United States Government Accountability Office GAO Testimony Before the Subcommittee on Readiness and Management Support, Committee on Armed Services, U.S. Senate DOD FINANCIAL For Release on Delivery Expected at 2:30 p.m. EDT Wednesday, April 18, 2012 MANAGEMENT Challenges in Attaining Audit Readiness and Improving Business Processes and Systems Statement of Asif A. Khan, Director Financial Management and Assurance GAO-12-642T April 18, 2012 DOD FINANCIAL MANAGEMENT Challenges in Attaining Audit Readiness and Improving Business Processes and Systems Highlights of GAO-12-642T, a testimony before the Subcommittee on Readiness and Management Support, Committee on Armed Services, U.S. Senate Why GAO Did This Study What GAO Found Over the years, the Department of GAO’s recent work highlights the types of challenges facing the Department of Defense (DOD) has initiated several Defense (DOD) as it strives to attain audit readiness and reengineer its business efforts intended to improve its financial processes and systems. The urgency in addressing these challenges has been management operations and ultimately increased by the goals of an auditable DOD Statement of Budgetary Resources achieve an unqualified (clean) opinion (SBR) by the end of fiscal year 2014 and a complete set of auditable financial on its financial statements. These statements by the end of fiscal year 2017. For example, GAO’s 2011 reporting efforts have fallen short of sustained highlights difficulties the DOD components experienced in attempting to achieve an improvement in financial management auditable SBR. These include: and financial statement auditability. • the Navy’s and the Air Force’s premature assertions of audit readiness and In this statement, GAO provides its missed interim milestones; assessment of DOD’s progress toward: • the Army’s inability to locate and provide supporting documentation for its (1) producing an auditable Statement military pay; of Budgetary Resources (SBR) by fiscal year 2014 and a complete set of • the Navy’s and Marine Corps’ inability to reconcile their Fund Balance with auditable financial statements by fiscal Treasury (FBWT) accounts; and year 2017, including the development of interim milestones for both • the Marine Corps’ inability to receive an opinion on both its fiscal years 2010 aforementioned audit readiness goals; and 2011 SBRs because it could not provide supporting documentation in a (2) acquiring and implementing new timely manner, and support for transactions was missing or incomplete. enterprise resource programs and In a February 2012 briefing on its updated plans, DOD accelerated milestones for its other critical financial management components —in some cases, significantly—to accomplish the 2014 SBR goal. For systems; (3) reengineering business example, the Air Force had planned to validate its audit readiness for many SBR- processes and instituting needed related items in fiscal year 2016; however, the department’s February 2012 controls; and (4) implementing a accelerated plans show that most of the Air Force’s SBR line items will be audit-ready comprehensive business enterprise in fiscal years 2013 or 2014. Also, in its February 2012 update DOD shows that 7 of architecture and transition plan, and 24 material general fund Defense Agencies and Other Defense Organizations have improved investment control either already had SBR audits or are ready to have their SBRs audited, which processes. represent important positive steps. This statement is primarily based on DOD has stated it considers the successful implementation of its enterprise resource GAO’s prior work related to the planning (ERP) systems critical to transforming its business operations, addressing department’s efforts to achieve audit long-standing weaknesses, and ensuring the department meets its mandated readiness, implement modern business September 30, 2017 auditability goals. However, in 2011, GAO reported that systems, and reengineer its business independent assessments of two of these systems—the Army’s and Air Force’s new processes. GAO also obtained and general ledger systems—identified operational problems, gaps in capabilities that compared key milestones in a required manual workarounds, and training that was not focused on system February 2012 DOD briefing on its operation. Moreover, users of these systems had difficulties using these systems to updated plans to accelerate achieving perform daily operations. GAO also reported in 2011 on numerous weaknesses in SBR auditability with the May 2011 DOD’s enterprise architecture and business processes that affect DOD’s auditability. Financial Improvement and Audit For example, while DOD continued to update its corporate enterprise architecture, it Readiness plan but did not had not yet augmented its corporate architecture with complete, coherent subsidiary independently verify the updated architectures for DOD components such as the military departments. Also, while information in the February 2012 DOD and the military departments largely followed DOD’s Business Process briefing. Reengineering Guidance to assess business system investments, they had not yet performed the key step of validating assessment results. GAO has made prior recommendations to address these issues. DOD has generally agreed with these recommendations and is taking corrective actions in response. GAO has work View GAO-12-642T. For more information, underway to evaluate DOD’s continuing efforts in these areas. contact Asif A. Khan at (202) 512-9869 or email@example.com. United States Government Accountability Office Chairman McCaskill, Ranking Member Ayotte, Members of the Subcommittee: It is a pleasure to be here today to discuss the status of the Department of Defense’s (DOD) efforts to improve its financial management and related business operations and to achieve audit readiness. DOD has been required to prepare departmentwide financial statements and have them audited since 1997, but through 2011, has not been able to meet this requirement. 1 On October 13, 2011, the Secretary of Defense directed the department to achieve audit readiness for the Statement of Budgetary Resources (SBR) for General Fund 2 activities by the end of fiscal year 2014 3 as an interim milestone toward meeting the mandate in the National Defense Authorization Act (NDAA) for Fiscal Year 2010 to achieve full audit readiness for DOD’s complete set of financial statements by the end of 2017. 4 Given the federal government’s fiscal challenges, it is more important than ever that the Congress, the administration, and federal managers have reliable, useful, and timely financial and performance information, particularly for the government’s largest department. Today, I will discuss DOD’s progress toward: (1) achieving the goals of an auditable SBR by fiscal year 2014 and a complete set of auditable financial statements by fiscal year 2017, including the development of interim milestones for both audit readiness goals, (2) acquiring and implementing new enterprise resource programs and other critical financial management systems, (3) reengineering business processes and instituting needed controls, and (4) implementing a comprehensive 1 The Chief Financial Officers Act of 1990, Pub. L. No. 101-576, title III, § 303, 104 Stat. 2838, 2849 (Nov. 15, 1990), initially required annual audited financial statements of certain DOD components and activities, but the Government Management Reform Act of 1994, Pub. L. No. 103-356, § 405, 108 Stat. 3410, 3415 (Oct. 13, 1994), expanded the annual requirement to departmentwide financial statements beginning with fiscal year 1996, which at the time had to be prepared no later than March 1, 1997. See 31 U.S.C. § 3515. 