Given DOD’s difficulties in achieving audit readiness and addressing its long-standing financial management deficiencies, you asked us to assess DOD’s risk management process for implementing its FIAR Plan. Our objective was to determine the extent to which DOD has established an effective process for identifying, analyzing, and addressing risks that could impede its progress in achieving audit readiness. To address this objective, we identified relevant guiding principles and leading practices of risk management used by the private sector and GAO. Based on our analysis, we found commonalities and identified five basic guiding principles governing effective risk management: (1) identify risks, (2) analyze risks, (3) plan for risk mitigation, (4) implement a risk mitigation plan, and (5) monitor risks and mitigation plans. Using these guiding principles as criteria, we analyzed DOD documents related to risk management, such as the May 2012 and November 2012 FIAR Plan Status Reports, which identified DOD’s program risks and mitigation plans, and FIAR oversight committee meeting minutes, which documented the results of DOD’s efforts to prioritize and manage these risks. We interviewed the FIAR Director and other officials responsible for the FIAR Plan in the Office of the Under Secretary of Defense (Comptroller) and the Office of the Deputy Chief Management Officer (DCMO) to obtain an understanding of DOD’s risk management process. We also inquired about coordinated risk management efforts and about DOD’s plans to revisit identified risks, identify new risks, and mitigate those risks. Although the FIAR Directorate is responsible for DOD-wide risk management activities to implement the FIAR Plan, FIAR Directorate officials told us that some of DOD’s component entities may have risk management activities under way. Accordingly, we made inquiries of the military components and two of the largest defense agencies—the Defense Finance and Accounting Service (DFAS) and the Defense Logistics Agency (DLA)—to identify those that had risk management efforts under way for implementing the FIAR Plan. Of these, the Department of the Navy (Navy) and DLA had risk management practices being implemented at the time of our review, and we included them for comparison purposes to the DOD-wide efforts. Using the five risk management guiding principles as criteria, we reviewed and analyzed the Navy’s and DLA’s risk management plans and supporting documents that identified, described, and prioritized risks to audit readiness as well as progress or status reports related to their efforts to address and monitor those risks. We also interviewed the Navy’s and DLA’s Financial Improvement Plan directors and other knowledgeable officials about their risk management processes and coordination with DOD’s FIAR Director and the Office of the DCMO. We conducted this performance audit from October 2011 to August 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. In 2005, the DOD Comptroller established the FIAR Directorate, consisting of the FIAR Director and his staff, to develop, manage, and implement a strategic approach for addressing financial management deficiencies, achieving audit readiness, and integrating those efforts with other initiatives. Also in 2005, DOD first issued the FIAR Plan—a strategic plan and management tool for guiding, monitoring, and reporting on the department’s ongoing financial management improvement efforts and for communicating the department’s approach to addressing its financial management weaknesses and achieving financial statement audit readiness. In August 2009, the DOD Comptroller sought to focus FIAR efforts by giving priority to improving processes and controls that support the financial information most often used to manage the department. Accordingly, the DOD Comptroller revised the FIAR Plan strategy to focus on two priorities—budgetary information and asset accountability. The first priority was to strengthen processes, controls, and systems that produce DOD’s budgetary information. The second priority was to improve the accuracy and reliability of management information pertaining to the department’s mission-critical assets, including military equipment, real property, and general equipment. In May 2010, the DOD Comptroller first issued the FIAR Guidance, which provided the standard methodology for the components—including the Departments of the Army, Navy, and Air Force and DLA—to implement the FIAR Plan. According to DOD, the components’ successful implementation of this methodology is essential to the department’s ability to achieve full financial statement auditability. In recent years, legislation has reinforced certain DOD financial improvement goals and initiatives and has strengthened the role of DOD’s Chief Management Officer (CMO). For example, the NDAA for Fiscal Year 2010 tasked the CMO, in consultation with the DOD Comptroller, with the responsibility for developing and maintaining the FIAR Plan, and required the plan to describe the specific actions to be taken and the costs associated with validating audit readiness by the end of fiscal year 2017. This act also mandated that the department provide semiannual reports—no later than May 15 and November 15—on