Recommendation: ODCFO should update the CAP template provided in its guidance to assist components in developing CAPs to include the year deficiencies are first identified data element defined in the Implementation Guide for OMB Circular A-123. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should update the NFR Database with a field to record the year deficiencies are first identified. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should incorporate appropriate steps to improve its CAP review process, including ensuring that (1) data elements not included in CAPs are appropriately identified and communicated to components and resolved, (2) NFRs are appropriately linked to the correct CAPs to address them, and (3) components document their rationale for accepting the risk associated with certain deficiencies and appropriately identify such instances in the NFR Database. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should update DOD guidance to instruct DOD and components to document root-cause analysis when needed to address deficiencies auditors identified. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: ODCFO should include appropriate steps in its monthly NFR Database review process to evaluate and follow-up on previously identified exceptions to ensure that they are resolved timely. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct the Chief Management Officer and other entities, as appropriate, to establish measures to determine if the department is succeeding in achieving its goal to improve its financial management systems. Specifically, it should document targets and time frames to define the level of performance to be achieved. It should also document how DOD plans to measure expected outcomes by identifying data sources, how it plans to measure values, and how DOD plans to verify and validate measured values. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct the Chief Management Officer and other entities, as appropriate, to establish a specific time frame for developing an enterprise road map to implement its financial management systems strategy, and ensure that it is developed. The road map should document the current and future states at a high level, from an architecture perspective, and present a transition plan for moving from the current to the future in an efficient, effective manner. The road map should discuss performance gaps, resource requirements, and planned solutions, and it should map DOD's financial management systems strategy to projects and budget. The plan should also document the tasks, time frames, and milestones for implementing new solutions, and include an inventory of systems. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct the Chief Management Officer and other entities, as appropriate, to develop detailed migration plans for the Air Force's General Accounting and Finance System-Reengineered, Navy's Standard Accounting and Reporting System, and Army's Standard Finance System and the Standard Operation and Maintenance Army Research and Development System. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct the Chief Management Officer and other entities, as appropriate, to establish performance goals that include performance indicators, targets and time frames, to monitor the status of efforts to address IT-related audit findings. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct the Chief Management Officer and other entities, as appropriate, to implement a mechanism for identifying financial management systems that support the preparation of the department's financial statements in the department's systems inventory and budget data, and identify a complete list of financial management systems. (Recommendation 5)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Defense should direct the Chief Management Officer and other entities, as appropriate, to ensure that the department limits investments in financial management systems to only what is essential to maintain functioning systems and help ensure system security until it implements the other recommendations in this report. (Recommendation 6)

Agency: Department of Defense
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Under Secretary of Defense (Comptroller) should, in collaboration with the Under Secretary of Defense (Acquisition and Sustainment), develop and implement a DOD-wide strategy to remediate real property asset control issues. (Recommendation 1).

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation and stated that it was committed to placing increased leadership emphasis on real property asset controls to ensure mission readiness, audit readiness, testing for existence and completeness, and maintaining internal controls.

Recommendation: The Under Secretary of Defense (Comptroller) should, in collaboration with the Under Secretary of Defense (Acquisition and Sustainment), develop department-wide instructions for performing the E&C verifications. (Recommendation 2).

Agency: Department of Defense
Status: Open

Comments: DOD concurred with this recommendation and stated that it was committed to placing increased leadership emphasis on real property asset policies and instructions to ensure consistent and repeatable existence and completeness verifications.

Recommendation: We recommend that the Secretary of the Treasury ensure that the Fiscal Assistant Secretary enhances Treasury's procedures for the aggregate analysis to consider the impact of all amounts not obtained from significant entity audited financial statements on the reliability of the CFS and use the results to determine if audit coverage is needed for any information. (Recommendation 1)

Agency: Department of the Treasury
Status: Open

Comments: In commenting on our draft report, Treasury stated that it has already taken steps to address this recommendation by updating guidance to federal entities for the preparation of the fiscal year 2020 Agency Financial Reports or Performance and Accountability Reports. In addition, Treasury stated that it has drafted a memo to the Federal Accounting Standards Advisory Board to seek clarification of existing guidance related to reporting differences for federal entities that prepare financial reports according to FASB standards.

Recommendation: We recommend that the Secretary of the Treasury ensure that the Fiscal Assistant Secretary enhances Treasury's process for revising accounting and reporting policies to reasonably assure that financial information—including the SOCNP, Funds from Dedicated Collections note, and Other Liabilities note—is prepared in accordance with U.S. GAAP and sufficiently documented to allow effective management review. (Recommendation 2)

Agency: Department of the Treasury
Status: Open

Comments: In commenting on our draft report, Treasury stated that it has already taken steps to address this recommendation by updating guidance to federal entities for the preparation of the fiscal year 2020 Agency Financial Reports or Performance and Accountability Reports.

Recommendation: We recommend that the Secretary of the Treasury ensure that the Fiscal Assistant Secretary enhances existing procedures to reasonably assure that disclosures for financial information incorporated using accounting standards issued by FASB are prepared in accordance with U.S. GAAP, such as improving (1) the quantitative analysis to consider all FASB information included in the CFS, (2) the FASB questionnaire to consider all relevant disclosures and obtain responses from all significant component entities, and (3) procedures for sufficiently documenting analyses and conclusions related to FASB information in the CFS. (Recommendation 3)

Agency: Department of the Treasury
Status: Open

Comments: In commenting on our draft report, Treasury stated that it drafted a memo to the Federal Accounting Standards Advisory Board to seek clarification of existing guidance related to reporting differences for federal entities that prepare financial reports according to FASB standards.

Recommendation: Congress should consider legislation to require each CFO at a CFO Act agency to oversee and provide leadership for all of the responsibilities necessary to effectively carry out federal financial management activities, including the formulation and financial execution of the budget, planning and performance, risk management, internal control, financial systems, and accounting. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language to clarify the duties and responsibilities of the CFO, including the formulation and financial execution of the budget, planning and performance, risk management, internal control, financial systems, and accounting. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require deputy CFOs in CFO Act agencies to have defined responsibilities consistent with the breadth of those of the agency CFOs. (Matter for Consideration 2)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language to specify that the deputy CFO shall assist the agency CFO in the performance of each of the duties of the agency CFO. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the Director of OMB to prepare and submit to the appropriate committees of Congress a government-wide 4-year financial management plan (with timing to match the GPRA reporting requirements) and an annual financial management status report.

a. The plan should include actions for improving financial management systems, strengthening the federal financial management workforce, and better linking performance and cost information for decision-making.