2 An agency’s general fund accounts are those accounts in the U.S. Treasury holding all federal money not allocated by law to any other fund account. GAO, High-Risk Series: An Update, GAO-11-278 (Washington, D.C.: Feb 16, 2011). 3 DOD, Secretary of Defense Memorandum, “Improving Financial Information and Achieving Audit Readiness,” October 13, 2011. 4 Pub. L. No. 111-84, § 1003(a), (b), 123 Stat. 2190, 2439-40 (Oct. 28, 2009). Page 1 GAO-12-642T business enterprise architecture and transition plan, and improved investment control processes. My statement today is primarily based on our prior work related to the department’s efforts to achieve audit readiness, implement modernized business systems and a business enterprise architecture, and reengineer its business processes. In addition, we are providing information on DOD’s updated plans for achieving auditability presented at a February 2012 briefing. Specifically, we are presenting a comparison of key milestones in the February 2012 DOD briefing 5 that outlined its plans to accelerate the timeframe to achieve SBR auditability with DOD’s May 2011 Financial Improvement and Audit Readiness (FIAR) plan. We also conducted interviews with DOD officials about the February 2012 briefing. We did not independently verify information contained in the February 2012 briefing with DOD or any of its components or agencies. Our work on which this testimony is based was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Additional information on our scope and methodology is available in previously issued products. According to the fiscal year 2013 President’s Budget, DOD accounts for Background about 57 percent of the discretionary federal budget authority. (See figure 1.) 5 Office of the Secretary of Defense (Comptroller), Accelerated Financial Improvement and Audit Readiness (FIAR) Plan, presented to the staff of the House Committee on Oversight and Government Reform, February 14, 2012. Page 2 GAO-12-642T Figure 1: Comparison of DOD’s Fiscal Year Budget Authority with That of Other Federal Agencies For fiscal year 2011, of the 24 agencies covered by the Chief Financial Officers Act of 1990 (CFO Act), DOD was the only agency to receive a disclaimer of opinion on all of its financial statements. 6 The DOD Inspector General (IG) reported that • the department’s fiscal year 2011 financial statements would not substantially conform to generally accepted accounting principles; • DOD’s financial management and feeder systems were unable to adequately support material amounts on the financial statements; and • long-standing material internal control weaknesses identified in prior audits continued to exist, including material weaknesses in areas such as financial management systems, Fund Balance with Treasury, Accounts Receivable, and General Property, Plant, and Equipment. In 2005, the DOD Comptroller first prepared the Financial Improvement and Audit Readiness (FIAR) Plan for improving the department’s 6 In a disclaimer of opinion, the auditor does not express an opinion on the financial statements. A disclaimer of opinion is appropriate when the audit scope is not sufficient to enable the auditor to express an opinion, or when there are material uncertainties involving a scope limitation—a situation where the auditor is unable to obtain sufficient appropriate audit evidence. Page 3 GAO-12-642T business processes. The FIAR Plan is DOD’s strategic plan and management tool for guiding, monitoring, and reporting on the department’s financial management improvement efforts. As such, the plan communicates progress in addressing the department’s financial management weaknesses and achieving financial statement auditability. In accordance with the NDAA for Fiscal Year 2010, DOD provides reports to relevant congressional committees on the status of DOD’s implementation of the FIAR Plan twice a year—no later than May 15 and November 15. 7 The NDAA for Fiscal Year 2010 also mandated that the FIAR Plan include the specific actions to be taken to correct the financial management deficiencies that impair the department’s ability to prepare timely, reliable, and complete financial management information. 8 In May 2010, the DOD Comptroller issued the FIAR Guidance to implement the FIAR Plan. The FIAR Guidance provides a standardized methodology for DOD components to follow for achieving financial management improvements and auditability. The FIAR Guidance requires DOD components to identify and prioritize their business processes into assessable units, 9 and then prepare a Financial Improvement Plan (FIP) for each assessable unit in accordance with the FIAR Guidance. Many of the procedures required by the FIAR Guidance are consistent with selected procedures for conducting a financial audit, such as testing internal controls and information system controls. In September 2010, we reported that the department needed to focus on implementing its FIAR Plan and that the key to successful implementation would be the efforts of the DOD military components and the quality of their individual FIPs. 10 A FIP serves as a framework of steps and documentation requirements for both planning and implementing the FIAR Guidance. For example, civilian and military pay are two assessable units for which DOD 7 Pub. L. No.111-84, §1003(b). 8 Pub. L. No.111-84, §1003(a)(2). 9 An assessable unit can be any part of the financial statements, such as a line item or a class of assets (e.g., civilian pay or military equipment), a class of transactions, or it can be a process or a system that helps produce the financial statements. 10 GAO, Department of Defense: Financial Management Improvement and Audit Readiness Efforts Continue to Evolve, GAO-10-1059T (Washington, D.C.: Sept. 29, 2010). Page 4 GAO-12-642T components, such as the Army, Navy, and Air Force, are expected to develop and implement FIPs in accordance with the FIAR Guidance. The steps required for these plans include assessing processes, controls, and systems; identifying and correcting weaknesses; assessing, validating, and sustaining corrective actions; and ultimately achieving audit readiness. After a component’s management determines that an assessable unit is ready for audit, both the DOD Comptroller and the DOD Inspector General (IG) review the related FIP documentation to determine if they agree with management’s conclusion of audit readiness. DOD intends to progress toward achieving financial statement auditability by executing the FIAR Guidance methodology for groups of assessable units across four waves. Under the FIAR Plan, successful execution of the FIAR Guidance methodology for groups of assessable units across these waves is intended to result in the audit readiness of various components’ financial statements through fiscal year 2017. The first two waves of the FIAR Plan focus on achieving the DOD Comptroller’s interim budgetary priorities, which DOD believes should lead to an auditable SBR. The third wave focuses on accountability for DOD’s mission-critical assets, and the fourth wave focuses on the remaining assessable units constituting DOD’s complete set of financial statements. As mentioned earlier, the Secretary of Defense directed the department to achieve audit readiness for the SBR for General Fund activities by the end of fiscal year 2014. The NDAA for Fiscal Year 2012 reinforced this directive by requiring that the next FIAR Plan Status Report—to be issued in May 2012—include a plan, with interim objectives and milestones for each military department and the defense agencies, to support the goal of SBR audit readiness by 2014. 