Recommendation: ODCFO should update the CAP template provided in its guidance to assist components in developing CAPs to include the year deficiencies are first identified data element defined in the Implementation Guide for OMB Circular A-123. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should update the NFR Database with a field to record the year deficiencies are first identified. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should incorporate appropriate steps to improve its CAP review process, including ensuring that (1) data elements not included in CAPs are appropriately identified and communicated to components and resolved, (2) NFRs are appropriately linked to the correct CAPs to address them, and (3) components document their rationale for accepting the risk associated with certain deficiencies and appropriately identify such instances in the NFR Database. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should update DOD guidance to instruct DOD and components to document root-cause analysis when needed to address deficiencies auditors identified. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should include appropriate steps in its monthly NFR Database review process to evaluate and follow-up on previously identified exceptions to ensure that they are resolved timely. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should ensure that the DOD Chief Information Officer (CIO) develops an IT enterprise architecture which includes a transition plan that provides a road map for improving the department's IT and computing infrastructure, including for each of its business processes. (Recommendation 5)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: In October 2019, the DOD CIO developed a report on the first increment of version 3 of the department's information enterprise architecture (IEA). The report includes high-level descriptions of the current and target architectures, and high-level plans and schedules for transitioning from the current to the target architecture. The report states that because of the incremental approach to developing the architecture, the plans and schedules are notional and depend on several factors over which the DOD CIO has limited or no control, such as funding and changing world events, priorities, and technology. The report also describes plans to integrate the IEA with the department's business enterprise architecture. However, the report did not define a specific time frame for integrating the architectures. According to the report, for the next increment of the architecture, the department plans to develop compliance criteria and plans for developing an ontology, database, and tool suite. The department did not provide a time frame for completing the next increment. We will continue to monitor the department's efforts to implement the recommendation.

Recommendation: The Secretary of Defense should ensure that the DOD CIO and Chief Management Officer work together to define a specific time frame for when the department plans to integrate its business and IT architectures and ensure that the architectures are integrated. (Recommendation 6)

Agency: Department of Defense: Office of the Secretary of Defense
Status: Open

Comments: In October 2019, the DOD CIO developed a report on the first increment of version 3 of its information enterprise architecture (IEA). The report described planned efforts related to integrating the IEA and the business enterprise architecture. However, the report did not define a specific time frame for when the department plans to integrate the architectures.

Recommendation: The Secretary of the Army should direct the Accountability and Audit Readiness Directorate under the Assistant Secretary of the Army, Financial Management and Comptroller, to enhance the directorate's policies and procedures for (1) tracking and prioritizing all financial management-related audit findings and recommendations under its purview and (2) developing and monitoring CAPs for all such recommendations so that they include sufficient details, such as the criteria used to prioritize the CAPs, the recommended CAP elements, and the process for monitoring and documenting the progress and status of CAPs.

Agency: Department of Defense: Department of the Army
Status: Open
Priority recommendation

Comments: The Army concurred with this recommendation. The Army stated that the Accountability and Audit Readiness Directorate has completed actions to enhance its current standard operating procedures to include (1) updating its corrective action plan (CAP) database and reporting tool, (2) documenting its reporting procedures, and (3) updating its CAP template to include additional elements recommended by the Implementation Guide for OMB Circular A-123. In addition, the Army stated that its policies and procedures include steps to incorporate external financial management-related audit findings assigned to the Accountability and Audit Readiness Directorate by the Internal Review Directorate and that the existing process the Army uses to prioritize findings and the related CAPs and to monitor the progress and status of CAPs has been documented. We reviewed Army's documentation that was provided in January 2020. Army's documentation did not show that it has a process for ensuring that all financial management related findings and recommendations are identified and tracked. To implement this recommendations Army needs to enhance their policies and procedures related to tracking and monitoring the status of these audit findings.

