Office of the Chief Financial Officer
New Core Project: Release 1of Phase 1 New Core
Interface Solution
Information Systems Audit Division Audit Report Number: 2015-DP-0007
Washington, DC September 03, 2015
‘SPECTOR G SEA
To: Joseph I. Hungate III, Deputy Chief Financial Officer, F
From: Hanh T. D , Director, rmation Systems Audit Division, GAA
Subject: New Core Release 1 of Phase 1 Implementation Was Not Completely Successful
Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) final results of our audit of the New Core Interface Solution.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its
publicly available reports on the OIG Web site. Accordingly, this report will be posted at
If you have any questions or comments about this report, please do not hesitate to call me at 202-
402-8147 or Dorothy Bagley at 202-402-8139.
Attachment
Audit Report Number: 2015-DP-0007
Date: September 03, 2015
New Core Release 1of Phase 1 Implementation Was Not Completely
Successful
Highlights
What We Audited and Why
We audited the U.S. Department of Housing and Urban Development’s (HUD) New Core
Interface Solution (NCIS) for release 1 of phase 1 as part of the internal control assessments
required for the fiscal year 2015 financial statement audit under the Chief Financial Officer’s Act
of 1990. Our objective was to determine whether adequate internal controls were in place for
NCIS and to relate the results of the review to the upcoming release 3 implementation. This
audit is the second in a series of audits to be completed on the New Core Project
implementation.
What We Found
HUD’s implementation of release 1 of the New Core Project was not completely successful. Our
review of NCIS processing for release 1 travel and relocation transactions found that missed
requirements and ineffective controls and procedures resulted in inaccurate financial data in
HUD’s general ledger and Oracle Financials. As a result, NCIS processed for more than 6
months with unresolved errors, leaving HUD’s general ledger and Oracle Financials with
inaccurate financial data and discrepancies in the balances between HUD’s general ledger and
Treasury’s Government Wide Accounting System. We concluded that the implementation of
release 1 confirmed the concerns we cited when we reviewed release 3. Although HUD had
taken action in its plans for release 3 to mitigate some of the problems that occurred with release
1, we are concerned that HUD could be moving too fast with its implementation plans and may
repeat these weaknesses.
What We Recommend
We recommend that the Deputy Chief Financial Officer correct the deficiencies cited in this
report to ensure financial data is recorded accurately in HUD’s general ledger and Oracle
Financials. Additionally, implement controls in current and future releases that will prevent
similar errors from occurring.
Table of Contents
Background and Objective......................................................................................3
Results of Audit ........................................................................................................5
Finding 1: New Core Release 1 Implementation Was Not Completely Successful .... 5
Scope and Methodology .........................................................................................12
Internal Controls ....................................................................................................13
Appendixes ..............................................................................................................14
A. Auditee Comments and OIG’s Evaluation ............................................................. 14
2
Background and Objective
The U.S. Department of Housing and Urban Development (HUD) has been modernizing its
legacy financial management system since fiscal year 2003. The previous project, the HUD
Integrated Financial Management Improvement Project, was canceled during fiscal year 2012
after HUD spent more than $35 million. In the fall of 2012, the New Core Project was created to
implement a new core financial system.
Office of Management and Budget Memorandum M-13-08 requires the use of Federal shared
service providers to modernize core accounting or mixed systems. In accordance with that
requirement, HUD signed an interagency agreement with the U.S. Department of the Treasury’s
Bureau of Fiscal Services’ Administrative Resource Center (ARC) on July 30, 2013, to migrate
its financial transactions and systems. Under that agreement, ARC will support (1) funds
management, (2) purchasing, (3) accounts payable, (4) accounts receivable, (5) cash
management, (6) cost accounting, (7) the core financial system, (8) the general ledger, (9)
financial reporting, (10) grants management, and (11) loans management.