b. The plan should be developed in consultation with the CFO Council, the Chief Information Officers Council, the Chief Data Officer Council, the Chief Acquisition Officers Council, CIGIE, GAO, and other appropriate financial management experts. (Matter for Consideration 3)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for a government-wide 4-year financial management plan and an annual financial management status report. The plan is to address actions for improving financial management systems, strengthening the federal financial management workforce, and better linking performance and cost information for decision-making. The plan is to be developed in consultation with the CFO Council, the Chief Information Officers Council, the Chief Data Officer Council, the Chief Acquisition Officers Council, CIGIE, GAO, and other appropriate financial management experts. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require each CFO at a CFO Act agency, in consultation with financial management and other appropriate experts, to prepare an agency plan to implement the 4-year government-wide financial management plan prepared by OMB. (Matter for Consideration 4)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the CFO of each CFO Act agency to prepare, in consultation with financial management and other appropriate experts, an agency plan to implement the 4-year financial management plan prepared by the Director of the Office of Management and Budget and to achieve and sustain effective financial management in the agency. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the Director of OMB to prepare comprehensive financial management performance-based metrics and use these metrics to evaluate the financial management performance of executive agencies. The metrics should be included in the government-wide and agency-level financial management plans, and agencies' performance against the metrics should be reported in the annual financial management status reports. (Matter for Consideration 5)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the Director of OMB to prepare comprehensive financial management performance-based metrics, which are to be used to evaluate the financial management performance of executive agencies. These metrics are to be included in the government-wide and agency-level financial management plans, and agencies' performance against the metrics are to be reported in annual financial management status reports. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the head of each executive agency to identify, and if necessary develop, the key financial management information, in addition to financial statements, needed for effective financial management and decision-making. (Matter for Consideration 6)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the head of each CFO Act agency to identify key financial management information needed for effective financial management decision-making. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require the head of each executive agency to annually assess and separately report their conclusion on the effectiveness of internal controls of the agency over financial reporting and other key financial management information. (Matter for Consideration 7)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the head of each CFO Act agency to annually assess and separately report on the effectiveness of internal controls of the agency over financial reporting and other key financial management information. We will continue to monitor the status of this bill.

Recommendation: Congress should consider legislation to require auditors, as part of each financial statement audit of an executive agency, to test and report on internal control over financial reporting and other key financial management information. (Matter for Consideration 8)

Agency: Congress
Status: Open

Comments: A bill (S. 3287) introduced in February 2020 proposed changes to the CFO Act. Among the proposed changes was language that calls for the financial statement auditors of each CFO Act agency to report on their evaluation of internal control over financial reporting and other key financial management information. We will continue to monitor the status of this bill.

Recommendation: The Secretary of the Air Force should develop and implement procedures for an ERM governance structure that includes oversight responsibilities for identifying, assessing, responding to, and reporting on the risks associated with agency material weaknesses from all relevant sources. These procedures should clearly demonstrate that risks associated with material weaknesses are considered by Air Force governance, as a whole, and are mitigated appropriately to achieve goals and objectives. (Recommendation 1)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and highlighted steps taken or planned to address this recommendation. Specifically, in FY19, the Air Force assessed the current-state of the risk management programs throughout the Air Force and developed a maturity model, implementation plan, and a governance structure to comply with OMB A-123 requirements. These enhancements will be implemented and formalized in policy in FY20. Further, beginning in FY19, the Air Force Senior Assessment Team (SAT) and the Senior Management Council (SMC) monitored corrective action plans for material weaknesses identified internally and by independent public accountants, including their impact on the Air Force's ability to achieve its enterprise objectives. In addition, the Air Force developed a process for the SAT and the SMC to discuss corrective action plans for material weaknesses on a quarterly basis as opposed to an annual basis, which will be evidenced in the form of board briefings and meeting minutes. Additionally, in FY19 the Air Force engaged the Enterprise Productivity Improvement Council to serve as the Air Force Risk Management Council (RMC) to oversee enterprise risk management as defined by their Charter, which was signed in February 2020. The Air Force will refine its policies and procedures to clearly specify the risks associated with the material weaknesses being addressed by the Air Force governance boards. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require (1) clearly delineating who within the Air Force is responsible for evaluating the internal control components and principles, how often they are to perform the evaluation, the level (e.g., entity or transactional) of the evaluation, what objectives are covered in the assessment, to whom to communicate the results if they are relevant to others performing assessments of internal control, and what guidance to follow; (2) documenting management's determination of whether each component and principle is designed, implemented, and operating effectively; and (3) documenting management's determination of whether components are operating together in an integrated manner. (Recommendation 2)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described steps taken or planned to address the recommendation. The Air Force SAF/FM performs both entity-level control assessments against all internal control components and principles and performs process level control assessments for internal controls over financial reporting and financial systems. The Air Force Audit Agency and the Air Force Inspector General have performed assessments related to operations and compliance. The Air Force will document those roles and responsibilities in formal policies. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require the use of test plans that (1) tie back to specific objectives to be achieved as included in the Business Operations Plan; (2) specify the nature, scope, and timing of procedures to conduct under the OMB Circular No. A-123 assessment process; and (3) reflect a consideration of prior year self-identified control deficiencies and results of internal and external audits. (Recommendation 3)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described steps taken or planned to address this recommendation. The Air Force test plans for internal controls over financial reporting and financial systems tie back to their relevant risk frameworks embedded in authoritative audit guidance. The framework used for financial reporting is the Financial Audit Manual, and the framework used for financial systems is the Federal Information Systems Controls Audit Manual, and include the nature, scope and timing of procedures performed. The Air Force's process-level internal control test plans are aligned with business process-level risks and objectives and are not directly associated with the Air Force's strategic objectives. The Air Force Business Operations Plan identifies strategic objectives, not business process-level objectives. Additionally, the Air Force considers previously identified internal control deficiencies in its annual documented internal control assessment scoping process. The Air Force will refine its policies and procedures regarding the use of test plans including operational and compliance controls. Due to the need for policy, procedure, and documentation updates required for operational and compliance controls, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine policies, procedures, and documentation by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require SAF/FM to validate (1) the number of organizational units reporting for its overall internal control assessment; (2) how control procedures were tested, what results were achieved, and how conclusions were derived from those results; and (3) whether the results used to compile the current year report are based on current fiscal year's assessments. (Recommendation 4)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will design policies and procedures to determine assessable units and verify that results are current on an annual basis. Due to the need to reevaluate the Air Force's assessable unit structure and the associated change management that will be necessary to implement the changes to sustain an effective program, the Air Force plans to refine the policies by September 2021 and publish the policies by September 2022.

