Skip to main content

DOD Financial Management: Improvement Needed in DOD Components' Implementation of Audit Readiness Effort

GAO-11-851 Published: Sep 13, 2011. Publicly Released: Sep 15, 2011.
Jump To:
Skip to Highlights

Highlights

The Department of Defense (DOD) has been required to prepare audited annual financial statements since 1997 but to date, has not been able to meet this requirement. The National Defense Authorization Act of Fiscal Year 2010 mandated that DOD be prepared to validate [certify] that its consolidated financial statements are audit-ready by September 30, 2017. In May 2010, DOD issued its Financial Improvement and Audit Readiness (FIAR) Guidance to provide a methodology for DOD components to follow to develop and implement their Financial Improvement Plans (FIPs) for achieving audit readiness. The DOD FIP is a framework for planning and tracking the steps and supporting documentation. GAO was asked to assess the FIP methodology provided in the FIAR Guidance, the development and implementation of selected components' FIPs, and DOD's monitoring and oversight of the FIP process. To do this, GAO analyzed the FIAR Guidance, reviewed two selected FIPs--Navy Civilian Pay and Air Force Military Equipment--and reviewed relevant documentation and interviewed DOD and component officials..

The FIAR Guidance provides a reasonable methodology for DOD components to use in developing and implementing their FIPs. The Guidance details the roles and responsibilities of the DOD components, and prescribes a standard, systematic process to follow to assess processes, controls, and systems. Overall, the procedures required by the FIAR Guidance are consistent with selected procedures for conducting a financial audit, such as testing internal controls and information system controls. The Guidance also requires components to take actions to correct any deficiencies identified during testing and document the results. DOD's ability to achieve departmentwide audit readiness is highly dependent on its military components' ability to effectively develop and implement FIPs in compliance with the FIAR Guidance. The Navy and Air Force did not adequately develop and implement their respective FIPs for Civilian Pay and Military Equipment in accordance with the FIAR Guidance. GAO found similar deficiencies in both FIPs. For example, internal controls and information systems controls were not sufficiently tested or documented, and conclusions reached were not supported by the testing results. In addition, neither component had fully developed and implemented corrective action plans to address deficiencies identified during implementation of the FIPs. As a result, the FIPs did not provide sufficient support for the Navy's and Air Force's conclusions that Civilian Pay and Military Equipment were ready to be audited. DOD and its military components have assigned to senior executive committees and designated individuals appropriate oversight roles and responsibilities for their financial improvement efforts. However, neither oversight committees nor Navy and Air Force officials effectively carried out their oversight responsibilities for the two FIPs, which did not support the components' conclusions of audit readiness. However, once the components indicated audit readiness, both the DOD Office of Inspector General and the Undersecretary of Defense (Comptroller) performed reviews and concluded that the FIPs did not comply with the FIAR Guidance and did not demonstrate audit readiness. The lack of adequate oversight results in an ineffective FIP process and can impact the ability of components to meet established milestones. If the components are unable to achieve interim milestones, DOD will need to consider how these factors could affect its ability to achieve departmentwide auditability by the end of fiscal year 2017. GAO recommends that the Secretary of Defense take various actions to improve the development, implementation, documentation, and oversight of DOD's financial management improvement efforts. DOD generally concurred with the recommendations and commented on actions being taken to implement them.