the status of its implementation of the FIAR Plan. In October 2011, the Secretary of Defense directed the department to achieve audit readiness for its SBR for general fund activities by the end of fiscal year 2014, and the NDAA for Fiscal Year 2012 required that the next FIAR Plan update include a plan to support this goal. Most recently, the NDAA for Fiscal Year 2013 made the 2014 target for SBR auditability an ongoing component of the FIAR Plan by amending the NDAA for Fiscal Year 2010 such that it now explicitly refers to describing the actions and costs associated with validating as audit ready both DOD’s SBR by the end of fiscal year 2014 and DOD’s complete set of financial statements by the end of fiscal year 2017. The department has established a FIAR governance hierarchy to oversee the FIAR Directorate’s management and implementation of the FIAR Plan. At the top is the CMO, who approves the vision, goals, and priorities of the FIAR Plan, which are provided by the DOD Comptroller, in coordination with stakeholders within the department (e.g., military departments) as well as external stakeholders (e.g., the Office of Management and Budget and Congress). The CMO chairs the Deputy Management Action Group, which (1) provides advice and assistance to the CMO on matters pertaining to DOD enterprise management, business transformation, and operations and (2) reviews DOD component FIAR Plans and monitors their progress. To manage and oversee FIAR Plan implementation efforts, a number of committees and working groups, beginning with the FIAR Governance Board, have been established, as shown in table 1. The FIAR Governance Board engages the department’s most senior leaders from the functional and financial communities and oversees DOD component progress. The FIAR Committee and Subcommittee oversee the management of the FIAR Plan. Descriptions of these key FIAR oversight bodies are presented below. In the November 2012 FIAR Plan Status Report, DOD reported the following: Fifteen percent of the department’s reported general fund budgetary resources were undergoing audits, including the Marine Corps’ budgetary resources. The military departments, defense agencies, and other components were preparing the remaining budgetary resources to be ready for audit by the end of September 2014. For mission-critical assets, DOD reported that 4 percent of these assets were undergoing audits, 37 percent had been validated as audit ready, 12 percent had been asserted as audit ready by the respective component, and the remaining 47 percent were being prepared for audit readiness assertions. DOD’s projected funding for the FIAR effort for fiscal years 2012 through 2018 is shown in table 2. Risk management is a strategy for helping program managers and stakeholders make decisions about assessing risk, allocating resources, and taking actions under conditions of uncertainty. Risk management can be applied to an entire organization, at its many levels, or to specific functions, projects, and activities. While risk management does not provide absolute assurance regarding the achievement of an organization’s objectives, an effective risk management strategy can be particularly useful in a decentralized organization—such as DOD—to help top management identify potential problems and reasonably allocate resources to address them. Leading risk management practices recommend that organizations develop, implement, and continuously improve a process for managing risk and integrate it into the organization’s overall governance, strategy, policies, planning, management, and reporting processes. When planning for risk, an organization determines the methodology, strategies, scope, and parameters for managing risks to the objective. In researching risk management principles, we identified five basic guiding principles of risk management, as shown in figure 1. Identify risks. The goal of risk identification is to generate a comprehensive list of risks, regardless of whether those risks are under the control of the organization, based on events that could significantly affect the achievement of objectives. Risk identification involves continuous and iterative communication and consultation with internal and external stakeholders to identify new risks, sources of risk, areas these risks affect, events (including changes in circumstances), their causes (root causes), and potential consequences to the objective. This can be performed through additional inquiry with subject matter experts, surveying and interviewing experienced executives, high-level and detailed documentation reviews, checklists based on historical information, and diagramming processes. Analyze risks. Risk analysis involves developing an understanding of identified risks to assist management in determining the most appropriate methods and strategies in prioritizing and responding to risk. It requires risks to be analyzed to determine the impact of interdependencies between the overall program risks and program component risks. According to guiding principles, risk analysis is a vital part of the entire risk management process as it helps managers determine where to focus their attention and allocate resources to maximize the likelihood of achieving objectives.