This is the accessible text file for GAO report number GAO-14-105R entitled 'Management Report: Improvements Are Needed to Strengthen the American Battle Monuments Commission's Internal Controls and Accounting Procedures' which was released on November 12, 2013. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. GAO-14-105R: GAO: United States Government Accountability Office: 441 G St. N.W. Washington, DC 20548: November 12, 2013: The Honorable Merrill McPeak, Chairman: The Honorable Max Cleland, Secretary: American Battle Monuments Commission: Courthouse Plaza II, Suite 500: 2300 Clarendon Boulevard: Arlington, Virginia 22201: Management Report: Improvements Are Needed to Strengthen the American Battle Monuments Commission's Internal Controls and Accounting Procedures: In July 2013, we issued our report on the results of our audit of the financial statements of the American Battle Monuments Commission (the Commission) as of and for the fiscal years ending September 30, 2012 and 2011.[Footnote 1] We also reported our conclusions on our consideration of the Commission's internal control and its compliance with selected provisions of laws and regulations. In that report, we concluded that the Commission did not maintain effective internal control over financial reporting because of material weaknesses in internal control concerning the Commission's (1) financial reporting process and (2) monitoring process.[Footnote 2] We also determined that a significant deficiency in internal control over the Commission's foreign employee payroll processes,[Footnote 3] which we reported in last year's audit,[Footnote 4] continued to exist in fiscal year 2012. In addition, we disclosed one area of noncompliance with laws governing the Commission's use of its Foreign Currency Fluctuation Account (FCFA).[Footnote 5] The purpose of this report is to present additional information on the internal control issues and the area of noncompliance that we identified during our fiscal year 2012 audit, along with 6 new recommendations for corrective action. In addition, this report presents the status of our 30 prior years' recommendations related to internal control and accounting procedures and the 24 prior years' recommendations related to information systems issues that remained open at the beginning of our fiscal year 2012 audit. Results in Brief: During our fiscal year 2012 audit of the Commission's financial statements, we identified internal control deficiencies in the following areas that collectively constituted a material weakness in the Commission's internal control over its financial reporting process as of September 30, 2012. * Preparation of financial statements. The Commission did not have an effective quality control process or mechanisms in place to reasonably assure that the financial statements were properly prepared in accordance with U.S. generally accepted accounting principles (U.S. GAAP) and Office of Management and Budget (OMB) guidance for federal agencies. This deficiency increases the risk of presenting information in the financial statements and related note disclosures that is inaccurate, inconsistent, or not in conformity with U.S. GAAP. * Accounting for foreign currency transactions. The Commission did not use the appropriate foreign currency exchange rate to recognize the value of accrued transactions originally denominated in foreign currencies in its financial statements. This deficiency increases the risk of the Commission significantly misstating the value of its foreign currency transactions in its financial statements. * Review of financial transactions. The Commission did not effectively review transactions to ensure that the transactions were accurate, valid, complete, and recorded in the appropriate accounting period. This deficiency increases the risk of assets being misappropriated and erroneous transactions and undetected misstatements being recorded in the financial statements. During our fiscal year 2012 audit we also identified a material weakness in the Commission's monitoring of the design and operating effectiveness of its internal control to identify, evaluate, and correct internal control deficiencies. This material weakness increases the risk that the Commission may not appropriately or timely identify deficiencies in internal control over financial reporting, which could, in turn, increase the risk of misappropriation of assets and misstatements in its financial statements. In addition, we found that as of September 30, 2012, the Commission continued to have a significant deficiency in internal control over its processing of payroll for its foreign employees that increases the risk of undetected errors or irregularities in the processing of the Commission's foreign payroll and, ultimately, in its financial statements. Further, we found that during fiscal year 2012, the Commission was not properly using its FCFA for fluctuations in foreign currency exchange rates related to payments made in foreign currencies. The Commission's improper use of its FCFA increases the risk that the Commission will continue to charge significantly more costs to this account than are allowable by law as identified during our audit. At the end of our discussion of each of these issues in the sections that follow, we present any new recommendations for strengthening the Commission's internal controls and accounting procedures. In this report we are making 6 new recommendations that are intended to improve management's oversight, controls, and compliance and minimize the risk of misstatements in the Commission's financial statements. Further, based on our follow-up on the status of recommendations we made in our prior reports that remained open, we are closing 12 of our 30 prior years' recommendations related to internal control and accounting procedures either because the Commission took appropriate action, the recommendations have been superseded by a more detailed recommendation in this report, or they are no longer relevant given changes in the Commission's control environment. In addition, the Commission had also taken action to fully address 2 of our 24 prior years' recommendations related to information systems that remained open at the completion of our audit of the Commission's fiscal year 2011 financial statements. In commenting on a draft of this report, the Commission stated that it agreed with the issues raised in our report and has already begun to take remedial actions to address our findings. The Commission's response is reprinted in its entirety in enclosure II. Scope and Methodology: This report addresses issues we identified during our audit of the Commission's fiscal years 2012 and 2011 financial statements. In planning and performing our audit, we considered the Commission's internal control over financial reporting for the purpose of determining our procedures for auditing the financial statements, not to express an opinion on the effectiveness of internal control. Accordingly, we did not express an opinion on the Commission's internal control over financial reporting. While our full scope and methodology