oversight

New Core Project: Although Transaction Processing Had Improved Weaknesses Remained

Published by the Department of Housing and Urban Development, Office of Inspector General on 2017-09-28.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

   Office of the Chief Financial Officer,
              Washington, DC

   New Core Project – New Core Financial Management
                        Solution




Information Systems Audit Division   Audit Report Number: 2017-DP-0003
Washington, DC                                       September 28, 2017
To:            Sarah A. Lyberg, Acting Deputy Chief Financial Officer, F
                       //s//
From:          Dorothy L. Bagley, Director, Information Systems Audit Division, GAA
Subject:       New Core Project: Although Transaction Processing Had Improved Weaknesses
               Remained




Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) final results of our completed audit of the New Core Financial Management
Solution.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M requires that OIG post its
publicly available reports on the OIG Web site. Accordingly, this report will be posted at
http://www.hudoig.gov.
If you have any questions or comments about this report, please do not hesitate to call me at 202-
402-8139 or Jacqueline Hyslop at 313-234-7403.
Attachment
                    Audit Report Number: 2017-DP-0003
                    Date: September 28, 2017

                    New Core Project: Although Transaction Processing Had Improved
                    Weaknesses Remained



Highlights
What We Audited and Why
We audited the functionality of the U.S. Department of Housing and Urban Development’s
(HUD) New Core Financial Management Solution as part of the internal control assessments
required for the fiscal year 2017 financial statement audit under the Chief Financial Officer’s Act
of 1990. Our objective was to determine whether effective business processes and interface
processing controls were in place for the New Core Financial Management Solution. This audit
is the fifth in a series of audits completed on the New Core Project implementation.

What We Found
Transaction processing using the New Core Financial Management Solution had improved, but
challenges and weaknesses remained. Specifically, (1) transactions were inaccurately posted to
the general ledger, and weaknesses still existed with transaction processing; (2) HUD had not
completed reconciling the differences between the subledgers and the general ledger; and (3) the
NCIS reconciliation tool was not effective. These conditions occurred because (1) an NCIS
exclusion code was not recognized in HUDCAPS, there were timing issues with transaction
processing and data entry errors in the crosswalk tables, funds were prematurely end dated for
yearend close, and fund codes were erroneously disabled; (2) HUD did not have a process to
ensure that a periodic reconciliation between the subsidiary ledgers and the general ledger took
place before the New Core implementation, and lacked sufficient resources to assign to the
subledger reconciliation project; and (3) HUD did not focus on the accuracy and usefulness of
the NCIS reconciliation tool and reports, because resources were prioritized to improve NCIS
transaction processing. Although HUD improved from what we found during our fiscal year
2016 audit work, (1) HUD continued to experience some weaknesses in transaction processing;
(2) HUD cannot fully support the balances recorded in its general ledger; and (3) HUD did not
fully reconcile data between HUDCAPS and its general ledger.

What We Recommend
We recommend that HUD (1) update yearend close procedures, (2) implement a data validation
process for crosswalk entries, (3) improve the subledger reconciliation process and resolve
unreconciled differences, (4) revise the NCIS reconciliation status of funds report, and (5)
resolve the data reconciliation differences identified between HUD’s Centralized Accounting and
Program System and Oracle Financials.
Table of Contents
Background and Objective......................................................................................3

Results of Audit ........................................................................................................5
         Finding 1: Although Transaction Processing Had Improved Weaknesses Remained
         ............................................................................................................................................. 5

Scope and Methodology .........................................................................................14

Internal Controls ....................................................................................................15

Follow-Up on Prior Audits ……………………………………………………...16

Appendixes ..............................................................................................................17
              Auditee Comments and OIG’s Evaluation ............................................................. 17




                                                                         2
Background and Objective
The U.S. Department of Housing and Urban Development (HUD) relies on its information
technology systems to accomplish its mission of providing cost-effective and reliable services to
HUD, other Federal agencies, and the public at large. The New Core Project supported the
integration activities associated with the migration of HUD’s core accounting and administrative
system functions to the U.S. Department of the Treasury, Bureau of Fiscal Services’
Administrative Resource Center (ARC) shared service environment.

The current functionality of the New Core Project was implemented October 1, 2015. In a
previous Office of Inspector General (OIG) audit 1 of the New Core Project implementation, we
concluded that HUD’s transition to a Federal shared service provider did not significantly
improve the handling of financial management transactions for HUD. We found that 1 year
following the transition, HUD had inaccurate data resulting from the conversions and continued
to execute programmatic transactions in its legacy applications. We also found that the transition
increased the number of batch processes required to record programmatic financial transactions
and introduced manual processes and delays for budget and procurement transactions.