Recommendation: The Secretary of the Air Force should develop policies or procedures for assessing internal control to require SAF/FM to assess how waivers affect the current year assessment of internal control, the determination of systemic weaknesses, and the compilation of the Air Force's overall Statement of Assurance. (Recommendation 5)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will design policies and procedures to consider the impact of waivers to the overall assessment of the system of internal control. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should require that developers of the policy and related guidance associated with designing the procedures for conducting OMB Circular No. A-123 assessments receive recurring training and are appropriately skilled in conducting internal control assessments and are familiar with Standards for Internal Control in the Federal Government. (Recommendation 6)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described steps taken or planned to address the recommendation. Specifically, the Air Force is implementing multiple changes to the Air Force's ERM and internal control program, including improved governance, standardized processes and documentation for enterprise risk management, entity-level and process-level controls, training, fraud risk management, and data quality management. Training content in FY20 was updated to reflect additional information, including definitions for internal controls and considerations for determining material weaknesses for operations. The Air Force will continue to update its the policies, guidance, and training to coincide with the current progress of the program. The Air Force will continue to refine the audience of its training to verify that those responsible for implementing and assessing ERM and internal controls are trained sufficiently. Due to the need for policy, procedure, documentation, and training updates required for operational and compliance controls, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, documentation, and training by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should analyze all definitions included in Air Force ERM and internal control assessment policy and related guidance to ensure that all definitions and concepts are defined correctly. (Recommendation 7)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will verify that all definitions and concepts in its policies are current and consistent with other authoritative guidance. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies by September 2020 and publish the policies by September 2021.

Recommendation: The Secretary of the Air Force should require SAF/FM to design recurring training for those who will assess internal control that (1) includes enhancing their skills in evaluating the internal control system and documenting results; (2) reflects all OMB Circular No. A-123 requirements, such as those related to identifying objectives, evaluating deficiencies, and determining material weaknesses; and (3) is provided to all who are responsible for performing internal control assessments. (Recommendation 8)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described actions taken or planned to address the recommendation. Specifically, the Air Force performs annual training to Major Commands, Direct Reporting Units, and Functional Executives. In FY20, the Air Force included business process assessable leads in this training. The Air Force plans to continue to refine the audience of its training to verify that those responsible for implementing and assessing ERM and internal controls are trained sufficiently by September 2021.

Recommendation: The Secretary of the Air Force should develop policy or procedures consistent with OMB Circular No. A-123 to assess the system of internal control using a risk-based approach. (Recommendation 9)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described actions taken or planned to address the recommendation. Specifically, the Air Force's scoping procedures, beginning in FY19, consider materiality, both quantitative and qualitative risk, as well as risks identified in the enterprise risk management process. The Air Force assesses internal controls over financial reporting and financial systems using a risk-based approach as evidenced currently in documented procedures and testing templates. The Air Force will refine its procedure documentation to include the assessment of internal controls over operations and compliance using a risk-based approach. Due to the need for policy, procedure, and documentation updates required for operational and compliance controls, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, and documentation by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should develop procedures to assess internal control over processes related to mission-critical assets, including (1) tests of design that evaluate whether controls are capable of achieving objectives, (2) tests of effectiveness only after a favorable assessment of the design of the control, and (3) a baseline that has accurate descriptions of business processes and identifies key internal controls as designed by management to respond to risks. (Recommendation 10)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation and described actions taken or planned to address the recommendation. The Air Force documents processes and assesses internal controls over financial reporting and financial systems related to mission critical assets that includes determinations as to internal control design, implementation, operating effectiveness and risks. The Air Force will enhance its approach for documenting processes and assessing internal controls over operations and compliance not related to financial reporting and financial systems through policy. Due to the need for policy, procedure, and documentation updates required for operational and compliance controls related to mission-critical assets, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, and documentation by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should establish a process and reporting lines of all the sources of information, including reviews performed of internal control processes related to mission-critical assets, that will be considered in the Secretary's Statement of Assurance. (Recommendation 11)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force reports material weaknesses in internal controls over financial reporting and financial systems related to mission critical assets through SAF/FM, but it will solidify its reporting channels for material weaknesses in internal controls over operations and compliance through policy. Due to the need for policy, procedure, documentation, and training updates required to appropriately report deficiencies in internal control over operations and compliance, and the coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, the Air Force plans to refine the policies, procedures, documentation, and training by September 2021 and publish the associated policies by September 2022.

Recommendation: The Secretary of the Air Force should develop procedures to require coordination between business process leads and the Air Force's unit managers to ensure that mission-critical asset–related internal control deficiencies are considered in the unit managers' assessments of internal control and related supporting statements of assurance. These procedures should include how, when, and with what frequency the results from the business process internal control reviews should be provided to relevant organizational units for consideration in their respective assurance statements. (Recommendation 12)

Agency: Department of Defense: Department of the Air Force
Status: Open

Comments: The DOD concurred with this recommendation. The Air Force will develop procedures to enhance communication between business process leads and Air Force unit managers to verify that deficiencies are reported appropriately in supporting statements of assurance. Due to the need for coordination across multiple Air Force organizations to seek input, approve, and concur with policy changes, as well as the change management needed to implement additional communications and protocol processes, the Air Force plans to refine the policies by September 2021 and publish the policies by September 2022.

Recommendation: The Office of the Chief Financial Officer should require payment reporting sites to document their procedures for identifying, tracking, and reporting improper payments to ensure they provide consistent and comparable information about their improper payments over time. (Recommendation 1)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that it plans to clarify and adjust its current and future guidance to its payment reporting sites to require that the sites (1) develop and maintain procedures to support implementation of its payment integrity requirements for identifying, tracking, and reporting improper payments, and (2) require payment reporting sites to certify that the procedures have been developed and implemented. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should develop a monitoring process to ensure that payment reporting sites document and implement procedures that will enable them to correctly identify and report improper payments to the OCFO. (Recommendation 2)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that it will (1) take measures to strengthen and enhance the existing payment integrity monitoring and quality assurance program by conducting period payment reporting site visits and (2) establish a payment integrity working group to identify best practices for incorporation into DOE processes. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should require payment reporting sites to document policies for tracking questioned costs to resolution. (Recommendation 3)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said they plan to develop and implement processes and procedures for tracking questioned costs to resolution. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should track information on the year the payment occurred for all improper payments, regardless of when they are identified, and determine and disclose in DOE's AFR whether the department's total annual improper payments exceeded $100 million in any given year. (Recommendation 4)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said it will conduct annual look-back analyses to the extent possible to determine if prior year reporting exceeded the $100 million threshold, and therefore could be subject to additional reporting requirements. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should clarify guidance to (1) define the factors for assessing adequacy of payment reporting sites' justifications that conducting recapture audits would not be cost-effective, and (2) require that the Office of the Chief Financial Officer review the sufficiency of these justifications against the criteria defined. (Recommendation 5)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said it will revise and enhance procedures defining the OCFO quality assurance process to (1) define the criteria for assessing the adequacy of payment reporting sites' justifications, and (2) review the payment reporting sites' justifications against the criteria defined. We will monitor and report on DOE's progress in implementing these planned actions.