used in carrying out our fiscal year 2012 audit is detailed in our July 2013 report,[Footnote 6] in summary, to fulfill our responsibilities as auditor of the financial statements of the Commission, we examined, on a test basis, evidence supporting the amounts and disclosures in the financial statements; assessed the accounting principles used and significant estimates made by Commission management; evaluated the overall presentation of the financial statements and notes; obtained an understanding of the Commission and its operations, including its internal control over financial reporting; assessed the risk that a material misstatement exists in the financial statements; tested relevant internal controls for the purposes of planning and performing our other audit procedures; tested compliance with selected laws and regulations; performed a targeted general controls and security review of the Commission's computer systems that support financial processing using applicable sections of GAO's Federal Information System Controls Audit Manual (FISCAM);[Footnote 7] and performed such other procedures as we considered necessary in the circumstances. We conducted our audit of the Commission's fiscal years 2012 and 2011 financial statements in accordance with U.S. generally accepted government auditing standards. We believe that our audit provided a reasonable basis for our conclusions in this report. Material Weakness in the Commission's Financial Reporting Process: During our fiscal year 2012 audit, we identified control deficiencies in the Commission's financial reporting process that collectively represented a material weakness in internal control. The deficiencies that constituted this material weakness include the Commission's (1) inadequate process for preparing the financial statements, (2) improper accounting for accrued foreign currency transactions, and (3) ineffective review of financial transactions. These deficiencies contributed to significant errors recorded in the Commission's accounting records and in the draft financial statements provided to us to audit. As a result, significant adjustments were necessary to finalize the Commission's fiscal year 2012 financial statements to achieve fair presentation. A discussion of these deficiencies follows. Preparation of Financial Statements: Beginning with its fiscal year 2012 financial reporting period, the Commission used an external service organization to prepare its financial statements. However, the Commission did not have an effective quality control process or mechanisms in place to reasonably assure that the financial statements were properly prepared in accordance with U.S. GAAP and OMB guidance. As a result, the fiscal year 2012 draft financial statements the Commission provided to us to audit contained numerous errors, including significant amounts that were misclassified or reported on the wrong financial statement, adjustments that were incorrectly reflected in the financial statements, and budgetary and proprietary accounts that did not appropriately reconcile. In addition, the draft notes to the financial statements omitted certain required disclosures and contained information that was incomplete or did not properly correspond to related amounts in the financial statements. The primary cause for this deficiency was that the Commission did not have documented policies and procedures governing (1) the process for preparing its financial statements, including the roles and responsibilities of key staff members involved in preparing the statements and the timing of when the key steps were to be performed; (2) the existence of quality control mechanisms, such as supervisory review of its financial reporting and the utilization of tools to ensure compliance with applicable accounting standards and guidance; and (3) documentation requirements. OMB Circular No. A-136, Financial Reporting Requirements,[Footnote 8] which is a central point of reference for all federal agencies that prepare financial statements, including the Commission, provides guidance for federal agencies to ensure that the information in the financial statements is presented in accordance with U.S. GAAP. In addition, according to Standards for Internal Control in the Federal Government,[Footnote 9] management is responsible for developing detailed policies and procedures to fit the agency's operations and to ensure that they are built into and are an integral part of operations to meet the agency's objectives. One such objective is timely and reliable financial reporting. Moreover, the standards state that internal control activities should be clearly documented and the documentation readily available for examination. The documentation should appear in management directives, administrative policies, or operating manuals and may be in paper or electronic form. However, our audit found that the Commission did not have detailed documented policies and procedures governing the preparation and review of its financial statements. The lack of such documented policies and procedures increases the risk (1) of errors in the financial statements, (2) that control activities may not be consistently implemented as designed, and (3) that the financial statements will not be prepared and presented in conformity with U.S. GAAP. Recommendation for Executive Action: We recommend that the Commission direct the appropriate officials to establish, document, and implement policies and procedures governing the financial statement preparation process that include detailed instructions and timelines for performing key steps in preparing the financial statements and related note disclosures, as well as supervisory review and documentation requirements. Accounting for Foreign Currency Transactions: During our fiscal year 2012 audit, we found that the Commission did not use the appropriate foreign currency exchange rate to recognize the value of accrued expenses originally denominated in foreign currencies in its financial statements.[Footnote 10] According to the Commission, nearly 60 percent of the Commission's salaries and other expenses are originally denominated in a unit of currency other than the Commission's functional currency--the U.S. dollar--with the majority of these transactions originally denominated in euros. [Footnote 11] According to applicable accounting standards and guidance for federal agencies, in financial statements denominated in U.S. dollars such as the Commission's, all amounts in the balance sheet that are originally denominated in foreign currencies should be translated into U.S. dollars at the U.S. Department of the Treasury (Treasury) exchange rate at the balance sheet date for financial reporting purposes.[Footnote 12] However, the Commission's practice with regard to valuing its foreign currency transactions was to translate these amounts in its financial statements using an internally developed exchange rate. For accrued transactions originally denominated in euros, this practice significantly understated the value compared to the value that would be derived if the Commission had used the Treasury exchange rate for these transactions.