11 The NDAA for Fiscal Year 2012 also requires the plan to include process and control improvements and business systems modernization efforts necessary for the department to consistently prepare timely, reliable, and complete financial management information. The SBR is the only financial statement predominantly derived from an entity’s budgetary accounts in accordance with budgetary accounting rules, which are incorporated into generally accepted accounting principles (GAAP) for the federal government. The SBR is designed to 11 Pub. L. No. 112-81, §1003, 125 Stat. 1298, 1555 (Dec. 31, 2011). Page 5 GAO-12-642T provide information on authorized budgeted spending authority reported in the Budget of the United States Government (President’s Budget), including budgetary resources, availability of budgetary resources, and how obligated resources have been used. Overview of DOD’s In November 1990, DOD created the Defense Finance and Accounting Accounting and Business Service (DFAS) as its accounting agency to consolidate, standardize, and Operations integrate finance and accounting requirements, functions, procedures, operations, and systems. 12 The military services continue to perform certain finance and accounting activities at each military installation. These activities vary by military service depending on what the services retained and the number of personnel they transferred to DFAS. As DOD’s accounting agency, DFAS is critical to DOD auditability as it records transactions in the accounting records, prepares thousands of reports used by managers throughout DOD and by the Congress, and prepares DOD-wide and service-specific financial statements. The military services play a vital role in that they authorize most of DOD’s expenditures and are the source of most of the financial information that DFAS uses to make payroll and contractor payments. The military services also have responsibility for most of DOD’s assets and the related information needed by DFAS to prepare annual financial statements required under the CFO Act. To support its operations, DOD performs an assortment of interrelated and interdependent business functions, such as logistics, procurement, health care, and financial management. As we have previously reported, the DOD systems environment that supports these business functions has been overly complex, decentralized, and error prone, characterized by (1) little standardization across the department, (2) multiple systems performing the same tasks and storing the same data, and (3) the need for data to be entered manually into multiple systems. For fiscal year 2012, the department requested about $17.3 billion to operate, maintain, and modernize its business systems. DOD has reported that it relies on 2,258 business systems, including 335 financial management systems, 709 human resource management systems, 645 logistics systems, 243 real property and installation systems, and 281 weapon acquisition management systems. 12 DOD Directive 5118.5, "Defense Finance and Accounting Service" (Nov. 26, 1990). Page 6 GAO-12-642T Importance of Business For decades, DOD has been challenged in modernizing its timeworn Enterprise Architecture business systems. Since 1995, GAO has designated DOD’s business and Reengineering systems modernization program as high risk. In June 2011, we reported that the modernization program had spent hundreds of millions of dollars Business Processes on an enterprise architecture and investment management structures that had limited value. 13 As our research on public and private sector organizations has shown, two essential ingredients to a successful systems modernization program are an effective institutional approach to managing information technology (IT) investments and a well defined enterprise architecture. 14 For its business systems modernization, DOD is developing and using a federated business enterprise architecture, which is a coherent family of parent and subsidiary architectures, to help modernize its nonintegrated and duplicative business operations and the systems that support them. Section 1072 of the NDAA for Fiscal Year 2010 requires that programs submitted for approval under DOD’s business system investment approach be assessed to determine whether or not appropriate business process reengineering efforts have been undertaken. The act further states that these efforts should ensure that the business process to be supported by the defense business system modernization will be as streamlined and efficient as practicable and the need to tailor commercial off-the-shelf systems to meet unique requirements or incorporate unique interfaces has been eliminated or reduced to the maximum extent practicable. 15 GAO’s recent work highlights the types of challenges facing DOD as it Challenges in strives to attain audit readiness and reengineer its business processes Achieving Audit and systems. DOD leadership has committed DOD to the goal of auditable financial statements and has developed FIAR Guidance to Readiness provide specific instructions for DOD components to follow for achieving auditability incrementally. The department and its components also established interim milestones for achieving audit readiness for various 13 GAO, Department of Defense: Further Actions Needed to Institutionalize Key Business System Modernization Management Controls, GAO-11-684 (Washington, D.C.: June 29, 2011). 14 GAO-11-684. 15 Pub. L. No.111-84, § 1072 (amending 10 U.S.C. §2222). Page 7 GAO-12-642T parts (or assessable units) of the financial statements. These efforts are an important step forward. The urgency in addressing these challenges has been increased by the recent efforts to accelerate audit readiness time frames, in particular attaining audit readiness for the department’s SBR by fiscal year 2014. Our September 2011 report highlights the types of challenges DOD may continue to face as it strives to attain audit readiness, including instances in which DOD components prematurely asserted audit readiness and missed interim milestones. 