Recommendation: The Office of the Chief Financial Officer should evaluate whether payment reporting sites could identify enough additional improper payments through payment recapture audits to make those audits cost-effective, such as by performing audits at selected sites. (Recommendation 6)

Agency: Department of Energy
Status: Open

Comments: DOE disagreed with the recommendation, stating in its comments that it has an ongoing Fraud Risk Management Working Group and that officials have developed a Fraud Risk Management and Data Analytics Implementation Plan to strengthen DOE's capability to prevent, identify, and recover improper payments and fraud. However, DOE's plan is still in draft form and, according to DOE's technical comments, they will not begin using data analytics until fiscal year 2021. In addition, DOE said that existing payment recapture activities to identify and recover improper payments are sufficient. However, as we discuss in the report, DOE determined that it does not need to conduct payment recapture audits based on justifications submitted by the reporting sites. We continue to believe that by evaluating whether it could identify enough additional improper payments to make payment recapture audits cost-effective, such as by performing audits at a limited number of sites, DOE would have an opportunity to identify and recover additional improper payments or have better information to justify that payment recapture audits are not cost-effective. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level process for conducting improper payment risk assessments to include (1) developing and documenting the rationale for the variable scale used to score risk factors and weighting of the payment reporting sites; and (2) documenting DOE's consideration of the inherent risk associated with the lag in identifying certain improper payments subsequent to the fiscal year they occurred to ensure that the process results in a reliable assessment of whether the department is susceptible to significant improper payments. (Recommendation 7)

Agency: Department of Energy
Status: Open

Comments: DOE did not agree with the recommendation to develop and document the rationale for the scale used to score risk factors and weighting of payment sites, stating that its risk assessment evaluates the volume and dollar amount of payments by payment category, payments subject to manual controls, and fluctuations in volume and dollar amounts. However, we are recommending that the OCFO document the weighting of all its risk factors, including its decision to consider as equal the risks identified by all sites-regardless of the dollar amount of outlays. We continue to believe that, because DOE did not properly document how it developed and considered risk factors during its fiscal year 2018 risk assessment, it cannot ensure that the process produces a reliable assessment of whether DOE is susceptible to significant improper payments. Regarding the consideration of inherent risk, DOE said that the Payment Integrity Risk Assessment directs payment reporting sites to consider inherent risk as part of DOE's Internal Control Program. However, even if none of the sites identifies the known lag in identifying improper payments as a risk, based on our review of DOE's Agency Financial Reports, this lag is a risk to DOE as a whole. Therefore, we continue to believe that DOE should document in its risk assessment process its consideration of the known lag in identifying improper payments. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level policies and procedures for reviewing risk assessments submitted by payment reporting sites to require a review and approval of the documentation supporting these assessments to help ensure the accuracy of the sites' assessments. (Recommendation 8)

Agency: Department of Energy
Status: Open

Comments: DOE did not agree with the recommendation, stating that sufficient processes are in place for ensuring the accuracy of payment reporting sites' risk assessments. DOE also stated that OCFO's Payment Integrity Guidance instructs payment reporting sites to maintain detailed information supporting risk assessments. However, as we discuss in the report, 5 of the 10 sites we reviewed did not provide sufficient explanation or documentation supporting their ratings for several of the risk factors. We continue to believe that by developing, documenting, and implementing policies and procedures to require the OCFO to review documentation supporting payment site risk assessments, DOE would enhance its ability to adequately monitor its decentralized improper payment risk assessment process and help ensure that individual payment reporting sites accurately score their risk factors, leading DOE to obtain a more accurate and reliable assessment of its overall risk of susceptibility to improper payments. We plan to monitor DOE actions related to this recommendation.

Recommendation: The Office of the Chief Financial Officer should revise DOE's department-level policies and procedures for conducting improper payment risk assessments to define the process for overriding a payment reporting site's risk determination, when appropriate. (Recommendation 9)

Agency: Department of Energy
Status: Open

Comments: DOE agreed with the recommendation and said that itwill clarify the quality assurance process for the payment reporting sites' ratings; however, DOE will not override the individual payment sites' risk determinations. Instead, DOE plans to work as needed with payment reporting site officials to determine the appropriate risk ratings. We will monitor and report on DOE's progress in implementing these actions.

Recommendation: We recommend that the Commissioner of Internal Revenue update and implement policies and procedures for developing a courier contingency plan to prohibit managers responsible for overseeing the preparation of taxpayer receipts for deposits from also transporting them to financial institutions. (Recommendation 20-01)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization will update the Courier Contingency Plan polices and procedures to provide for appropriate segregation of duties or other curative measures.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement manual refund procedures to direct (1) initiators to document (e.g., record on the taxpayers' accounts or annotate on the related manual refund forms) the justification for bypassing the IAT tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to monitor whether such warnings were bypassed and review the justifications for reasonableness prior to approving manual refund forms. (Recommendation 20-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization agrees that actions need to occur to address duplicate tax refund conditions through improved manual refund procedures to require (1) initiator to document the justification for bypassing the Integrated Automated Technologies (IAT) tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to review the justification documented for bypassing the IAT tool warning for reasonableness prior to approving manual refund forms. However, IRS also stated that it was unable to commit to implementing a corrective action plan at this time due to budgetary constraints on system enhancements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that business units record the acceptance of goods and services in a timely manner in accordance with IRS policies and procedures. (Recommendation 20-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will determine the reasons for business unit(s) non-compliance with established policies and procedures related to timely recording of receipts and acceptance of goods and services and, based on this evaluation, develop an action plan that once completed will provide additional tools to aid the business units in reasonably ensuring compliance with established requirements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that the future lease payment amounts for non-cancellable operating leases are calculated correctly. (Recommendation 20-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will update policies and procedures to include additional instructions needed to calculate the future lease payments due on the non-cancelable leases with terms greater than one year and will also create an automated calculation to determine the number of remaining months of lease payments.

Recommendation: The Program Director for Financial Integration, with input from NNSA's Office of Management and Budget and respective program offices, should establish and implement a work breakdown structure change control process for common financial reporting that ensures changes are approved by program office management, at a minimum; documented; and communicated to M&O contractors on a timely basis. (Recommendation 1)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and officials said they are working to establish a work breakdown structure change control process by June 30, 2020.