The project includes the following four phases:
Phase 1 is separated into four different releases. Each release defines a particular
function that will be transferred to Treasury’s shared services platform as follows:
o Release 1 transferred the travel and relocation functions to Treasury on
October 1, 2014.
o Release 2, transferring time and attendance, was implemented on February 8, 2015.
o Release 3 will cover the migration of the core financial services owned by the Office
of the Chief Financial Officer (OCFO). This release includes the migration of
accounting system services associated with budget execution, accounting, finance,
data warehouse reporting, and an interface solution. Release 3 is scheduled for
implementation in the fourth quarter of fiscal year 2015 or the first quarter of fiscal
year 2016.
o Release 4 will address HUD’s grant and loan accounting systems. Details regarding
this release have not been finalized, and there is no scheduled date for
implementation.
Phase 2 of the project will address managerial cost accounting, budget formulation, and a
fixed assets system.
Phases 3 and 4 of the project will address the consolidation of the Federal Housing
Administration and Government National Mortgage Association as well as the migration
of the functionality of HUD’s Line of Credit Control System.
Details regarding phases 2, 3, and 4 have not been finalized, and there are no scheduled dates for
implementation.
Release 1 of phase 1 of the New Core Project migrated HUD’s travel functions to ARC’s Concur
Travel System. The New Core Interface Solution (NCIS) supports the automated exchange of
3
data between HUD’s existing accounting system HUD Centralized Accounting and Processing
System (HUDCAPS) and ARC’s Oracle Financials. NCIS was designed to be an automated
interface solution that manages HUD’s budget travel data and ARC’s travel general ledger data
files. NCIS translates HUD and ARC data, using predefined crosswalk tables, and transfers the
output data file in the format required by the receiving system. Any data file exceptions are
handled manually.
This audit was conducted as a component of the internal control assessments required for the fiscal
year 2015 financial statement audit under the Chief Financial Officer’s Act of 1990. Our objective
was to determine whether adequate internal controls were in place for NCIS and to relate the
results of the review to the upcoming release 3 implementation. This audit is the second of
several reviews to be completed on the New Core Project implementation.
4
Results of Audit
Finding 1: New Core Release 1 Implementation Was Not
Completely Successful
HUD’s implementation of release 1 of phase 1 of the New Core Project was not completely
successful. Our review of NCIS processing for release 1 travel and relocation transactions found
that missed requirements and ineffective controls and procedures resulted in inaccurate financial
data in HUDCAPS (HUD’s general ledger) and Oracle Financials. Specifically, (1) expenditures
for travel transactions outside Concur travel system were not included in Oracle Financials; (2)
interface processing was not monitored, delays were not detected and errors were not addressed;
(3) controls were not effective to prevent transactions from processing more than once; and (4)
data were not reconciled between HUDCAPS and Oracle Financials. In addition, HUD had not
implemented a formal process for users to report issues with the system. These deficiencies
existed because the New Core Project Management Team failed to identify all system
requirements, follow their established procedures, provide users adequate training, include all
required parties in the process, and perform a post deployment review. As a result, NCIS
processed transactions for more than 6 months with unresolved errors, leaving HUD’s general
ledger and Oracle Financials with inaccurate financial data and discrepancies in the balances
between HUD’s general ledger and Treasury’s Government Wide Accounting System. We also
noted that the deficiencies we found in release 1 confirmed the concerns cited when we reviewed
the project management of the pending release 3.1 HUD had taken action in its plans for release
3 to mitigate some of the problems that occurred with release 1, but we are concerned that HUD
could be moving too fast with its implementation plans and may repeat these weaknesses.
Travel Transactions Paid Outside of Concur Were Not Recorded in Oracle Financials
NCIS is the HUD-owned application designed to allow data to be transferred between
HUDCAPS and Oracle Financials. Budget information for HUD’s travel funds flows from
HUDCAPS through NCIS to Oracle Financials. Oracle Financials processes travel obligation
and expenditure transactions made in Concur Travel System and then sends the transaction data
through NCIS to be recorded in HUDCAPS. However, expenditures for General Services
Administration vehicles and tolls were accounted for in HUDCAPS and that information was
not transferred to Oracle Financials. Therefore, the remaining funds available for Concur travel
transactions were overstated. Office of Management and Budget Circular No. A-123,
Appendix D, Compliance with the Federal Financial Management Improvement Act
(FFMIA) of l996, Section 7, FFMIA compliance, states, “Financial reporting objectives
include reliable, timely, and accurate financial information for managing day-to-day
operations and reporting on an agency’s financial condition. Reliable financial reporting also
includes maintaining internal control over financial reporting and financial system security.”
