Office of the Chief Financial Officer New Core Project: Release 1of Phase 1 New Core Interface Solution Information Systems Audit Division Audit Report Number: 2015-DP-0007 Washington, DC September 03, 2015 ‘SPECTOR G SEA To: Joseph I. Hungate III, Deputy Chief Financial Officer, F From: Hanh T. D , Director, rmation Systems Audit Division, GAA Subject: New Core Release 1 of Phase 1 Implementation Was Not Completely Successful Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our audit of the New Core Interface Solution. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at If you have any questions or comments about this report, please do not hesitate to call me at 202- 402-8147 or Dorothy Bagley at 202-402-8139. Attachment Audit Report Number: 2015-DP-0007 Date: September 03, 2015 New Core Release 1of Phase 1 Implementation Was Not Completely Successful Highlights What We Audited and Why We audited the U.S. Department of Housing and Urban Development’s (HUD) New Core Interface Solution (NCIS) for release 1 of phase 1 as part of the internal control assessments required for the fiscal year 2015 financial statement audit under the Chief Financial Officer’s Act of 1990. Our objective was to determine whether adequate internal controls were in place for NCIS and to relate the results of the review to the upcoming release 3 implementation. This audit is the second in a series of audits to be completed on the New Core Project implementation. What We Found HUD’s implementation of release 1 of the New Core Project was not completely successful. Our review of NCIS processing for release 1 travel and relocation transactions found that missed requirements and ineffective controls and procedures resulted in inaccurate financial data in HUD’s general ledger and Oracle Financials. As a result, NCIS processed for more than 6 months with unresolved errors, leaving HUD’s general ledger and Oracle Financials with inaccurate financial data and discrepancies in the balances between HUD’s general ledger and Treasury’s Government Wide Accounting System. We concluded that the implementation of release 1 confirmed the concerns we cited when we reviewed release 3. Although HUD had taken action in its plans for release 3 to mitigate some of the problems that occurred with release 1, we are concerned that HUD could be moving too fast with its implementation plans and may repeat these weaknesses. What We Recommend We recommend that the Deputy Chief Financial Officer correct the deficiencies cited in this report to ensure financial data is recorded accurately in HUD’s general ledger and Oracle Financials. Additionally, implement controls in current and future releases that will prevent similar errors from occurring. Table of Contents Background and Objective......................................................................................3 Results of Audit ........................................................................................................5 Finding 1: New Core Release 1 Implementation Was Not Completely Successful .... 5 Scope and Methodology .........................................................................................12 Internal Controls ....................................................................................................13 Appendixes ..............................................................................................................14 A. Auditee Comments and OIG’s Evaluation ............................................................. 14 2 Background and Objective The U.S. Department of Housing and Urban Development (HUD) has been modernizing its legacy financial management system since fiscal year 2003. The previous project, the HUD Integrated Financial Management Improvement Project, was canceled during fiscal year 2012 after HUD spent more than $35 million. In the fall of 2012, the New Core Project was created to implement a new core financial system. Office of Management and Budget Memorandum M-13-08 requires the use of Federal shared service providers to modernize core accounting or mixed systems. In accordance with that requirement, HUD signed an interagency agreement with the U.S. Department of the Treasury’s Bureau of Fiscal Services’ Administrative Resource Center (ARC) on July 30, 2013, to migrate its financial transactions and systems. Under that agreement, ARC will support (1) funds management, (2) purchasing, (3) accounts payable, (4) accounts receivable, (5) cash management, (6) cost accounting, (7) the core financial system, (8) the general ledger, (9) financial reporting, (10) grants management, and (11) loans management. The project includes the following four phases: Phase 1 is separated into four different releases. Each release defines a particular function that will be transferred to Treasury’s shared services platform as follows: o Release 1 transferred the travel and relocation functions to Treasury on October 1, 2014. o Release 2, transferring time and attendance, was implemented on February 8, 2015. o Release 3 will cover the migration of the core financial services owned by the Office of the Chief Financial Officer (OCFO). This release includes the migration of accounting system services associated with budget execution, accounting, finance, data warehouse reporting, and an interface solution. Release 3 is scheduled for implementation in the fourth quarter of fiscal year 2015 or the first quarter of fiscal year 2016. o Release 4 will address HUD’s grant and loan accounting systems. Details regarding this release have not been finalized, and there is no scheduled date for implementation. Phase 2 of the project will address managerial cost accounting, budget formulation, and a fixed assets system. Phases 3 and 4 of the project will address the consolidation of the Federal Housing Administration and Government National Mortgage