16 Also, DOD’s efforts over the past couple of years to achieve audit readiness for some significant SBR assessable units have not been successful. However, these experiences can serve to provide lessons for DOD and its components to consider in addressing the department’s auditability challenges. DOD Component DOD’s ability to achieve departmentwide audit readiness is highly Compliance with FIAR dependent on its military components’ ability to effectively develop and Guidance Is Crucial to implement FIPs in compliance with DOD’s FIAR Guidance. However, in our September 2011 report, we identified several instances in which the Ensuring Audit Readiness components did not prepare FIPs that fully complied with the FIAR Guidance, resulting in premature assertions of audit readiness. Specifically, as we reported in September 2011, the FIAR Guidance provides a reasonable methodology for the DOD components to follow in developing and implementing their FIPs. 17 It details the roles and responsibilities of the DOD components, and prescribes a standard, systematic approach that components should follow to assess processes, controls, and systems, and identify and correct weaknesses in order to achieve auditability. When DOD components determine that sufficient financial improvement efforts have been completed for an assessable unit in accordance with the FIAR Guidance and that the assessable unit is ready for audit, the FIP documentation is used to support the conclusion of audit readiness. Thus, complying with the FIAR Guidance can provide a consistent, systematic means for DOD components to achieve and verify audit readiness incrementally. 16 GAO, DOD Financial Management: Improvement Needed in DOD Components’ Implementation of Audit Readiness Effort, GAO-11-851 (Washington, D.C.: Sept. 13, 2011). 17 GAO-11-851. Page 8 GAO-12-642T We found that when DOD components did not prepare FIPs that fully complied with the FIAR Guidance, they made assertions of audit readiness prematurely and did not achieve interim milestones.18 While the components initially appeared to meet some milestones by asserting audit readiness in a timely manner, reviews of supporting documentation for the FIPs of two assessable units and attempts to audit the Marine Corps’ SBR revealed that the milestones had not been met because the assessable units were not actually ready for audit. For example, the Navy asserted audit readiness for its civilian pay in March 2010 and the Air Force asserted audit readiness for its military equipment in December 2010. However, we reported that neither component had adequately developed and implemented their FIPs for these assessable units in accordance with the FIAR Guidance and were therefore not ready for audit. The Marine Corps first asserted financial audit readiness for its General Fund SBR on September 15, 2008. The DOD IG reviewed the Marine Corps’ assertion package and on April 10, 2009, reported that the assertion of audit readiness was not accurate, and that its documentation supporting the assertion was not complete. GAO has made prior recommendations to address these issues. DOD has generally agreed with these recommendations and is taking corrective actions in response. Reported DOD Progress The Secretary of Defense’s direction to achieve audit readiness for the toward Audit Readiness SBR by the end of 2014 necessitated that DOD’s components revise for the Statement of some of their plans and put more focus on short-term efforts to develop accurate data for the SBR in order to achieve this new accelerated goal.19 Budgetary Resources In August 2011, DOD’s military components achieved one milestone toward SBR auditability when they all received validation by an independent public accounting firm that their Appropriations Receipt and Distribution—a section of the SBR—was ready for audit. In addition, the November 2011 FIAR Plan Status Report indicated that the Air Force achieved audit readiness for its Fund Balance with Treasury (FBWT). 18 GAO-11-851. 19 In addition to requiring audit readiness of the SBR, the Secretary’s memo also directed the DOD Comptroller to increase emphasis on accountability for assets; execute a full review of the department’s financial controls over the next 2 years and establish interim goals for assessing progress; ensure mandatory training for audit and other key financial efforts, and establish a pilot certification program for financial managers; appropriately resource efforts to meet these goals; and meet the legal requirement for full financial statement audit readiness by 2017. Page 9 GAO-12-642T Further, in a February 2012 briefing on its accelerated plans, DOD indicated that 7 of 24 material general fund Defense Agencies and Other Defense Organizations are either already sustaining SBR audits or are ready to have their SBRs audited. 20 These accomplishments represent important positive steps. Nevertheless, achieving audit readiness for the military components’ SBRs is likely to pose significant challenges based on the long-standing financial management weaknesses and audit issues affecting key SBR assessable units. Our recent reports highlight some of the difficulties that the components have experienced recently related to achieving an auditable SBR, including • the Army’s inability to locate and provide supporting documentation for its military pay; 21 • the Navy’s and the Marine Corps’ inability to reconcile their Fund Balance with Treasury accounts; 22 and • the Marine Corps’ inability to provide sufficient documentation to auditors of its SBR. 23 To achieve SBR audit readiness by 2014, DOD and its components need accelerated, yet feasible, well-developed plans for identifying and correcting weaknesses in the myriad processes involved in producing the data needed for the SBR. While DOD has developed an accelerated FIAR Plan to provide an overall view of the department’s approach for meeting the 2014 goal, most of the work must be carried out at the component level. 20 According to the February 2012 accelerated plan, the seven Defense Agencies and Other Defense Organizations that are already sustaining SBR audits are the Defense Finance and Accounting Service (DFAS), Defense Contract Audit Agency (DCAA), TRICARE Management Activity—Contract Resource Management, Defense Commissary Agency, Medicare Eligible Retiree Healthcare Fund, Military Retirement Fund, and the DOD Office of the Inspector General. 21 GAO, DOD Financial Management: The Army Faces Significant Challenges in Achieving Audit Readiness for Its Military Pay, GAO-12-501T (Washington, D.C.: March 22, 2012). 22 GAO, DOD Financial Management: Ongoing Challenges with Reconciling Navy and Marine Corps Fund Balance with Treasury, GAO-12-132 (Washington, D.C.: Dec. 20, 2011). 23 GAO, DOD Financial Management : Marine Corps Statement of Budgetary Resources Audit Results and Lessons Learned, GAO-11-830 (Washington, D.C.: Sept. 15, 2011). Page 10 GAO-12-642T Army’s Inability to Locate and The Army’s active duty military payroll, reported at $46.1 billion for fiscal Provide Supporting year 2010, made up about 20 percent of its reported net outlays for that Documentation for Military Pay year. As such, it is significant to both Army and DOD efforts for achieving auditability for the SBR. For years, we and others have reported continuing deficiencies in the Army’s military payroll processes and controls. 24 Moreover, other military components such as the Air Force and the Navy share some of these same military payroll deficiencies. In March 2012, we reported that the Army could not readily identify a complete population of its payroll accounts for fiscal year 2010. 