HUD’s New Core Interface Solution (NCIS) is a custom developed system owned by HUD’s
Office of the Chief Financial Officer and hosted by Oracle Managed Cloud Services. NCIS
performs the extract, transform, and load functions, as well as a variety of error processing,
reconciliation, and interface file management functions to support the interface of HUD systems
with ARC’s systems. NCIS is used to (1) transfer budget information to legacy systems from
Oracle Federal Financials 2 used by ARC and (2) transfer programmatic financial transactions
from legacy systems to Oracle Financials. In both instances, NCIS translates this information
between HUD’s Centralized Accounting and Program System (HUDCAPS) 3 account code
structure and the Oracle Financials accounting flex field. 4 All data are sent to and from NCIS
through HUD’s secured file transfer protocol (SFTP) server. 5



1
  Audit Report 2017-DP-0001, HUD’s Transition to a Federal Shared Service Provider Failed To Meet Expectations,
issued February 1, 2017
2
  Oracle Federal Financials is a common term used to describe a collection of Oracle E-Business Suite modules and
functionality used by U.S. Federal Government agencies.
3
  HUDCAPS is HUD’s former core accounting application. It captures, controls, and summarizes the results of the
accounting processes for HUD’s program funds. Before October 1, 2015, it was HUD’s general ledger and system
of financial records.
4 The accounting flex field is a feature within Oracle Financials applications that provides a flexible way for the

applications to represent objects such as accounting codes. The accounting flex field aligns to the Common
Government-Wide Accounting Classification structure. This structure represents an accounting classification, which
provides a consistent means for classifying financial events that enables the summarization and reporting of
information in a meaningful way.
5
  An SFTP server is a server running secure file transfer protocol. SFTP is a secure version of file transfer protocol,
which facilitates data access and data transfer over a secure shell data stream.




                                                           3
Under the shared service agreement, ARC is responsible for producing external regulatory and
consolidated financial reporting on behalf of HUD. HUD is responsible for validating and
certifying the ARC-generated financial statements for inclusion in the annual financial report.
Oracle Financials is the financial system of record for HUD.

This audit was conducted as a component of the internal control assessments required for the fiscal
year 2017 financial statement audit under the Chief Financial Officer’s Act of 1990. Our objective
was to determine whether effective business processes and interface processing controls were in
place for the New Core Financial Management Solution. This audit is the fifth in a series of
audits completed on the New Core Project implementation.




                                                 4
Results of Audit

Finding 1: Although Transaction Processing Had Improved
Weaknesses Remained
Transaction processing using the New Core Financial Management Solution had improved, but
challenges and weaknesses remained. Specifically, (1) transactions were inaccurately posted to
the general ledger, and weaknesses still existed with transaction processing; (2) HUD had not
completed reconciling the differences between the subledgers and the general ledger; and (3) the
NCIS reconciliation tool was not effective. These conditions occurred because (1) an NCIS
exclusion code was not recognized in HUDCAPS, there were timing issues with transaction
processing and data entry errors in the crosswalk tables, funds were prematurely end dated for
yearend close, and fund codes were erroneously disabled; (2) HUD did not have a process to
ensure that a periodic reconciliation between the subsidiary ledgers and the general ledger took
place before the New Core implementation, and lacked sufficient resources to assign to the
subledger reconciliation project; and (3) HUD did not focus on the accuracy and usefulness of
the NCIS reconciliation tool and reports, because resources were prioritized to improve NCIS
transaction processing. Although HUD improved from what we found during our fiscal year
2016 audit work, (1) HUD continued to experience some weaknesses in transaction processing;
(2) HUD cannot fully support the balances recorded in its general ledger; and (3) HUD did not
fully reconcile data between HUDCAPS and its general ledger.

