DOD established the FIAR Plan as its strategic plan and management tool for guiding, monitoring, and reporting on the department’s ongoing financial management improvement efforts and for communicating the department’s approach to addressing its financial management weaknesses and achieving financial statement audit readiness. To implement the FIAR Plan, the DOD Comptroller issued the FIAR Guidance, which defines DOD’s strategy, goals, roles, and responsibilities and the procedures that the components need to perform to improve financial management and achieve audit readiness. DOD components are expected to prepare a FIP in accordance with the FIAR Guidance for each of their assessable units. The FIPs are intended to both guide and document financial improvement efforts. While the name FIP indicates that it is a plan, as a component implements that plan, it must document the steps performed and the results of those steps, and retain that documentation within the FIP. When a component determines that it has completed sufficient financial improvement efforts for an assessable unit to undergo an audit, it asserts audit readiness for the related assessable unit and submits the FIP documentation to the FIAR Directorate to support the conclusion of audit readiness. The FIAR Directorate is responsible for reviewing and validating the supporting documentation within the FIP to determine whether the component is audit ready. DOD’s service providers are responsible for a variety of accounting, personnel, logistics, and system development or operations services to support DOD components. Recognizing that the effectiveness of the service providers’ controls affects the auditability of the amounts reported on the components’ financial statements, DOD’s FIAR Guidance outlines the steps service providers are to perform to achieve audit readiness. Specifically, the FIAR Guidance requires service providers to work with the components to execute audit readiness activities on their systems, data, processes, internal controls, and supporting documentation that have a direct effect on the components’ audit readiness state. To support the component audit readiness efforts, a service provider is required to take either of the following steps: Develop and implement a FIP to improve its processes, systems, and controls so that it can successfully undergo a Statement on Standards for Attestation Engagements (SSAE) No. 16 examination. Specifically, the FIAR Guidance requires the service provider to implement a FIP if three or more components will rely on its processes and systems for their audit readiness assertions, and if the service provider will be able to assert audit readiness prior to the components’ targeted dates for asserting audit readiness. Directly participate in and support the component’s financial statement audit where the service provider’s processes, systems, internal controls, and supporting documentation are audited as part of the components’ financial statement audits. The FIAR Guidance service provider methodology requires the FIP to include the following five phases: Discovery, Corrective Action, Assertion/Evaluation, Validation, and SSAE No. 16 Examination. Table 1 provides a list of steps for each of the phases and the required deliverables. As presented in table 1, the service provider documents, evaluates, and tests its processes, systems, and controls during the Discovery Phase of its FIP, and designs and implements the necessary corrective action plans as part of the Corrective Action Phase. The deliverables from the service provider are then reviewed by the FIAR Directorate during the Assertion/Evaluation Phase. Based on its review of the deliverables, the FIAR Directorate determines whether the service provider is audit ready and, if so, authorizes the service provider to engage an auditor to perform an SSAE No. 16 examination. If the FIAR Directorate determines that the service provider is not audit ready, the FIAR Directorate provides feedback, which the service provider has to address before resubmitting the required deliverables for review. After the auditor completes the SSAE No. 16 examination and issues the report, the service provider submits a copy of the SSAE No. 16 examination report to the FIAR Directorate and evidence that it has implemented corrective actions to remediate the deficiencies identified by the auditor, if any. As part of the Validation Phase, the FIAR Directorate reviews the SSAE No. 16 report and supporting documentation of the implemented additional corrective actions to determine if the service provider is ready for a second SSAE No. 16 examination and, if so, authorizes the service provider to engage an auditor to perform a second SSAE No. 16 examination. If the service provider receives an unqualified opinion on the first SSAE No. 16 examination, the FIAR Directorate will not require the service provider to undergo a second audit as part of the SSAE No. 16 Examination Phase. Figure 1 illustrates a summary of the process in the FIAR Guidance related to the submission, review, and approval of the service providers’ documentation for audit readiness. DFAS is the service provider responsible for processing, accounting, and reporting contract pay for DOD components. Figure 2 illustrates the relevant systems and end-to-end process, which includes contract input, invoice entitlements, pre-validation, disbursing, Treasury reporting, accounting and reconciliation, and contract closeout and reconciliation processes. 