[Footnote 13] Since most of the Commission's accrued balances were originally denominated in euros, the draft financial statements were materially misstated. As a result, adjustments were necessary to finalize the Commission's fiscal year 2012 financial statements to achieve fair presentation. The incorrect accounting for foreign currency transactions occurred because the Commission had not established a policy and related procedures for valuing its foreign currency transactions in accordance with applicable accounting standards and Treasury guidance. Standards for Internal Control in the Federal Government provides that control activities are intended to help ensure that all transactions are completely and accurately recorded.[Footnote 14] Further, control activities over translating foreign currency transactions into U.S. dollars should adhere to applicable standards and be clearly documented, periodically updated, and readily available for examination. Without policies and procedures for properly accounting for its foreign currency transactions at year-end using the appropriate Treasury rate, there is an increased risk that the value of the Commission's foreign currency transactions will be materially misstated in its financial statements. Recommendation for Executive Action: We recommend that the Commission direct the appropriate officials to establish, document, and implement a policy and related procedures for valuing its foreign currency transactions in its financial statements in accordance with applicable accounting standards and guidance for federal agencies. Review of Financial Transactions: During our fiscal year 2012 audit, we found that the Commission did not effectively review its financial transactions to ensure that the transactions were accurate, valid, complete, and recorded in the appropriate accounting period. For example, we found the Commission did not review its open obligations to verify whether they remained valid and whether adjustments, if necessary, were made timely to accurately reflect its open obligations balance. When the Commission initially places orders with vendors, it records budgetary obligations to reserve funds to pay for the goods and services. Once the goods and services have been received and a decision has been made that any additional goods or services will not be delivered, the remaining reserved funds are no longer valid and should be deobligated. However, because the Commission did not review its open obligations, it was not aware that as of September 30, 2012, at least $603,000 of recorded obligations were no longer valid, thereby restricting the availability of these funds for other purposes. In another example, we found amounts recorded in the general ledger that could not be reconciled to supporting detail, such as certain deposits of trust fund donations the Commission collected from donors to decorate grave sites with flowers and maintain and repair nonfederal war memorials. Further, our audit found numerous instances in which transactions affecting accounts payable, payroll accruals, and depreciation expense calculations were incorrectly recorded and summarized in the financial management accounting system. The primary cause of these findings was that the Commission did not have documented policies and procedures outlining the supervisory review process for its financial transactions. Consistent with Standards for Internal Control in the Federal Government,[Footnote 15] the Commission should have controls in place to provide reasonable assurance that its financial transactions are recorded completely and accurately. The standards indicate that these controls should generally be designed to assure that ongoing monitoring occurs in the course of normal operations, such as managerial reviews of financial transactions, activities, comparisons, reconciliations, and other actions people take in performing their duties of processing financial transactions. The standards also provide that transactions and events should be timely recorded to maintain their relevance and value to management in controlling operations and making decisions. Ineffective supervisory review and a lack of continuous monitoring of financial transactions increase the risk that errors or fraud may not be detected and corrected in time to prevent misstatement of the financial statements or misappropriation of assets. Recommendation for Executive Action: We recommend that the Commission direct the appropriate officials to establish and implement written policies and procedures requiring timely and continuous supervisory review of all financial transactions. Material Weakness in the Commission's Monitoring of Internal Controls: During our fiscal year 2012 audit, we found that the Commission did not have an adequate process for monitoring the design and operating effectiveness of its internal control to identify, evaluate, and correct internal control deficiencies. Over the past 2 fiscal years, our audits revealed that the Commission underwent significant changes to its organizational structure and internal control activities, including reorganizing key staff members and their responsibilities, and switched to a different financial management system managed by an external service organization.[Footnote 16] Although these significant changes introduced new internal and external risks to the Commission's control environment, the Commission did not consider these risks or effectively monitor internal control over financial reporting during fiscal year 2012. A primary mechanism for management to monitor and assess internal control over financial reporting is through the self-assessment process under OMB Circular No. A-123, Management's Responsibility for Internal Control (OMB A-123).[Footnote 17] OMB A-123 provides that management is responsible for establishing and maintaining internal control to achieve the objectives of effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. OMB A-123 further provides that managers should define the control environment (e.g., programs, operations, or financial reporting) and then perform risk assessments to identify the most significant areas within that environment in which to place or enhance internal control. Continuous monitoring and testing should help to identify poorly designed or ineffective controls and should be reported upon periodically. However, the Commission did not have policies and procedures for planning and conducting the Commission's annual assessment of internal control over financial reporting, as required by OMB A-123. Further, the documentation the Commission provided to us to support its fiscal year 2012 assertion on its review of internal control over financial reporting did not demonstrate that the Commission properly conducted the review and considered all responsibilities and requirements as outlined under OMB A-123. For example, we found that the Commission did not: * consider its internal control environment, which entails such elements as the tone at the top, ethical standards, and personnel management, and