HUD Continued To Experience Transaction Processing Errors
HUD continued to experience transaction processing errors between HUDCAPS and Oracle
Financials. Although there was improvement from our fiscal year 2016 audit, we found multiple
issues had been identified and resolved through the OCFO Systems error handling process.
Transactions were inaccurately sent from HUDCAPS to Oracle Financials for posting through
the NCIS interface because an NCIS exclusion code was not recognized in HUDCAPS. In
addition, we found errors in both the NCIS budget and general ledger processing due to timing
issues. We found additional errors in the NCIS general ledger interface processing due to (1)
data entry errors in the crosswalk tables, (2) prematurely end dating funds for yearend close, and
(3) disabling fund codes because of modifications made during data conversion cleanup. Office
of Management and Budget (OMB) Circular A-123 (II. Standards, part C) requires agencies to
design application controls to ensure that transactions are properly authorized and processed
accurately and that the data are valid and complete. These errors required HUD to make
adjustments to its general ledger for reporting and reinforced the need for HUD to continue to
pay for support services for errors encountered with the continued use of legacy systems and an
interface to the official system of record.
HUD staff erroneously processed transactions through the NCIS interface that made funding
amounts inaccurate in Oracle Financials. This error occurred on November 17, 2016, while
HUD staff was performing regular cleanup of documents using expired funds as part of the
yearend activities in HUDCAPS. These transactions were not to be sent to Oracle Financials for



                                                 5
posting because this activity was unique to HUDCAPS. HUD staff attached an exclusion code to
these cleanup records to prevent the transactions from being sent to NCIS. However, as the file
was loaded into HUDCAPS, the records lost the exclusion code as they posted. During the
nightly HUDCAPS generation of the Admin Journal Detail file, which was sent to NCIS, 196
lines that used the expired funds with a blank exclusion code were included. As Oracle
Financials received the records, it encountered cross validation rule 6 violations (level 2 errors) 7
and failed funds reservation errors (level 3 errors). 8 However, when there was funding available,
some records posted successfully. The records that posted in error in Oracle Financials affected
29 funds. The absolute value 9 of the impact to the general ledger was about $186 million, with
approximately $93 million of this debit and $93 million credit.

The transactions that were posted to Oracle Financials in error caused HUD to make adjustments
to its general ledger for reporting. To do this, HUD created a temporary journal entry, removing
192 transactions from the general ledger because of month end reporting requirements and to
ensure reporting figures were accurate. The permanent resolution for this issue was implemented
in December 2016. HUD first posted reversing entries in HUDCAPS and allowed them to flow
through NCIS to Oracle Financials. Once this process was completed, HUD created a second
journal entry to reverse the temporary journal entry previously entered. According to HUD,
these transactions would not be processed as a batch in the future but, instead, would be
processed individually.

Transaction processing errors were encountered for both the NCIS budget and general ledger
interfaces because of timing issues. Timing errors occur when a transaction fails because a
prerequisite transaction or action has not yet processed. The errors occurred because HUD
continued to rely on the legacy systems (HUDCAPS) to do a large portion of the financial
management functions and then interface the transactions to Oracle Financials, which is the
official system of record. The use of the interface subjected transaction processing to timing
issues and obsolete tables and processes remained as a pass-through for other processing to
occur. The absolute value of the timing errors was more than $132 million debit and $132
million credit.

Transaction processing errors were encountered for the general ledger interface because of data
entry errors in the crosswalk tables, end dating funds prematurely, and erroneously disabling
funds during data clean up. HUD continued to experience data entry errors in the crosswalk



6
  Cross validation rules allow or prohibit the combination of certain accounting flex field values. The accounting
flex field represents the accounting strip or line of accounting and must be present on every transaction in the Oracle
Financials application.
7
  Level 2 errors result from validations performed by the system, which extract the data from the staging tables and
write it to an import table. The validations are designed to catch errors before they are entered into Oracle
Financials.
8
  Level 3 errors occur after the transaction has been created in Oracle Financials. The rules that have been violated
at this point require individuals to take corrective actions to allow the transaction to post in the Oracle Financials
application.
9
  The absolute value of a real number is the value without regard to its sign.




                                                           6
tables. For example, there were 42 cross validation errors on November 17 and November 18,
2016, because of a data entry error in the crosswalk tables. The errors occurred on consecutive
days because the error was not resolved until November 18. The absolute values of the incorrect
transactions was more than $7 million debit and $7 million credit on each date.

HUD end dated several funds prematurely. At the end of the fiscal year OCFO Systems worked
to identify the funds that were cancelling, and anticipated when they would be flowing through
the interface. However, the resulting calculation was a day too soon. Once the end date was
established, the accounting flex field was disabled. On October 6, 2016, HUD encountered 58
level 2 transaction processing errors because of disabled accounting flex fields. To correct these
errors, the established end date was removed. This action re-enabled the fund and allowed the
transactions to post. The absolute value of these incorrect transactions was more than $1.5
million debit and $1.5 million credit.

