DOD Financial Management: The Defense Finance and Accounting Service Needs to Fully Implement Financial Improvements for Contract Pay
Highlights
What GAO Found
The Defense Finance and Accounting Service (DFAS) is responsible for processing and disbursing nearly $200 billion annually in contract payments (contract pay) for the Department of Defense (DOD). DFAS recognized the importance of implementing a Financial Improvement Plan (FIP) to improve its contract pay processes, systems, and controls, and performed steps required by DOD's Financial Improvement and Audit Readiness (FIAR) Guidance, such as performing testing of internal controls, and substantive processes. However, GAO found that DFAS did not fully implement the steps required by the FIAR Guidance. GAO found numerous deficiencies in the implementation of DFAS's contract pay FIP, including the following:
DFAS did not adequately perform certain planning activities for its contract pay FIP as required by the FIAR Guidance. For example, DFAS did not assess the dollar activity and risk factors of its processes, systems, and controls, which resulted in the exclusion of three key processes from the FIP, including the reconciliation of its contract pay data to the components' general ledgers. Standards for Internal Control in the Federal Government states that control activities such as reconciliations are an integral part of an entity's planning, implementing, reviewing, and accountability for stewardship of government resources and achieving effective results. As result, DFAS did not obtain sufficient assurance that the contract disbursements are accurately recorded and maintained in the components' general ledgers, and that the status of DOD's contract obligations is accurate and up-to-date.
DFAS did not adequately perform required testing of its contract pay controls, processes, and balances. For example, DFAS did not adequately validate the populations used to perform substantive and internal control testing as required by the FIAR Guidance. DFAS officials stated that they validated that the population that was tested; however, GAO found that the process followed by DFAS for validating the population did not include a reconciliation of the population to the components' general ledgers. As a result, additional deficiencies may exist in DFAS's contract pay controls and additional errors may exist in the recorded transactions activity and balances, which affects the components' ability to rely on DFAS's controls over contract pay.
DFAS did not provide adequate documentation to support that it had remediated all of the identified control deficiencies that DFAS stated had been corrected. GAO's review of a nongeneralizable sample of 25 of these deficiencies found that in 3 instances, corrective actions had not been taken as required, and in 15 other instances, the documentation provided by DFAS did not sufficiently support that the identified deficiencies were remediated. DFAS had adequately developed and implemented the necessary corrective action plans for 7 of the deficiencies GAO reviewed.
Although DFAS has asserted audit readiness, until it corrects the deficiencies and fully implements its FIP in accordance with the FIAR Guidance, its ability to process, record, and maintain accurate and reliable contract pay transaction data is questionable. Therefore, DFAS does not have assurance that its FIP will satisfy the needs of the components or provide the expected benefits to department-wide audit readiness efforts.
Why GAO Did This Study
The National Defense Authorization Act for Fiscal Year 2013 mandated that DOD's FIAR Plan include the goal of validating that DOD's Statement of Budgetary Resources (SBR) is audit ready by no later than September 30, 2014. DOD identified contract pay as one of the key elements of its SBR. DFAS, the service provider responsible for the department's contract pay, asserted that its processes, systems, and controls over contract pay were suitably designed and operating effectively to undergo an audit.
DOD's FIAR Guidance provides a methodology DOD components are required to follow to develop and implement FIPs to improve financial management and assert audit readiness. The FIP is a framework for planning, executing, and tracking the steps and supporting documentation necessary to achieve auditability.
GAO is mandated to audit the U.S. government's consolidated financial statements, including activities of executive branch agencies such as DOD. This report discusses the extent to which DFAS implemented its contract pay FIP in accordance with the FIAR Guidance. GAO reviewed the FIP and related work products, such as process flowcharts, test plans, and test results, and interviewed DFAS and DOD officials.