25 DOD’s FIAR Guidance states that identifying the population of transactions is a key task essential to achieving audit readiness. However, the Army and DFAS-Indianapolis (DFAS-IN), which is responsible for accounting, disbursing, and reporting for the Army’s military personnel costs, did not have an effective, repeatable process for identifying the population of active duty payroll records. For example, it took 3 months and repeated attempts before DFAS-IN could provide a population of service members who received active duty Army military pay in fiscal year 2010. Further, because the Army does not have an integrated military personnel and payroll system, it was necessary to compare the payroll file to active Army personnel records. However, DOD’s central repository for information on DOD-affiliated personnel did not have an effective process for comparing military pay account files with military personnel files to identify a valid population of military payroll transactions. In addition, the Army and DFAS-IN were unable to provide documentation to support the validity and accuracy of a sample of fiscal year 2010 payroll transactions we selected for review. For example, DFAS-IN had difficulty retrieving and providing usable Leave and Earnings Statement files and the Army was unable to locate or provide supporting personnel 24 DOD Inspector General, Active Duty Military Personnel Accounts Were Generally Valid and Secure, but DoD May have Made Improper Payments, D-2011-093 (Arlington, Va.: July 27, 2011); GAO, Military Pay: The Defense Finance and Accounting Service– Indianapolis Could Improve Control Activities over Its Processing of Active Duty Army Military Personnel Federal Payroll Taxes, GAO-09-557R (Washington, D.C.: June 18, 2009); Military Pay: Hundreds of Battle-Injured GWOT Soldiers Have Struggled to Resolve Military Debts, GAO-06-494 (Washington, D.C.: Apr. 27, 2006); Military Pay: Army National Guard Personnel Mobilized to Active Duty Experienced Significant Pay Problems, GAO-04-89 (Washington, D.C.: Nov. 13, 2003). 25 GAO, DOD Financial Management: The Army Faces Significant Challenges in Achieving Audit Readiness for Its Military Pay, GAO-12-406 (Washington, D.C.: Mar. 22, 2012). Page 11 GAO-12-642T documents for a statistical sample of fiscal year 2010 Army military pay accounts. At the end of September 2011, 6 months after we had provided them with our sample of 250 items, the Army and DFAS-IN were able to provide complete documentation for only 2 of the sample items and provided only partial documentation for another 3 items; they were unable to provide any documentation for the remaining 245 sample items. At of the time of our report, the Army had several military pay audit readiness efforts planned or under way. Timely and effective implementation of these efforts could help reduce the risk of DOD not achieving the SBR audit readiness goal of 2014. However, most of these actions are in the early planning stages. Moreover, these initiatives, while important, do not address (1) establishing effective processes and systems for identifying a valid population of military payroll records, (2) ensuring Leave and Earnings Statement files and supporting personnel documents are readily available for verifying the accuracy of payroll records, (3) ensuring key personnel and other pay-related documents that support military payroll transactions are centrally located, retained in service member Official Military Personnel Files, or are otherwise readily accessible, and (4) requiring the Army’s Human Resources Command to periodically review and confirm that service members’ Official Military Personnel File records are consistent and complete to support annual financial audit requirements. GAO has made prior recommendations to address these issues. DOD has agreed with these recommendations and is taking corrective actions in response. Navy’s and Marine Corps’ A successful audit of the SBR is dependent on the ability to reconcile an Inability to Reconcile Fund agency’s Fund Balance with Treasury (FBWT) with the Treasury records. Balance with Treasury FBWT is an account that reflects an agency’s available budget spending authority by tracking its collections and disbursements. Reconciling a FBWT account with Treasury records is a process similar in concept to reconciling a check book with a bank statement. In December 2011, we reported that neither the Navy nor the Marine Corps had implemented effective processes for reconciling their FBWT. 26 The Navy and the Marine Corps rely on the DFAS location in Cleveland (DFAS-CL) to perform their FBWT reconciliations. We found numerous deficiencies in DFAS processes that impair the Navy’s and the Marine 26 GAO-12-132. Page 12 GAO-12-642T Corps’ ability to effectively reconcile their FBWT with Treasury records, including the following. • There are significant data reliability issues with the Defense Cash Accountability System (DCAS), which records daily collections and disbursements activity. The Navy and Marine Corps rely on DCAS to reconcile their FBWT to Treasury records. • DFAS-CL did not maintain adequate documentation for the sample items we tested to enable an independent evaluation of its efforts to research and resolve differences. • DFAS-CL recorded unsupported entries (plugs) to force Navy and Marine Corps appropriation balances to agree with those reported by Treasury instead of investigating and resolving differences between these two services’ appropriation balances and those maintained by Treasury. Navy, Marine Corps, and DFAS-CL officials acknowledged that existing FBWT policies and procedures were inadequate. Navy and DFAS-CL officials stated that the base realignment and closure changes from 2006 through 2008 resulted in loss of experienced DFAS-CL personnel and that remaining staff have not received the needed training. In response to our recommendations, the Navy developed a plan of action and milestones (POAM) intended to address the Navy’s audit readiness weaknesses, including FBWT required reconciliations. Difficulty in Auditing the The Marine Corps received disclaimers of opinion from its auditors on its Marine Corps’ Statement of fiscal year 2010 and 2011 SBRs because it could not provide supporting Budgetary Resources documentation in a timely manner, and support for transactions was missing or incomplete. Further, the Marine Corps had not resolved significant accounting and information technology (IT) system weaknesses identified in the fiscal year 2010 SBR audit effort. The auditors also reported that the Marine Corps did not have adequate processes and controls, including systems controls, for accounting and reporting on the use of budgetary resources. Further, the Marine Corps could not provide evidence that reconciliations for key accounts (such as FBWT) and processes were being performed on a monthly basis. The auditors also identified ineffective controls in key IT systems used by the Marine Corps to process financial data. During fiscal year 2011, however, the Marine Corps was able to demonstrate progress toward auditability. For example, its auditors confirmed that as of October 2011, the Marine Corps had fully implemented 32 out of 139 fiscal year 2010 audit recommendations. Page 13 GAO-12-642T The results of the audit for fiscal year 2010 provided valuable lessons on preparing for a first-time financial statement audit. In our September 2011 report, we identified five fundamental lessons that are critical to success. 