HUD erroneously disabled funds during data conversion cleanup. For example, during cleanup
of the converted data for fund 0108, all of the money allocated for this fund was moved to the
direct fund code. On November 18, 2016, a level 3 reservation error occurred for fund 0108
using the reimbursable fund code. However, the reimbursable fund code was no longer enabled
in Oracle Financials and had no available funds. HUD later determined that the reimbursable
fund code was needed and re-enabled it, allowing the transactions to process. Four errors were
encountered on November 18, 2016, and one on December 21, 2016, which totaled absolute
values of $164,900 debit and $109,933 credit.

The errors that were encountered from timing issues, prematurely end dating funds for end of
year close and disabling of funds during data conversion cleanup had minimal impact on
financial processing. However, they reinforced the need for HUD to continue to pay for support
services for errors encountered with the continued use of legacy systems and an interface to the
official system of record.

HUD Had Not Completed Reconciling Differences Between the Subsidiary Ledgers and the
General Ledger
HUD had not completed reconciling the differences between the subsidiary ledgers and the
general ledger. According to the subledger differences log provided by Office of the Chief
Financial Officer (OCFO) on June 1, 2017, the absolute value of the remaining differences to be
resolved was approximately $1 billion for those identified up to September 30, 2016, and $3.6
billion for those from October 1, 2016, forward. OMB Circular A-123 (II. Standards, part C)
requires agencies to establish controls at an application’s interfaces to verify inputs and outputs.
The differences existed because HUD did not have a process to ensure that a periodic
reconciliation between the subsidiary ledgers and the general ledger took place before the New
Core implementation. In addition, HUD did not have sufficient resources to assign to the fiscal
year 2017 process. As a result, HUD’s focus for the project had been on the differences
identified in fiscal year 2016. HUD had not assigned staff to assess the differences identified in
fiscal year 2017. However, some items had been resolved.




                                                  7
Based on audit work performed during fiscal year 2016 by OIG’s Information System Audit
Division and Financial Audit Division (FAD), we reported 10 that ARC had been unable to
reconcile the HUD balances converted to Oracle Financials (general ledger) on October 1, 2015,
and the balances from transactions in HUD’s legacy applications (subledgers). For the
reconciliations that ARC performed through September 2016, differences totaling $29.38 billion
were identified. The differences remained unresolved primarily because HUD could not identify
and locate sufficient documentation to support material United States Standard General Ledger
(USSGL) accounts. The unresolved differences were material and pervasive and impacted
several USSGL accounts and financial statement line items. The remaining differences,
combined, were material to the financial statements. As a result of HUD’s inability to support
the balances recorded in the USSGL with sufficient, adequate documentation, we were unable to
rely on the balances presented in HUD’s consolidated balance sheet and the combined statement
of budgetary resources.
FAD made four recommendations to the Deputy Chief Financial Officer related to the
unresolved differences identified up to September 30, 2016. They are summarized as follows:
(1) develop and implement standard operating procedures, (2) continue the subledger
reconciliation project and complete it in a timely manner, (3) perform a root cause analysis, and
(4) communicate the impact of system limitations that contributed to unreconciled balances. All
four recommendations remained open.
HUD uses a subledger differences log to track its progress. Based on the log provided by OCFO
on June 1, 2017, the absolute value of the remaining differences to be resolved totaled
approximately $4.8 billion. See the table below for details.
                                      Status of reconciliation project

                    Differences identified up       Differences identified
                     to September 30, 2016         October 1, 2016, forward                 Total

     Completed      $ 37,309,883,560.77            $ 10,773,018,969.83             $ 48,082,902,530.60

     Not resolved     1,193,927,635.14                 3,585,474,315.82              4,779,401,950.96

     Total           38,503,811,195.91                14,358,493,285.65             52,862,304,481.56



Of the approximately $3.6 billion in unresolved differences identified after October 1, 2016,
audit work performed by FAD determined that two items totaling approximately $3.3 billion had




10
  Audit Report 2017-DP-0001, HUD’s Transition to a Federal Shared Service Provider Failed To Meet
Expectations, issued February 1, 2017, and Audit Report 2017-FO-0005, Fiscal Years 2016 and 2015 (Restated)
U.S. Department of Housing and Urban Development Consolidated Financial Statements Audit (Reissue), issued
March 1, 2017




