to consider the risks associated with them in developing its audit readiness strategy. In addition, documentation provided by FIAR Directorate officials supporting the rationale for revising the FIAR Guidance concerning beginning balances specifies that the revision was not intended to affect Discovery Phase requirements. Further, the FIAR Guidance also requires reporting entities to identify processes and systems supporting existing “as-is” environments, in addition to planned “to-be” environments associated with implementing new financial systems. This requirement also recognizes the complexities and challenges associated with implementing large-scale financial systems, such as GFEBS, and the importance of identifying and addressing risks associated with legacy systems and related business processes. Addressing such risks is to be performed during Discovery Phase Task 2 and is essential for developing a cost-effective readiness strategy. Service provider assessable units and MOU. The Army’s analysis did not identify activity attributable to assessable units associated with service provider business processes and systems, as required by the FIAR Guidance, despite the significant impact they have on the Army’s SBR and its reliance on them to help achieve readiness. Also, the Army had not established an MOU with its service providers to formally document a shared understanding of roles and responsibilities affecting audit readiness efforts as required by the FIAR Guidance. For example, an MOU would include roles and responsibilities for the authorization, initiation, processing, recording, and reporting of transactions affected by the service provider, including requirements for the retention of supporting documents. Army officials stated they had established a Mission Work Agreement with DFAS, a document that defines the terms of work, describing various types of services DFAS provides to the Army, including those associated with financial reporting, civilian and military pay, contract pay, and other processes. However, it does not contain the level of detail needed in an MOU to help ensure coordination, performance, and accountability of the parties, such as a clear linkage between the services described and specific control activities DFAS is required to perform that affect the Army’s financial reporting objectives. According to Army officials, efforts to coordinate with service providers to obtain sufficient information on their business processes and systems and establish MOUs has been challenging as relationships and audit readiness interdependencies with the service providers are very complex. They also indicated that the FIAR Directorate has been taking a lead role in coordinating efforts of service providers to help facilitate the development of MOUs but that time frames for finalizing them had not been determined. Until the relationships between the Army and its service providers are identified and documented in sufficient detail, the Army remains at risk of important tasks necessary to ensure audit readiness not being identified or completed as intended. Per the FIAR Guidance, Task 2 of the Discovery Phase (prioritizing readiness efforts) requires reporting entities to rank all assessable units based on materiality and to identify and document qualitative risks and other factors associated with each of those identified. Also, this task requires reporting entities to identify and document entity-level controls, including assessments of internal and external risks that may affect their readiness efforts and serve as the basis for their FIPs. The Army developed its FIP for budget execution to help guide its General Fund SBR audit readiness activities and focus efforts on implementing GFEBS- based audit-ready processes. However, for this task, we found that the Army did not identify and document its consideration of several significant qualitative risks and other factors in developing its General Fund FIP for budget execution. Documentation demonstrating the Army’s identification and evaluation of these risks is essential to help ensure that incremental SBA and full SBR audit readiness goals will be achieved. Additional details concerning these risks are highlighted below. Reliance on service providers. The Army relies heavily on service providers, such as DFAS, to process accounting and payment transactions as well as ensure the effectiveness of the controls and information systems they use in providing support to the Army. Accordingly, the FIAR Guidance requires service providers to ensure the readiness of their systems and business processes that have a material impact on reporting entity SBRs. However, as previously discussed, the Army’s efforts to better understand and document complex relationships and audit readiness interdependencies with service providers have not been completed, hampering its ability to obtain sufficient information concerning risks associated with their activities. Further, the Army’s ability to rely on service providers remains unclear since, as discussed later in this report, IPA or DOD OIG assessments of the audit readiness of service provider systems and processes have not been completed. As a result, the Army is at increased risk that it may not meet its audit readiness goals. Limitations in scope of audit readiness efforts. As previously discussed, the Army’s strategy did not include efforts to ensure the audit readiness of (1) SBR beginning balances and (2) certain legacy systems and business processes the Army relies on to support significant portions of its SBR. Risks associated with these scope limitations, if not properly addressed, could adversely affect the Army’s ability to achieve audit readiness goals as highlighted below. Beginning balances. The Army reported beginning balances (as of October 1, 2012) of $44.3 billion and $138.7 billion for unobligated and unpaid obligated balances, respectively, on its General Fund SBR for fiscal year 2013, representing amounts associated with prior year funding brought forward from fiscal year 2012. While the FIAR Guidance provides for limiting the focus of initial audits to current year budget activity and expenditures contained in SBAs, it does not eliminate the requirement to identify and assess risks associated with these beginning balances for achieving full SBR auditability. Accordingly, assessing the extent to which amounts associated with prior year funding may affect efforts to achieve this goal is essential. Also, apart from the FIAR requirements, the Army continues to be responsible for the accuracy of reported balances relating to current and prior year budget activity in order to comply with appropriations law, and to accurately report them by appropriation for inclusion in the President’s annual budget request. Recognizing the need to ensure the accuracy of information contained in agency budget requests, agencies are also required to include information in their audited financial statements showing material differences between key amounts contained in their SBRs and related amounts contained in the President’s Budget. However, the Army’s most recent financial statements for fiscal years 2013 and 2012 remain unaudited and, importantly, do not provide information regarding material differences, if any, between comparable amounts reported in its SBR and the President’s Budget. As a result, the extent to which the Army can provide needed assurance regarding the accuracy of reported balances and activity related