27 Specifically, the Marine Corps’ experience demonstrated that prior to asserting financial statement audit readiness, DOD components must (1) confirm completeness of populations of transactions and address any abnormal transactions and balances, (2) test beginning balances, (3) perform key reconciliations, (4) provide timely and complete responses to audit documentation requests, and (5) verify that key IT systems are compliant with the Federal Financial Management Improvement Act of 1996 28 and are auditable. GAO has made prior recommendations to address these issues. DOD has generally agreed with these recommendations and is taking corrective actions in response. These issues are addressed in GAO’s Standards for Internal Control in the Federal Government 29 and DOD’s FIAR Guidance. During our audit, Navy, Army, and Air Force FIP officials stated that they were aware of the Marine Corps lessons and were planning to, or had, incorporated them to varying degrees into their audit readiness plans. Accelerated Plans for SBR Are In its November 2011 FIAR Plan, DOD provided an overall view of its in Progress accelerated FIAR Plan for achieving audit readiness of its SBR by the end of fiscal year 2014. In its February 2012 briefing, DOD recognized key factors that are needed to achieve auditability such as the consistent involvement of senior leadership as well as the buy-in of field commanders who ultimately must implement many of the changes needed. The plan also provided interim milestones for DOD components such as the Army, Navy, Air Force, Defense Logistics Agency, and other defense agencies. Acceleration substantially compresses the time allotted for achieving some of these milestones. For example, the May 2011 FIAR Plan Status Report indicated that the Air Force had planned to validate its 27 GAO-11-830. 28 CFO Act agencies’ financial management systems are required by the Federal Financial Management Improvement Act of 1996 (FFMIA) to comply with federal financial management systems requirements, applicable federal accounting standards, and the United States Government Standard General Ledger at the transaction level, Pub. L. No. 104-208, div. A, title VIII, § 803, 110 Stat. 3009, 3009-390 (Sept. 30, 1996). 29 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). Page 14 GAO-12-642T audit readiness for many SBR-related assessable units in fiscal year 2016 and that its full SBR would not be ready for audit until 2017. However, the February 2012 briefing on the accelerated plans indicated that most of the Air Force’s SBR assessable units will be audit-ready in fiscal years 2013 or 2014. These revised dates reflect the need to meet the expedited audit readiness goal of 2014. (See figure 2.) Figure 2: Changes in SBR Interim Milestones As discussed earlier, the key to audit readiness is for DOD components to effectively develop and implement FIPs for SBR assessable units, and to meet interim milestones as they work toward the 2014 goal. According to Navy officials, the Navy plans to prepare a FIP for each of several assessable units that make up the SBR. For example, for its SBR, Navy Page 15 GAO-12-642T officials told us they have identified assessable units for appropriations received, and for various types of expenditures for which funds are first obligated and then disbursed, such as military pay, civilian pay, contracts, and transportation of people. The Air Force will prepare FIPs for assessable units similar to those of the Navy. Army officials told us they are taking a different approach from the Navy. They said that instead of developing FIPs for discrete assessable units constituting the SBR, they are preparing only one FIP for one audit readiness date for the Army’s entire SBR, an approach similar to that of the Marine Corps. For years, DOD has been developing and implementing enterprise Effective resource planning (ERP) systems, which are intended to be the backbone Implementation of to improved financial management. 30 DOD considers the successful Business Systems Is implementation of these ERP systems critical to transforming its business operations and addressing long-standing weaknesses in areas such as Critical financial and supply-chain management and business systems modernization. DOD officials have also stated that these systems are critical to ensuring the department meets its mandated September 30, 2017, goal to have auditable departmentwide financial statements. However, as we recently reported, six of these ERP systems are not scheduled to be fully deployed until either fiscal year 2017 or the end of fiscal year 2016. 31 The DOD IG reported that the Navy developed and approved deployment of the Navy ERP System without ensuring that the system complied with DOD’s Standard Financial Information Structure (SFIS) and the U.S. Government Standard General Ledger. 32 The DOD IG further stated that as a result, the Navy ERP System, which is expected to manage 54 percent of the Navy’s obligation authority when fully deployed, might not produce accurate and reliable financial information. 30 An ERP system is an automated system using commercial off-the-shelf software consisting of multiple, integrated functional modules that perform a variety of business- related tasks such as general ledger accounting, payroll, and supply chain management. 32 DOD Inspector General, Navy Enterprise Resource Planning System Does Not Comply With the Standard Financial Information Structure and U.S. Government Standard General Ledger, DODIG-2012-051 (Arlington, Va.: Feb. 13, 2012). 32 DOD Inspector General, Navy Enterprise Resource Planning System Does Not Comply With the Standard Financial Information Structure and U.S. Government Standard General Ledger, DODIG-2012-051 (Arlington, Va.: Feb. 13, 2012). Page 16 GAO-12-642T Two ERP systems—the Army’s General Fund Enterprise Business System (GFEBS) and the Air Force’s Defense Enterprise Accounting and Management System (DEAMS)—are general ledger systems intended to support a wide range of financial management and accounting functions. However, DFAS users of these systems told us that they were having difficulties using the systems to perform their daily operations. Problems identified by DFAS users included interoperability deficiencies between legacy systems and the new ERP systems, lack of query and ad hoc reporting capabilities, and reduced visibility for tracing transactions to resolve accounting differences. For example: • Approximately two-thirds of invoice and receipt data must be manually entered into GFEBS from the invoicing and receiving system due to interface problems. Army officials explained that the primary cause of the problem was that the interface specification that GFEBS is required by DOD to use did not provide the same level of functionality as the interface specification used by the legacy systems. At the time of our review, Army officials stated that they are working with DOD to resolve the problem, but no time frame for resolution had been established. • DEAMS did not provide the capability—which existed in the legacy systems—to produce ad hoc query reports that could be used to perform data analysis needed for day-to-day operations. DFAS officials noted that when DEAMS did produce requested reports, the accuracy of those reports was questionable. According to DFAS officials, they are currently working with DEAMS financial management to design the type of reports that DFAS needs. While we were told that as of February 2012, the Army and the Air Force had corrective actions under way to address identified deficiencies, specific timelines had not been developed so that progress could be monitored. 