                                                       8
been resolved during January 2017. However, the items remained on the subledger differences
log provided to us on June 1, 2017.
Below are some examples of unresolved items on the log used to track the differences between
the subsidiary ledgers and the general ledger. The examples are attributed to conversion errors,
unavailable subledger data, unsupported general ledger balances, and possible overspending.
The dollar amounts are reported as absolute values.
1. While HUD had made progress in resolving the more than $503 million in differences
   attributed to conversion, there remained more than $754 million that had not been resolved.
   Of the amount not resolved, more than $752 million was identified up to September 30,
   2016, and almost $3 million was identified after October 1, 2016. The log indicated multiple
   reasons for the differences, some of which were invalid balances or amounts being placed in
   the wrong fund.

2. We found 23 records with differences identified by ARC up to September 30, 2016, totaling
   more than $25 million, in which subledger data were still needed. The subledger had
   detailed information about transactions posted in Oracle Modules, 11 miscellaneous feeder
   systems, 12 and independent records. 13

3. There were 11 records totaling more than $217 million, in which the log indicated that the
   balance in the general ledger was not supported. Ten of the records totaling more than $216
   million had differences identified up to September 30, 2016, and were being worked on. One
   of the records, with a difference of more than $1.6 million, was identified in April 2017 but
   work to resolve it had not started.

4. The differences log showed that for fund HUD0303DBXXXXXX (Project-Based Rental
   Assistance HUD program), there was a difference in the amount of about $21,000 identified
   by ARC during April 2016. The log showed that overspending may have occurred for a
   Program Accounting System (PAS) 14 project. HUD was still researching this item.

The differences existed partly because HUD did not have a process to ensure that a periodic
reconciliation between the subsidiary ledgers and the general ledger took place before the New
Core implementation. In a December 2013 audit report, 15 FAD reported that reconciliations were
performed only when requested by OIG during routine audit procedures. It concluded that as a
result, differences that existed between the two ledgers were not identified and resolved in a



11
   Accounts Payable, Accounts Receivable, Fixed Assets, Purchasing
12
   HUDCAPS, PAS, Line of Credit Control System, Nortridge Loan System
13
   Schedules or documents from accounting or program offices
14
   PAS is an integrated subsidiary ledger for HUD’s grant, subsidy, and loan programs. PAS maintains accounting
records based on receipt of funding authorizations from HUDCAPS, which generates transaction activity at different
levels.
15
   Audit Report 2014-FO-0003, Additional Details To Supplement Our Report on HUD’s Fiscal Years 2013 and
2012 (Restated) Financial Statements, issued December 16, 2013




                                                        9
timely manner. FAD reported that in response to a similar finding reported in a management
letter, 16 the Accounting Monitoring and Analysis Division stated that it planned to hire a
contractor and work with the OCFO Systems Division to determine the appropriate system
reports needed to complete the reconciliations and create and document reconciliation policies
and procedures. However, because of budget and staffing limitations, no action was taken.
Additionally, HUD management decided that since it was planning to implement a new
accounting system, it would be in its best interest to wait until after the implementation of the
new accounting system to create the procedures.
In addition, between September 2016 and January 2017 HUD did not have sufficient resources to
assign to this process, and the contract with the vendor initially tasked with developing reports
and assigning fund differences for reconciliation ended in November 2016. As a result, HUD’s
focus for the project had been on the differences identified in fiscal year 2016. HUD had not
assigned staff to assess the differences identified in fiscal year 2017, but some items that were
easy to remedy had been resolved. However, some items remained in the log because OCFO had
not provided the necessary supporting documentation to ARC.
Until HUD reconciles all of the differences, it will be unable to fully support the balances
recorded in its general ledger. Subledger reconciliations provide assurance regarding the
completeness and accuracy of records. They support the amounts in the financial statements by
ensuring that the controlling accounts in the general ledger equal subledger balances. It is
important to support the general ledger balances with subledger detail or independent records
and identify any differences between the two. When differences are not identified in a timely
manner, the number of transactions and time and research needed to reconcile the differences
increase.

