Financial Audit: Other Matters Identified During GAO's 1996 Financial Statement Audits

Published by the Government Accountability Office on 1997-08-01.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

      United States
GAO   General Accounting Office
      Washington, D-C. 20548

      Accounting and Information
      Management Division


      August     1, 1997
      Mr. Andrew C. Hove, Jr.
      Acting Chairman, Board of Directors
      Federal Deposit  Insurance Corporation
      Subject:        Financial Audit:  Other Matters   Identified
                      Durinu GAO's 1996 Financial  Statement Audits
      Dear Mr. Hove:
      In June, we issued our opinions            on the calendar       year 1996
      financial   statements      of the Bank Insurance         Fund (BIF),
      Savings Association       Insurance     Fund (SAIF), and FSLIC
      Resolution   Fund (FRF).       We also issued our opinion            on the
      Federal Deposit     Insurance      Corporation      (FDIC) management's
      assertions   regarding      the effectiveness        of its system of
      internal   controls    as of December 31, 1996, and reported                 on
      FDIC's compliance      with significant        provisions     of selected
      laws and regulations        for the three funds ,for the year ended
      December 31, 1996 (GAO/Am-97-111               June 30, 1997).          In
      addition,   we are communicating         several other matters            to
      YOU--in a separate      letter     because of their       sensitive
      nature-- concerning     electronic      data processing       security.
      The purpose of this letter            is to advise you of accounting
      policies     and procedures     and internal       control    matters
      identified      during our audits of the 1996 financial
      statements.       We suggest improvements          to address those
      weaknesses,      which include      the need to improve controls
      related    to asset valuation,          receipt   processing,     check
      disbursement      procedures,    disbursement        documentation,     and
      payroll    records.    In addition,        FDIC should review the impact
      of using cash based accounting              to record securitization
      reserve    interest.
      Although     these matters were not material      in relation      to the
      financial      statements,  we believe   that they warrant      the
      attention      of management.   We provided    FDIC officials      with a
      draft     of this letter   and discussed    the matters    addressed    in