Recommendation: The Program Director for Financial Integration should assess the extent to which M&O contractors make manual changes to their financial data to reconcile with STARS and determine whether it has an effect on the accuracy of the data collected for common financial reporting. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and plans to review how management and operating (M&O) contractors make manual changes to their financial data as part of an ongoing review of M&O contractors indirect cost data. The review is expected to be completed by September 30, 2020.

Recommendation: The Program Director for Financial Integration should develop and implement an internal process for NNSA to verify how the M&O contractors crosswalk financial data from their systems to the appropriate NNSA work breakdown structure to ensure the reported data are accurate and consistent. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and plans to establish a process to verify that the management and operating (M&O) contractors are crosswalking their financial data to the appropriate NNSA work breakdown structure by September 30, 2020. As of April 2020, NNSA has hired two federal employees who will be conducting site visits to work with M&O contractors on verifying their crosswalks.

Recommendation: The Program Director for Financial Integration should develop and implement an internal process for NNSA to verify that the M&O contractors are consistently applying common cost element definitions at their sites and across the nuclear security enterprise. (Recommendation 4)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: NNSA agreed with the recommendation and plans to establish a process to verify that the management and operating (M&O) contractors are consistently applying common cost element definitions at their sites and across the nuclear security enterprise by September 30, 2020. As of April 2020, NNSA has hired two federal employees who will be conducting site visits to work with M&O contractors on verifying their crosswalks.

Recommendation: The Director of DFAS should, in accordance with the FMR, implement procedures to help ensure that FBWT reconciliations are consistently performed and that all DFAS sites review and document research conducted on the causes of any differences arising from these reconciliations. (Recommendation 1)

Agency: Department of Defense: Defense Finance and Accounting Service
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. They stated that the Defense Finance and Accounting Service (DFAS) will update the Financial Management Regulation (FMR) and implement procedures to help ensure Fund Balance with Treasury (FBWT) reconciliations are performed consistently and appropriate research on the causes of any difference arising from these reconciliations is reviewed and documented by all DFAS sites. Further, DFAS will update internal documentation/policy to outline DFAS roles and processes for FBWT reconciliations as well as include guidance on the execution of DOD's FMR FBWT reconciliation requirements. The estimated completion date for the implementation of this recommendation is December 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should update the FMR to clearly define the required supporting documentation for system-generated accounting adjustments, including the required documentation of business rules driving the recording of these adjustments, such as documentation of the programming logic. (Recommendation 2)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. They stated that the Department is developing a checklist of required supporting documents for incorporation into the DOD Financial Management Regulations (FMR). They will update the DOD FMR Volume, 6A, Chapter 2 to define the required supporting documentation for system generated accounting adjustments. Additionally, the Defense Finance and Accounting Service (DFAS) will update internal documentation to include narratives outlining the business rules for system generated accounting adjustments with the required supporting documentation. The estimated completion date for the implementation of this recommendation is December 2020. We will continue to follow up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should perform and document a comprehensive review of the FMR accounting adjustment category codes to determine their ongoing applicability or the need for additional codes to reflect the current financial reporting environment. (Recommendation 3)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department intends to collaborate with the financial community to update the category codes within the DOD Financial Management Regulations (FMR). Specifically, the Office of the Under Secretary of Defense will perform a comprehensive review of Journal Voucher Category Codes listed in DOD FMR, Volume 6A, Chapter 2 and update regulations based on feedback. The Defense Finance and Accounting Service will update internal documentation and procedures to reflect any code changes identified in the revised DOD FMR. The estimated completion date for this recommendation is July 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should establish procedures to help ensure the consistent implementation of the requirements of DFAS Form 9339. (Recommendation 4)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department plans to update the Defense Finance and Accounting Service (DFAS) Form 9339 and develop and conduct refresher training to all users of the Form 9339. The estimated completion date for this recommendation is September 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller) should update policies and procedures to identify the causes of out-of-balance accounting adjustments and resolve the causes in a timely manner. (Recommendation 5)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department is collaborating on utilizing existing data to identify and resolve out-of-balances and update DOD Financial Management Regulation, Volume 6A, Chapter 2 to include a section conveying out-of-balance accounting adjustments are not authorized. Root cause analysis efforts will be performed in conjunction with corrective action plans (CAPs) for recommendations 6--8. The estimated completion date for this recommendation is December 2020. We will continue to follow-up with DOD on the status of this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller), in conjunction with the Director of DFAS, should develop and implement policies and procedures to help ensure that root cause analyses for accounting adjustments are consistently performed and documented across DOD. (Recommendation 6)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department, in conjunction with the Director of Defense Finance and Accounting Service (DFAS), intends to utilize existing advanced analytics tools to research and document root cause analyses. The estimated completion date for the implementation of this recommendation is December 2020. We will continue to follow-up on this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller), in conjunction with the Director of DFAS, should develop and implement policies and procedures to help ensure consistent development, implementation, monitoring, and documentation of action plans across DOD that address accounting adjustment causes that staff identified internally. (Recommendation 7)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department intends to collaborate with the financial community, including the Director of the Defense Financial and Accounting Service (DFAS), and utilize existing tools for documenting and implementing consistent procedures for action plans of accounting adjustments. The analytical tool, Advana will be used to analyze the action plan code for consistent analysis to be performed across the DOD. The estimated completion date for the implementation of this recommendation is February 2021. We will continue to follow-up on this recommendation.

Recommendation: The Under Secretary of Defense (Comptroller), in conjunction with the Director of DFAS, should develop and implement procedures across DOD that include clearly defined outcomes focused on reducing accounting adjustments (supported and unsupported) with specific actionable steps and procedures for achieving stated goals. (Recommendation 8)

Agency: Department of Defense: Under Secretary of Defense (Comptroller)
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. The Department, in conjunction with the Director of the Defense Finance and Accounting Service, plans to utilize existing tools to define and measure the outcomes of accounting adjustments. The estimated completion date for the implementation of this recommendation is April 2021. We will continue to follow-up on this recommendation.

Recommendation: The Secretary of State should ensure that the Director of State's Office of U.S. Foreign Assistance Resources conducts a review of the Section 653(a) process to identify process steps that can be streamlined or eliminated and determine the time frame needed to prepare the annual Section 653(a) report. If State determines that the time frame exceeds 30 days, the office should coordinate with other appropriate officials to submit a legislative proposal to Congress to extend the mandated time frame for submitting Section 653(a) reports. (Recommendation 1)

Agency: Department of State
Status: Open
Priority recommendation

Comments: State indicated in their letter commenting on GAO-19-600 that they concurred with this recommendation. In their comments, State said they would determine a reasonable time frame for completing the report and will coordinate with appropriate officials regarding a potential legislative proposal to Congress.