1. Contract input: The components electronically transmit contract award data and related document images through their contract writing systems into the Mechanization of Contract Administration Services (MOCAS) system. DFAS reported that some contract awards are issued with manually produced documents, which the components mail or fax to DFAS for input into MOCAS. DFAS’s Contract Input Branch personnel validate the contract data before inputting them into MOCAS. 2. Invoice entitlements: Contractors electronically transmit invoices to DFAS for payment processing in MOCAS; however, if these invoices do not pass a series of automatic validation edits in MOCAS, they are rejected by the system. DFAS’s Entitlement branch personnel process these transactions utilizing its Entitlement Automation System (EAS). MOCAS perform edits to validate the invoices in MOCAS or EAS and compare the contract obligations, invoices, and receiving reports. DFAS’s entitlement branch personnel also utilize the Business Activity Monitoring (BAM) tool during the entitlement process to monitor and validate the contractors’ invoices. The BAM tool is a monitoring capability that DFAS uses to identify potential erroneous or improper payments. 3. Pre-validation: The Elimination of Unmatched Disbursements (EUD) system transmits invoice data to the components’ accounting systems. The components review the invoice data transmitted by EUD and approve the invoices for payment. 4. Disbursing: Once the components approve the invoices for payment, the components notify DFAS disbursing operations personnel who input the approval status into MOCAS. MOCAS processes the approved invoices to be paid either by check or electronic funds transfer (EFT). MOCAS generates a disbursement file that identifies all invoices to be paid. A certifying official reviews the disbursement file for accuracy prior to payment being made. After approval by the certifying official, DFAS’s Disbursing Operations personnel either mail the checks to contractors or transmit the EFT file to the Federal Reserve Bank to make the payment. 5. Treasury reporting: Once the disbursements are processed, MOCAS interfaces with the Defense Cash Accountability System (DCAS), which is the system used by DFAS to generate and submit monthly reports on contract pay disbursements to the Department of the Treasury (Treasury). 6. Accounting and reconciliation: DFAS’s Contract Branch personnel generate a disbursement file from MOCAS that is provided to the components to record the contract disbursements into their general ledgers. DFAS is also responsible for the reconciliation of the disbursements transactions in MOCAS to the components’ general ledgers; however, DFAS has yet to implement this process. 7. Contract closeout and reconciliation: DFAS’s Contract Branch personnel assist the components during the contract closeout and reconciliation processes, for example, with paying final vouchers and, when needed, resolving unreconciled balances on a contract. DFAS officials explained that they utilize the Standard Contract Reconciliation Tool (SCRT) to investigate differences in contract payment data between MOCAS and the components’ general ledgers upon request from the components and to process the necessary adjustments. Most of these requests are submitted to DFAS from the components during the contract closeout procedures. DFAS recognized the importance of implementing a FIP to improve its contract pay processes, systems, and controls, and performed steps required by the FIAR Guidance, such as performing internal control, information technology (IT), and substantive testing. However, we found that DFAS did not fully comply with the requirements in the FIAR Guidance to improve its contract pay processes, systems, and controls. For example, our review found that DFAS did not perform adequate planning and testing activities for the Discovery Phase of its FIP. In addition, DFAS did not provide adequate documentation for several corrective action plans to support that it has remediated identified control deficiencies. DFAS asserted in October 2013 that its contract pay controls were suitably designed and operating effectively to undergo an audit, and awarded a contract to an independent public accounting firm prior to fully remediating the deficiencies it identified during the implementation of its contract pay FIP. Without fully implementing the financial improvement steps required in the FIAR Guidance, DFAS does not have assurance that its processes, systems, and controls can produce and maintain accurate, complete, and timely financial management information for contract pay. Further, the deficiencies noted will affect the components’ ability to rely on DFAS’s controls over contract pay, ultimately increasing the risk that DOD’s goal for an auditable SBR will not be achieved in its planned time frame.