which can have a significant effect on how the organization functions and the integrity of its financial accounting and reporting; * adequately assess the risk of material misstatement to its financial statements; * establish internal control objectives and document the related internal control activities in place to meet those objectives; * document its approach for assessing its internal control, or provide sufficient, appropriate evidence to support the nature and extent of the tests performed, and how conclusions were reached on the effectiveness of its internal control activities; or: * establish a corrective action plan or process for addressing deficiencies that have been identified. In addition to not adequately monitoring its in-house control processes, the Commission did not adequately monitor the effectiveness of internal control at the service organizations that performed significant aspects of its financial transaction processing and reporting, including processing its federal employee payroll transactions, reconciling its fund balance with Treasury, and preparing its annual financial statements. Specifically, the Commission did not evaluate the service organizations' service auditor reports that contained information on the service organizations' controls and the effectiveness of those controls, and did not consider the impact of the findings and conclusions contained in the service auditor reports on the effectiveness of its internal control.[Footnote 18] Further, the Commission did not design and implement appropriate complementary user entity controls that were identified by the service auditors.[Footnote 19] Standards for Internal Control in the Federal Government provides that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations, and includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties.[Footnote 20] According to OMB A-123, periodic assessments should be integrated as part of management's continuous monitoring of internal control, which should be ingrained in the agency's operations. The lack of an adequate monitoring process increases the risk that the Commission may not appropriately identify deficiencies in internal control over financial reporting, which could increase the risk of misstatements in its financial statements. Recommendations for Executive Action: We recommend that the Commission direct the appropriate officials to take the following actions to improve its monitoring of internal control: * Establish and implement written policies and procedures for planning and conducting the Commission's annual assessment of internal control over financial reporting as required by OMB A-123. The policies and procedures should include: - documenting an understanding of its internal control environment, which entails such elements as the tone at the top, ethical standards, and personnel management, which can have a significant effect on how the organization functions and the integrity of its financial accounting and reporting; - documenting its assessment of the risk of material misstatement to its financial statements; - establishing and documenting its internal control objectives and related internal control activities in place to meet those objectives; - documenting the tests to be performed and the results of each test, clearly identifying exceptions and resulting deficiencies; and: - establishing a corrective action plan for all identified deficiencies that specifies how and when each deficiency will be corrected, and assigning responsibility for its effective and timely resolution. * Establish and implement written policies and procedures for monitoring the activities of the external service organizations that perform significant aspects of the Commission's financial transaction processing and reporting, including implementing relevant complementary user entity controls identified by the service auditors. Significant Deficiency in Foreign Payroll Processes: In our audit of the Commission's fiscal years 2011 and 2010 financial statements,[Footnote 21] we identified a significant deficiency in the Commission's internal control over payroll processes for its non-U.S. citizen employees (foreign employees) that increased the risk of financial reporting misstatements and unauthorized access and manipulation of the systems or their data.[Footnote 22] Specifically, we found that (1) two system administrators had inappropriate access, allowing them to not only make system changes but also to alter data in systems for which they were responsible; (2) the Commission had not installed critical updates and patches on several of its servers as outlined in its Computer Security Plan; and (3) the Commission did not have policies and procedures clearly delineating the responsibilities of both the Human Resources and Finance Directorates with respect to ensuring accurate payroll information for foreign employees. During fiscal year 2012, the Commission contracted with a consultant to assess information relating to the Commission's foreign payroll operations, analyze outsourcing options, and compare vendors for final selection and contract negotiations. However, as of September 30, 2012, the Commission had not taken action to address the specific deficiencies we identified during our fiscal year 2011 audit concerning its foreign payroll processes. Consequently, the deficiencies we identified concerning the Commission's foreign payroll processes remained as of September 30, 2012, thus increasing the risk of undetected errors or irregularities in the processing of the Commission's foreign payroll and, ultimately, in its financial statements. While we are not making any new recommendations in this area, we reaffirm our five recommendations from our July 2012 management report that we made to address internal control deficiencies concerning the Commission's processing of foreign payroll.[Footnote 23] These five recommendations remained open as of June 28, 2013, and continue to increase the risk of undetected errors or irregularities in the processing of the Commission's foreign payroll and, ultimately, in its financial statements. These recommendations are detailed in enclosure I. Noncompliance with Laws Governing the FCFA: During our fiscal year 2012 audit, our tests of the Commission's compliance with selected provisions of laws and regulations for fiscal year 2012 disclosed one area of noncompliance that is reportable under U.S. generally accepted government auditing standards. This area relates to the Commission not properly charging its FCFA for fluctuations in foreign currency exchange rates related to payments made in foreign currencies. Specifically, the Commission did not comply with the FCFA's governing statutes in (1) section 2109 of title 36, United States Code, which authorizes the use of FCFA funds to pay the costs of salaries and expenses that exceed the amount appropriated for salaries and expenses because of fluctuations in currency exchange rates of foreign countries occurring after a budget request is submitted to Congress, and (2) the Consolidated Appropriations Act, 2012, which appropriated an unlimited amount of FCFA funds for purposes authorized by section 2109.