to prior budget years contained in the President’s Budget is limited. Despite these requirements, Army officials told us that the Army had not identified risks associated with beginning balances reported on its SBR or assessed how and when efforts to prepare auditable SBAs would result in full SBR audit readiness. Specifically, at the time of our review, the Army had not determined how achieving audit readiness would be affected by expenditures or other activity associated with beginning balances that are expected to occur in future years. The Army has various appropriated funds that are available for obligation for 1, 2, 3, and 5 fiscal years. After these periods of availability expire, the accounts remain open for 5 additional fiscal years to adjust or liquidate obligations before the accounts are closed and any remaining balances are canceled. For example, the fiscal year 2012 ending balances included five 3-year procurement appropriation accounts containing $12.3 billion that had not been obligated for payment, and $39.2 billion that the Army had obligated to pay but had not yet disbursed. The Army will potentially be required to account for these procurement appropriations into fiscal year 2019, beyond the current audit readiness plan as well as the September 30, 2017, deadline for achieving auditability of its full SBR and other financial statements for fiscal year 2018. Additional analysis documenting and supporting the Army’s expectations concerning the extent to which future SBRs may include significant activity and balances associated with these multiyear appropriation funds would assist in assessing risks that could impede audit readiness. Legacy systems. According to the FIAR Guidance, reporting entities involved in system transformation initiatives are required to assess the target dates of their to-be environments against their audit-ready assertion dates to determine whether existing systems, to-be systems, or both should be included in their current readiness efforts. In this regard, based on transformation efforts associated with implementing GFEBS and other key ERP systems intended to replace certain existing legacy systems, the Army excluded tasks to ensure the readiness of these legacy systems and related business processes from the scope of its readiness efforts. The Army expects the appropriation accounts that would continue to generate transaction data from such systems to be expended or expired and thus amounts would become immaterial over time. However, officials told us that they were uncertain as to how continued reliance on these systems may affect initial audits. For example, officials told us that a timeline for transitioning funding for classified and other associated activity from legacy systems to a GFEBS-based environment has not been determined. Until this transition occurs, ongoing activity accounted for in legacy systems could have a major impact on the Army’s SBAs and SBR. Also, processing billions of dollars in unobligated balances and unpaid obligations in the Army’s five procurement appropriation accounts that are accounted for in legacy systems as previously discussed could take several years. Therefore, this ongoing activity will likely affect initial examinations of incremental SBAs currently expected to begin with fiscal year 2015 as well as full SBRs to be examined in subsequent years. Army officials acknowledged these risks and that the Army had not documented its assessment of them. Despite the uncertainty associated with how these risks may affect the auditability of the Army’s incremental SBAs and full SBRs, according to Army officials, the scope of their efforts and plans for adhering to established audit readiness assertion and examination milestones have remained unchanged. However, without sufficient documentation identifying these risks and assessing their potential impact on producing auditable SBAs and full SBRs within established time frames, the Army is unable to provide needed assurance that its strategy will achieve audit readiness or when it will be achieved. Further, as discussed earlier, the NDAA for Fiscal Year 2013 requires that DOD’s FIAR Plan Status Reports include the Army’s determination on whether it will achieve an auditable SBR by September 30, 2014. Recognizing the potential impact of audit readiness challenges, the NDAA also requires that the FIAR Plan Status Report include an alternative date for achieving SBR audit readiness if the Army determines that it is unable to meet this deadline. However, the Army’s determination, as presented in the November 2013 FIAR Plan Status Report, did not meet these requirements. Specifically, while the Army’s determination stated that it would achieve SBA audit readiness by September 30, 2014, it did not address whether full SBR auditability would be achieved by that date or, if not, clearly indicate an alternative deadline for doing so. For those budget execution audit readiness activities the Army determined to be within the scope of its FIP for budget execution, the Army has made progress toward implementing the first three phases of Discovery, Corrective Action, and Assertion/Evaluation. For example, the Army identified selected control activities and conducted monthly tests to assess their effectiveness, developed tools to assist commands in assessing controls and remediating deficiencies, and outlined efforts to address IPA-reported deficiencies related to its Wave 2 audit readiness assertion. However, we found that it did not always follow the FIAR Guidance in performing tasks required for these phases. For example, we found that the Army’s documentation and assessment of internal controls were not always complete or accurate and that extensive deficiencies had not been remediated prior to an IPA firm’s examination of its audit readiness efforts. The Army plans to address remaining tasks required for the Validation and Audit Phases after June 2014. As a result of the Army’s decision to limit the scope of its FIP for budget execution, remaining Discovery Phase efforts largely focused on establishing an audit-ready GFEBS environment. In connection with these efforts, the Army prepared narratives, flowcharts, and risk assessments documenting manual and GFEBS automated control activities and financial reporting objectives as well as an inventory of key supporting documents associated with various SBR-related business processes. The Army also prepared a reconciliation of GFEBS activity to help identify the population of transactions to be used for assessing controls and summarized its evaluation of controls in its annual statement of assurance on internal controls over financial reporting and financial systems. However, as discussed below, based on our review of efforts as the Army was completing its Discovery Phase activities in June 2013, it had not completed or effectively implemented Discovery Phase Task 3 (document processes and assess/test controls) and Task 4 (evaluate supporting documentation) as required by the FIAR Guidance. Without effective implementation of the Discovery Phase of the FIAR Guidance for its budget execution FIP, the Army is at increased risk that problems that could hinder audit readiness efforts will not be identified and controls for ensuring reliable financial reporting will not be effectively tested, assessed, or documented. Further, without adequate, reliable information on the effectiveness of controls, including those at the command level and those associated