Recommendations

Recommendations for Executive Action

Agency Affected Sort descending Recommendation Status
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to improve DOD's monitoring and oversight of FIP activities, the Secretary of Defense should direct the Secretary of the Air Force to ensure that all responsible parties within the Air Force, including the Assistant Secretary of the Air Force (Financial Management and Comptroller) carry out their responsibilities for ensuring that FIP development and implementation complies with the FIAR Guidance and that the FIP contains sufficient information to indicate audit readiness before it is signed.
Closed – Not Implemented
DOD concurred with this recommendation. Since the beginning of fiscal year 2018, DOD's strategy has changed from preparing for audit readiness through the Financial Improvement Plan process to undergoing a full financial statement audit and remediating specific audit findings. As a result, DOD components are no longer expected to prepare Financial Improvement Plans and DOD's FIAR Guidance has been replaced by two new documents entitled "DOD Internal Control Over Financial Reporting Guide" and "DOD Financial Statement Audit Guide." Therefore, this recommendation is no longer relevant and we are closing it as not-implemented.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Navy develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Navy to put procedures in place to help ensure that the Navy's Financial Improvement Plans to include documentation that the Navy performed sufficient control and substantive testing.
Closed – Implemented
The Department of Defense (DOD) concurred with this recommendation. As a result of our recommendation, the Navy revised its Financial Improvement Plan assertion package in June 2012 to include a summary of testing results as well as several pages of documentation on the Navy's testing scope and methodology, detailed results of both control and substantive testing, and the conclusions drawn from those results. In accordance with DOD's Financial Improvement and Audit Readiness (FIAR) guidance, these assertion packages are submitted to the FIAR Directorate for review. These actions enhance the documentation and oversight of the Navy's financial management improvement efforts.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Navy develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Navy to put procedures in place to help ensure that the Navy's Financial Improvement Plans to include documentation that the Navy performed a reconciliation of the complete population of transactions for an assessable unit to the relevant general ledger(s) and to the amount(s) reported in the financial statements, including researching and resolving reconciling items.
Closed – Implemented
The Department of Defense (DOD) partially concurred with this recommendation. As a result of our recommendation, the Navy revised its Financial Improvement Plan assertion package in June 2012 to include a summary of reconciliation procedures performed as well as the results of their reconciliations. Where discrepancies were found, the Navy documented root causes of the discrepancies as well as corrective actions put in place. In accordance with DOD's Financial Improvement Audit Readiness (FIAR) guidance, these assertion packages are submitted to the FIAR Directorate for review. These actions enhance the documentation and oversight of the Navy's financial management improvement efforts.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Navy develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Navy to put procedures in place to help ensure that the Navy's Financial Improvement Plans to include documentation that the Navy performed an assessment of information systems controls that addresses all relevant critical elements.
Closed – Implemented
The Department of Defense (DOD) concurred with this recommendation. As a result of our recommendation, the Navy published an information technology (IT) systems controls strategy to address the audit readiness of key financial systems. The strategy provides guidance on assessing relevant and critical entity-wide and IT general controls and business process application controls as well as requirements for reporting assessment results. If effectively implemented, this action will help ensure that the Navy's IT systems controls are adequately assessed for effectiveness.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Navy develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Navy to put procedures in place to help ensure that the Navy's Financial Improvement Plans to include documentation that the Navy performed an assessment of information systems controls that, for any deficiencies identified in a SAS 70 report that is relied upon, show that either mitigating controls exist or actions have been taken to address the deficiencies.
Closed – Implemented
The Department of Defense (DOD) concurred with this recommendation. As a result of our recommendation, the Navy implemented a deficiency tracker tool in April 2015 which documents control deficiencies identified from SSAE No. 16 (formerly known as SAS 70) reports along with remediation efforts to address them. If effectively implemented, this tool will help ensure that such deficiencies, as well as the related corrective actions, are more closely monitored by Navy personnel.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Navy develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Navy to put procedures in place to help ensure that the Navy's Financial Improvement Plans to include documentation that the Navy performed preparation and execution of corrective action plans to address significant control weaknesses.
Closed – Implemented
The Department of Defense (DOD) concurred with this recommendation. As a result of our recommendation, the Navy revised its Financial Improvement Plan assertion package in June 2012 to include detailed corrective action plans for each deficient control activity. These plans identify the root cause and potential impact of the control deficiency, steps taken to remediate the control deficiency, critical implementation milestones, and potential plan stakeholders. In accordance with DOD's Financial Improvement and Audit Readiness (FIAR guidance), these assertion packages are submitted to the FIAR Directorate for review. These actions enhance the documentation and oversight of the Navy's financial management improvement efforts.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Navy develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Navy to put procedures in place to help ensure that the Navy's Financial Improvement Plans to include documentation that the Navy performed assessments of the metrics (e.g., key control objectives and key supporting documents) to ensure that they are consistent with, and supported by, testing results.
Closed – Implemented
The Department of Defense (DOD) concurred with this recommendation. As a result of our recommendation, the Navy revised its Financial Improvement Plan assertion package in June 2012 to include results of procedures performed to assess the effectiveness of Key Control Objectives (KCOs), the availability of Key Supporting Documentation (KSDs), and the accuracy of the recorded transactions. In accordance with DOD's Financial Improvement and Audit Readiness (FIAR) guidance, these assertion packages are submitted to the FIAR Directorate for review. These actions enhance the documentation and oversight of the Navy's financial management improvement efforts.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Air Force develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Air Force to ensure that the Air Force's Financial Improvement Plans include documentation that the Air Force performed sufficient control and substantive testing.