1
2015-DP-0006 - New Core Project: Release 3 Project Management
5
The program budget office is responsible for the reconciliation of mismatches between
HUDCAPS and Oracle Financials data. On May 5, 2015, we found that for some of the
organizations, the difference between the average funds remaining in HUDCAPS and Oracle
Financials was approximately $79,000, with the largest difference being $115,682. The funding
available in Oracle Financials was not decreased by the funds paid from HUDCAPS causing an
overstatement. The table below details some of the differences identified.
HUDCAPS funds Oracle funds Overstatement
Organization remaining remaining in Oracle
1 $10,291.03 $93,999.71 $83,708.68
2 $36,365.73 $122,473.40 $86,107.67
3 $52,068.89 $150,453.05 $98,384.16
4 $53,453.58 $169,135.67 $115,682.09
5 $105,447.77 $161,612.84 $56,165.07
6 $53,322.36 $122,460.51 $69,138.15
7 $38,985.11 $82,549.08 $43,563.97
HUD did not include requirements to address travel transactions made outside Concur during the
planning phase of release 1. The independent verification and validation contractor noted in its
October 27, 2014, report that release 1 had been plagued with challenges developing and
managing system requirements. Challenges included failure to staff the program with relevant
subject-matter experts, poorly structured requirements sessions, infrequency of working group
sessions with all the necessary personnel, overlapping schedules, bottlenecked decision
authority, and insufficient demonstrations. The missed system requirements resulted in a system
that did not fully meet HUD’s needs and forced manual tracking of funds outside the system.
Interface Processing Was Not Monitored, Delays Were Not Detected, and Errors Were Not
Addressed
NCIS maintains a log of all records during processing. File processing was impacted twice
because the log file was full and additional records could not be written to it. We were informed
that the problem was mostly due to the high number of records that failed processing, were
marked unreconciled, and were not addressed. During these timeframes, the log records were
recorded in an alternate location and not accessible to the reconciliations query, which was
designed to monitor processing. In one instance, the records were not available for 5 days.
We also identified significant delays in the time it took to post transactions. Budget data should
be available in Oracle Financials no more than 1 day after being processed in HUDCAPS, and
general ledger transactions should post to HUDCAPS the same day they are processed in Oracle
Financials. However, we analyzed travel transactions for four organizations within one fund
code and found that 50 obligations were made from October 1, 2014, to May 4, 2015. Of the 50
obligations, only 23 posted the same day. The longest delay in posting was 41 days. The table
on the next page details the posting delays observed.
6
Transactions Days to post to HUDCAPS
23 0
5 1
2 2
1 6
5 7
2 8
2 9
1 15
2 17
2 22
1 27
1 28
1 29
2 41
We also found that adjustments were later made to 37 of the 50 obligations. In addition, only 27
of the adjustments made in Oracle were posted to HUDCAPS.
Interface processing errors were not addressed. An automated reconciliation is performed in
NCIS to verify that transactions are received and completely processed by NCIS before being
sent to Oracle Financials and HUDCAPS. NCIS translates budget and general ledger transaction
data into the format required by the receiving system. When errors occurred during NCIS
processing, the records in error were not sent forward to HUDCAPS or Oracle Financials. NCIS
has a query facility designed to identify records that did not successfully process through the
interface. The NCIS manual2 outlines how to use the reconciliation menu and output reports to
identify budget and general ledger transaction records that did not process successfully. We
were informed by OCFO systems staff that it did not use this method to address records that did
not process successfully. In addition, the responsibility for reconciliations was assigned to
OCFO systems staff without adequate training and without representation from OCFO
accounting staff. Only errors identified by users and presented to OCFO systems staff were
addressed. Unreconciled interfaced transactions lessened the accuracy of HUD’s financial
information used for managing day-to-day operations and reporting on HUD’s financial
condition.