with its information technology systems, the Army is at increased risk of not fully addressing deficiencies that may significantly affect its ability to achieve its audit readiness goals. With regard to Task 3 of the Discovery Phase on documenting processes and related control assessments and testing, we found the following. Documentation of the linkage of certain financial reporting objectives to related control activities was incomplete.requires reporting entities to evaluate control activities to determine if they have been designed to meet financial reporting objectives. However, the Army’s listing of controls used to demonstrate this linkage did not identify controls to address 13 of 84 financial reporting objectives, which could lead to weaknesses in financial reporting. For example, the listing did not identify specific control activities to ensure that obligations relate to valid appropriations and do not include any The FIAR Guidance expired, canceled, or rescinded amounts.the missing linkages we identified and discussions with officials, the Army did not sufficiently monitor the preparation of the listing to ensure its completeness. Effective monitoring controls to detect or prevent such omissions are essential as the lack of complete, accurate information on the control activities the Army relies on to achieve its financial reporting objectives could impede future efforts to audit its financial statements. Based on our review of Documentation of the criteria and processes used for identifying key information technology systems was incomplete. Specifically, the FIAR Guidance required the Army to identify key systems and feeder systems affecting audit readiness assertions and to consider various types of systems, such as general ledger systems, source/feeder systems, disbursing systems, reporting systems, and property management systems, as well as system interfaces. According to documentation provided by Army officials, the Army identified 16 of 66 systems as key systems affecting SBR audit readiness. This included GFEBS and other systems used to process detailed transactions and provide accounting data to be recorded in GFEBS, such as the Army’s key military pay system. Army officials told us that its determination that a system was key was based on the number and value of transactions initiated or processed by the system and by other factors, such as whether the system would be replaced. While its assessments were discussed in various meetings with FIAR Directorate and DFAS officials, the Army did not document the specific criteria and assessment process used to support its determination. Without adequate documentation to support the identification of key systems, the Army could not provide assurance that all key systems had been identified and that they were included in its audit readiness efforts. According to the FIAR Guidance, the Army is required to assess the effectiveness of its internal controls. Further, the Army has determined that individual commands are responsible for the implementation of controls within their command. Therefore, the effectiveness of controls Army-wide depends largely on efforts to ensure that they are operating effectively at each command. However, Army officials told us that assessments of the effectiveness of controls at specific commands were not always reliable. The results of assessments performed by commands in 2012 using a checklist indicated that 64 percent of controls assessed were operating effectively. However, Army officials stated that the checklist was to help commands understand their roles and responsibilities, and acknowledged that the Army could not rely on self-reporting by commands as a useful measure of audit readiness. While a checklist can provide guidance and assist in identifying weaknesses, officials at the commands we visited told us that users may not be sufficiently knowledgeable to accurately complete it. Also, officials at all three commands we visited told us that their ability to review and assess the effectiveness of controls has been hampered by a lack of funding and staffing. For example, an official in the organization responsible for reviewing control assessments at one command told us that its ability to perform this function was limited because of a 34 percent vacancy rate in staffing. In addition, this official told us that internal control assessments prepared at the specific garrison level within a command were not always reliable. Officials attributed this, in part, to those preparing them not having appropriate skills or not performing sufficient testing to adequately assess whether controls were operating effectively. Command officials also explained that much of the information they have on control assessments relates to results associated with the Army’s centralized testing of the operating effectiveness of manual controls. In connection with this testing, the Army established a failure rate of 5 percent or less as its goal for assessing the effectiveness of controls. Results of this testing on the number of commands tested through May 2013, when the Army was completing its Discovery Phase efforts, indicated failure rates that averaged 56 percent, as shown in figure 3. Army officials attributed the November 2012 drop in failure rates to 28 percent, in part, to the experience gained by the use of GFEBS by the four commands that were tested that month. As indicated in figure 3, beginning in January 2013, Army greatly expanded its testing to include all remaining installations migrating to GFEBS. With the substantial increase in new users, test results indicated failure rates for January and February 2013 of 46 percent and 64 percent, respectively. Also, the Army found that all the controls tested for February and March 2013 (14 and 15 controls, respectively) were operating ineffectively. As installations become more experienced with GFEBS, the Army expects the failure rate to decrease. However, the methodology for the Army’s centralized testing was designed to produce reliable results Army-wide, and as command officials pointed out, it was not designed to produce reliable assessments of controls at the specific command level. Further, these officials highlighted how Army-wide assessments can vary significantly from more detailed assessments performed at the command level. For example, controls tested for 6 of 15 Army Reserve Command sample items associated with two business processes (i.e., temporary duty travel and supply) were found to be ineffective during the Army’s February 2013 centralized testing process, equating to a 40 percent failure rate. Army Reserve Command conducted its own tests using a larger sample of 412 items across eight business processes that resulted in a much higher (77 percent) failure rate. Command officials described plans for performing additional assessments to better understand the effectiveness of their controls; however, they acknowledged that insufficient information on the effectiveness of controls has hampered their ability to develop and execute appropriate corrective actions to address control deficiencies. The FIAR Guidance requires reporting entities to document their understanding of business processes, systems, and related control activities with narratives, flowcharts, risk assessments, and internal control worksheets. However, documentation describing Army SBR- related processes and systems was incomplete. The documentation did not address complete end-to-end processes, including