The NCIS Reconciliation Tool Was Not Effective
HUD did not have an effective process to reconcile data between HUDCAPS and Oracle
Financials. Specifically, the trial balance reports from the NCIS reconciliation tool were not
fully available for the first 4.5 months of fiscal year 2017, and the NCIS status of funds
reconciliation report did not have accurate or useful information. The Federal Managers’
Financial Integrity Act requires agencies to establish internal control and financial systems that
provide reasonable assurance of the effectiveness and efficiency of operations and the reliability
of financial reporting. HUD delayed taking action to correct the reconciliation reports because it
prioritized improving NCIS transaction processing.
In September 2016, we reported 17 that the automated reconciliation tool within NCIS was not
fully functional for the first 9 months of the fiscal year and manual reconciliations were not
performed. This condition occurred because the New Core project management team did not
move the scheduled implementation date when development of the functionality required for the




16
   OIG management letter, Fiscal Year 2011 Management Recommendations, issued January 14, 2012
17
   Audit Report 2016-DP-0004, HUD Rushed the Implementation of Phase 1 Release 3 of the New Core Project,
issued September 20, 2016




                                                      10
data reconciliation tool could not be completed by that date. Instead of delaying implementation
until the tool was fully functional, HUD decided to implement it on October 1, 2015, and rely on
exception reports, which were used to assist the operations team in resolving processing errors.
The trial balance 18 reconciliation reports were not fully functional until April 7, 2016, half way
through the fiscal year, because an accurate version of the beginning balances file was not
available for use within the tool until that time. In addition, the implementation of the status of
funds reconciliation report 19 was extended because of the excessive amount of time it took to
reconcile the conversion activities. HUD did not produce this report until the end of the third
quarter of the fiscal year. We received a copy of the report on June 27, 2016. The report showed
differences for 954 accounts with an absolute value of approximately $4.5 billion. We issued a
recommendation that the OCFO verify that the NCIS trial balance and status of funds
reconciliation reports function properly and resolve the differences. 20 The OCFO has not
completed the corrective actions to address this recommendation.
The NCIS reconciliation tool requires beginning balance information from Oracle Financials to
calculate other balances based on current fiscal year activity. The fiscal year 2017 beginning
balances file was not loaded into NCIS until February 9, 2017. As a result, a fully functional set
of NCIS reconciliation reports was not produced until that time. The trial balance reports did not
show a complete picture of beginning balances and activity and calculate the ending balance
before February 2017. As a result of the delay in loading the file, HUD had limited
reconciliation functionality for the first 4.5 months of the fiscal year.
Our review of the NCIS status of funds report, dated May 22, 2017, showed a difference between
HUDCAPS and Oracle Financials (HUD’s general ledger) totaling an absolute value of more
than $39 billion. We met with OCFO Systems Division staff in June to discuss the accuracy and
reliability of these reports and concluded that the information in the NCIS status of funds
reconciliation report was not accurate or useful. For example, the status of funds report would
show zero dollars available for some funds, but the funding amounts would appear in Oracle
Financials on the Discoverer Viewer reports. 21 We were also told that since the reports had been
a challenge to use, both OCFO’s Accounting Monitoring and Analysis Division and Systems
Divisions were using other methods to reconcile the data between the two systems and double
checking the balances.




18
   A trial balance is a list of all accounts (both revenue and capital) contained in the general ledger. The NCIS trial
balance report provides beginning balances, fiscal year activity, and ending balances, for general ledger activity
passed between HUDCAPS and Oracle.
19
   The NCIS status of funds report provides summarized balances of available budgetary resources, commitments,
obligations, paid expenditures, and available balances for both HUDCAPS and Oracle Financials, along with the
calculated differences between the two systems.
20
   Recommendation 1F from Audit Report 2016-DP-0004, HUD Rushed the Implementation of Phase 1 Release 3 of
the New Core Project, issued September 20, 2016
21
   Discoverer Viewer allows users to view preestablished reports of queries against Oracle databases, including
Oracle Federal Financials.




                                                           11
To address the issues, OCFO Systems staff planned to redesign the reports. Until that is
completed, according to OCFO Systems, it would rely on the following to ensure that all activity
was posted properly:

           •   OCFO Systems staff conducts daily monitoring of interface processing (Oracle
               Financials to NCIS, NCIS to HUDCAPS, HUDCAPS to PAS, etc.) and error
               resolution of entries that may not have posted. The staff conducts a detailed
               analysis of the entries and postings in both HUDCAPS and Oracle Financials to
               ensure that the entries properly posted.
           •   OCFO Systems staff receives a line-by-line confirmation on the individual
               transactions that are sent nightly through the NCIS general ledger confirmation
               file. If the staff encounters an Oracle Financials cross validation rule error, it
               works with ARC and any key stakeholder to resolve the issue and ensure that the
               transactions post properly.
           •   OCFO Systems staff receives confirmation of the HUDCAPS budget postings
               through the ADMIN detail journal file, which is also where it gets the general
               ledger entries from HUDCAPS.
While the compensating controls cited by the OCFO Systems staff will help determine whether
transaction processing was complete and accurate, there was no overall comparison between the
two systems to show differences or that balances were in agreement. An overall data
reconciliation between HUDCAPS and Oracle Financials is essential because actions after
successful transaction processing like journal entry adjustments could cause differences.
Although, OCFO Systems monitored transaction processing, accurate reconciliation reports
would have provided a tool for use in ensuring that the data in HUDCAPS and Oracle matched
after updates to Oracle via journal entries. During the first two quarters of fiscal year 2017,
there were approximately 1,393 journal entries processed in Oracle Financials with
adjustments totaling more than $428 billion.

Conclusion
HUD encountered significant challenges with its transition to ARC’s financial management
services and Oracle Financials. While there had been significant improvements to transaction
processing, challenges and weaknesses remained. The implementation of the New Core
Project increased the number of batch processes required to record programmatic financial
transactions. This also increased the number of opportunities for data to be modified between
HUD’s legacy applications’ subledgers and the general ledger maintained in Oracle
Financials. We found multiple issues had been identified and resolved through the OCFO
Systems error handling process. Transactions were inaccurately sent from HUDCAPS to
Oracle Financials for posting through the NCIS interface because an NCIS exclusion code
was not recognized in HUDCAPS. In addition, we found errors in both the NCIS budget and
general ledger processing due to timing issues. We found additional errors in the NCIS
general ledger interface processing due to (1) data entry errors in the crosswalk tables, (2)
prematurely end dating funds for yearend close, and (3) disabling fund codes because of
modifications made during data conversion cleanup.




                                                12
HUD did not have a process to ensure that a periodic reconciliation between the subsidiary
ledgers and the general ledger took place before the New Core implementation. Although HUD
had improved its processes to reconcile data between its subledgers and its general ledger,
additional efforts are needed. HUD had not assigned staff to assess the differences identified in
fiscal year 2017, because they did not have sufficient resources. As a result, HUD’s focus for the
project had been on the differences identified in fiscal year 2016.
It is also critical to keep HUD’s financial data in sync between the legacy HUDCAPS system,
which is still relied upon for processing programmatic funds, and the Oracle Financials
general ledger. The intent of the NCIS Reconciliation Reporting Tool was to identify
differences between the two systems and show that available budgetary balances were in
agreement. As a result of the delay in loading the beginning balances, the reconciliation tool
provided limited reconciliation functionality through the first 4.5 months of the fiscal year. In
addition, the NCIS status of funds reconciliation report did not have accurate or useful
information, and compensating controls cited by HUD did not provide an overall comparison
between the two systems to show differences or that balances were in agreement, which is
necessary to ensure accurate financial management and reporting.

Recommendations
We recommend that the Office of the Chief Financial Officer


   1A. Update yearend close procedures to mitigate repeat processing errors and reduce the
       processing time of future yearend closeouts.

   1B. Implement a data validation process to ensure the accuracy of the NCIS crosswalk table
       entries.

   1C. Resolve the unreconciled subledger differences identified after October 1, 2016.

   1D. Implement improvements to the subledger reconciliation process that will allow HUD
       to provide supporting subledger details to ARC in a timely manner.

   1E. Obtain the beginning balance file earlier in the year for use with the NCIS reconciliation
       tool.

   1F. Once NCIS reconciliation reports are available, implement a process for identifying and
       resolving data differences.




                                                 13
Scope and Methodology
The audit covered the period October 1, 2016, through July 21, 2017. We performed the audit at
HUD headquarters in Washington, DC. Audit work was conducted from December 5, 2016,
through July 21, 2017. Our audit was based on the U.S. Government Accountability Office’s
Federal Information System Controls Audit Manual methodology and information technology
guidelines established by the National Institute of Standards and Technology.
We conducted the audit to determine whether effective business processes and interface
processing controls were in place for the New Core Financial Management Solution.
To evaluate the internal controls, we

   •   identified and documented key system components,
   •   interviewed HUD and contractor staff,
   •   assessed interface processing to determine whether it was adequately controlled,
   •   assessed the department’s efforts to reconcile differences between the subsidiary ledgers
       and the general ledger,
   •   assessed the interfaced data and errors encountered between HUDCAPS and Oracle
       Financials to determine whether validation checks and error handling were in place, and
   •   assessed the data reconciliation process for ensuring the data were adequately reconciled
       between the source and target systems.