                                   GAO/Am-97-142R        FDIC Management      Letter
it with them. They agreed with our findings    and
suggestions.  We will  follow up on these matters during                      our
audits of the 1997 financial  statements.
As part of its Asset Loss Review (ALR) project,                FDIC
implemented the Standard Asset Valuation            Estimation      (SAVE)
methodology in 1996 to estimate the recovery values for
failed    institution    assets in liquidation.       The objective       of
the ALR project       is to prepare fund-level      asset recovery
estimates      for use in the FDIC's calculation        of loss reserves
for BIF, SAIF, and FRF. The ALR instruction              manual requires
first-    and second-level     review of all SAVE work products           to
verify    that asset valuations       are reasonable.      In order to
ensure compliance with these requirements,             quality    control
procedures       over the preparation    and review of individual
asset estimates       are a necessary element of FDIC fieldwork.
However, during our audits we found that FDIC preparers           did
not always use all relevant    file  information     for estimating
the recovery values for individual      assets.    In addition,     we
found numerous errors in the valuation       of certain    complex
assets,   such as subsidiary  equity and subsidiary      loan
assets.    We found that FDIC's primary and secondary review
procedures   were not adequate to detect the above errors.
According     to FDIC officials,       preparers      did not have
sufficient      time to ensure a thorough file            review and to
accurately      complete the related       valuation.documents.
Therefore,     preparers     overlooked    information       significant       to
the asset estimates         or made errors when preparing             the cash
flow worksheets        (CFW) used to value the assets.               FDIC's
review procedures were also subject              to the same time-
pressures,      and in some cases, were not properly               conducted.
As a result,       FDIC lacked assurance that individual                assets
were reasonably valued.           This, in turn,        could affect      the
accuracy of FDIC's statistical            projections       to that class of
assets.      These projections       are an integral        component in
FDIC's calculation         of the allowance for losses on BIF's and
FRF’s    receivables     from resolution      activity      and investment        in
corporate     owned assets.
During our     audits,    we found that the errors        made on
individual     asset values were generally        offsetting    and,
therefore,     did not affect     the overall    estimates.     However,            a
continued     quality    control  problem with individual       asset
valuations     presents risk for future       estimates.      Therefore,
during the     course of our audits,      we suggested that FDIC
review its     fieldwork     blementation     procedures     to identify
2                             GAO/AIMD-97-142R FDIC Management Letter
specific    actions which could be taken to improve quality
control    during its asset valuation    process.  In addition,   we
suggested that FDIC assign personnel        with specialized
knowledge to estimate recoveries      for complex assets,     such as
subsidiary     equity and subsidiary  loan assets.
For its sunnner 1997 valuation          round, FDIC has developed and
implemented improved review requirements.                 These
requirements    direct    the primary reviewer        to compare each CFW
to the source documents in the file             to verify     the preparer's
appropriate    use of information        in developing      the asset's
value.     In addition,     the primary reviewer        is required    to
ensure that the proper valuation           methodology was followed,
and that the preparer's        analysis     is reasonable.       FDIC is
also planning     to establish     a team with the specialized
knowledge required      to value complex assets,           such as
subsidiary    equity and subsidiary         loans.
The Division     of Administration's        (DOA) standard operating
procedures    for mail room operations         require     that mail
containing    monetary items be opened under dual control.
Also, the Division      of Finance's      (DOF) Reoional Accountinq
Manual (RAM) required       establishing      control    totals   for each
day's receipts     when received.        The RAM also required         that
monetary items held (i.e.,         not included       in the daily
deposit)    be logged until     released     or deposited.       The
Comptroller    General's    Standards for Internal          Controls     in the
Federal Government require         supervisory     review of staff's
work to ensitre management objectives           are met and errors          or
misunderstandings     of procedures       are detected,       and that
duties are properly      segregated,
During our audits,      we found that receipts            were not properly
controlled     at six field     offices.      Specifically,      we noted the
lack of (1) dual control         at two offices,         (2) establishing
control    totals  at the initial        point of receipt       at three
offices,     (3) accountability       (no "Hold" log) for monetary
items held for research at three offices,                  (4) supervisory
review on receipts      forwarded to the Field Finance Center
 (FFC)' at four offices,        and (5) segregation          of duties   at one
Receipts were not properly    controlled      because when DOF
consolidated  its cashier  function      into FFC, DOF and DOA did
not modify receipt  and mail room procedures         and borrowers

'FFC was formerly      the National     Financial     Service   Center.
3                          GAO/AIMD-97-142R'FDIC         Management Letter
continued    to mail their payments to field     offices.       These
control   weaknesses created the opportunity      and potential       for
monetary items to be misplaced,      temporarily     forgotten,
misappropriated,     or misdirected.
In December 1996, FFC directed             field    offices     to not hold
monetary items, but rather to immediately                   forward them to
FFC. Also, in February            1997, DOF placed in operation           the
Field    Financial     Oneration     (FFO) AccountincT Manual.          The new
manual replaces        the RAM and establishes           specific   procedures
field    offices    are required       to perform when monetary items
are received       and then transferred          to FFC. FFC obtained        the
field    offices    affirmation      that they are now in compliance
with the FFO Accountina           Manual.      Further,     DOA has proposed
working with DOF to review its mail room procedures,                     develop
a directive      pertaining      to mail room operations,          and
establish      a review program to ensure compliance with the new
We suggest DOA and DOF proceed with DOA's proposal.                   DOA's
revised mail room operations  should include adequate
safeguards,  accountability, and supervisory controls                 over
FDIC's Accounts Pavable Procedures Manual and FFO Accountinq
Manual, in effect        through 1996, required    that disbursements
be accurately       recorded in the appropriate     period and
correctly     classified     in general ledger accounts to permit
preparation      of reports    and statements   in conformity   with the
Corporation's      policies.     These manuals also required     that
checks be issued in numerical           sequence and that missing
documents be immediately         reported.
Prior to selecting     our sample of 1996 check disbursements
for testing,    we reviewed the population   of check
disbursement    data from FDIC's accounts payable systems for
possible, gaps in issued check numbers.      Based on this
review,   we found 25 Liability    Dividend System (LDS) checks
that were not uploaded into the accounts payable system and
were not recorded in the general ledger during 1996.        In
addition,    we found two LDS checks that were not used.      For
these two checks, FDIC was unable to provide sufficient
documentation     to show why these checks were not used.
Because FDIC did not have procedures in place to identify
and explain check number gaps, controls   were not in place
during 1996 to account for all checks or to ensure that
funds were safeguarded against unauthorized   use.   In
 4                          GAO/AIMD-97-142R FDIC Management Letter
addition,    the general ledger      did not properly    reflect  all
check disbursement     activity    that occurred during 1996.
Although   these amounts were      irmnaterial  in 1996, material
misstatements    could occur in      the future   if check gap control
procedures    are not in place.
We suggest that FDIC implement specific          procedures    to ensure
that all check number gaps are identified           and resolved
promptly.   In addition,  we suggest that        LDS be modified    so
that the system automatically     generates      the next starting
check number as dividends     are processed.