Recommendation: The Secretary of State should ensure that the Director of State's Office of U.S. Foreign Assistance Resources improves the data collection from the many sources contributing to the Section 653(a) reports, such as by enhancing their data information systems. (Recommendation 2)

Agency: Department of State
Status: Open

Comments: State indicated in their letter commenting on GAO-19-600 that they concurred with this recommendation. In their comments, State said they are taking steps to modify their Foreign Assistance Coordination and Tracking System database to improve the collection of relevant data.

Recommendation: The Secretary of State should develop a plan to address vacancies within State's Office of U.S. Foreign Assistance Resources, consulting with the USAID Administrator as appropriate. (Recommendation 3)

Agency: Department of State
Status: Open

Comments: State indicated in their letter commenting on GAO-19-600 that they concurred with this recommendation. In their comments, State said they are developing a plan in coordination with USAID to fill existing vacancies, and are recruiting State and USAID employees to serve on details to fill existing staffing gaps.

Recommendation: The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary enhances existing procedures for Treasury management to perform additional reviews for restatements, reclassifications, and adjustments to beginning net position to reasonably assure that they are properly supported and accurately reported. (Recommendation 2)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remains open. Treasury enhanced its procedures to include additional management reviews, particularly the Financial Reports and Advisory Division Director, for restatements, reclassifications, and adjustments to beginning net position. Although FRAD took steps to enhance its review procedures, the additional review did not prevent FRAD from including descriptions in the draft CFS that were not supported by entity financial statements or from excluding some information from the CFS notes. Further steps are needed to define procedures to ensure consistent and accurate treatment of restatements, reclassifications, and adjustments to beginning net position in the CFS. We will follow-up on progress made by Treasury as part of our fiscal year 2020 CFS audit.

Recommendation: The Secretary of the Treasury should ensure that the Fiscal Assistant Secretary, working in coordination with the Controller of OMB, establishes effective processes and procedures to reasonably assure that appropriate information regarding legal contingency losses is reported in the CFS. (Recommendation 4)

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remains open. Treasury and OMB (1) increased guidance to federal entities in the Treasury Financial Manual section 2-4700; (2) included an illustrative Contingent Loss Table in OMB Circular No. A-136 for agencies to use as guidance when reporting probable and reasonably possible losses; (3) provided guidance to agencies through monthly Central Reporting Team (CRT) meetings with the agencies' financial reporting staff and at the Government Financial Management Conference; (4) communicated regularly with Department of Justice officials regarding the preparation of the government-wide legal representation letter; and (5) increased the number of Treasury staff performing the legal letter analysis. However, we noted inconsistencies among the significant component entities' financial statement note disclosures, management schedules, and legal representation letters, and the legal contingency loss information reported in the CFS, as well as inconsistencies between entities' year-end management schedules/legal representation letters and the final government-wide legal representation letter. We will follow-up on progress made by Treasury as part of our fiscal year 2020 CFS audit.

Recommendation: The Commissioner of Fiscal Service should develop and implement a mechanism to reasonably assure that all the journal entries recorded in the Schedules of the General Fund general ledgers can be readily identified and traced, such as through a unique identifier, to determine the effect of a transaction on all applicable general ledger accounts and line items of the Schedules of the General Fund, including the budget deficit. (Recommendation 1)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open
Priority recommendation

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Commissioner of Fiscal Service should develop and implement a mechanism to reasonably assure that payment transactions recorded in the Schedules of the General Fund general ledgers capture all of the key information needed, including payment schedules if applicable, to readily trace transactions to the information certified by the federal agency. (Recommendation 2)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Commissioner of Fiscal Service should develop and implement additional reporting requirements with related guidance for federal agencies that better align with the General Fund financial reporting objectives and enable Fiscal Service to capture the effect of a transaction on all applicable general ledger accounts and line items of the Schedules of the General Fund, including the budget deficit. (Recommendation 3)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open
Priority recommendation

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: We recommend that the Commissioner of Fiscal Service develop and implement a process that would enable Fiscal Service to obtain the information necessary to effectively assess the effect of the Statement of Difference on the Schedules of the General Fund for those federal agencies that have not implemented the Central Accounting and Reporting System. (Recommendation 4)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open
Priority recommendation

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: We recommend that the Commissioner of Fiscal Service design and implement procedures to evaluate risks and monitor internal controls over financial reporting relevant to the Schedules of the General Fund. (Recommendation 5)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Commissioner of Fiscal Service should develop and implement a mechanism for evaluating agencies' use of BETCs based on the enhanced guidance. (Recommendation 7)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Commissioner of Fiscal Service should design and implement procedures to (1) obtain and review supporting documentation for reported activity included on Agency Submission Forms and (2) assess the overall completeness of federal agency activity reported on Agency Submission Forms. (Recommendation 8)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Commissioner of Fiscal Service should design and implement procedures to periodically review all active Treasury accounts to determine whether they are valid and the related General Fund account balances are consistent with federal agency records. (Recommendation 10)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open
Priority recommendation

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: The Commissioner of Fiscal Service should enhance current procedures for reviewing negative balances to include Treasury accounts with indefinite periods of availability. (Recommendation 11)

Agency: Department of the Treasury: Bureau of the Fiscal Service
Status: Open
Priority recommendation

Comments: Fiscal Service concurred with the results of our audit. As of July 2020, Fiscal Service developed a remediation plan and efforts are underway to address this recommendation. We will continue to monitor the agency's actions to address this recommendation.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials implement the necessary actions to effectively address the two primary causes of the significant deficiency in IRS's internal control over unpaid assessments. These actions should (1) resolve the system limitations affecting the recording and maintenance of reliable and appropriately classified unpaid assessments and related taxpayer data to support timely and informed management decisions, and enable appropriate financial reporting of unpaid assessment balances throughout the year, and (2) identify the control deficiencies that result in significant errors in taxpayer accounts and implement control procedures to routinely and effectively prevent, or detect and correct, such errors. (Recommendation 19-01)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, IRS documented the key management decisions in the design and use of the estimation process. This step should reduce the risk that IRS may perform sampling procedures inconsistent with management intent or plans. Continued management commitment and sustained efforts are necessary to build on the progress made to date and to fully address IRS's remaining unresolved issues concerning the management and reporting of unpaid assessments. We will assess IRS's progress in addressing these issues during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials document and implement a formal comprehensive strategy to provide reasonable assurance concerning its nationwide coordination, consistency, and accountability for internal control over key areas of physical security. This strategy should include nationwide improvements for (1) coordinating among the functional areas involved in physical security; (2) implementing and monitoring the effectiveness of physical security policies, procedures, and internal controls; and (3) ongoing communication in identifying, documenting, and taking corrective action to resolve underlying control issues that affect IRS's facilities. (Recommendation 19-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open
Priority recommendation

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that Facilities Management and Security Services is in the process of developing and documenting a formal, comprehensive strategy. According to IRS officials, this strategy will include different overarching goals, such as improving workforce effectiveness, ensuring appropriate monitoring functions and employee accountability, and improving coordination and communication of policies and procedures. IRS plans to complete the formal, comprehensive strategy during fiscal year 2020 and finalize the implementation of this strategy by March 2021.