Recommendation: The Secretary of the Air Force should design and document a comprehensive process to ensure that the complete universe of all financial management-related findings and recommendations from all audit sources is identified and tracked.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that it continues to develop a process for identifying and tracking financial management-related findings and recommendations from all audit sources by updating its process guidance. In August 2019, we received draft guidance that Air Force is developing as guidance and procedures for a universe of financial management-related findings and recommendations. In January 2020, we also received a list of the Air Force deficiencies being tracked in the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database. After assessing the provided documentation, we found that the draft does not include procedures for identifying GAO, DODOIG, and Air Force Audit Agency (AFAA) findings and the database did not include deficiencies identified by those external auditors. As a result of our review of the documentation provided, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: The Secretary of the Air Force should update the Air Force's written policies and procedures for prioritizing financial management-related audit findings and recommendations from all audit sources and for developing and monitoring CAPs so that they include sufficient details. These procedures should include the following details: (1) The process to be followed for prioritizing the financial management-related findings and recommendations from audit sources. (2) The guidance for developing CAPs for all financial management-related audit findings and recommendations from all audit sources to include complete details, including the elements recommended by the Implementation Guide for OMB Circular A-123. (3) The process for monitoring the status of the CAPs for all financial management-related audit findings and recommendations from all audit sources, including the documentation to support any corrective actions taken, as recommended by the Implementation Guide for OMB Circular A-123.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that its Air Force Deficiency Remediation Tracking processes and guides were being refined. In December 2019, Air Force provided a document titled "NFR Prioritization Process." We found that this document included Air Force's priority categories. However, the document does not include information on determining the priority level or applying the priority levels when addressing the deficiencies. We also received a copy of Air Force's guide for the Corrective Action Plan (CAP) process dated July 2019. We found that this guide does not fully incorporate CAP development for deficiencies from all sources. Additionally, the guide does not provide information on the process for (1) determining resources and other requirements for remediating the deficiency, (2) conducting a cost benefit analysis, and (3) developing criteria for validating that the deficiency has been remediated. The guide also includes a template for conducting a root cause analysis. However, the instructions for conducting a root cause analysis are somewhat limited for determining the initial cause or underlying reason for the deficiency. Per the guide, the Air Force uses the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database to monitor and report on Air Force's deficiencies and remediation CAP status. We obtained a listing of the NFRs and related CAPS in the database as of December 2019. We found that deficiencies from all audit sources were not included in the listing, only the independent public accountant's NFRs. The results of our review of a limited number of CAPs indicate that Air Force staff does not always comply with the Air Force's CAP requirements. As a result of our assessment of the Air Force documentation, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: To improve DOD management's process for monitoring the military services' audit remediation efforts and to provide timely and useful information to stakeholders as needed, the Secretary of Defense should direct the Secretary of the Army, the Secretary of the Navy, and the Secretary of the Air Force to prepare and submit to the Under Secretary of Defense (Comptroller), on at least a bimonthly basis for availability at the FIAR Governance Board meetings, a summary of key information included in the CAPs that at a minimum contains the data elements recommended by the Implementation Guide for OMB Circular A-123 for each CAP related to critical capabilities for achieving audit readiness.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD concurred with this recommendation. DOD stated that it solicits input on a bi-monthly basis, on critical capability corrective action plans (CAPs) at a summary level. This information is provided routinely at regularly scheduled FIAR Governance Board meetings. DOD also stated that an updated notice of finding and recommendation (NFR) form template is being developed and will be provided to the military services to use for reporting this information so that it will include the recommended standard data elements outlined in OMB Circular A-123 to provide greater transparency into the nature of remediation plans. DOD also stated that FIAR Guidance will be updated to explicitly state that military services should include the OMB recommended standard data elements in CAPs. To implement this recommendation, DOD needs to provide documentation that shows that the military services are able to provide a summary of key information in the corrective action plans that at a minimum contains data elements recommended by the Implementation Guide for OMB Circular A-123. .