Association as well as the migration of the functionality of HUD’s Line of Credit Control System. Details regarding phases 2, 3, and 4 have not been finalized, and there are no scheduled dates for implementation. Release 1 of phase 1 of the New Core Project migrated HUD’s travel functions to ARC’s Concur Travel System. The New Core Interface Solution (NCIS) supports the automated exchange of 3 data between HUD’s existing accounting system HUD Centralized Accounting and Processing System (HUDCAPS) and ARC’s Oracle Financials. NCIS was designed to be an automated interface solution that manages HUD’s budget travel data and ARC’s travel general ledger data files. NCIS translates HUD and ARC data, using predefined crosswalk tables, and transfers the output data file in the format required by the receiving system. Any data file exceptions are handled manually. This audit was conducted as a component of the internal control assessments required for the fiscal year 2015 financial statement audit under the Chief Financial Officer’s Act of 1990. Our objective was to determine whether adequate internal controls were in place for NCIS and to relate the results of the review to the upcoming release 3 implementation. This audit is the second of several reviews to be completed on the New Core Project implementation. 4 Results of Audit Finding 1: New Core Release 1 Implementation Was Not Completely Successful HUD’s implementation of release 1 of phase 1 of the New Core Project was not completely successful. Our review of NCIS processing for release 1 travel and relocation transactions found that missed requirements and ineffective controls and procedures resulted in inaccurate financial data in HUDCAPS (HUD’s general ledger) and Oracle Financials. Specifically, (1) expenditures for travel transactions outside Concur travel system were not included in Oracle Financials; (2) interface processing was not monitored, delays were not detected and errors were not addressed; (3) controls were not effective to prevent transactions from processing more than once; and (4) data were not reconciled between HUDCAPS and Oracle Financials. In addition, HUD had not implemented a formal process for users to report issues with the system. These deficiencies existed because the New Core Project Management Team failed to identify all system requirements, follow their established procedures, provide users adequate training, include all required parties in the process, and perform a post deployment review. As a result, NCIS processed transactions for more than 6 months with unresolved errors, leaving HUD’s general ledger and Oracle Financials with inaccurate financial data and discrepancies in the balances between HUD’s general ledger and Treasury’s Government Wide Accounting System. We also noted that the deficiencies we found in release 1 confirmed the concerns cited when we reviewed the project management of the pending release 3.1 HUD had taken action in its plans for release 3 to mitigate some of the problems that occurred with release 1, but we are concerned that HUD could be moving too fast with its implementation plans and may repeat these weaknesses. Travel Transactions Paid Outside of Concur Were Not Recorded in Oracle Financials NCIS is the HUD-owned application designed to allow data to be transferred between HUDCAPS and Oracle Financials. Budget information for HUD’s travel funds flows from HUDCAPS through NCIS to Oracle Financials. Oracle Financials processes travel obligation and expenditure transactions made in Concur Travel System and then sends the transaction data through NCIS to be recorded in HUDCAPS. However, expenditures for General Services Administration vehicles and tolls were accounted for in HUDCAPS and that information was not transferred to Oracle Financials. Therefore, the remaining funds available for Concur travel transactions were overstated. Office of Management and Budget Circular No. A-123, Appendix D, Compliance with the Federal Financial Management Improvement Act (FFMIA) of l996, Section 7, FFMIA compliance, states, “Financial reporting objectives include reliable, timely, and accurate financial information for managing day-to-day operations and reporting on an agency’s financial condition. Reliable financial reporting also includes maintaining internal control over financial reporting and financial system security.” 1 2015-DP-0006 - New Core Project: Release 3 Project Management 5 The program budget office is responsible for the reconciliation of mismatches between HUDCAPS and Oracle Financials data. On May 5, 2015, we found that for some of the organizations, the difference between the average funds remaining in HUDCAPS and Oracle Financials was approximately $79,000, with the largest difference being $115,682. The funding available in Oracle Financials was not decreased by the funds paid from HUDCAPS causing an overstatement. The table below details some of the differences identified. HUDCAPS funds Oracle funds Overstatement Organization remaining remaining in Oracle 1 $10,291.03 $93,999.71 $83,708.68 2 $36,365.73 $122,473.40 $86,107.67 3 $52,068.89 $150,453.05 $98,384.16 4 $53,453.58 $169,135.67 $115,682.09 5 $105,447.77 $161,612.84 $56,165.07 6 $53,322.36 $122,460.51 $69,138.15 7 $38,985.11 $82,549.08 $43,563.97 HUD did not include requirements to address travel transactions made outside Concur during the planning phase of release 1. The independent verification and validation contractor noted in its October 27, 2014, report that release 1 had been plagued with challenges developing and managing system requirements. Challenges included failure to staff the program with relevant subject-matter experts, poorly structured requirements sessions, infrequency of working group sessions with all the necessary personnel, overlapping schedules, bottlenecked decision authority, and insufficient