Recommendation: The Commissioner of Internal Revenue should ensure that appropriate IRS officials determine the reasons staff did not consistently comply with IRS's existing requirement for maintaining an emergency contact list at all of its facilities and, based on this determination, establish a process to enforce compliance with the requirement. (Recommendation 19-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, IRS used a questionnaire survey and obtained feedback from security section chiefs and physical security specialists to determine the reasons staff did not consistently comply with IRS's existing requirement to maintain an emergency contact list at all IRS facilities. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will establish a process to better enforce compliance with the requirement based on the results of the feedback obtained.

Recommendation: The Commissioner of Internal Revenue should ensure that appropriate IRS officials establish and implement policies and procedures requiring that corrective actions be documented in the Alarm Maintenance and Testing Certification Report for malfunctioning alarms identified in the annual alarm tests. (Recommendation 19-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will (1) update the Internal Revenue Manual to reflect the requirement to use the Alarm Maintenance and Testing Certification Report to document alarm testing results, including any malfunctioning alarms and related corrective actions taken, as appropriate;, and (2) review the Alarm Maintenance and Testing Certification Report Form and incorporate any additional instructions and fields to document the specific alarms tested, the testing results, and related corrective actions taken, as appropriate.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials establish and implement policies or procedures, or both, to provide reasonable assurance that the video surveillance systems at all IRS facilities record activity at the correct time and are properly secured. The policies or procedures should include periodic checks and adjustments, as needed, as part of the annual service and maintenance of security equipment and systems. (Recommendation 19-05)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Facilities Management and Security Services will develop, document, and implement policies or procedures, or both, to provide reasonable assurance of the accuracy and physical security of the video surveillance systems at all IRS facilities by including periodic checks and adjustments, as needed, as part of the annual service and maintenance of security equipment.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to clarify (1) who is responsible for conducting the annual review of the visitor access logs, (2) the date by which the review is to be conducted, and (3) how the review should be documented. (Recommendation 19-06)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Information Technology and the Criminal Investigation organizations will update and implement their policies or procedures, or both, to clarify (1) who is responsible for conducting the annual review of the visitor access logs, (2) the date by which the review is to be conducted, and (3) how the review should be documented.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials (1) identify the reason IRS's policies and procedures related to the transmittal forms were not always followed and (2) design and implement actions to provide reasonable assurance that SB/SE units comply with these policies and procedures. (Recommendation 19-07)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that the Small Business/Self-Employed (SB/SE) Field Collection organization determined that the reasons the policies and procedures were not always followed were either a lack of understanding of the requirements or a lack of consistency in adhering to them. In order to address this, in October 2019, Field Collection distributed a memorandum to its area directors, territory managers, and group managers, reminding them of the required remittance processing procedures, emphasizing the importance of following the procedures, and requesting that they distribute the information in the memorandum within their organization. IRS officials stated that the memorandum will help assure that SB/SE Field Collection units comply with the applicable policies and procedures. Since this memorandum was issued after the end of our fiscal year 2019 audit, we will review the implementation of this action during our fiscal year 2020 audit. Further, IRS officials stated that during fiscal year 2020, the SB/SE Examination organization will identify the reason that IRS's policies and procedures for transmittal forms were not followed, and based on this, it will add guidance to the applicable Internal Revenue Manual sections to clarify and supplement the service-wide guidance for the appropriate control, monitoring, and review of the forms used to transmit packages containing personally identifiable information.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to clearly define the roles and responsibilities of second-level managers and IDRS security account administrators for validating the information on USR designation forms, including specifying how the information should be validated. (Recommendation 19-08)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2019, the Information Technology (IT) organization updated IRS's Integrated Data Retrieval System (IDRS) security policy contained in the Internal Revenue Manual to ensure that the IDRS account administration process complies with IRS's personnel security policy regarding background investigation completion dates. In addition, IRS officials stated that by November 2020, the IT organization will update the Unit Security Representative (USR) designation form, as well as policies and procedures, to clearly define the roles and responsibilities of second-level managers and IDRS security account administrators for validating the information on USR designation forms, including how the information should be validated.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement procedures to clearly specify the tax refund data elements that PVS COs are required to verify before certifying the tax refunds in SPS. (Recommendation 19-09)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, the Information Technology organization updated its standard operating procedures to clearly specify the tax refund data elements that the Processing Validation Section Certifying Officers are required to verify before certifying the tax refunds in the Secure Payment System. Since IRS completed this action after we had already performed our fiscal year 2019 testing related to the certification of tax refunds, we will evaluate IRS's actions to address this recommendation during our fiscal year 2020 audit.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials establish and implement a review process to provide reasonable assurance that the RSNs that Data Conversion key entry operators enter into the ISRP system and post to the master files are correct. (Recommendation 19-10)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, the Wage & Investment organization will establish and implement a review process to provide reasonable assurance that the Refund Schedule Numbers on manual refund forms are transcribed accurately into the Integrated Submission and Remittance Processing system.

Recommendation: The Commissioner of Internal Revenue should ensure that the appropriate IRS officials implement a validity check in the ISRP system to confirm that RSNs that Data Conversion key entry operators enter into the system have the required 14 digits. (Recommendation 19-11)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS officials stated that the Wage and Investment organization agrees that developing and implementing a Unified Work Request for programming changes is needed to systemically validate the refund schedule numbers input into the Integrated Submission and Remittance Processing system; however, IRS officials indicated that the organization is unable to commit to implementing a corrective action because of budgetary constraints. As a result, IRS will place this recommendation on hold until funds are available.

Recommendation: We recommend that the Commissioner of Internal Revenue ensure that the appropriate IRS officials update and implement policies or procedures, or both, to require that reviewers follow up with tax examiners to verify the errors that tax examiners made in working on cases related to suspicious or questionable tax returns are corrected. (Recommendation 19-12)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that by April 2020, IRS will update and implement policies or procedures, or both, requiring that reviewers follow up with tax examiners to verify that the errors tax examiners made in working a case related to suspicious or questionable tax returns are corrected.