those related to legacy systems and service provider activities and feeder systems, thus limiting the Army’s ability to perform complete control assessments. Service providers are responsible for the systems they operate and processes they perform on behalf of reporting entities, and tasks for preparing process and system narratives and assessing controls associated with four service providers are included in the Army’s FIP for budget execution. However, we found that the Army had not completed these tasks and, as a result, did not have sufficient information to effectively assess how service provider- related activities may affect its ability to achieve SBR audit readiness. Army officials told us that except for DFAS, service providers had not provided sufficient documentation of their control activities as required by the FIAR Guidance. Such documentation is needed for a clear understanding of how the Army’s financial reporting objectives may be affected by service provider controls and documentation. According to the FIAR Guidance, to assess and provide assurance on the effectiveness of their controls, service providers are to undergo annual examinations in accordance with Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization. Army officials told us that they are participating in a FIAR Directorate working group established to direct and coordinate service provider- related audit readiness efforts. According to Army officials, this group is working to help map out complete end-to-end business processes involving responsibilities shared by service providers and reporting entities. In addition, Army officials told us that the group is working to facilitate and monitor service provider efforts to prepare for SSAE No. 16 examinations to be conducted by IPA firms to provide an independent assessment on the effectiveness of service provider control activities. Because of the Army’s reliance on service provider controls to achieve its General Fund SBR financial reporting objectives, Army officials told us that their readiness efforts greatly depend on the results of service provider SSAE No. 16 examinations. According to the November 2013 FIAR Plan Status Report, initial SSAE No. 16 examinations for 7 of 13 service provider assessable units and systems are scheduled for completion from April 2014 through September 2015. The adequacy of controls associated with units and systems to be assessed through these examinations—such as those focused on contract pay at DFAS and the Defense Contract Management Agency—will affect the Army’s SBR audit readiness goal. Accordingly, the Army’s efforts to obtain the results of service provider SSAE No.16 examinations and assess them to determine the adequacy of controls supporting complete end-to-end business processes will be essential. With regard to Task 4 of the Discovery Phase on the evaluation of supporting documentation, the status of audit readiness efforts was not accurately reflected in the Army’s budget execution FIP status reports. For example, some activities that have been ongoing since 2010 were, as of May 31, 2013, reported in the Army’s FIP status report at zero percent complete although they were expected to be 100 percent complete in April 2013. An Army official acknowledged that there were several tasks on the FIP status report that were erroneously reported as zero percent completed that in fact had been completed. Further, according to DOD’s May 2013 FIAR Plan Status Report, the Army’s SBR Discovery Phase efforts were completed as of March 2013. However, this report was in conflict with the most recent FIP status report at the time. The March 2013 status report indicated that 62 percent of Discovery Phase tasks were completed, with many tasks not expected to be completed until after March 2013. Also, Army officials told us that they had limited time to update FIP status reports because of efforts focused on preparing for the Wave 3 assertion in June 2013 and because OUSD(C) did not require updated reports during the 90-day period leading up to readiness assertions. According to Standards for Internal Control in the Federal Government, entities must have relevant, reliable, and timely communications to run and control their operations and determine whether performance plans and accountability goals are being met. The lack of accurate and consistent information on progress and plans for completing remaining audit readiness tasks limits the ability to effectively manage risks and assess performance. While some progress had been made on the Army’s SBR FIP for budget execution tasks we reviewed through May 2013 when it was preparing its readiness assertion for Wave 3 GFEBS processes and locations, it was still in the process of completing its corrective action efforts. However, for actions taken through this date, we found that the Army’s efforts did not effectively address the FIAR Guidance requirements for the Corrective Action Phase tasks for the budget execution FIP of identifying appropriate corrective actions, validating their effectiveness, and adequately tracking progress. As a result, the Army is at increased risk that problems identified during the Discovery Phase may not be addressed and may therefore hinder its ability to ensure that audit readiness goals are effectively achieved. As defined in the FIAR Guidance, the Corrective Action Phase comprises five tasks: (1) design of the audit-ready environment, to include requirements for remediating deficiencies in internal controls and supporting documentation; (2) development of corrective actions, to include concrete corrective action plans (CAP) to resolve each deficiency identified during the Discovery Phase; (3) development of resource requirements, to include budget estimates of funding and staffing to execute the CAPs; (4) execution of the CAPs, to include performing procedures to verify that the CAPs have successfully remediated the deficiencies; and (5) notification to the FIAR Directorate that the reporting entity is ready for an examination of its assessable unit. The Army has taken steps toward completing these tasks, such as developing The SBR Audit Support Handbook—a reference tool to assist commands in implementing GFEBS-based processes and remediating deficiencies— and estimates of resources required to execute CAPs and conduct other audit readiness activities. However, as discussed below, we found that the Army’s efforts to develop and execute corrective actions (Corrective Action Phase Tasks 2 and 4) did not provide adequate assurance that deficiencies identified during the Discovery Phase will be resolved as required by the FIAR Guidance. According to its FIP status report, the Army began efforts to develop and execute corrective actions in March 2011 and June 2011, respectively, to address deficiencies identified during the Discovery Phase. Army officials explained that the primary components of the Army’s corrective action strategy are to provide targeted feedback to commands on control failures identified through monthly testing; perform targeted follow-up visits at commands to address specific challenges; and provide training, guides, and other tools to support corrective action within commands. However, for the Corrective Action Phase, the Army was unable to clearly demonstrate the extent to which (1) CAPs had been developed containing specific actions to resolve each identified deficiency (Task 2) and (2) required actions had been completed and deficiencies had been