These deficiencies were not detected because HUD did not perform a post deployment review.
The closeout phase of HUD’s project planning and management procedures requires that a post
2
New Core Interface Solution Operations and Maintenance Manual – Final, dated October 16, 2014
7
deployment review take place after a period of sustained operation. The IT project manager,
along with the integrated project team, performs the high-level review of the functionality that
was released into the production environment to determine whether it has been operating as
expected. The team seeks to ascertain the degree of success from the project (in particular, the
extent to which it met its objectives, delivered planned levels of benefit, and addressed the
specific requirements as originally defined). The team examines the effectiveness of all elements
of the installed solution to determine whether further improvements can be made to optimize the
benefit delivered, and to learn lessons from the project that can be used to improve future project
work and solutions.
Controls Were Not Effective in Preventing Duplicate Transaction Processing
Controls were not effective in preventing data from being processed more than once. New Core
staff determined that some travel expenditures had been posted to HUDCAPS several times.
These duplicate transactions resulted from processing errors. New Core staff implemented a
system fix in April 2015.
Data Were Not Reconciled Between HUDCAPS and Oracle Financials
There was no automated reconciliation in place for verifying that the records in HUDCAPS and
Oracle Financials matched, and compensating controls initiated by HUD were not effective. It is
the responsibility of the program budget office to perform reconciliations between HUDCAPS
and Oracle Financials for its accounts. However, users were not able to perform reconciliations
because OCFO did not provide instructions or training outlining the process that should be used.
Despite the desire of the NCIS team to have users rely on the reports generated from Oracle
Financials, the users interviewed relied on reports from HUDCAPS and unofficial documents,
like Excel spreadsheets, to track their budgets for travel.
HUDCAPS, the official system of record for the travel and relocation transactions for fiscal year
2015, was missing some obligations and expenditures made through Concur travel system that
were not posted to HUDCAPS. In addition, there were negative obligations and expenditure
amounts.
For example, on May 13, 2015, we examined account balances for two fund codes. Of the 49
active organizations identified, only 6 had matching balances between HUDCAPS and Oracle
Financials. In addition, we found (1) obligations made through Concur travel system that were
not posted to HUDCAPS in amounts totaling up to $355,310, (2) expenditures made through
Concur travel system that were not posted to HUDCAPS in amounts totaling up to $110,837, (3)
negative unliquidated obligations for 9 of the active organizations, and (4) a negative expenditure
amount for 1 organization. The funds remaining differences between HUDCAPS and Oracle
Financials were approximately $367,636 for one of the fund codes and $98,511 for the other.
HUD Had Not Implemented a Formal Process To Report Issues With NCIS
HUD had not implemented a formal process for users to report issues with the system and
processing errors. We were informed that problems were reported and tracked using email
communications. OCFO acknowledged that it needed a formal process for problem reporting
and resolution but did not establish a formal problem reporting process because it overlooked
that functionality in the planning process. The missing problem reporting process inhibited
8
HUD’s ability to effectively track issues and maintain historical information to aid in resolving
future problems.
HUD’s General Ledger does not Match with Treasury’s Central Accounting and Reporting
System
The Office of Inspector General (OIG), Financial Audits Division, in its assessment of HUD’s
fund balance with Treasury cash reconciliations identified discrepancies between the balances
reported in Treasury’s Central Accounting and Reporting System3 and HUDCAPS. The balance
in the Central Accounting and Reporting System is the actual balance that Treasury has for each
HUD fund. The following table details the absolute value of the discrepancies by month for the
first 6 months of processing for fiscal year 2015.
