This is the accessible text file for GAO report number GAO-14-106T entitled 'DHS Financial Management: Continued Effort Needed to Address Internal Control and System Challenges' which was released on November 15, 2013. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Testimony: Before the Subcommittee on Oversight and Management Efficiency Committee on Homeland Security House of Representatives: For Release on Delivery: Expected at 2:00 p.m., EDT: Thursday, October 10, 2013: DHS Financial Management: Continued Effort Needed to Address Internal Control and System Challenges: Statement of Asif A. Khan, Director: Financial Management and Assurance: GAO-14-106T: Chairman Duncan, Ranking Member Barber, and Members of the Subcommittee: I am pleased to be here today to discuss our recent work on the Department of Homeland Security's (DHS) efforts to improve its financial management and reporting. Since DHS's inception in March 2003,[Footnote 1] internal control and financial management system weaknesses have impeded its ability to provide reliable, timely, and useful financial data to support daily operational decision making. [Footnote 2] Those internal control and financial management system deficiencies contributed to our decision to designate DHS's management functions--including financial management--as high risk in 2003. [Footnote 3] As noted in our 2013 high-risk report, continued improvement is needed to mitigate the risks identified and to help ensure that management weaknesses do not hinder the department's ability to efficiently and effectively use its resources and accomplish its mission.[Footnote 4] The DHS Audit Requirement Target Act of 2012 requires DHS to take the necessary steps to ensure that its fiscal year 2013 financial statements are ready in a timely manner in order to obtain a clean opinion.[Footnote 5] A clean opinion means that the financial statements are presented fairly, in all material respects, in accordance with the applicable accounting principles. DHS's financial statements consist of the consolidated balance sheets; statements of net cost, changes in net position, budgetary resources, and custodial activity; and related notes. Further, DHS is required by the DHS Financial Accountability Act of 2004[Footnote 6] to obtain an audit opinion on its internal control over financial reporting.[Footnote 7] A clean opinion states that, in the auditors' opinion, the entity maintained effective internal control over financial reporting. We have long held that accountability is part of the organizational culture that goes well beyond receiving a clean audit opinion on the financial statements; the underlying premise is that agencies must become more results-oriented, cost conscious, and focused on internal control. A disciplined and structured approach to assessing internal control is critical to successfully implement and maintain adequate financial management oversight in the federal government. My remarks today are primarily based on our September 2013 report on DHS financial management issues.[Footnote 8] Accordingly, this testimony addresses DHS's progress toward (1) obtaining a clean opinion on its financial statements; (2) obtaining a clean opinion on its internal control over financial reporting; and (3) modernizing its financial systems, including the extent to which DHS's approach for modernizing its current financial systems was consistent with Office of Management and Budget (OMB) requirements. We also discuss whether DHS followed certain information technology (IT) best practices while implementing its approach. For our report, we reviewed relevant DHS guidance and documents, determined whether DHS followed OMB requirements and certain industry best practices, and interviewed key DHS officials. We updated this statement for new information obtained from DHS since the issuance of our report related to DHS's schedule for completing its financial system modernization efforts. This work was performed in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Our report provides further details on our scope and methodology. In summary, we found DHS: * has made considerable progress toward generating reliable financial data to obtain a clean opinion on its financial statements; * has made limited progress in establishing effective controls to obtain a clean opinion on its internal control over financial reporting; and: * is in the early planning stages of implementing its decentralized approach with each component determining the specific solution for its financial systems modernization. Opinion on Financial Statements: DHS's progress on obtaining a clean opinion on its financial statements includes reducing the number of audit qualifications from 11 in 2005 to 1 in 2010;[Footnote 9] receiving a qualified audit opinion on two of its five fiscal year 2011 financial statements--the consolidated balance sheet and statement of custodial activity;[Footnote 10] expanding the financial audit in fiscal year 2012 to all financial statements; and obtaining a qualified opinion on the fiscal year 2012 financial statements.[Footnote 11] DHS was able to achieve this progress based in part on management's commitment to improving its financial management process. DHS is working to resolve the deficiencies in the U.S. Coast Guard's (USCG)--one of DHS's major component entities--ability to complete certain reconciliations and provide evidence supporting certain components of general property, plant, and equipment (PP&E), as well as heritage and stewardship assets that caused its auditors to issue a qualified opinion on its fiscal year 2012 financial statements. DHS has a goal of achieving a clean opinion for fiscal year 2013. However, the auditors' report indicates that DHS continues to rely on compensating controls and complex manual work-arounds to support its financial reporting, rather than sound internal control over financial reporting and effective financial management systems. Opinion on Internal Control: In regard to DHS's progress on obtaining a clean opinion on internal control over financial reporting, from fiscal years 2005 through 2011, DHS's auditors reported a reduction in the number of material weaknesses in internal control over financial reporting from 10 to 5 and a decrease in the number of control deficiencies contributing to the material weaknesses from 30 to 15.