resolved (Task 4). These limitations resulted from a corrective action strategy and related oversight activities that were not designed to provide sufficient detail on corrective action efforts and to ensure their effectiveness. Additional information on these limitations is discussed below. Extent to which CAPs were developed to resolve identified deficiencies unclear. The effectiveness of the Army’s corrective actions depends on its efforts to ensure the completeness and effectiveness of CAPs containing specific actions planned to resolve identified deficiencies and their underlying causes. Recognizing the need to ensure the completeness of corrective actions and provide a means for tracking their status, the FIAR Guidance requires reporting entities to include corrective actions to resolve each deficiency identified in the corrective action sections of their FIP status reports. However, actions listed in the Army’s report were not linked to specific CAPs developed to address identified deficiencies, and as a result, the Army’s ability to demonstrate the completeness of its corrective actions was limited. Rather than listing specific tasks or references to specific CAPs, actions listed on the Army’s report largely consisted of references to specific control activities that were not effectively implemented based on the results of monthly control testing. Further, in many instances these references were outdated, as they cited controls in existence prior to the Army’s realignment of controls in February 2013. Additionally, we found that the Army’s FIP status report did not include corrective actions for addressing other known deficiencies and assessing the severity of each as a deficiency, a significant deficiency, or a material weakness, as required by the FIAR Guidance. For example, we found that the Army’s FIP status reports did not indicate the severity or include actions to correct deficiencies associated with (1) service provider controls and systems, (2) GFEBS system issues, and (3) the lack of supporting documentation identified through substantive testing. In addition, the effectiveness of the Army’s corrective actions for resolving deficiencies largely depends on the effectiveness of its discovery efforts. However, as previously discussed, the Army had not effectively implemented Discovery Phase tasks, including efforts to document processes and assess controls. Consequently, its ability to ensure the effectiveness of corrective actions was limited. Further, we found that CAPs at the command level were not always effective. For example, at one of the commands we visited, corrective actions contained in the commander’s checklist were not specific enough to address the extensive weaknesses reported. Command officials explained that this occurred, in part, because sufficient efforts to assess controls had not been completed to effectively determine the causes of identified deficiencies, thus limiting their ability to develop effective corrective actions to remediate the deficiencies. In addition, command officials told us that other issues hampering their discovery efforts also adversely affected their ability to effectively develop and execute corrective actions. These issues included the lack of sufficient resources and personnel with appropriate skills. Also, identifying the underlying causes of identified deficiencies is essential for developing specific tasks to remediate them. As part of its centralized monthly testing, the Army identified the reasons for each sample-item failure and communicated them to affected commands. In Leadership Briefs summarizing test results, the primary reason provided for these failures was documents not being signed and dated as evidence of review. However, other reasons contributed to sample-item failures but the Army had not analyzed them to better understand their relative significance and assist in identifying underlying causes. Accordingly, we analyzed the reasons for the failures for January 2013 through March 2013 by grouping them into four categories based upon data provided at the time of our review in May 2013. (See fig. 4.) Our analysis showed that over half of the failures identified were due to supporting evidence not being provided. This category also included samples for which a command had not provided a response Officials to requests for documentation within required time frames.at the three selected commands we visited told us that providing the supporting documentation within 15 days as required by the Army’s monthly testing schedule was often difficult because they needed to coordinate with other entities to obtain the documentation. Also, Army officials stated that they have been analyzing the nonresponses to better understand why they occurred and attributed them, in part, to the need to more timely obtain documentation from third-party stakeholders, such as DFAS. They also acknowledged that some deficiencies extended across commands and, in some instances, were outside the control of individual commands. For example, command officials told us that their test failures sometimes resulted from following the Army’s guidance for executing business process activities that had not been updated to reflect changes in procedures resulting from previously implemented systems changes. However, the ability to assess the extent to which the Army’s corrective actions are targeted at addressing the underlying causes contributing to sample-item failures is limited as corrective actions to address identified deficiencies were not linked to specific tasks or references to specific CAPs. Extent to which required actions were completed and effective unclear. Recognizing the need for information to measure efforts to execute corrective actions, the FIAR Guidance requires reporting entities to (1) verify that CAPs have been effectively implemented and have remediated identified deficiencies and (2) update FIP status reports to reflect corrective action progress each month. These updates are to include any scope and timeline changes resulting from their efforts. However, we found that the Army was unable to effectively demonstrate its verification that CAPs had been effectively implemented. This occurred because corrective actions listed in its FIP status report were not linked to CAPs containing specific tasks and time frames for their completion to remediate deficiencies. Army officials explained that the Army was relying on the results of its centralized monthly control testing as its primary means to monitor the effectiveness of corrective actions. These results indicated failure rates of 56 percent on average, raising questions concerning the effectiveness of the Army’s corrective actions. Further, while such results may be a useful indicator of progress, they do not identify the root causes for testing failures or provide needed assurance that deficiencies have been resolved. Verification that tasks have been completed and have effectively remediated deficiencies would enable the Army to better demonstrate that it has sufficient assurance concerning the effectiveness of its efforts. In addition, the Army’s progress toward completing corrective actions as reported in its FIP status reports was not accurate and the reliability of its estimates for completing them was unclear. Specifically, Army status reports indicated the status of many corrective action tasks as zero percent complete. According to Army officials, this status was based largely on results associated