Recommendations
GAO is making nine recommendations for DFAS to fully implement the requirements in the FIAR Guidance in the areas of planning, testing, and corrective actions. DOD concurred with the recommendations and described its actions to address them.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer | To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Discovery Phase planning activities for contract pay by documenting its contract pay end-to-end process by developing the necessary flowcharts and narratives for those processes excluded from the FIP. |
Closed – Not Implemented
DOD concurred with this recommendation. This recommendation called for DFAS to prepare necessary narratives and flowcharts to document processes excluded from its financial improvement plan in order to comply with the FIAR Guidance requirements to prepare for audit readiness. However, DOD asserted that it was ready for an audit of its fiscal year 2018 financial statements. DOD underwent the fiscal year 2018 departmentwide audit and the DOD OIG issued a disclaimer of opinion and reported 20 material weaknesses in internal control across the department. Further, the DOD independent public accountants issued over 2,400 findings and recommendations. DOD did not expect to get a clean opinion but will measure its success by how well it will be able to remediate these and future auditor findings. Therefore, based on the new audit environment at DOD, this recommendation related to audit readiness is overcome by events and no longer relevant.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer | To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Discovery Phase planning activities for contract pay by assessing the materiality (i.e., dollar activity and risk factors) of its processes, systems, and controls. |
Closed – Not Implemented
DOD concurred with this recommendation. This recommendation called for DFAS to assess the materiality of the processes, systems, and controls in the contract pay cycle to comply with the FIAR Guidance requirements to prepare for audit readiness. However, DOD asserted that it was ready for an audit of its fiscal year 2018 financial statements. DOD underwent the fiscal year 2018 departmentwide audit and the DOD OIG issued a disclaimer of opinion and reported 20 material weaknesses in internal control across the department. Further, the DOD independent public accountants issued over 2,400 findings and recommendations. DOD did not expect to get a clean opinion but will measure its success by how well it will be able to remediate these and future auditor findings. Therefore, based on the new audit environment at DOD, this recommendation related to audit readiness is overcome by events and no longer relevant.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer | To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Discovery Phase planning activities for contract pay by completing a memorandum of understanding with each of the components. |
Closed – Not Implemented
DOD concurred with this recommendation. This recommendation called for a complete memorandum of understanding with each of the DOD components to address deficiencies related to contract pay in support of the FIAR Guidance requirements to prepare for audit readiness. However, DOD asserted that it was ready for an audit of its fiscal year 2018 financial statements. DOD underwent the fiscal year 2018 departmentwide audit and the DOD OIG issued a disclaimer of opinion and reported 20 material weaknesses in internal control across the department. Also, the DOD independent public accountants issued over 2,400 findings and recommendations. DOD did not expect to get a clean opinion but will measure its success by how well it will be able to remediate these and future auditor findings. Therefore, based on the new audit environment at DOD, this recommendation related to audit readiness is overcome by events and no longer relevant.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer | To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Discovery Phase testing activities by validating the completeness and accuracy of the populations of transactions used to perform testing. |
Closed – Not Implemented
DOD concurred with this recommendation. This recommendation called for DFAS to validate the completeness and accuracy of populations to perform testing to comply with the FIAR Guidance requirements to prepare for audit readiness. However, DOD asserted that it was ready for an audit of its fiscal year 2018 financial statements. DOD underwent the fiscal year 2018 departmentwide audit and the DOD OIG issued a disclaimer of opinion and reported 20 material weaknesses in internal control across the department. Also, the DOD's independent public accountants issued over 2,400 findings and recommendations. DOD did not expect to get a clean opinion but will measure its success by how well it will be able to remediate these and future auditor findings. Therefore, based on the new audit environment at DOD, this recommendation related to audit readiness is overcome by events and no longer relevant.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer | To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Discovery Phase testing activities by considering and assessing the design and operational effectiveness of the entity-level general controls that were not tested by DFAS, as appropriate. |
Closed – Implemented