[Footnote 12] Although the number of auditor-reported material weaknesses in DHS's internal control over financial reporting has decreased since fiscal year 2005, the largest reduction--for fiscal year 2007--was due to a consolidation of weaknesses into fewer, broader categories for reporting purposes.[Footnote 13] For fiscal year 2012, the most recently completed audit, DHS's auditors reported material weaknesses in five areas related to deficiencies at eight components, including USCG. The material weaknesses reported in fiscal year 2012 include (1) financial reporting, (2) IT controls and financial system functionality, (3) property, plant, and equipment, (4) environmental and other liabilities, and (5) budgetary accounting.[Footnote 14] According to DHS's auditors, the existence of these material weaknesses limits DHS's ability to process, store, and report financial data in a manner that ensures accuracy, confidentiality, integrity, and availability of data without substantial manual intervention. DHS has plans to resolve the remaining five material internal control weaknesses, with a goal of achieving a clean opinion on internal control over financial reporting for fiscal year 2016. DHS will continue to face challenges in obtaining and sustaining a clean opinion on its financial statements and attaining a clean opinion on its internal control over financial reporting until serious internal control and financial management systems deficiencies are resolved. Financial Management Systems: For nearly a decade, DHS tried to modernize its financial management systems by attempting to implement a department-wide integrated financial management system. DHS's efforts included two projects--one that ended in December 2005 when DHS acknowledged that its pilot project had not been successful, and another in June 2011 when requirements had changed and DHS canceled the program. Now, under its decentralized approach, DHS plans to modernize the financial systems of components with the most critical need first and integrate the financial systems with asset management and acquisition systems, resulting in component-level integrated financial management systems. DHS determined that components with a critical business need to modernize their financial management systems include Immigration and Customs Enforcement and USCG, and their customer components, as well as the Federal Emergency Management Agency. Components are in the early planning stages of implementing the approach, and as of September 2013, DHS estimated that its financial system modernization efforts will not be completed until fiscal year 2018. In our September 2013 report, we found that DHS's decentralized approach for modernizing its components' financial systems is consistent with relevant OMB requirements, such as implementing projects in smaller, simpler segments, but not all relevant IT best practices have been fully implemented. DHS has implemented certain IT recommended best practices that reflect key areas of effective program management, such as conducting an analysis of alternatives, establishing a governance structure, developing financial management systems baseline business process requirements, and developing a description of its current financial management environment. However, DHS had not fully incorporated other IT best practices, including developing a description of how its components' financial management systems will operate in the future--called a detailed target state--or a description of how components will transition to a new financial management environment--called a department-level transition plan. [Footnote 15] To help DHS deploy component-level integrated financial management systems, we made two recommendations to DHS regarding the need to follow best practices related to its target state and transition plan. After reviewing the draft report, DHS generally agreed with our recommendations and described actions already taken to address them. However, we believe that further action is needed to address these recommendations. Specifically, DHS has not developed other important details for its target state, such as department-level operational needs and characteristics, including the systems' availability, data flow, expandability, and interoperability. In addition, its transition strategy is missing needed elements of a transition plan such as milestones and time frames for implementing new systems as well as the optimal sequencing of activities. Without a detailed target state and department-level transition plan, DHS has an increased risk of, among other things, investing in and implementing systems that do not provide the desired capabilities and inefficiently using resources during its financial management system modernization efforts. With regard to the status of DHS's efforts to complete actions necessary to achieve removal from our high-risk list, in a September 2010 letter to DHS, we identified, and DHS subsequently agreed to achieve, 31 actions and outcomes, including 9 related to financial management, that are critical to addressing the high-risk issues and challenges within the department's management areas.[Footnote 16] Based on our recent review, we determined that DHS has made progress improving its financial management and fully addressing two of the nine high-risk financial management actions and outcomes--obtaining top management commitment and developing corrective action plans. [Footnote 17] However, a significant amount of work remains to be completed on the remaining seven financial management actions and outcomes, which include obtaining and sustaining a clean opinion on its financial statements, addressing weaknesses in internal controls and systems to obtain an opinion on the effectiveness of internal control over financial reporting, ensuring that its financial systems substantially comply with the Federal Financial Management Improvement Act of 1996,[Footnote 18] and deploying modern financial systems at certain components. Achieving these outcomes will greatly enhance DHS's ability to produce reliable, timely, and useful financial information to support operational decision making, and thus assist it in efficiently and effectively