demonstrations. The missed system requirements resulted in a system that did not fully meet HUD’s needs and forced manual tracking of funds outside the system. Interface Processing Was Not Monitored, Delays Were Not Detected, and Errors Were Not Addressed NCIS maintains a log of all records during processing. File processing was impacted twice because the log file was full and additional records could not be written to it. We were informed that the problem was mostly due to the high number of records that failed processing, were marked unreconciled, and were not addressed. During these timeframes, the log records were recorded in an alternate location and not accessible to the reconciliations query, which was designed to monitor processing. In one instance, the records were not available for 5 days. We also identified significant delays in the time it took to post transactions. Budget data should be available in Oracle Financials no more than 1 day after being processed in HUDCAPS, and general ledger transactions should post to HUDCAPS the same day they are processed in Oracle Financials. However, we analyzed travel transactions for four organizations within one fund code and found that 50 obligations were made from October 1, 2014, to May 4, 2015. Of the 50 obligations, only 23 posted the same day. The longest delay in posting was 41 days. The table on the next page details the posting delays observed. 6 Transactions Days to post to HUDCAPS 23 0 5 1 2 2 1 6 5 7 2 8 2 9 1 15 2 17 2 22 1 27 1 28 1 29 2 41 We also found that adjustments were later made to 37 of the 50 obligations. In addition, only 27 of the adjustments made in Oracle were posted to HUDCAPS. Interface processing errors were not addressed. An automated reconciliation is performed in NCIS to verify that transactions are received and completely processed by NCIS before being sent to Oracle Financials and HUDCAPS. NCIS translates budget and general ledger transaction data into the format required by the receiving system. When errors occurred during NCIS processing, the records in error were not sent forward to HUDCAPS or Oracle Financials. NCIS has a query facility designed to identify records that did not successfully process through the interface. The NCIS manual2 outlines how to use the reconciliation menu and output reports to identify budget and general ledger transaction records that did not process successfully. We were informed by OCFO systems staff that it did not use this method to address records that did not process successfully. In addition, the responsibility for reconciliations was assigned to OCFO systems staff without adequate training and without representation from OCFO accounting staff. Only errors identified by users and presented to OCFO systems staff were addressed. Unreconciled interfaced transactions lessened the accuracy of HUD’s financial information used for managing day-to-day operations and reporting on HUD’s financial condition. These deficiencies were not detected because HUD did not perform a post deployment review. The closeout phase of HUD’s project planning and management procedures requires that a post 2 New Core Interface Solution Operations and Maintenance Manual – Final, dated October 16, 2014 7 deployment review take place after a period of sustained operation. The IT project manager, along with the integrated project team, performs the high-level review of the functionality that was released into the production environment to determine whether it has been operating as expected. The team seeks to ascertain the degree of success from the project (in particular, the extent to which it met its objectives, delivered planned levels of benefit, and addressed the specific requirements as originally defined). The team examines the effectiveness of all elements of the installed solution to determine whether further improvements can be made to optimize the benefit delivered, and to learn lessons from the project that can be used to improve future project work and solutions. Controls Were Not Effective in Preventing Duplicate Transaction Processing Controls were not effective in preventing data from being processed more than once. New Core staff determined that some travel expenditures had been posted to HUDCAPS several times. These duplicate transactions resulted from processing errors. New Core staff implemented a system fix in April 2015. Data Were Not Reconciled Between HUDCAPS and Oracle Financials There was no automated reconciliation in place for verifying that the records in HUDCAPS and Oracle Financials matched, and compensating controls initiated by HUD were not effective. It is the responsibility of the program budget office to perform reconciliations between HUDCAPS and Oracle Financials for its accounts. However, users were not able to perform reconciliations because OCFO did not provide instructions or training outlining the process that should be used. Despite the desire of the NCIS team to have users rely on the reports generated from Oracle Financials, the users interviewed relied on reports from HUDCAPS and unofficial documents, like Excel spreadsheets, to track their budgets for travel. HUDCAPS, the official system of record for the travel and relocation transactions for fiscal year 2015, was missing some obligations and expenditures made through Concur travel system that were not posted to HUDCAPS. In addition, there were negative obligations and expenditure amounts. For example, on May 13, 2015, we examined account balances for two fund codes. Of the 49 active organizations identified, only 6 had matching balances between HUDCAPS and Oracle Financials. In addition, we found (1) obligations made through Concur travel system that were not posted to HUDCAPS in amounts totaling up to $355,310, (2) expenditures made through Concur travel system that were not posted to HUDCAPS in