[Footnote 24] To determine the portion of costs of salaries and expenses incurred because of fluctuations in foreign currency exchange rates that occurred after the submission of the budget request to Congress involves a comparison of the Treasury exchange rates in effect on the date of payment with those in effect on the date the Commission's budget request is submitted to Congress. In instances where the Treasury exchange rate (from the foreign currency into U.S. dollars) in effect on the date of payment exceeds the Treasury exchange rate that was in effect on the date of budget submission, the Commission can use the FCFA to fund the resultant additional cost related to the exchange rate fluctuations. However, we found that the Commission's process for determining the amount to charge to the FCFA was based on the Commission comparing the Treasury exchange rate on the date of payment to internally developed exchange rates the Commission used for foreign currency transactions in its budget submission. Because the Commission's internal rate for euro transactions, which accounted for the predominance of foreign currency transactions, undervalued the euro on the date of budget submission, the Commission charged significantly more costs to the FCFA than were allowable by law for the transactions we evaluated. [Footnote 25] The following example from our review of operation and maintenance expense transactions during fiscal year 2012 illustrates the effect of not using the appropriate exchange rates in determining the correct amount to charge to the FCFA. In March and May 2012, the Commission received two invoices for maintenance expenses totaling 32,912.50 euros. To pay these invoices, the Commission was required to expend $42,726.86 in May 2012 because the actual exchange rate at the time of payment was one euro to 1.29819551 dollars.[Footnote 26] If the Commission had properly performed a comparison of the Treasury euro-to- dollar exchange rate on the date of its February 14, 2011, budget submission to the exchange rate on the date of payment, the entire payment for this transaction would have been expensed to the salaries and expense account because the euro-to-dollar exchange rate of 1.29819551 dollars on the date of payment was a lesser rate than the rate of 1.32872 dollars on the date the Commission's budget was submitted to Congress. In other words, this expense was nearly $1,005 less expensive on the date it was actually paid as compared to if it had been paid on the date the Commission's budget was submitted to Congress. However, as a result of its internal practices, the Commission compared the Treasury exchange rate on the date of payment (1.29819551 dollars) to the internally developed exchange rate it used for euro transactions in its budget submission (1.0 dollars) and charged $32,912.50 to its salaries and expense account and $9,814.36 to its FCFA, for a total of $42,726.86 in expenditures for this transaction. We concluded that the Commission should not have used any funds from the FCFA to pay for this transaction. Based on our statistical evaluations, we estimate that of the $8.6 million charged to the FCFA during fiscal year 2012, as much as $7.3 million of that amount shares characteristics with the FCFA funds in the transactions we fully evaluated and found to be noncompliant.[Footnote 27] Until the Commission changes its policy to conform to FCFA's governing statutes, the Commission is at increased risk of charging significantly more costs to this account than are allowable by law. Recommendation for Executive Action: We recommend that the Commission direct the appropriate officials to revise its policy and implement procedures to comply with the FCFA's governing statutes in section 2109 of title 36, United States Code, and the Consolidated Appropriations Act, 2012, by only using the FCFA to cover costs derived from fluctuations in Treasury foreign currency exchange rates that occurred after the submission of the budget request to Congress. Status of Prior Years' Recommendations: The Commission has continued to work to address control deficiencies related to open recommendations from our prior financial audits. At the beginning of our fiscal year 2012 financial audit, there were 30 open recommendations to improve the Commission's internal controls and accounting procedures from prior year audits. In the course of performing our fiscal year 2012 financial audit, we evaluated the actions the Commission took to address our previously identified control deficiencies. Based on our evaluation and fiscal year 2012 audit work, we are closing 12 of these recommendations either because the Commission took appropriate action, the recommendations have been superseded by new recommendations in this report, or they are no longer relevant given changes in the Commission's control environment. Consequently, a total of 24 recommendations related to internal control and accounting procedures still need to be addressed--18 remaining from our prior years' audits and the 6 new recommendations we are making in this report. See enclosure I for more details on the status of the Commission's actions to address our prior year recommendations related to internal control and accounting procedures. In addition, at the beginning of our fiscal year 2012 financial audit, there were 24 open recommendations related to information systems from our prior year audits. During this year's audit we were able to substantiate that the Commission took action that fully addressed 2 of these open recommendations. Consequently, a total of 22 information systems recommendations still need to be addressed. In our prior reports, we provided Commission management some of these information systems-related recommendations in limited official use reports because of their sensitive nature, and we are therefore not including the details of these sensitive recommendations in this report. Commission Comments: In its written comments, reprinted in enclosure II, the Commission agreed with the issues raised in the report and stated that it had already undertaken remedial actions to begin addressing our findings. The Commission also stated that it would provide a full response to each recommendation as part of its 31 U.S.C. § 720 letter to Congress, which is due 60 days after the issuance of this report. We will follow up at a later date on all these matters as well as any open recommendations to determine the status of related corrective actions. This report contains recommendations to the Commission. The head of a federal agency is required by 31 U.S.C. § 720 to submit a written statement on actions taken on these recommendations. You should submit your statement to the Senate Committee on Homeland Security and Governmental Affairs and to the House Committee on Oversight and Government Reform within 60 days of the date of this report. A written statement must also be sent to the House and Senate Committees on Appropriations with the Commission's first request for appropriations made more than 60 