MARAD is responsible for overall policy direction of the Academy. The Maritime Administrator issues Maritime Administrative Orders (MAO) and bulletins establishing policies and providing guidelines for Academy operations. Additionally, the MARAD Chief Financial Officer (CFO) issues directives to provide guidance for conducting Academy financial operations. Since 2010, there have been two MARAD CFOs with an acting CFO between their appointments. From 2009 through 2011, MARAD relied on a Fiscal Oversight Board to assist MARAD in the oversight of the Academy’s operations. The Academy Superintendent is responsible for day-to-day management of the Academy and reports directly to the head of MARAD, the Maritime Administrator. Since September 2008, there have been three Academy Superintendents, with the Academic Dean serving as Interim Superintendent between Superintendent appointments. Various assistant superintendents report to the Superintendent, and various directors of departments and offices report to the assistant superintendents. The Office of Academy Operations is led by the Academy’s CFO, who reports directly to the MARAD CFO. Additionally, since our 2009 report, four Academy support functionsdirectly to MARAD headquarters offices. As of September 30, 2011, the Academy was also affiliated with two nonappropriated fund instrumentalities (NAFI) intended to assist the Academy in providing programs and services primarily for Academy midshipmen and employees. One of these NAFIs, the Employee Association, is intended to promote and support the interests of Academy personnel. The other is the Regimental Morale Fund Association, authorized to support morale, welfare, and recreation activities for the Academy’s midshipmen. In addition, as of September 30, 2011, four other NAFIs were in transition for closure (see table 1). Additionally, the Academy also received financial support from two private foundations, the U.S. Merchant Marine Academy Alumni Association and Foundation and the Sailing Foundation. These foundations use funds provided by Academy alumni to provide financial support for the Academy’s charitable, scientific, and educational activities. See figure 1 for an overview of DOT, MARAD, and Academy organizational relationships. Our 2009 reportdeficiencies as well as weaknesses in the Academy’s control environment. Specifically, we found that flawed design and implementation of internal controls were the root causes of the Academy’s inability to prevent or detect numerous instances of improper and questionable sources and uses of funds that we identified. Additionally, we found that the Academy lacked an accountability structure that clearly defined organizational roles and responsibilities; policies and procedures for carrying out its financial stewardship responsibilities; an oversight and monitoring process; and periodic, comprehensive financial reporting. As a result, our 2009 report included a total of 47 recommendations for corrective action. on the Academy identified numerous internal control Of the 47 recommendations, we made 1 overarching recommendation concerning actions needed for the Academy to establish effective overall internal control. Specifically, we recommended that the Secretary of Transportation direct the Administrator of MARAD, in coordination with the Superintendent of the Academy, to establish a comprehensive, risk- based internal control system to address the core causes of the control deficiencies identified in our 2009 report, including delineating the roles and responsibilities of management and employees to establish and maintain a positive and supporting attitude toward internal control and conscientious management, and the responsibility of managers to monitor control activities. The remaining 46 recommendations related to control deficiencies associated with the following activities: Academy training vessel use, personal service acquisitions, NAFI camps and clinics using Academy facilities, midshipmen fee accountability, accountability for Academy reserves, Academy and NAFI governance structure, financial reporting, fund accountability, and capital asset repairs and improvements. Our review of the Academy’s and MARAD’s efforts to address the issues reported in our 2009 report found that the Academy and MARAD had not yet established a comprehensive, risk-based system of internal control at the Academy. The Academy and MARAD both focused their initial efforts on the more readily correctible deficiencies in the Academy’s controls over specific activities. As a result, the Academy and MARAD had made substantial progress in addressing weaknesses related to specific control activities by successfully implementing 32 of the 46 control deficiency- related recommendations identified in our 2009 report. For example, the corrective actions taken to improve controls were sufficient for us to conclude that all recommendations related to training vessel use, personal service acquisitions, accountability for Academy reserves, and NAFI camps and clinics using Academy facilities were successfully implemented. Our review found that actions taken by the Academy and MARAD through September 30, 2011, were not sufficient to fully address our overarching recommendation related to the establishment of a comprehensive, risk- based internal control system at the Academy, a positive and supportive attitude toward internal control, and an associated system of monitoring internal control effectiveness. Standards for Internal Control in the Federal Government provides that internal control should (1) serve as the first line of defense in preventing and detecting errors and fraud, (2) provide for an assessment of external and internal risks to the entity, and (3) provide for internal control monitoring. Monitoring is critical to ensure that findings of audits or other reviews are promptly resolved and to assess the ongoing effectiveness of controls. However, our review found that the Academy had not yet taken actions sufficient to address the core cause of many of the control deficiencies identified in our 2009 report. Understanding the causes of internal control deficiencies is critical to designing effective, risk-based controls that can help prevent questionable transactions in the future. For example, as discussed later in this report, the Academy took action to correct errors we identified in its accounting for certain capital asset repairs and improvements, but had not yet taken action to conduct an analysis, as we recommended, to identify and address the underlying causes of these errors. Nonetheless, the Academy and MARAD have taken a number of actions that represent an important first step toward focusing the top-level attention and accountability needed to establish an effective overall system of internal control for the Academy. For example, in January 2011, MARAD established and filled an Internal Control Officer (ICO) position for the Academy. The Academy ICO, who is also the Academy’s Chief Information Officer, reports to MARAD’s Internal Controls Program Manager and is responsible for coordinating and leading the Academy’s reviews of internal controls in accordance with Office of Management and Budget (OMB) Circular A-123 and the Federal Managers’ Financial Integrity Act of 1982 (FMFIA). Also, in September 2011, MARAD issued guidance in MAO 400-11 intended to help clarify the Academy’s oversight role and responsibilities with respect to the Academy’s affiliated NAFIs. Despite these completed actions, until Academy and MARAD officials take additional actions to fully address our recommendation in this area, their ability to ensure that Academy and MARAD management’s objectives are carried out, including proactively identifying and correcting control deficiencies in a timely fashion, will continue to be impaired. Both the Academy and MARAD focused their initial efforts on the more readily correctible deficiencies in the Academy’s specific controls, as discussed later in this report. However, while these efforts are necessary and have a significant impact on internal control, it is important that the Academy and MARAD address the long-standing, deeply rooted causes of the specific control deficiencies we identified and establish processes to ensure that effective internal control is fully established, maintained, and monitored over time. In this regard, it is also important that the Academy and MARAD provide priority attention and focus not only on addressing questionable transactions we identified in our prior report, but also on the underlying causes of the specific errors we identified. As of September 30, 2011, Academy and MARAD officials had taken sufficient actions to address 32 of our 46 prior recommendations intended to address specific deficiencies in the Academy’s control activities. For example, officials took steps to fully close all of our previous recommendations related to controls over training vessel use, personal service acquisitions, accountability for Academy reserves, and NAFI camps and clinics using Academy facilities. For the 14 remaining recommendations, we identified varying levels of action in process as of September 30, 2011, but none sufficient for us to consider them effectively implemented. Our conclusions on the status of Academy and MARAD actions to address our 46 previous recommendations concerning specific deficiencies in control activities are summarized in table 2, discussed in summary in the following sections, and discussed in greater detail in appendix II. Standards for Internal Control in the Federal Government provides that agencies should take appropriate follow-up actions to address findings and recommendations of audits and other reviews. Also, GAO’s Internal Control Management and Evaluation Tool provides that in taking such actions, agencies are to ensure that the underlying causes giving rise to the findings or recommendations are investigated, that actions are decided upon to correct the identified weaknesses, and that weaknesses are corrected promptly. Training vessel use. In 2009, we reported that the Academy lacked policies and procedures and adequate internal controls over the use of Academy training vessels by outside parties. For example, we found that the usage rates for Academy training vessels were not supported and were not based on consideration of current costs of operation. The Academy and MARAD took steps to address all five of our recommendations related to internal control deficiencies regarding outside party use of Academy training vessels. In September 2010, the Academy issued Superintendent’s Instruction 2010-08, which set out procedures for outside parties to use and pay for all costs associated with the use of Academy training vessels. The Academy’s Department of Waterfront Activities also issued a vessel usage rate schedule in September 2010 that provided current costs of operation for use of Academy training vessels. The guidance provides base hourly, daily, and weekly billing rates that outside parties are to be charged for using the Academy’s training vessels. Personal service acquisitions. In our 2009 report,instances in which the Academy entered into illegal personal service agreements with its NAFIs, whereby NAFI employees performed exclusively Academy functions and reported to Academy supervisors. The Academy and MARAD took actions to address both of our recommendations related to improving internal controls over personal service acquisitions.