Month Total difference
October $ 23,264.78
November $ 23,215.02
December $ 528,787.08
January $ 113,165.29
February $ 255,813.81
March $ 123,479.18
Total $ 1,067,725.16
These Findings Impact the Implementation of Release 3
Our review of the implementation of release 1 confirmed the concerns cited when we reviewed
release 3. On June 12, 2015, we issued an audit report regarding the project management of
release 3 for the New Core Project. In that report, we cited weaknesses in the New Core Project
for release 3 that had not been adequately addressed. Specifically, (1) HUD may have rushed
release 3 system design and development activities, (2) schedule management deficiencies could
impact the timeliness and quality of the release 3 solutions, and (3) risk management weaknesses
may have misrepresented the project’s status. These conditions resulted from noncompliance
with HUD’s own IT project management policy and best practices. We concluded that HUD’s
failure to successfully implement New Core could result in a system that may not meet HUD’s
needs. The implementation of release 1 resulted in a system that did not meet HUD’s needs, did
3
Treasury’s Central Accounting and Reporting System (CARS) is the central accounting System of Record for
Treasury’s Bureau of the Fiscal Service and is the official source for the posting of financial transactions which
impact all Federal Program Agency’s Fund Balance with Treasury. CARS captures and records Treasury Account
Symbol information for payments, deposits, and intragovernmental transactions. It also provides agencies with an
account statement of their Fund Balance with Treasury and allows them to access transaction details to support
research and reconciliations.
9
not provide HUD staff accurate information to manage day-to-day operations, and increased
HUD’s risk of Antideficiency Act violations.
During the implementation of release 1, HUD did not identify all system requirements, follow
established procedures, provide users adequate training, and include all required parties in the
process to establish standard operating procedures or perform a post deployment review. Based
on the information the New Core team provided to the Office of Management and Budget in its
July 16, 2015, preliminary go or no go assessment, the team had taken some actions to address
our recommendations on releases 1 and 3. Specifically, HUD stated that it
(1) Had initiated plans to create an operations and maintenance team for release 3,
(2) Had added accounting expertise to the NCIS monitoring function for release 3,
(3) Had scheduled NCIS training,
(4) Had scheduled Discoverer report training,
(5) Had begun reviewing NCIS audit logs,
(6) Had drafted a contingency plan, and
(7) Would establish a help desk for users.
However, during that briefing, we also heard information that raised significant concerns
regarding the planned release 3 implementation on October 1, 2015. HUD reported several
weaknesses related to the testing of the system, as well as the development of reports, standard
operating procedures, and reconciliations for release 3. Each of these areas was a significant
factor contributing to the deficiencies identified with release 1, and HUD appeared to be
repeating these mistakes with release 3.
In our first report, we noted a perceived reluctance to move the October 1, 2015, implementation
date. The independent verification and validation team reported that the release 3 schedule was
developed under the October 1, 2015, deadline and this date was not extended when additional
work packages were added to the schedule. During the July 16, 2015, confidence check, HUD
reported that for release 3, system integration testing had been completed, mock 1 testing had
been completed, and mock 2 testing was expected to start and finish on time. However, HUD
also reported that
Ten tests were deferred from the system integration testing because they involved mixed
funds reconciliations and new code would be required to proceed with the testing. When
questioned on why the new code had not been developed, New Core staff responded that
the time required for the contractor to code the necessary system changes was 3 weeks
and that would have delayed other testing and possibly the October 1 implementation
date.
Mock 1 testing had unresolved issues that would not be resolved before mock 2 testing
began but should be resolved before the go-live date. Mock 1 financial management and
travel data were transmitted to ARC and successfully converted with some manual
manipulation of data. Forty percent of the procurement data had been entered with some
manual manipulation of data. Some conversion issues could not be fixed so these files
were not loaded into the environment.
10
In addition, we noted issues with the development of standard operating procedures and
customized reports. Standard operating procedures for users had not been developed, and
resources had not been identified for the development of a mitigation strategy. HUD indicated
that it planned to obtain resources and develop the procedures from user acceptance testing. The
development of customized reports for performing reconciliations and day-to-day business
operations was not completed in time to allow users to test and validate because waiting for the
completion of the development would have delayed user acceptance testing. HUD
acknowledged that manual reconciliations would be required until the additional code was
developed. As reported, we identified significant issues with the manual reconciliations for
release 1.