days after the date of this report. Furthermore, to ensure that we have accurate, up-to-date information on the status of the Commission's actions on our recommendations, we request that you also provide us with a copy of the Commission's statement of actions taken on open recommendations. Please send your statement of actions to Cheryl E. Clark, Director, at clarkce@gao.gov or John D. Sawyer, Assistant Director, at sawyerj@gao.gov. This report is intended for use by the management of the Commission. We are sending copies of this report to interested congressional committees, the Director of the Office of Management and Budget, and other interested parties. In addition, the report is available at no charge on the GAO website at [hyperlink, http://www.gao.gov]. We acknowledge and appreciate the cooperation and assistance provided by Commission management and staff during our audit of the Commission's fiscal years 2012 and 2011 financial statements. If you have any questions about this report or need assistance in addressing these issues, please contact Cheryl E. Clark at (202) 512-9377 or clarkce@gao.gov or Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made major contributions to this report are listed in enclosure III. Signed by: Cheryl E. Clark: Director: Financial Management and Assurance: Signed by: Nabajyoti Barkakati: Chief Technologist: Applied Research and Methods: Enclosures - 3: [End of section] Enclosure I: Status of Recommendations That Were Open at the Beginning of GAO's Fiscal Year 2012 Audit of the American Battle Monuments Commission's (the Commission) Financial Statements: GAO-07-690RSU[A]: Controls over disbursing agency amounts: ID no: 07-18RS[B]; Recommendation: Periodically reconcile amounts reported by other federal agencies to Commission accounts, schedules, and transactions and investigate and document actions to correct any differences; Status: Closed. Controls over foreign service national employees' sick leave. ID no: 07-55RS[B]; Recommendation: Periodically reconcile sick leave use by Commission Italian Foreign Service National employees to amounts reported by the U.S. Embassy in Rome, Italy; Status: Closed. GAO-09-714R[C]: Controls over intragovernmental transactions: ID no: 09-03; Recommendation: Obtain documentation from other federal agencies to support its intragovernmental charges paid through the Department of the Treasury's (Treasury) Intra-governmental Payment and Collection (IPAC) system; Status: Closed. Controls over receipt dates and approvals of expenditure transactions: ID no: 09-31; Recommendation: Instruct and monitor approving officials to ensure that expenditure transactions are dated when goods and services are received and approved before payment is made; Status: Open. GAO-10-596R[D]: Controls over management reviews: ID no: 10-05; Recommendation: Finalize management review and issue the Internal Control Handbook or equivalent for use by Commission personnel; Status: Closed - not implemented[E]. ID no: 10-08; Recommendation: Determine who will conduct future annual internal control risk assessments and evaluations and document the planned roles and responsibilities of Commission personnel and any contractors to execute the strategy for monitoring internal controls; Status: Closed - not implemented[E]. Controls over procurement process: ID no: 10-09; Recommendation: Follow established policies and procedures in taking action to conduct a review of contracts and purchase orders outstanding for completeness, accuracy, and proper dates; Status: Open. ID no: 10-11; Recommendation: Follow established policies and procedures in taking action to coordinate procurement activity with finance personnel to ensure accurate and compliant obligation of funding of procurements, including proper application of multiyear contract terms; Status: Open. Controls over donated services: ID no: 10-22; Recommendation: Remind personnel of the existing Commission guidance for accepting funds and in-kind donations and gifts and, as necessary, conduct training; Status: Closed. Controls over imprest cash counts: ID no: 10-25; Recommendation: Ensure that cash balances reported on the monthly Financial Management Service (FMS) 1219, Statement of Accountability, reconcile to actual cash amounts on hand in accordance with the Treasury Financial Manual; Status: Open. ID no: 10-26; Recommendation: Write off the pre-1996 receivable amount reported on the monthly FMS 1219, Statement of Accountability, as uncollectible; Status: Open. Controls over documentation of expenditure transactions: ID no: 10-29; Recommendation: Follow established accounting procedures to include an Invoice Approval Sheet in every voucher package; Status: Closed. ID no: 10-31; Recommendation: Follow established accounting procedures to review voucher packages for completeness before they are processed for payment; Status: Closed. Controls over foreign service national holiday pay: ID no: 10-40; Recommendation: Revise the existing holiday leave policy to clearly provide that employees can charge no more than 8 hours for a holiday, regardless of their work schedules; Status: Closed - not implemented[F]. ID no: 10-41; Recommendation: Notify employees of the policy clarification prohibiting charging more than 8 hours for a holiday, regardless of their work schedules; Status: Closed - not implemented[F]. ID no: 10-42; Recommendation: Notify supervisors and other payroll reviewers to check that holiday hours charged by employees are correct before processing payroll; Status: Closed - not implemented[F]. GAO-11-577R[G]: Controls over budgetary information: ID no: 11-02; Recommendation: Strengthen controls over financial reporting to ensure the complete disclosure of budgetary activity, including an explanation of any differences between amounts reported in the Commission's Statement of Budgetary Resources and actual amounts reported for the entity in the Budget of the United States Government, along with the availability of published information; Status: Open. Controls over cash accounts. ID no: 11-03; Recommendation: Monitor monthly cash reconciliations for all fund balance with Treasury accounts Commission-wide to ensure their completeness and accuracy; Status: Open. Controls over active contracts: ID no: 11-04; Recommendation: Maintain a consolidated Active Contracts List, or require the Paris Overseas Office to maintain a separate list, with information on each contract, including the name of the contact person; the status of work completed; whether retainage amounts had been paid; and whether any amounts were pending due to disagreements on work performed; Status: Open. ID no: 11-05; Recommendation: Ensure that the Active Contracts List is reconciled to contracts on the undelivered orders report produced by the Commission's accounting system; Status: Open. Controls over budgetary activity: ID no: 11-06; Recommendation: Follow existing budgetary procedures to ensure that contracts are officially agreed to and executed as of or before the date of obligation; Open. Controls over documentation of personnel actions: ID no: 11-08; Recommendation: Follow