In December 2014, DFAS Internal Review issued a report on the audit conducted on the remaining entity-level Information Technology General Controls (ITGC). The objective of the audit was to assess the design and operating effectiveness of the 139 other entity level ITGC for the 12-month period from April 1, 2013 through March 31, 2014. DFAS also provided a breakout by site that summarized the results of its review of the 139 other entity level controls. As a result of the action taken by DFAS to implement our recommendation, DFAS improved its assessment of DOD's entity-level ITGC in accordance with the FIAR Guidance and its ability to process, record and maintain accurate and reliable contract pay transaction data. These actions addressed our recommendation.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer | To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Discovery Phase testing activities by documenting and executing an audit strategy or plan for application-level testing of system controls. |
Closed – Implemented
DOD concurred with this recommendation. This recommendation calls for documenting and executing an audit strategy or plan for application level testing of system controls. In June 2017, DFAS provided us with its FISCAM strategy used to document its application level testing of contract pay controls that was approved by agency leadership. In addition, DFAS provided us with its test results that show no deficiencies were identified in its contract pay systems. As a result of DFAS actions taken DFAS improved its IT testing and its ability to provide the expected benefits to department-wide audit readiness.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer | To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Discovery Phase testing activities by coordinating with the components to classify all identified deficiencies as control deficiencies, significant deficiencies, and material weaknesses. |
Closed – Not Implemented
DOD concurred with this recommendation. This recommendation called for DFAS to coordinate with the components to classify all identified deficiencies as control deficiencies, significant deficiencies, and material weaknesses in accordance with the FIAR Guidance requirements to prepare for audit readiness. However, DOD asserted that it was ready for an audit of its fiscal year 2018 financial statements. DOD underwent the fiscal year 2018 departmentwide audit and the DOD OIG issued a disclaimer of opinion and reported 20 material weaknesses in internal control across the department. Also, the DOD independent public accountants issued over 2,400 findings and recommendations. DOD did not expect to get a clean opinion but will measure its success by how well it will be able to remediate these and future auditor findings. Therefore, based on the new audit environment at DOD, this recommendation related to audit readiness is overcome by events and no longer relevant.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer |
Priority Rec.
To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Corrective Action Phase activities by assessing the population of implemented corrective action plans to determine whether the deficiencies we found in our nongeneralizable sample of DFAS's corrective action plans are more wide spread in the population. |
Closed – Implemented
This recommendation is closed. On June 15th and 16th of 2017, we visited DFAS Columbus to review actions taken in response to our recommendations. DFAS has taken actions to assess whether there were deficiencies in its corrective action plans. In response, in December 2014 and September 2015, DFAS officials provided an analysis that linked all of the CAPs in our sample to tests of controls performed during their Statements on Standards for Attestation Engagements (SSAE) No. 16 contract pay audits. Also, in June 2017, DFAS officials initiated retesting and improved the CAP documentation. In fiscal years 2014, 2015, and 2016, DFAS received an unmodified opinion on its contract pay SSAE No. 16 audit examination. During the three examinations, the IPA only identified 10 deficiencies in the DFAS contract pay system, a substantial reduction of the 393 deficiencies that DFAS remediated during the contract pay audit readiness process. These deficiencies were not material to preclude DFAS from attaining an unmodified opinion on its contract pay SSAE No. 16 audit examination. As a result of DFAS's actions taken, DFAS improved its contract pay CAP process for remediating deficiencies towards achieving audit readiness.
|
| Office of the Under Secretary of Defense (Comptroller)/Chief Financial Officer |
Priority Rec.
To ensure that DFAS is able to obtain the necessary assurance that its contract pay end-to-end process can produce, maintain, and sustain accurate, complete, and timely information in support of the components' and DOD-wide financial improvement and audit readiness efforts, the Under Secretary of Defense (Comptroller)/Chief Financial Officer should direct the Director of the Defense Finance and Accounting Service to address deficiencies in its Corrective Action Phase activities by revising its FIAR status reports to accurately reflect the current status of its audit readiness efforts. |
Closed – Implemented
This recommendation is closed. DFAS has taken actions to provide more current information on its audit readiness efforts. For example, DFAS participates in tri-annual service provider working group meetings to provide DOD components and respective independent public accountants with the status of their ongoing Statement of Standards on Attestation Engagements No. 18 (SSAE 18) audits (e.g. Contract Pay and Civilian Pay) as well as their audit readiness progress, deficiencies and corrective actions. Further, in the bi-annual Financial Improvement and Audit Readiness Plan Status Report DFAS provides a status of these issues as well. The actions taken by the DFAS should provide better information to DOD and Component management on the status of audit readiness progress and the remediation of deficiencies.
|