33 In February 2012, we reported that independent assessments of four ERPs—the Army’s GFEBS and Global Combat Support System (GCSS- Army), and the Air Force’s DEAMS and Expeditionary Combat Support System (ECSS)—identified operational problems, such as deficiencies in 33 GAO, DOD Financial Management: Implementation Weaknesses in Army and Air Force Business Systems Could Jeopardize DOD’s Auditability Goals, GAO-12-134 (Washington, D.C.: Feb. 28, 2012) Page 17 GAO-12-642T data accuracy, inability to generate auditable financial reports, the need for manual workarounds, and training. 34 DOD oversight authority limited the deployment of GFEBS and DEAMS on the basis of the results of the independent assessments. However, in June 2011, DOD authorized continued deployment of GFEBS and delegated further GFEBS deployment decisions to the Under Secretary of the Army. In addition to functional issues, we found that training was inadequate. According to DFAS personnel as of February 2012, the training they received for GFEBS and DEAMS did not fully meet their needs. DFAS personnel informed us that the training focused on an overview of GFEBS and DEAMS and how the systems were supposed to operate. While this was beneficial in identifying how GFEBS and DEAMS were different from the existing legacy systems, the training focused too much on concepts rather than the skills needed for DFAS users to perform their day-to-day operations. GAO has made prior recommendations to address these issues. DOD has generally agreed with these recommendations and is taking corrective actions in response. Improving the department’s business environment through efforts such as Challenges in DOD’s business enterprise architecture and improved business systems Developing and management is an important part of helping DOD achieve auditability. In June 2011, we reported that DOD had continued to make progress in Implementing DOD’s implementing a comprehensive business enterprise architecture, Business Enterprise transition plan, and improved investment control processes. 35 However, Architecture and we also reported that long-standing challenges had yet to be addressed. Specifically, we reported that while DOD continued to release updates to Investment Control its corporate enterprise architecture, the architecture had yet to be Processes augmented by a coherent family of related subsidiary architectures. 36 For example, we reported that while each of the military departments had developed aspects of a business architecture and transition plan, none of them had fully developed a well-defined business enterprise architecture 34 GAO-12-134. 35 GAO-11-684. 36 DOD's business enterprise architecture approach calls for a federated approach, in which the architecture consists of a family of coherent but distinct member architectures that conform to an overarching corporate or parent architecture. Page 18 GAO-12-642T and transition plan to guide and constrain business transformation initiatives. 37 We also reported in June 2011 that DOD continued to improve its business system investment management processes, but that much remained to be accomplished to align these processes with investment management practices associated with individual projects and with portfolios of projects. 38 With regard to individual projects, DOD and the military departments all had documented policies and procedures for identifying and collecting information about IT projects and systems to support their business system investment management processes. However, neither DOD nor the military departments had fully documented policies and procedures for selecting a new investment, reselecting ongoing investments, integrating funding with investment selection, or management oversight of IT projects and systems. With regard to portfolios of projects, DOD and the Departments of the Air Force and Navy had assigned responsibility for managing the development and modification of IT portfolio selection criteria. However, neither DOD nor the military departments had fully documented policies and procedures for creating and modifying IT portfolio selection criteria; analyzing, selecting, and maintaining their investment portfolios; reviewing, evaluating, and improving the performance of their portfolios; or conducting post implementation reviews. In addition, while DOD largely followed its certification and oversight processes, we reported that key steps were not performed. For example, as part of the certification process, DOD assessed investment alignment with the business enterprise architecture, but did not validate the results of this assessment, thus increasing the risk that decisions regarding certification would be based on inaccurate and unreliable information. Since 2001, we have made recommendations to improve DOD’s business architecture, enterprise transition plan, and business system investment 37 GAO-11-684. 38 These best practices are identified in GAO IT investment management guidance. See GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, GAO-04-394G (Washington, D.C.: Mar. 2004). Page 19 GAO-12-642T management. 39 DOD has generally agreed with these recommendations and is taking corrective actions in response. It is essential that DOD implement our recommendations aimed at addressing these long- standing challenges, as doing so is critical to the department’s ability to establish the full range of institutional management controls needed for its financial management as well as its overall business systems modernization high-risk program. We have ongoing work to evaluate the department’s efforts to comply with the NDAA for Fiscal Year 2012, as amended, including updating our evaluations of DOD’s comprehensive business enterprise architecture and transition plan and improved investment control processes. Section 1072 of the NDAA for Fiscal Year 2010 requires that new DOD DOD Has Begun programs be assessed to determine whether or not appropriate business- Performing Business- process reengineering efforts have been undertaken. The act further states that these efforts should ensure that (1) the business process to be Process supported by the defense business system modernization will be as Reengineering streamlined and efficient as practicable and (2) the need to tailor commercial-off-the-shelf systems to meet unique requirements or Assessments incorporate unique interfaces has been eliminated or reduced to the maximum extent practicable. 40 In June 2011, we reported that, for those investments we reviewed, DOD and the military departments used DOD’s Business Process Reengineering Guidance (dated April 2011) to assess 39 See, for example, GAO, Information Technology: Architecture Needed to Guide Modernization of DOD’s Financial Operations, GAO-01-525 (Washington, D.C.: May 17, 2001); DOD Business Systems Modernization: Improvements to Enterprise Architecture Development and Implementation Efforts Needed, GAO-03-458 (Washington, D.C.: Feb. 28, 2003); Business Systems Modernization: DOD Continues to Improve Institutional Approach, but Further Steps Needed, GAO-06-658 (Washington, D.C.: May 15, 2006); Business Systems Modernization: Strategy for Evolving DOD's Business Enterprise Architecture Offers a Conceptual Approach, but Execution Details Are Needed, GAO-07- 451 (Washington, D.C.: Apr. 16, 2007); Business Systems Modernization: DOD Needs to Fully Define Policies and Procedures for Institutionally Managing Investments, GAO-07- 538 (Washington, D.C.: May 11, 2007); DOD Business Systems Modernization: Progress in Establishing Corporate Management Controls Needs to Be Replicated Within Military Departments, GAO-08-705 (Washington, D.C.: May 15, 2008); DOD Business Systems Modernization: Recent Slowdown in Institutionalizing Key Management Controls Needs to Be Addressed, GAO-09-586 (Washington, D.C.: May 18, 2009); Organizational Transformation: Military Departments Can Improve Their Enterprise Architecture Programs, GAO-11-902 (Washington, D.C., Sept. 26, 2011). 