existing policy to prepare, approve, and file current forms to support pay changes in foreign employees' official personnel files; Status: Open. ID no: 11-09; Recommendation: Direct the Rome office personnel specialist to follow existing policy to prepare, approve, and file current forms to support pay changes in employees' official personnel files; Status: Open. ID no: 11-10; Recommendation: Establish a consistent policy for Paris and Rome offices to support changes in employees' official personnel files by using Standard Form 50, Notification of Personnel Action, for all employees; Status: Open. Controls over approvals and invoice dates: ID no: 11-11; Recommendation: Instruct Commission personnel to print their names and sign when approving the receipt of goods and services; Status: Closed. ID no: 11-12; Recommendation: Maintain an authorized list of approving Commission officials with their signatures that Finance Directorate personnel can verify when processing invoices for payment; Status: Open. ID no: 11-13; Recommendation: Modify existing accounting procedures to instruct Finance Directorate personnel to enter the date on the invoice into the accounting system; Status: Open. GAO-12-830R[H]: Controls over foreign employee payroll systems: ID no: 12-01; Recommendation: Establish and implement written policies and procedures to identify and appropriately segregate the roles and responsibilities of staff involved in developing, testing, and implementing changes to and maintenance of the foreign employee payroll systems to reduce the risk of malevolent activity without collusion; Status: Open. ID no: 12-02; Recommendation: Perform a review of the Commission's computer systems and servers to assess whether all patches and critical updates are current. For any systems and servers found without the most current patch or update, establish a process to ensure immediate installation; Status: Open. ID no: 12-03; Recommendation: Establish a mechanism to monitor implementation of existing procedures requiring timely installation of all patches and critical updates as outlined in the Commission's Computer Security Plan; Status: Open. ID no: 12-04; Recommendation: Update the Commission's Computer Security Plan to reflect the current state of the Commission's information technology environment; Status: Open. Controls over processing foreign payroll: ID no: 12-05; Recommendation: Establish written policies and procedures outlining the key tasks, roles, and responsibilities of both the Human Resources Directorate and the Finance Directorate, including a formal mechanism for communicating all decisions and actions related to processing payroll for foreign employees; Status: Open. Controls over physical inventory counts: ID no: 12-06; Recommendation: Establish and implement written procedures for conducting all physical inventory counts of equipment. These procedures, at a minimum, should outline the processes for (1) planning and executing the physical inventory count and (2) analyzing and documenting the results; Status: Open. ID no: 12-07; Recommendation: Establish a mechanism to monitor implementation of existing Commission policy to perform biennial physical inventory counts of all items of equipment with an obligated balance of $500 or more; Status: Open. Source: GAO. Note: This table does not include 20 information systems-related recommendations that were published in limited official use reports and considered sensitive in nature. The status of any sensitive recommendations will be reported separately to Commission management. [A] GAO, American Battle Monuments Commission: Management Action Needed to Establish Control Requirements and Related Procedures in Fiscal Year 2006, GAO-07-690RSU; (Washington, D.C.: June 4, 2007). [B] While these recommendations were originally published in a restricted report with limited use, these recommendations are not sensitive in nature. [C] GAO, American Battle Monuments Commission: Management Action Needed to Improve Internal Control Procedures, [hyperlink, http://www.gao.gov/products/GAO-09-714R] (Washington, D.C.: June 17, 2009). [D] GAO, Management Report: Improvements Needed in American Battle Monuments Commission's Internal Controls and Accounting Procedures, [hyperlink, http://www.gao.gov/products/GAO-10-596R] (Washington, D.C.: July 23, 2010). [E] We are closing this recommendation as not implemented because it has been superseded by a more detailed recommendation. [F] We are closing this recommendation as not implemented because it is no longer relevant given changes in the Commission's control environment. [G] GAO, American Battle Monuments Commission: Improvements Needed in Internal Controls and Accounting Procedures - Fiscal Year 2010, [hyperlink, http://www.gao.gov/products/GAO-11-577R] (Washington, D.C.: July 28, 2011). [H] GAO, Management Report: Improvements Are Needed to Strengthen the American Battle Monuments Commission's Internal Controls and Accounting Procedures, [hyperlink, http://www.gao.gov/products/GAO-12-830R] (Washington, D.C.: July 26, 2012). Recommendations in this report, assigned as numbers 12-01 through 12- 04, relate to information systems. [End of table] [End of section] Enclosure II: Comments from the American Battle Monuments Commission: American Battle Monuments Commission: Office of the Secretary: 2300 Clarendon Boulevard, Suite 500: Arlington, VA 22201-3367: [hyperlink, http://www.abmc.gov] November 5, 2013: Ms. Cheryl Clark: Director, Financial Management and Assurance: United States Government Accountability Office: Washington, DC 20548: Dear Ms. Clark, This responds to your October 23, 2013, memorandum regarding your proposed report: Improvements Are Needed to Strengthen the American Battle Monuments Commission's Internal Controls and Accounting Procedures (GAO-14-105R). Prior to the completion of the audit we had already undertaken remedial actions to begin addressing your findings. We hired a contractor to perform an internal control review and develop standard operating procedures. The results of the internal control review and implementation of standard operating procedures will occur within the current fiscal year. In addition, the agency is in the process of outsourcing the payroll system for our foreign service nationals. This process will be completed within the current fiscal year and will rectify the previously reported significant deficiency. We will continue to work with the Office of Management and Budget and our Congressional appropriations subcommittees during the current budget cycle to resolve the instance of noncompliance with laws and regulations relating to the process for utilizing our foreign currency fluctuation account. We agree with the issues raised in your report and are considering its recommendations. The Commission will provide a full response to each recommendation as part of our 31 U.S.C. 720 letter to the Congress, which is due 60 days after the issuance of the report. Most respectfully, Signed by: Max Cleland: [End of section] Enclosure III: GAO Contacts and Staff Acknowledgments: GAO Contacts: Cheryl E. Clark, (202) 512-9377 