Conclusion
HUD’s implementation of release 1 of the New Core Project resulted in more than 6 months of
processing with unresolved errors, leaving HUD’s general ledger and Oracle financials with
inaccurate financial data and discrepancies between HUD’s general ledger and the amount of
funding that Treasury has paid out for HUD.
Our review of the implementation of release 1 confirms the concerns cited when we reviewed
release 3. Although HUD had taken action in its plans for release 3 to mitigate some of the
problems that occurred with release 1, we are concerned that HUD could be moving too fast with
its implementation plans and did not take time to assess and correct the weaknesses that occurred
with release 1.
Recommendations
We recommend that the Office of the Chief Financial Officer
1A. Correct the reconciliation errors.
1B. Make the required adjustments to ensure that the funds remaining for travel in Oracle
Financials account for all expenditures made outside Concur travel system.
1C. Modify its reconciliation procedures to include accounting expertise and ensure that
subject-matter experts are included in all requirements sessions on the project moving
forward.
1D. Provide training to OCFO systems staff on reconciliation procedures.
1E. Provide reconciliation instructions and training to the program budget offices.
1F. Implement a problem reporting process.
1G. Ensure that a post deployment review is conducted for all future releases.
11
Scope and Methodology
The audit covered the period April 30 through July 17, 2015. We performed the audit at HUD
headquarters in Washington, DC. Audit work was conducted from April 30 through July 17,
2015. Our audit was based on the U.S. Government Accountability Office’s Federal Information
System Controls Audit Manual methodology and IT guidelines established by the National
Institute of Standards and Technology.
We conducted the audit to determine whether adequate internal controls were in place for NCIS.
To evaluate the internal controls, we
Examined the system description, purpose, and classification;
Identified key hardware and software components;
Documented interfaced and dependent systems;
Assessed user permissions;
Determined whether the application had been appropriately reviewed for common
security vulnerabilities;
Determined whether the contingency planning would effectively minimize the
consequences of a loss of application integrity or availability; and
Determined whether the interfaced data between HUDCAPS and Oracle Financials was
adequately reconciled between the source and target systems.
We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective(s). We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.
12
Internal Controls
Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to
Effectiveness and efficiency of operations,
Reliability of financial reporting, and
Compliance with applicable laws and regulations.
Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.
Relevant Internal Controls
We determined that the following internal controls were relevant to our audit objective:
Policies, procedures, and other management tools used for the implementation of controls for
the New Core Project.
We assessed the relevant controls identified above.
A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, the
reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or
efficiency of operations, (2) misstatements in financial or performance information, or (3)
violations of laws and regulations on a timely basis.
Significant Deficiency
Based on our review, we believe that the following item is a significant deficiency:
New Core release 1 implementation was not completely successful (finding 1).
13
Appendixes
Appendix A
Auditee Comments and OIG’s Evaluation
Ref to OIG Auditee Comments
Evaluation
Comment 1
Comment 2
Comment 2
14
Appendix A
Auditee Comments and OIG’s Evaluation
Ref to OIG Auditee Comments
Evaluation
Comment 2
Comment 2
Comment 2
Comment 2
Comment 2
15
Appendix A
Auditee Comments and OIG’s Evaluation
Ref to OIG Auditee Comments
Evaluation
16
OIG Evaluation of Auditee Comments
Comment 1 We disagree that the title of the finding is misleading. During the implementation
of release 1, HUD did not identify all system requirements, follow established
procedures, provide users adequate training, and include all required parties in the
process to establish standard operating procedures. This resulted in the multiple
operations and maintenance issues, which we cited in our report. No changes
were made to the report.
Comments 2 The OIG has not received documentation in support of the OCFO’s comments;
therefore, we cannot make an assessment regarding them. We look forward to
working with the OCFO to ensure that the actions proposed or taken are sufficient
to address the weaknesses cited.
17
New Core Release 1 of Phase 1 Implementation Was Not Completely Successful
Published by the Department of Housing and Urban Development, Office of Inspector General on 2015-09-03.
Below is a raw (and likely hideous) rendition of the original report. (PDF)