Recommendation: To reasonably assure that DOD management and external stakeholders have a comprehensive picture of the status of corrective actions needed for audit readiness throughout the department, the Secretary of Defense should direct the Under Secretary of Defense (Comptroller) to prepare a consolidated CAP management summary on a bimonthly basis that includes the data elements referred to above on the status of all CAPs related to critical capabilities for the military services and for the service providers and other defense organizations.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD partially concurred with this recommendation. According to DOD, the military services already provide summary-level updates on their critical capability corrective action plans (CAPs) at FIAR Governance Board meetings. It also stated that the template that is used to present CAPs to the FIAR Governance Board meetings at the summary level has been updated to align CAPs to critical capabilities. DOD still needs to address how all of the data elements from the Implementation Guide for OMB Circular A-123 will be summarized or otherwise reported for all CAPs pertaining to critical capabilities across the Department. In addition, DOD stated that because the Under Secretary of Defense (Comptroller) takes responsibility for maintaining, monitoring, and reporting on the status of CAPs for the service providers and other defense organizations and of DOD-wide issues, the Comptroller will also summarize this information. However, DOD has not clarified what information from the military services will be summarized. To implement this recommendation, DOD needs to provide documentation that shows the Comptroller has prepared a consolidated CAP management summary on a bimonthly basis.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prepare a level I quantitative drilldown in accordance with the FIAR Guidance.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it has actions planned, taken, or under way to prepare a quantitative drilldown. In September 2017, Navy provided a listing of certain systems (DCAS, GLs, DDRS-B, and DDRS-AFS) it considered as Level 1 assessable units. However, the listing did not include a drilldown from the financial statement amounts through DDRS-AFS, DDRS-B, and DCAS to the receipt and disbursement source systems. In July 2020, Navy officials stated that Navy is implementing a new system that will enable them to complete a quantitative drill down for its Fund Balance with Treasury (FBWT). The new system is not expected to be fully implemented until March 2021. In the interim, certain FBWT reconciliations are performed at DFAS, that may provide a drilldown capability of FBWT as reported in financial statements to the applicable general ledger amounts.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prioritize audit readiness efforts for the key FBWT systems, prepare an audit strategy that identifies for each system (1) the Navy's plan for assessing the system to gain assurance that the system can be relied on; (2) the assessment types, including prioritizing the assessments based on qualitative and quantitative factors for each system; and (3) planned start and completion dates of these assessments for each system.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it has actions planned, taken, or under way to prioritize audit readiness efforts for key Fund Balance with Treasury (FBWT) systems. In September 2017, Navy provided documentation for three systems, but this documentation did not address corrective actions for ineffective controls and the expected completion dates. Further, during our audit, Navy provided a list of 22 relevant systems. In July 2020, Navy officials stated that they are preparing an audit strategy for each system, and documenting control activities and computer controls for significant systems. We will continue to follow-up on the status of this recommendation.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prepare, in accordance with FIAR Guidance, the documentation of control activities and information technology general computer controls for significant systems; system certifications or accreditations; system, end user, and systems documentation locations; and hardware, software, and interfaces.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it had actions planned, taken, or under way to document control activities, information technology general computer controls for significant systems, systems documentation locations, and hardware, software, and interfaces. In September 2017, Navy provided documentation for 3 systems, but the documentation did not include system certifications or accreditations; system, end user, and systems documentation locations; and hardware, software, and interfaces. Further, during our audit, Navy provided a list of 22 relevant systems. In July 2020, a Navy official told us that they are preparing an audit strategy for each system, and documenting control activities and computer controls for significant systems. We will continue to monitor Navy's progress addressing this recommendation.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prepare an internal control assessment document for each assessable unit, summarizing control activities that are appropriately designed and in place.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it had actions planned, taken, or under way to prepare an internal control assessment document. In September 2017, Navy provided support for actions taken to address this recommendation. However, the documentation provided did not summarize controls by assessable unit (DCAS, DDRS-B, or systems). Instead controls were listed by function (Treasury Reporting, Audit Readiness, and Departmental Reporting). In July 2020, a Navy official stated that documentation of overall Fund Balance with Treasury (FBWT) controls is in process and they are finalizing the Risk Control Matrix for FBWT to include controls at DFAS and at Treasury. The Rick Control Matrix is estimated to be completed by the end of August 2020. We will continue to monitor the progress in addressing this recommendation.