40 Pub. L. No.111-84, § 1072. Page 20 GAO-12-642T whether the investments complied with the business-process reengineering requirement. 41 Consistent with the guidance, DOD and the military departments completed questionnaires to help them identify and develop approaches to streamlining and improving existing business processes. Once these assessments had been completed, the appropriate authorities asserted that business-process reengineering assessments had been performed. We also reported in June 2011 that while DOD and the military departments largely followed DOD’s guidance, they did not perform the key step of validating the results of these reengineering assessments to ensure that they, among other things, accurately assessed process weaknesses and identified opportunities to streamline and improve affected processes. The reason DOD did not follow key aspects of the certification process—primarily not validating assessment results—was attributed in part to unclear roles and responsibilities. According to military department officials responsible for the investments we reviewed, validation activities did not occur because DOD policy and guidance did not explicitly require them to be performed. In addition, there was no guidance that specified how assessments should be validated. According to DOD officials, the oversight and designated approval authorities did not validate the DOD level assessments and assertions because DOD policy and guidance had not yet been revised to require these authorities to do so. We have work underway to evaluate DOD’s efforts to improve its business system investment process, including its efforts to address the act’s business process reengineering requirement. GAO has made prior recommendations to address these issues. DOD has agreed with these recommendations and is taking corrective actions in response. In closing, DOD has demonstrated leadership and sustained commitment Concluding since the first issuance of its FIAR Plan in 2005 and through Observations improvements and responsiveness to our recommendations since then. DOD has made progress through the FIAR Guidance, with the development of a methodology for implementing the FIAR strategy. Full compliance with the guidance can provide a consistent, systematic process to help DOD components achieve and verify audit readiness. Without full compliance, as we have seen in our work, components may 41 GAO-11-684. Page 21 GAO-12-642T assert audit readiness while process deficiencies prevent validation, require corrective actions, and delay an audit for another fiscal year. Automated information systems are essential for modern accounting and recordkeeping. DOD is developing its ERP systems as the backbone of its financial management improvement and they are critical for transforming its business operations. To be fully successful, implementation of ERP systems should be consistent with an effective corporate enterprise architecture and the development of streamlined business processes. DOD officials have stated that these systems are critical to ensuring that the department meets its mandated September 30, 2017, goal to have auditable departmentwide financial statements. However, implementation has been delayed by deficiencies in performance and the need for remedial corrective actions. DOD components will evaluate cost-effective modifications to legacy systems and implement any necessary changes. According to DOD officials, for the ERP systems that will not be fully deployed prior to the audit readiness goals, the DOD components will need to identify effective workaround processes or modifications to legacy systems that will enable audit readiness. DOD faces considerable implementation challenges and has much work to do if it is to meet the goals of an auditable SBR by fiscal year 2014 and a complete set of auditable financial statements by fiscal year 2017. It is critical that DOD continue to build on its current initiatives. Oversight and monitoring will also play a key role in making sure that DOD’s plans are implemented as intended and that lessons learned are identified and effectively disseminated and addressed. Absent continued momentum and necessary future investments, the current initiatives may falter, similar to previous well-intended, but ultimately failed, efforts. We will continue to monitor the progress and provide feedback on the status of DOD’s financial management improvement efforts. We currently have work in progress to assess (1) the FIAR Plan’s risk management process for identifying, assessing, and addressing risks that may impede DOD’s ability to achieve the 2017 financial audit readiness goal; (2) DOD’s funds control in relation to the reliability of its financial statements; (3) the schedule and cost of Army’s GCSS; (4) components’ efforts to prepare for SBR and full financial statement audits; and (5) DOD’s actions in response to our recommendations. As a final point, I want to emphasize the value of sustained congressional interest in the department’s financial management improvement efforts, as demonstrated by this subcommittee’s leadership. Page 22 GAO-12-642T Chairman McCaskill, Ranking Member Ayotte, and members of the subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. If you or your staff have any questions about this testimony please GAO Contacts and contact me at (202) 512-9869 or firstname.lastname@example.org. Contact points for our Staff Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. GAO staff who made key contributions to Acknowledgments this testimony include Valerie Melvin, Director; Cindy Brown Barnes, Assistant Director; Mark Bird, Assistant Director; Kristi Karls; Michael Holland, Chris Yfantis, and Maxine Hattery. (197115) Page 23 GAO-12-642T This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. GAO’s Mission The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no Obtaining Copies of cost is through GAO’s website (www.gao.gov). Each weekday afternoon, GAO Reports and GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, Testimony go to www.gao.gov and select “E-mail Updates.” Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, http://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. Visit GAO on the web at www.gao.gov. Contact: To Report Fraud, Waste, and Abuse in Website: www.gao.gov/fraudnet/fraudnet.htm E-mail: email@example.com Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Katherine Siggerud, Managing Director, firstname.lastname@example.org, (202) 512- Congressional 4400, U.S. Government Accountability Office, 441 G Street NW, Room Relations 7125, Washington, DC 20548 Chuck Young, Managing Director, email@example.com, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 Please Print on Recycled Paper.
DOD Financial Management: Challenges in Attaining Audit Readiness and Improving Business Processes and Systems
Published by the Government Accountability Office on 2012-04-18.
Below is a raw (and likely hideous) rendition of the original report. (PDF)