using its resources to accomplish its mission. Chairman Duncan, Ranking Member Barber, and Members of the Subcommittee, this concludes my prepared remarks. I would be happy to answer any questions that you may have. GAO Contact and Staff Acknowledgments: For future contacts regarding this statement, please contact Asif Khan at (202) 512-9869 or at khana@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Michael LaForge, Assistant Director; Laura Pacheco; and Leonardo Zapata made key contributions to this statement. [End of section] Footnotes: [1] In March 2003, DHS was created by merging 22 disparate agencies and organizations, many of which had known financial management weaknesses and vulnerabilities. Only 5 of the agencies that transferred to DHS had been subject to financial statement audits-- U.S. Customs Service, Transportation Security Administration, Immigration and Naturalization Service, Federal Emergency Management Agency, and Federal Law Enforcement Training Center. DHS currently comprises 16 component entities. [2] Internal control is a major part of managing an organization and comprises the plans, methods, and procedures used to meet missions, goals, and objectives and, in doing so, supports performance-based management. GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999) provides an overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste and abuse, and mismanagement. [3] GAO, High-Risk Series: An Update, [hyperlink, http://www.gao.gov/products/GAO-03-119] (Washington, D.C.: January 2003). [4] GAO, High-Risk Series: An Update, [hyperlink, http://www.gao.gov/products/GAO-13-283] (Washington, D.C.: February 2013). [5] Pub. L. No. 112-217, § 2(b), 126 Stat. 1591 (Dec. 20, 2012). [6] Pub. L. No. 108-330, § 4(a), 118 Stat. 1277 (Oct. 16, 2004). [7] The objectives of internal control over financial reporting are to provide reasonable assurance that (1) transactions are properly recorded, processed, and summarized to permit the preparation of the financial statements in conformity with U.S. generally accepted accounting principles, and assets are safeguarded against loss from unauthorized acquisition, use, or disposition, and (2) transactions are executed in accordance with laws governing the use of budget authority and with other laws and regulations that could have a direct and material effect on the financial statements. [8] GAO, DHS Financial Management: Additional Efforts Needed to Resolve Deficiencies in Internal Controls and Financial Management Systems, [hyperlink, http://www.gao.gov/products/GAO-13-561] (Washington, D.C.: Sept. 30, 2013). [9] An audit qualification is a matter identified by auditors that contributes to their inability to render a clean opinion on the financial statements. [10] Auditors reported that (1) the other three financial statements, including the statements of net cost, changes in net position, and budgetary resources, were not auditable, and (2) DHS must be able to represent that its balance sheet is fairly stated, and obtain at least a qualified opinion before it is practical to extend the audit to other financial statements. [11] A qualified opinion, in relation to the financial statements, states that certain reported balances are unauditable, or the financial statements contain a material departure from generally accepted accounting principles, or both. [12] A material weakness is a significant deficiency, or a combination of significant deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a control deficiency, or combination of deficiencies, in internal control important enough to merit attention by those charged with governance. A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. [13] For fiscal year 2007, auditors consolidated certain material weaknesses by combining (1) intragovernmental balances into the financial reporting material weakness; (2) PP&E with the operating materials and supplies material weakness and reporting the combination as capital assets and supplies; and (3) actuarial liabilities with the legal and other liabilities and reported the combination as actuarial and other liabilities. The auditors noted that DHS had made progress during fiscal year 2007 in remediating the deficiency related to intragovernmental balances. USCG was the only DHS component that contributed to the fiscal year 2006 material weaknesses in operating materials and supplies and actuarial liabilities, but the auditors did not report that USCG had made progress during fiscal year 2007 in remediating the deficiencies within operating materials and supplies and actuarial liabilities. [14] For detailed information on the five material weaknesses, see [hyperlink, http://www.gao.gov/products/GAO-13-561], appendix IV. [15] We also had two other findings and recommendations in our report related to IT best practices and the need for DHS, at the time of our review, to update its standard operating procedures and include specific procedures for revising milestone dates and providing written confirmation of completed activities reflected in its integrated master schedule and for performing key elements of a lessons learned process. After DHS received our draft report for comment, DHS finalized its procedures to resolve these issues, and we agreed that DHS had completed actions to address these two recommendations. [16] For a list and discussion of the 31 actions and outcomes, see GAO, Department of Homeland Security: Continued Progress Made Improving and Integrating Management Areas, but More Work Remains, [hyperlink, http://www.gao.gov/products/GAO-12-1041T] (Washington, D.C.: Sept. 20, 2012); and High-Risk Series: Government-wide 2013 Update and Progress Made by the Department of Homeland Security, [hyperlink, http://www.gao.gov/products/GAO-13-444T] (Washington, D.C.: Mar. 21, 2013). [17] For detailed information on the nine financial management actions and outcomes, see [hyperlink, http://www.gao.gov/products/GAO-13-561], appendix II. [18] Pub. L. No. 104-208, div. A, title VIII, 110 Stat. 3009, 3009-389 (Sept. 30, 1996). [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E-mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Katherine Siggerud, Managing Director, siggerudk@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, DC 20548. [End of document]