Closed – Implemented
The Department of Defense (DOD) partially concurred with this recommendation. As a result of our recommendation, in December 2011 DOD issued updated FIAR guidance to include requirements Air Force and other reporting entities must satisfy to assert audit readiness. Specifically, this guidance requires that reporting entity readiness assertions include management's assertion that an appropriate combination of control and supporting documentation testing has been performed in accordance with criteria contained in the FIAR guidance. This guidance also requires regular submission of all component FIPs to the FIAR Directorate for review to ensure their compliance with FIAR guidance. Based on this guidance, the Air Force assessable unit assertion packages prepared during 2013 and 2014 included documentation of detailed control and substantive tests performed and related results. For example, Air Force's June 2014 test plan and summary for its Reimbursable Budget Authority and Execution assessable unit included details on procedures performed to assess the effectiveness of specific control activities, sample sizes selected for testing controls and key supporting documentation, the number of exceptions identified, and overall conclusions.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Air Force develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Air Force to ensure that the Air Force's Financial Improvement Plans include documentation that the Air Force performed a reconciliation of the complete population of transactions for an assessable unit to the relevant general ledger(s) and to the amount(s) reported in the financial statements, including researching and resolving reconciling items.
Closed – Not Implemented
DOD concurred with this recommendation. Since the beginning of fiscal year 2018, DOD's strategy has changed from preparing for audit readiness through the Financial Improvement Plan process to undergoing a full financial statement audit and remediating specific audit findings. As a result, DOD components are no longer expected to prepare Financial Improvement Plans and DOD's FIAR Guidance has been replaced by two new documents entitled "DOD Internal Control Over Financial Reporting Guide" and "DOD Financial Statement Audit Guide." Therefore, this recommendation is no longer relevant and we are closing it as not-implemented.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Air Force develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Air Force to ensure that the Air Force's Financial Improvement Plans include documentation that the Air Force performed an assessment of information systems controls that includes documentation of both the testing and the results.
Closed – Implemented
The Department of Defense (DOD) concurred with this recommendation. DOD updated and reissued FIAR Guidance in December 2011, including specific guidance to identify and document key systems and assess the effectiveness of related information system controls. To comply with this guidance, Air Force officials indicated that assessments of selected information systems are included in systems assertion documentation. The Air Force's June 2014 system assertion documentation for its Automated Business Services System contained detailed information describing its scope, key control objectives and related risks associated with the system as well as results of tests performed to assess related control activities.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to ensure that the Air Force develops and implements its Financial Improvement Plan in accordance with the FIAR Guidance, the Secretary of Defense should direct the Secretary of the Air Force to ensure that the Air Force's Financial Improvement Plans include documentation that the Air Force performed preparation and execution of corrective action plans to address significant control weaknesses.
Closed – Implemented
The Department of Defense (DOD) partially concurred with this recommendation. In July 2014, the Air Force developed draft standard operating procedures (SOP) documenting its process to define, create, execute, track, and report on corrective action plans and, in accordance with the draft SOP guidance, began documenting their status in a schedule known as the "Corrective Action Plan Template." This schedule summarizes identified deficiencies as well as steps required to address them and those responsible for their implementation. If effectively implemented, this action will help increase oversight over the Air Force's implementation of corrective action plans and help ensure that weaknesses identified as a result of audit testing are remediated.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to improve DOD's monitoring and oversight of FIP activities, the Secretary of Defense should direct the Co-Chairs of the FIAR Governance Board to ensure that the board carries out its responsibilities for identifying risks that could prevent the department from achieving its goals and ensuring sufficient documentation of FIP assessment results.
Closed – Implemented
The Department of Defense (DOD) concurred with this recommendation. DOD's Financial Improvement and Audit Readiness (FIAR) Governance Board monitors to ensure that risks, that could present obstacles to achieving its FIAR goals, are identified. In addition, FIAR Directorate, among other things, assists DOD's components by evaluating financial improvement plans and related work products and deliverables. These actions enhance the documentation and oversight of DOD's FIAR effort by ensuring that (1) risks are identified and monitored and (2) component financial improvement plans and related work documents comply with the FIAR Guidance.
Department of Defense To improve the development, implementation, documentation, and oversight of the department's financial management improvement efforts, and to improve DOD's monitoring and oversight of FIP activities, the Secretary of Defense should direct the Secretary of the Navy to ensure that all responsible parties within the Navy, including the Assistant Secretary of the Navy (Financial Management and Comptroller), carry out their responsibilities for ensuring that FIP development and implementation complies with the FIAR Guidance and that the FIP contains sufficient information to indicate audit readiness before it is signed.
Closed – Not Implemented
DOD concurred with this recommendation. Since the beginning of fiscal year 2018, DOD's strategy has changed from preparing for audit readiness through the Financial Improvement Plan process to undergoing a full financial statement audit and remediating specific audit findings. As a result, DOD components are no longer expected to prepare Financial Improvement Plans and DOD's FIAR Guidance has been replaced by two new documents entitled "DOD Internal Control Over Financial Reporting Guide" and "DOD Financial Statement Audit Guide." Therefore, this recommendation is no longer relevant and we are closing it as not-implemented.

Full Report

Office of Public Affairs

Topics

AccountingDefense capabilitiesDefense economic analysisDefense procurementDocumentationFinancial management systemsFinancial statement auditsFinancial statementsInformation systemsInternal controlsMilitary cost controlMilitary forcesMilitary materielReporting requirementsFinancial Improvement Plans