or clarkce@gao.gov: Nabajyoti Barkakati, (202) 512-4499 or barkakatin@gao.gov: Staff Acknowledgments: In addition to the contacts named above, John D. Sawyer, Chuck R. Fox, and Edward Alexander (Assistant Directors); Tulsi Bhojwani; Jessica Boucher; Mark Canter; Melanie Darnell; Ryan Guthrie; Brian Harechmak; Tuan Lam; Chari Nash-Cannaday; Andrew Stephens; and Vanessa Taja made key contributions to this report. [End of section] Footnotes: [1] GAO, Financial Audit: American Battle Monuments Commission's Financial Statements for Fiscal Years 2012 and 2011, [hyperlink, http://www.gao.gov/products/GAO-13-641] (Washington, D.C.: July 19, 2013). [2] A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. [3] A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit the attention of those charged with governance. [4] GAO, Financial Audit: American Battle Monuments Commission's Financial Statements for Fiscal Years 2011 and 2010, [hyperlink, http://www.gao.gov/products/GAO-12-404] (Washington, D.C.: Mar. 1, 2012). [5] Congress created the FCFA in 1988. FCFA funds are only to be used to pay the cost of salaries and expenses that exceed the amount appropriated for salaries and expenses because of fluctuations in foreign currency exchange rates that occur after the Commission's budget request is submitted to Congress. 36 U.S.C. § 2109(a). [6] [hyperlink, http://www.gao.gov/products/GAO-13-641]. [7] GAO, Federal Information System Controls Audit Manual (FISCAM), [hyperlink, http://www.gao.gov/products/GAO-09-232G] (Washington, D.C.: February 2009). [8] Office of Management and Budget, Financial Reporting Requirements, OMB Circular No. A-136 (revised Aug. 3, 2012). [9] GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999), contains the internal control standards to be followed by executive agencies in establishing and maintaining systems of internal control as required by 31 U.S.C. § 3512 (c), (d) (commonly referred to as the Federal Managers' Financial Integrity Act of 1982). [10] Accrued expenses relate to the costs of goods and services that had been incurred by the Commission, but for which payment had not yet been made as of fiscal year-end. [11] During fiscal year 2012, the Commission engaged in transactions originally denominated in euros (Europe), Tunisian dinars (Tunisia, North Africa), Philippine pesos (Philippines), and Mexican pesos (Mexico). [12] See Federal Accounting Standards Advisory Board 1, Accounting for Selected Assets and Liabilities, and Financial Accounting Standards Board 830, Foreign Currency Matters. In addition, the Treasury Financial Manual instructs federal agencies to use the Treasury exchange rate for this purpose. [13] The internal exchange rates the Commission used for recognizing transactions denominated in the other currencies were significantly closer to the statutory rate, and the volume of transactions was considerably less than those denominated in euros. Consequently, the effect on these foreign currency transactions was not significant. [14] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [15] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [16] In fiscal year 2012, the Commission contracted with one outside service organization to process its federal employee payroll transactions and another organization to reconcile its fund balance with Treasury and to prepare its financial statements. [17] OMB A-123 defines management's responsibility for developing and maintaining internal control in federal agencies and provides guidance for federal managers to use in providing an annual assurance statement on whether the agency's internal control met the objectives of effective and efficient operations, reliable financial reporting, and compliance with laws and regulations, which is a requirement under the Federal Managers' Financial Integrity Act of 1982 (FMFIA). The internal control assessment that OMB A-123 directs agencies to perform to support its annual FMFIA assurance statement is critical to effective monitoring of internal control over financial reporting. [18] In accordance with Statement of Standards on Attestation Engagements No. 16, Reporting on Controls at a Service Organization, the auditors of each of these external service organizations issued reports concerning the design and operating effectiveness of the service organizations' internal control over the processing of user transactions. Services provided by an external service organization are considered to be part of a user entity's information system relevant to the user entity's financial reporting if the services affect classes of transactions that are significant to the user entity's financial statements as well as the financial reporting process used to prepare the financial statements. [19] Service auditor reports identify any key complementary user entity controls that user entities should have in place to achieve the control objectives described in the service auditor reports. [20] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [21] [hyperlink, http://www.gao.gov/products/GAO-12-404]. [22] The Commission maintains three payroll systems for foreign employees located in the following countries: (1) Belgium, (2) the United Kingdom (England), (3) France, (4) Italy, (5) Luxembourg, (6) the Netherlands, and (7) Tunisia. [23] GAO, Management Report: Improvements Are Needed to Strengthen the American Battle Monuments Commission's Internal Controls and Accounting Procedures, [hyperlink, http://www.gao.gov/products/GAO-12-830R] (Washington, D.C.: July 26, 2012). [24] Pub. L. No. 112-74, div. H, title III, 125 Stat. 786, 1160 (2011). [25] The internally developed exchange rates the Commission used for recognizing transactions denominated in the other foreign currencies, including the Tunisian dinars, Philippine pesos, and Mexican pesos, were significantly closer to the Treasury rate, and the volume of these transactions was significantly less than that of those denominated in euros. Consequently, funds, if any, used from the FCFA for these other foreign currency transactions were less significant. [26] The exchange rate listed above is based on the International Treasury Service (ITS.gov) rate for the euro-to-dollar on May 16, 2012. ITS.gov provides foreign currency exchange rates for federal agencies dealing with foreign currencies, like the Commission. [27] Our evaluation was based on a statistical sample from a population of 15,650 expenditures totaling $8.6 million charged to the FCFA during fiscal year 2012. Net and absolute dollar value totals for the population were $8.6 million and $9.1 million, respectively. We are 95 percent confident that the upper error limit total that should have been charged to the Commission's appropriations for salaries and expenses is $7.3 million if the use of FCFA funds was noncompliant in a similar fashion as in those transactions we fully evaluated. [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E-mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Katherine Siggerud, Managing Director, siggerudk@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, DC 20548. [End of document]