amounts totaling up to $110,837, (3) negative unliquidated obligations for 9 of the active organizations, and (4) a negative expenditure amount for 1 organization. The funds remaining differences between HUDCAPS and Oracle Financials were approximately $367,636 for one of the fund codes and $98,511 for the other. HUD Had Not Implemented a Formal Process To Report Issues With NCIS HUD had not implemented a formal process for users to report issues with the system and processing errors. We were informed that problems were reported and tracked using email communications. OCFO acknowledged that it needed a formal process for problem reporting and resolution but did not establish a formal problem reporting process because it overlooked that functionality in the planning process. The missing problem reporting process inhibited 8 HUD’s ability to effectively track issues and maintain historical information to aid in resolving future problems. HUD’s General Ledger does not Match with Treasury’s Central Accounting and Reporting System The Office of Inspector General (OIG), Financial Audits Division, in its assessment of HUD’s fund balance with Treasury cash reconciliations identified discrepancies between the balances reported in Treasury’s Central Accounting and Reporting System3 and HUDCAPS. The balance in the Central Accounting and Reporting System is the actual balance that Treasury has for each HUD fund. The following table details the absolute value of the discrepancies by month for the first 6 months of processing for fiscal year 2015. Month Total difference October $ 23,264.78 November $ 23,215.02 December $ 528,787.08 January $ 113,165.29 February $ 255,813.81 March $ 123,479.18 Total $ 1,067,725.16 These Findings Impact the Implementation of Release 3 Our review of the implementation of release 1 confirmed the concerns cited when we reviewed release 3. On June 12, 2015, we issued an audit report regarding the project management of release 3 for the New Core Project. In that report, we cited weaknesses in the New Core Project for release 3 that had not been adequately addressed. Specifically, (1) HUD may have rushed release 3 system design and development activities, (2) schedule management deficiencies could impact the timeliness and quality of the release 3 solutions, and (3) risk management weaknesses may have misrepresented the project’s status. These conditions resulted from noncompliance with HUD’s own IT project management policy and best practices. We concluded that HUD’s failure to successfully implement New Core could result in a system that may not meet HUD’s needs. The implementation of release 1 resulted in a system that did not meet HUD’s needs, did 3 Treasury’s Central Accounting and Reporting System (CARS) is the central accounting System of Record for Treasury’s Bureau of the Fiscal Service and is the official source for the posting of financial transactions which impact all Federal Program Agency’s Fund Balance with Treasury. CARS captures and records Treasury Account Symbol information for payments, deposits, and intragovernmental transactions. It also provides agencies with an account statement of their Fund Balance with Treasury and allows them to access transaction details to support research and reconciliations. 9 not provide HUD staff accurate information to manage day-to-day operations, and increased HUD’s risk of Antideficiency Act violations. During the implementation of release 1, HUD did not identify all system requirements, follow established procedures, provide users adequate training, and include all required parties in the process to establish standard operating procedures or perform a post deployment review. Based on the information the New Core team provided to the Office of Management and Budget in its July 16, 2015, preliminary go or no go assessment, the team had taken some actions to address our recommendations on releases 1 and 3. Specifically, HUD stated that it (1) Had initiated plans to create an operations and maintenance team for release 3, (2) Had added accounting expertise to the NCIS monitoring function for release 3, (3) Had scheduled NCIS training, (4) Had scheduled Discoverer report training, (5) Had begun reviewing NCIS audit logs, (6) Had drafted a contingency plan, and (7) Would establish a help desk for users. However, during that briefing, we also heard information that raised significant concerns regarding the planned release 3 implementation on October 1, 2015. HUD reported several weaknesses related to the testing of the system, as well as the development of reports, standard operating procedures, and reconciliations for release 3. Each of these areas was a significant factor contributing to the deficiencies identified with release 1, and HUD appeared to be repeating these mistakes with release 3. In our first report, we noted a perceived reluctance to move the October 1, 2015, implementation date. The independent verification and validation team reported that the release 3 schedule was developed under the October 1, 2015, deadline and this date was not extended when additional work packages were added to the schedule. During the July 16, 2015, confidence check, HUD reported that for release 3, system integration testing had been completed, mock 1 testing had been completed, and mock 2 testing was expected to start and finish on time. However, HUD also reported that Ten tests were deferred from the system integration testing because they involved mixed funds reconciliations and new code would be required to proceed with the testing. When questioned on why the new code had not been developed, New Core staff responded that the time required for the contractor to code the necessary system changes was 3 weeks and that would have delayed other testing and possibly the October 1 implementation date. Mock 1 testing had unresolved issues that would not be resolved before mock 2 testing began but should be resolved before the go-live date. Mock 1 financial management and travel data were transmitted to ARC and successfully converted with some manual manipulation of data. Forty percent of the procurement data had been entered with some manual manipulation of data. Some conversion issues could not be fixed so these files were not loaded into the environment. 