The Comptroller     General’s   Standards for Internal       Controls  in
the Federal Government require        that transactions      be
authorized    and executed only by persons acting within           the
scope of their     authority.    Accordingly,    FDIC's Accounts
Pavable Procedures Manual established         the scope of authority
relating    to approval of disbursements      within    the Accounts
Payable System (APS). The manual required            that only
supervisory    personnel with release authority         approve
disbursements    within    the APS.
During our 1996 audits,       we found that the accounts payable
supervisor    and the accounting manager in the FFC granted
clerks   in the accounts payable unit the authority            to approve
disbursements     within APS. Although FFC management            stated
that the change was due to the downsizing            of staff,    FFC did
not provide     documentation   supporting    that the proper
official    approved this deviation      from established
procedures.      Changes in authorizations       without   proper
approval    could lead to transactions       not being processed in
accordance with FDIC's policies         and procedures.
FFC management informed us that the clerks             are no longer
authorizing      transactions     and their supervisory    capability
within    APS has been deleted.        Further,  security   records
indicate    that    the clerks did not have concurrent        input and
approval    capability      within APS, thereby maintaining
segregation      of duties,
Nonetheless,   we suggest that FDIC require    personnel    to
obtain approval by the proper official     before'implementing
any deviations   from established disbursement     procedures.

5                         GAO/AIMD-97-142R FDIC Management Letter
The Comptroller      General's    Standards for Internal         Controls    in
the Federal Government require written              evidence of all
pertinent    aspects of transactions         and require    the
transaction     documentation     to be complete and readily
available    for examination.       The FDIC's Accounts Pavable
Manual and Accounts Pavable Procedures Manual,                in effect
during 1996, required        a DOF approving official         to initial
the Group Edit Report (GER) or sign the Daily Invoice
Register    (DIR) after reviewing        for validity,     accuracy,     and
completeness of critical        disbursement      data entered into the
accounts payable system,         The manuals specifically
identified     the GER and the DIR as documentation             required   to
be retained      for disbursement     transactions.
However, for eight disbursement          transactions      we tested as
part of our 1996 audits,        FFC personnel      could not provide us
with all    the required   documents.       Specifically,     FDIC was
unable to provide five GERs and three DIRs.                FFC management
stated that one GER was destroyed           based on its local GER
retention    policy   and that another GER was discarded           after
being used as part of Financial          Information      Management
System testing.?       FFC personnel    could not locate the
remaining signed/initialed        three GERs and three DIRs.            By
not maintaining     these documents, FFC is not complying with
its established     procedures.      Further,    the absence of the
GERs and DIRs reduces the amount of evidence that critical
disbursement data entered into the accounts payable system
was reviewed for validity,        accuracy,     and~completeness.
We suggest that FDIC review its procedures     to (1) identify
disbursement   documents that should be retained   and
(2) ensure documentary evidence of the review of critical
disbursement   data entered into its accounts payable system
be readily   available  for examination.
FDIC's record retention         and disposition       procedures    require
that copies of payroll         and related     records be retained        for
6 years.  FDIC could not        locate time and attendance          related
reports  for five of the        payroll    transactions      we tested as
part of our 1996 audits.          The missing records pertained           to
employee representations          and supervisory       approvals   of hours