with its monthly control testing. They also explained that although the Army has been working on corrective actions since 2011, it had difficulties in estimating interim percentages to accurately reflect the extent of progress achieved. In addition, Army FIP status reports indicated that corrective actions would be completed by March 2014. This estimate, according to Army officials, was based largely on dates previously established to meet audit readiness assertions. However, since the Army’s reported progress and estimates for completing corrective actions are not linked to CAPs containing specific actions already taken and time frames for completing those still remaining to remediate deficiencies, their accuracy and reliability remain unclear. According to its corrective action strategy, the Army placed responsibility on commands to resolve identified deficiencies. However, the limitations we identified resulted from insufficient oversight steps to clearly demonstrate the completeness and effectiveness of the Army’s efforts to resolve deficiencies within planned time frames. Such steps would include linking corrective actions on its FIP status report to CAPs containing specific tasks required to resolve identified deficiencies and their underlying causes and time frames for their completion. Without such oversight of its corrective actions, the Army lacks needed assurance concerning whether efforts to achieve auditability of its SBAs and full SBRs will occur as planned. Some progress had been made in completing Assertion/Evaluation Phase tasks, including IPA examinations of the Army’s Wave 1 and 2 audit readiness assertions, and examination of its Wave 3 assertion is expected to be completed by May 2014. However, for actions taken through June 2013, when it was completing its Wave 3 readiness assertion, we found that the Army’s efforts did not effectively address the FIAR Guidance requirements for the Assertion/Evaluation Phase tasks for the budget execution FIP in assessing whether the reporting entity was ready for an independent audit of its readiness assertion. As defined by the FIAR Guidance, the Assertion/Evaluation Phase comprises five tasks: (1) the FIAR Directorate evaluates the documentation to determine the state of audit readiness; (2) the FIAR Directorate provides feedback to the reporting entity on its status of audit readiness; (3) reporting entity management asserts audit readiness and an auditor is engaged to examine and identify any deficiencies in its assertion; (4) the reporting entity evaluates the nature and extent of deficiencies noted by the auditor on its assertion and implementation of corrective actions to remediate them; and (5) the reporting entity verifies that corrective actions successfully remediated auditor-identified deficiencies. The FIAR Guidance was revised in March 2013 to accelerate the involvement of IPAs in performing independent assessments to better identify control deficiencies. However, the guidance continues to require reporting entities to perform procedures to verify that corrective action plans were implemented and that they successfully remediated deficiencies prior to engaging an IPA. Upon the FIAR Directorate’s review of readiness documentation and approval to proceed with an IPA examination, reporting entities are required to prepare a written assertion declaring that the subject matter to be examined is audit ready in conformity with the internal control and supporting documentation criteria contained in the guidance. For the Assertion/Evaluation Phase tasks, the FIAR Directorate evaluated documentation supporting the Army’s Wave 2 audit readiness assertion, and the Army outlined efforts to address deficiencies reported by an IPA based on its examination of the Army’s assertion. However, we found that the Army did not follow the FIAR Guidance for Assertion/Evaluation Phase Tasks 2 (FIAR Directorate feedback on audit readiness) and 3 (reporting entity evaluation of audit readiness assertion) as discussed below. With regard to task 2 on providing feedback on the Army’s status of audit readiness, the FIAR Directorate concluded, based on its review of the FIP for budget execution efforts contained in the Army’s Wave 2 assertion package that Army commands within the scope of the assertion were not ready for the type of examination envisioned under the FIAR Guidance. Specifically, OUSD(C) noted in a July 2012 memorandum to the Assistant Secretary of the Army (Financial Management and Comptroller) that the Army’s testing indicated that (1) 33 percent of identified manual controls were not implemented, 31 percent were not tested, and 1 percent was operating effectively and (2) 30 percent of general and application information technology controls tested were operating effectively. Further, OUSD(C) highlighted other concerns in its memorandum—such as key process and control gaps in end-to-end processes, an inadequate reconciliation of complete populations of transactions to the general ledger, and insufficient substantive testing to support general ledger transaction and account balances. According to the memorandum, OUSD(C) also noted that Army representatives stated that corrective actions had been implemented and controls were operating effectively. However, the Army had not fully retested remediation actions because of time constraints and, as a consequence, had not provided evidence to demonstrate effective implementation of corrective actions. Nonetheless, OUSD(C) documentation indicated that it supported the Army’s efforts to proceed to an IPA examination, in part, to enable it to accelerate efforts with clear and independent feedback on its approaches, assumptions, and judgments. However, based on the extensive nature of the deficiencies noted above, accelerating these efforts prior to remediating them may not be cost effective, given the likelihood that an IPA would identify similar deficiencies during its examination. With regard to Task 3 on assessing audit readiness, the Army’s June 2012 assertion memorandum for Wave 2 stated that all applicable control activities had been effectively implemented. However, specific information on the effectiveness of controls contained in its assertion package indicated the existence of extensive deficiencies and control gaps. Nevertheless, the Army proceeded to have its Wave 2 audit readiness assertion examined by an IPA firm despite extensive uncorrected internal control deficiencies. In April 2013, the IPA reported several inadequacies in the Army’s Wave 2 readiness assertion. The IPA reported one material deviation (the Army did not identify all financial reporting objectives and controls in GFEBS and its processes or complete end-to-end process reviews in accordance with the FIAR Guidance); three material weaknesses (in GFEBS information technology controls, journal voucher processing, and documentation supporting the design and operating effectiveness of controls); and one significant deficiency (in evidence of internal control implementation). Army officials stated that the IPA exams were beneficial in giving commands experience in undergoing an audit. However, an IPA exam to validate audit readiness assertions can be costly, not only in terms of IPA fees, but also in terms of focusing the Army’s efforts on a validation process likely to identify deficiencies already known to exist and potentially delaying efforts to remediate them. Accordingly, conducting IPA exams prior to the Army taking steps to verify