10 In addition, we noted issues with the development of standard operating procedures and customized reports. Standard operating procedures for users had not been developed, and resources had not been identified for the development of a mitigation strategy. HUD indicated that it planned to obtain resources and develop the procedures from user acceptance testing. The development of customized reports for performing reconciliations and day-to-day business operations was not completed in time to allow users to test and validate because waiting for the completion of the development would have delayed user acceptance testing. HUD acknowledged that manual reconciliations would be required until the additional code was developed. As reported, we identified significant issues with the manual reconciliations for release 1. Conclusion HUD’s implementation of release 1 of the New Core Project resulted in more than 6 months of processing with unresolved errors, leaving HUD’s general ledger and Oracle financials with inaccurate financial data and discrepancies between HUD’s general ledger and the amount of funding that Treasury has paid out for HUD. Our review of the implementation of release 1 confirms the concerns cited when we reviewed release 3. Although HUD had taken action in its plans for release 3 to mitigate some of the problems that occurred with release 1, we are concerned that HUD could be moving too fast with its implementation plans and did not take time to assess and correct the weaknesses that occurred with release 1. Recommendations We recommend that the Office of the Chief Financial Officer 1A. Correct the reconciliation errors. 1B. Make the required adjustments to ensure that the funds remaining for travel in Oracle Financials account for all expenditures made outside Concur travel system. 1C. Modify its reconciliation procedures to include accounting expertise and ensure that subject-matter experts are included in all requirements sessions on the project moving forward. 1D. Provide training to OCFO systems staff on reconciliation procedures. 1E. Provide reconciliation instructions and training to the program budget offices. 1F. Implement a problem reporting process. 1G. Ensure that a post deployment review is conducted for all future releases. 11 Scope and Methodology The audit covered the period April 30 through July 17, 2015. We performed the audit at HUD headquarters in Washington, DC. Audit work was conducted from April 30 through July 17, 2015. Our audit was based on the U.S. Government Accountability Office’s Federal Information System Controls Audit Manual methodology and IT guidelines established by the National Institute of Standards and Technology. We conducted the audit to determine whether adequate internal controls were in place for NCIS. To evaluate the internal controls, we Examined the system description, purpose, and classification; Identified key hardware and software components; Documented interfaced and dependent systems; Assessed user permissions; Determined whether the application had been appropriately reviewed for common security vulnerabilities; Determined whether the contingency planning would effectively minimize the consequences of a loss of application integrity or availability; and Determined whether the interfaced data between HUDCAPS and Oracle Financials was adequately reconciled between the source and target systems. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective(s). We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 12 Internal Controls Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to Effectiveness and efficiency of operations, Reliability of financial reporting, and Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objective: Policies, procedures, and other management tools used for the implementation of controls for the New Core Project. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiency Based on our review, we believe that the following item is a significant deficiency: New Core release 1 implementation was not completely successful (finding 1). 13 Appendixes Appendix A Auditee Comments and OIG’s Evaluation Ref to OIG Auditee Comments Evaluation Comment 1 Comment 2 Comment 2 14 Appendix A Auditee Comments and OIG’s Evaluation Ref to OIG Auditee Comments Evaluation Comment 2 Comment 2 Comment 2 Comment 2 Comment 2 15 Appendix A Auditee Comments and OIG’s Evaluation Ref to OIG Auditee Comments Evaluation 16 OIG Evaluation of Auditee Comments Comment 1 We disagree that the title of the finding is misleading. During the implementation of release 1, HUD did not identify all system requirements, follow established procedures, provide users adequate training, and include all required parties in the process to establish standard operating procedures. This resulted in the multiple operations and maintenance issues, which we cited in our report. No changes were made to the report. Comments 2 The OIG has not received documentation in support of the OCFO’s comments; therefore, we cannot make an assessment regarding them. We look forward to working with the OCFO to ensure that the actions proposed or taken are sufficient to address the weaknesses cited. 17
New Core Release 1 of Phase 1 Implementation Was Not Completely Successful
Published by the Department of Housing and Urban Development, Office of Inspector General on 2015-09-03.
Below is a raw (and likely hideous) rendition of the original report. (PDF)