2Beginning in 1997, FDIC established     a new general ledger
system called the Financial  Information    Management System.
 6                          GAO/Am-97-142R         FDIC Management Letter
FDIC representatives           stated their belief        that these are
isolated      instances     and not indicative        of a systemic internal
control    weakness and that records may have been misplaced
during downsizing of field              offices   and decentralizing      of
payroll    records.        However, FDIC acknowledged the importance
of retaining       payroll     related     records in order to deter
fraud, waste, and abuse, and to maintain                  an audit trail;     it
recently     issued internal         communication     to all Divisions      and
Offices    reiterating       record     retention   requirements.      FDIC is
also planning       to (1) list        the specific    record retention
responsibilities        in its upcoming revised           Time & Attendance
Reporting Directive          scheduled for implementation          during the
third quarter of 1997 and (2) revise                its time and attendance
process in 1998 to be able 'to maintain                electronic    copies of
documents in place of hard copies.
We suggest that the FDIC Division     of Administration      continue
to periodically  emphasize its record retention       policies    to
all FDIC personnel responsible    for payroll   and time and
attendance record keeping.
FDIC presents FRF's financial      statements           in accordance with
generally     accepted accounting  principles            {GA&P). Accrual
accounting     concepts are an integral     part        of GAAP, and
require    that revenues be recognized      when        they are earned as
opposed to when cash is received.
During     1996, FDIC recorded the interest              income on FRF's
securitization        reserve   (established       to cover future
estimated      losses on securitization          transactions)      on a cash
basis of accounting.           Thus, interest        income was only
recognized when cash payments were received.                     Because some
of the reserve funds are invested              in securities       with
maturities      up to 6 months, an accrual basis of accounting
would more fairly         state securitization          reserve fund interest
income in accordance with GAAP. During                    1996, FDIC recorded
$82.1 million       in interest     income on a cash basis.             This
figure    represented      3 months of interest          receipts,    as FRF
owned the securitization          reserves     for the last 3 months of

                            GAO/Am-97-142R          FDIC Management Letter
1996 .3 For 1997, the interest   income figure  will be
significantly   greater, as FRF will  earn income for the
entire    year.
We suggest that FDIC review the impact of using cash-based
amounts for recording   interest   income on the securitization
reserve funds.   FDIC should evaluate whether the cash-based
income  amount approximates    an accrual-based      figure  or if
adjustments  are necessary for financial       reporting    purposes.

We would appreciate     receiving    your comments as well as a
description    and the status of your planned corrective
actions within     30 days from the date of this letter.            We
appreciate   the cooperation      and assistance    the F'DIC
management and staff     provided during our 1996 audits.            We
are sending copies of this letter         to the FDIC Inspector
General and the FDIC Audit Committee.            If you have any
questions   or need assistance      in addressing     these matters,
please contact me at (202) 512-9406 or Jeanette             Franzel,
Assistant   Director,   at (202) 512-9471.
Sincerely   yours,

Robert W. Gramling
Director,   Corporate    Audits
   and Standards


"In October 1996, the securitization       reserve funds used to
cover future estimated      losses were transferred      from the
receiverships    to FRF in its corporate     capacity.      The
transfer    was offset   by amounts owed by the receiverships       to
FRF. The reserve funds are generally         invested    in U.S.
Treasury Bills,     highly collateralized    securities,     and money
market funds.      As of December 31, 1996, the balance in the
reserve fund totaled      $6.3 billion.
8                         GAO/Am-97-142R       FDIC Management Letter
Ordering Information
The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order
made out to the Snperintendent of Documents, when
necessary. VISA and Mastercard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 6016
Gaithersburg, MD 20834-6015

or visiti

Room 1100
706 4th St. NW (corner of 4th aand G Sts. NW)
U.S. General Accounting OfEke
Washington, DC

Orders may also be placed by calling (202) 612-6006
or by using fax number (301) 263-4066, or TDD (301) 413-0006.

Each day, GAO issues a List of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list Iiom the past 30 days, please call (202) 612-6000 using a
touchtone phone. A recorded menu will provide i&ormation on
how to obtain these lists.

For information on how to access GAO reports on the INTEENET,
send an e-mail message wit&‘info” in the body to:


or visit GAO’s World Wide Web Home Page St:

United States
General Accounting Office
Washington, D.C. 20548-0001
Official Bnsiness
Penalty for Private    Use $300

Address   Correction   Reanested