that significant known deficiencies have been addressed is not a cost-effective approach for achieving audit readiness. To help minimize the inefficient use of resources when previously identified deficiencies have not been addressed, the NDAA for Fiscal Year 2002 offered DOD some relief from the cost and time associated with preparing and auditing unreliable financial statements. Similarly, redirecting resources toward addressing known deficiencies rather than validating their existence could enhance the Army’s ability to ensure the completeness and accuracy of its audit readiness assertion and achieve SBR auditability in a more cost- effective and timely manner. The Army has made a commitment to audit readiness and taken steps to follow the FIAR Guidance. This commitment has resulted in some progress and helped to develop an essential foundation on which further progress can be achieved. However, in implementing its General Fund SBR FIP for budget execution, the Army has not completed tasks required by the FIAR Guidance to ensure that risks and other key aspects of its efforts, including business processes, key systems, and controls that it and its service providers rely on to achieve audit readiness, are adequately documented and evaluated. Also, extensive deficiencies identified have not been resolved, increasing the likelihood that audit readiness of the Army’s SBR will not be achieved as planned. DOD’s FIAR Plan and Guidance describe steps for achieving audit readiness of its full SBR and other financial statements by September 30, 2017, as mandated by the NDAA of Fiscal Year 2010, as well as incremental SBA readiness by September 2014. However, the Army had not documented its assessment for how and when its approach is expected to achieve the goal of producing an audit-ready SBR, including risks related to excluding steps to ensure the audit readiness of billions of dollars of beginning balances and legacy system activity from the scope of its efforts. Overall, the gaps and deficiencies we identified throughout the various phases of the Army’s efforts to develop and implement its FIP for budget execution were largely due to its focus on (1) an approach that emphasizes establishing audit-ready GFEBS-based processes and (2) meeting scheduled dates and asserting audit readiness before correcting extensive control deficiencies. However, this approach raises serious concerns regarding the reliability of the Army’s readiness assertions, the likelihood that SBA and full SBR audit readiness will occur as planned, and the Army’s ability to ensure the accuracy of financial information used to monitor budgetary resources to achieve its mission. To improve the Army’s implementation of the FIAR Guidance for its General Fund SBR FIP for budget execution and facilitate remaining efforts to achieve SBR auditability, we recommend that the Assistant Secretary of the Army, Financial Management and Comptroller, take the following 10 actions: identify activity attributable to assessable units associated with service provider systems and business processes having a significant impact on the Army’s SBR; coordinate efforts with service providers to obtain and document within MOUs a shared understanding of roles and responsibilities for processing Army data; identify and document qualitative risks and other factors, including those associated with the Army’s reliance on service provider readiness efforts as well as other processes and systems supporting significant portions of its SBR that the Army excluded from the scope of its readiness efforts and assess their potential impact on SBA and full SBR auditability and established timelines required to effectively achieve audit readiness; update the Army’s determination for achieving SBR audit readiness included in DOD’s FIAR Plan Status Report to address NDAA requirements; completely and accurately document the linkage of financial reporting objectives to control activities; document criteria and processes for identifying key information technology systems that have a significant impact on the Army’s SBR audit readiness; obtain and assess the results of service provider SSAE No. 16 examinations upon completion to determine the adequacy of internal controls and document complete end-to-end business processes; update the Army’s FIP status reports to include actions to address identified deficiencies related to service providers, systems, and other known issues, along with an assessment of their severity, including references to current control activities with accurate estimates of the completion status; link corrective actions and estimates for their completion in FIP status reports to (1) specific CAP tasks to resolve deficiencies and their underlying causes and (2) dates for their expected completion; and correct significant deficiencies or material weaknesses identified before asserting audit readiness and engaging an IPA to validate the assertion. We provided a draft of this report to the Army for review and comment. In its written comments, reprinted in appendix III, the Army concurred with our recommendations. The Army also described planned and ongoing actions that are being taken in response to our recommendations. These actions include identifying and defining service providers’ responsibilities, systems, and controls; assessing risks and additional feeder systems; and updating its FIP status reports to accurately reflect the status of its current and planned efforts. Generally, these actions, if effectively implemented, will help improve the Army’s implementation of its General Fund SBR FIP for budget execution and facilitate remaining efforts to achieve SBR audit readiness. The Army’s comments did not fully address our recommendation that the Army update its determination for achieving SBR audit readiness included in DOD’s FIAR Plan Status Report. Specifically, as indicated in its comments, the Army’s Chief Management Officer’s determination included in the May 2014 FIAR Plan Status Report stated that most of the Army is well postured to achieve audit readiness of the Schedule of Budgetary Activity by September 30, 2014. The Schedule of Budgetary Activity is expected to reflect the amount of budgetary resources and associated activity related only to funding approved on or after October 1, 2014, and therefore represents an incremental step building toward an audit-ready SBR. As discussed in our report, the NDAA for Fiscal Year 2013 included requirements for the FIAR Plan Status Report to include a determination by the Chief Management Officer of each military department concerning its ability to achieve an auditable SBR by September 30, 2014, and, if unable to meet this deadline, provide an explanation as to why it is unable to meet the deadline as well as an alternative deadline and a description of the plan for achieving an auditable SBR by the alternative deadline. The Army’s response did not address the deadline for full SBR auditability, and the May 2014 FIAR Plan Status Report does not presently comply with the NDAA requirements. Updating the FIAR Plan Status Report as required would provide Congress and DOD decision makers with important information on DOD’s progress toward meeting auditability and financial management improvement goals. We are sending copies of this report to the Secretary of Defense, the Under Secretary of Defense (Comptroller), the Secretary of the Army, and the Chief Management Officer of the Army. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. The objectives of our review were to determine the extent to which the Army developed and implemented its General Fund Statement of Budget Resources (SBR) financial improvement plan (FIP) for budget execution in accordance with the Financial Improvement and Audit Readiness (FIAR) Guidance with regard to (1) determining the scope of activities included in the FIP and (2) completing those activities included in the scope of the FIP. To address our objectives, we reviewed the Department of Defense (DOD) FIAR Guidance and selected provisions of the National Defense Authorization Acts (NDAA) for fiscal years 2013 and 2010 to understand the methodology the Army is required to use, and related responsibilities, for achieving audit readiness. We analyzed the Army’s FIP to determine whether it contained elements, such as audit readiness tasks, required by the FIAR Guidance for the portions of the Discovery, Corrective Action, and Assertion/Evaluation Phases completed at the time of our review. The Army plans to address tasks required by the FIAR Guidance for the Validation and Audit Phases after June 2014. Appendix II provides specific information on the phases, tasks, and deliverables required by the FIAR Guidance for reporting entities to include in their FIPs. We also analyzed the SBR FIP deliverables required by the FIAR Guidance, such as process narratives and flowcharts, internal control assessments, and test results as well as results of independent public accountant examinations of the Army’s audit readiness efforts. We analyzed other documentation, such as DOD FIAR Plan Status Reports, the Army’s Audit Readiness Strategy, and periodic leadership briefs and presentations, to understand the Army’s approach for achieving General Fund SBR budget execution audit readiness and high-level efforts to monitor and manage progress and risks, and to determine whether the Army’s FIP accurately reflected the status of tasks required to achieve audit readiness. We interviewed the Army’s General Fund Audit Readiness Director responsible for the Army’s General Fund SBR FIP for budget execution and Army representatives supporting these efforts, as well as officials in the Office of the Under Secretary of Defense (Comptroller), FIAR Directorate, and Defense Finance and Accounting Service, to obtain explanations and clarifications associated with our evaluation of the documentation. We reviewed SBR FIP and audit readiness issues at the Army command level by conducting on-site audit work and interviewing installation officials at Installation Management Command, Fort Sam Houston, Texas, and Forces and Reserve Commands, Fort Bragg, North Carolina. We conducted this performance audit from June 2012 to May 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Table 1 presents the reporting entity methodology in the Financial Improvement and Audit Readiness (FIAR) Guidance, which the Army is required to follow in implementing its financial improvement plan (FIP) for General Fund Statement of Budget Resources budget execution. In addition to the contact named above, the following individuals made key contributions to this report: Roger Stoltz (Assistant Director), James Kernen, Richard Kusman, Marc Oestreicher, Laura Pacheco, Francine DelVecchio, Maxine Hattery, and Jason Kelly. The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to http://www.gao.gov and select “E-mail Updates.” The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts Visit GAO on the web at www.gao.gov. . Please Print on Recycled Paper.

Summary: The National Defense Authorization Act for Fiscal Year 2013 requires the Department of Defense (DOD) to describe how its SBR will be validated as ready for audit by September 30, 2014. The DOD Comptroller issued the FIAR Guidance to provide a standard methodology for DOD components to use to develop and implement FIPs, improve financial management, and achieve audit readiness. The Army's FIP for budget execution provides a framework for planning, executing, and tracking essential steps with supporting documentation to achieve audit readiness of its General Fund SBR. GAO is mandated to audit the U.S. government's consolidated financial statements, including activities of executive branch agencies such as DOD. This report identifies the extent to which the Army developed and implemented its General Fund SBR FIP for budget execution in accordance with the FIAR Guidance with regard to (1) determining the scope of activities included in the FIP and (2) completing those activities included in the scope of the FIP. GAO reviewed the Army's FIP to determine whether it contained the elements required by the FIAR Guidance and reviewed test results, status reports, and other deliverables. The Army has made important progress in developing its financial improvement plan (FIP) for budget execution to help guide its General Fund Statement of Budgetary Resources (SBR) audit readiness efforts. This FIP covers current year activity associated with the recently deployed General Fund Enterprise Business System (GFEBS) emphasizing the implementation of effective business processes. However, the Army did not fully complete certain tasks in accordance with the Financial Improvement and Audit Readiness (FIAR) Guidance to ensure that its FIP adequately considered the scope of efforts required for audit readiness. For example, the Army did not consider the risks associated with excluding current year activity associated with legacy systems and did not adequately identify significant SBR activity attributable to service provider business processes and systems. These activities may continue to represent material portions of future SBRs and, if not auditable, will likely affect the Army's ability to achieve audit readiness goals as planned. For GFEBS-related audit readiness activities within the scope of its FIP for budget execution, the Army documented controls in narratives and flowcharts and performed monthly tests to assess their effectiveness. Based on test results from June 2012 through May 2013, the Army identified extensive deficiencies, such as lack of appropriate reviews or approvals, and had an average failure rate of 56 percent. The Army did not fully follow the FIAR Guidance in performing the tasks required. For example, the Army's documentation and assessment of controls were not always complete or accurate. Further, extensive deficiencies identified by Army had not been remediated prior to an independent public accountant's (IPA) examination of its audit readiness efforts. Overall, the gaps and deficiencies identified above are largely due to the Army's focus on (1) the audit readiness of new GFEBS processes despite continued reliance on legacy systems and service providers and (2) asserting audit readiness before correcting extensive control deficiencies. Army officials cited adherence to assertion and IPA examination milestones as essential. However, this approach raises serious concerns regarding the likelihood that SBR audit readiness will occur as planned and the Army's ability to ensure the accuracy of financial information used to monitor budgetary resources to achieve its mission. GAO recommends that among other things, the Army take steps to improve implementation of the FIAR Guidance for its General Fund SBR FIP for budget execution and ensure that all significant SBR processes, systems, and risks are adequately considered and identified deficiencies are resolved. The Army concurred with GAO's recommendations.