We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective(s). We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.




                                                14
Internal Controls
Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to

•   effectiveness and efficiency of operations,
•   reliability of financial reporting, and
•   compliance with applicable laws and regulations.
Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.

Relevant Internal Controls
We determined that the following internal controls were relevant to our audit objective:

•   Interface controls
•   Controls over the data reconciliation processes

We assessed the relevant controls identified above.
A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, the
reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or
efficiency of operations, (2) misstatements in financial or performance information, or (3)
violations of laws and regulations on a timely basis.
Significant Deficiencies
Based on our review, we believe that the following items are significant deficiencies:

•   HUD continued to experience transaction processing errors between HUDCAPS and Oracle
    Financials (finding 1).
•   HUD’s subledger reconciliation was not complete (finding 1).
•   The NCIS reconciliation tool was not effective (finding 1).




                                                  15
Follow-Up On Prior Audits
HUD Rushed the Implementation of Phase 1 Release 3 of the New Core Project. Audit
report number 2016-DP-0004.
Six recommendations were issued within audit report 2016-DP-0004. We concurred on the
action plans submitted by the OCFO for all six recommendations. One of the six
recommendations from the previous audit is significant within the context of the objectives for this
audit. Recommendation 1F was to verify that the NCIS trial balance and status of funds
reconciliation reports function properly and resolve the differences. The OCFO’s target
completion date to implement this recommendation is December 5, 2017. In July 2017, the
OCFO informed us that they anticipate that additional time will be needed to complete these
actions.




                                                  16
Appendix B
             Auditee Comments and OIG’s Evaluation



Ref to OIG
Evaluation    Auditee Comments




Comment 1




                               17
             Auditee Comments and OIG’s Evaluation




Ref to OIG    Auditee Comments
Evaluation


Comment 1


Comment 2




Comment 3




Comment 4




Comment 5




                               18
             Auditee Comments and OIG’s Evaluation




Ref to OIG    Auditee Comments
Evaluation




Comment 6


Comment 7


Comment 8




                               19
                         OIG Evaluation of Auditee Comments


Comment 1   We disagree with the OCFO’s comments. Within the audit report, we state that
            we found multiple issues that had been identified and resolved through the OCFO
            Systems error handling process. We feel that the report gives the department
            adequate credit for the improvements made to their processes. No changes were
            deemed necessary to the report.
Comment 2   Based on additional information received during the audit exit conference and
            OCFO’s comments and concerns about footnote numbers 8 and 18, we made
            modifications to those footnotes within the report.
Comment 3   We have not received documentation in support of OCFO’s comments; therefore,
            we cannot make an assessment regarding them. The information within the report
            reflects the information provided by the OCFO during the audit period.
Comment 4   The OCFO provided the error handing policies and procedures completed in
            August 2017, in support of their comments. We assessed the documentation
            provided and agree with the OCFO. We will close this recommendation when the
            report is issued.
Comment 5   We disagree with the OCFO’s comments. Recommendations 1C and 1D relate to
            the resolution of differences identified following October 1, 2016 specifically.
            The recommendations issued in Finding 3 of OIG audit report 2017-FO-0003
            relate to the resolution of differences identified prior to October 1, 2016. No
            changes were deemed necessary to the report.
Comment 6   We look forward to working with the OCFO to resolve this recommendation.
Comment 7   Recommendation 1F within the draft report was to revise the NCIS Status of
            Funds report. We were provided additional information during the exit
            conference in regards to the OCFO’s concern that this recommendation was
            duplicative of open recommendation 1F issued in OIG Audit report 2016-DP-
            0004. We agree with the OCFO. We added information within the body of the
            report regarding the open recommendation from the prior audit report and
            removed the recommendation from this audit report.
Comment 8   Within the draft report, this recommendation was numbered 1G, but has now been
            renumbered to 1F. We were provided additional information during the exit
            conference in regards to the OCFO’s concerns regarding how this
            recommendation was written in the draft report. Based on our review of the
            information provided, we agree that the OCFO’s proposed revision added clarity
            to the recommendation and revised the recommendation in this audit report. The
            recommendation was changed to read implement a process for identifying and
            resolving data differences once the reports are available.




                                             20