Recommendation: The Director of OMB should ensure that information is collected regarding how centralized reporting of procurement requirements might reduce recipient reporting burden—including input from stakeholders such as contractors through an iterative and ongoing process—to inform OMB's planned expansion of the Central Reporting Portal.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In an October 2019 written response to the recommendation contained in GAO-19-299, OMB acknowledged the importance of collecting stakeholder input and described some steps that it has taken to do so in the past. The letter also stated OMB's intention to engage key stakeholders moving forward but was not specific regarding steps it planned to take related to the potential expansion of the Central Reporting Portal. GAO will continue to monitor this issue including what specific actions, if any, OMB takes in response to this recommendation.

Recommendation: The Commissioner of Internal Revenue should finalize the PDC program objectives so that they are clearly defined in consistent terms, and assure that the key program risks, measures, and targets are linked with the objectives. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS partially agreed with recommendation. IRS said it would use consistent terms in developing measures that link to its PDC program objectives, but did not agree that program objectives are necessarily framed in terms of program risks. In December 2019, IRS provided new objectives linked with proposed measures to assess collection agencies. In February 2020, IRS said it intends to award new contracts in 2021 that will include performance measures linked to program objectives. To fully address GAO's recommendation, IRS also needs to identify targets for measures linked to program objectives.

Recommendation: The Commissioner of Internal Revenue should include the Department of the Treasury Inspector General for Tax Administration (TIGTA) costs in IRS's reporting of PDC program costs. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS disagreed with the recommendation. In October 2019 IRS said that including TIGTA costs in reporting program costs would be inconsistent with legislative requirements that define program costs as IRS's costs and with IRS cost-accounting practices. However, we maintain that the FAST Act set minimum reporting requirements to which IRS can add more information. Also, the existing cost accounting standards and practices to which IRS refers govern IRS's accounting for and reporting of costs incurred by IRS, not to fuller reporting of the PDC program's costs to the federal government. We will continue to pursue this recommendation and update its status in response to any changes.

Recommendation: The Commissioner of Internal Revenue should report the amount of collected revenue sent to the general fund of the Treasury and amounts retained by IRS to pay its costs. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with our recommendation and in October 2019 said it plans to report PDC revenue amounts going to the Treasury and to IRS's retained funds by February 2020. As of March 2020, we had not received documentation from IRS to demonstrate it had done so.

Recommendation: The Commissioner of Internal Revenue should analyze PDC program results to identify the types of cases that are not potentially collectible and should not be assigned to collection agencies. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS disagreed with the recommendation and said such analysis is unnecessary due to a legal requirement to assign all such cases to collection agencies and because there is very little cost in doing so. Our report noted that IRS has the authority and responsibility for efficient program operations to not assign uncollectible debt cases. In February 2020, IRS said that the assignment and recall of cases add nothing to the cost. We disagree, noting that IRS has not supported this assertion. IRS incurred some portion of its PDC costs from assigning and recalling cases that collected no revenue. Even if these costs are minor, they would be greater than the amount collected. We maintain the importance of this recommendation because IRS has incurred tens of millions of dollars in costs with little or no revenue collected for most of the PDC cases that IRS has closed.

Recommendation: The Commissioner of Internal Revenue should analyze PDC program results and the cases not assigned to the PDC program to identify the types of inactive cases IRS will not pursue that could be assigned to collection agencies to improve PDC program results. (Recommendation 5)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed and noted that it already had the recommended analyses built into the PDC case identification process. IRS also provided documentation to GAO in December 2019 and its comments in February 2020 repeated its view that its process already identified other inactive cases that have not been assigned to PDC. IRS's documentation during the review and provided in December did not show how IRS analyzes its debt inventory and PDC results to identify inactive cases that are not being assigned to PDC but may be worth pursuing.

Recommendation: The Commissioner of Internal Revenue should clearly document and distinguish the complete list of identified risks to taxpayers in the PDC program risk register, and align the risks with PDC program objectives. (Recommendation 6)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. We will update the status after completing review of documentation IRS provided in December 2019, on actions taken to implement the recommendation. IRS actions included a risk register with related information on the analyses and response to the listed risks.

Recommendation: The Commissioner of Internal Revenue should clearly document the severity of impacts of the taxpayer risks, as well as the likelihood of each taxpayer risk after responding to it, in the PDC program risk register, and use this information to prioritize risks to address and guide selection of risk responses. (Recommendation 7)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. We will update the status after completing review of documentation IRS provided in December 2019, on actions taken to implement the recommendation. IRS actions included a risk register with related information on the analyses and response to the listed risks.

Recommendation: The Commissioner of Internal Revenue should clearly document how each risk response aligns with specific taxpayer risks in the PDC program risk register. (Recommendation 8)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. We will update the status after completing review of documentation IRS provided in December 2019, on actions taken to implement the recommendation. IRS actions included a risk register with related information on the analyses and response to the listed risks.

Recommendation: The Commissioner of Internal Revenue should document how IRS's monitoring of the PDC program provides information on specific taxpayer risks and how well specific responses are working to address each risk, and should supplement IRS's monitoring of taxpayer complaints with Federal Trade Commission (FTC) complaint data. (Recommendation 9)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. We will update the status after completing review of documentation IRS provided in December 2019 on actions taken to implement the recommendation, such as outreach to FTC on its system to record the complaints.

Recommendation: The Commissioner of Internal Revenue should more fully seek and document feedback from external stakeholders representing vulnerable taxpayers to identify and appropriately respond to possible PDC taxpayer risks. (Recommendation 10)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. We will update the status after completing review of documentation IRS provided in December 2019 on actions taken to implement the recommendation, such as a system to record feedback received.

Recommendation: The Commissioner of Internal Revenue should clearly document an assessment of fraud risks related to the PDC program. (Recommendation 11)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation and said that by June 2020, it would conduct a fraud risk assessment based on the Fraud Reduction and Data Analytics Act of 2015 and OMB guidance. We will update the status when we complete review of any documentation IRS provides on actions taken to implement the recommendation.

Recommendation: The Commissioner of Internal Revenue should ensure that its printed guidance to PDC taxpayers includes information about reporting scams to TIGTA. (Recommendation 12)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with the recommendation. We will update the status after completing review of documentation IRS provided in December 2019 on actions taken to implement the recommendation.

Recommendation: The Director of OMB should clarify and document OMB's procedure for changing official data definition standards for DATA Act reporting, for example, by explicitly describing how change procedures developed for other government-wide initiatives apply to DATA Act definition standards in a public source of guidance or information. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB has taken steps to restructure the federal data ecosystem, including issuing government-wide guidance covering all federal data and creating a Business Standards Council. However, given the complexity of recent changes, OMB needs to explicitly and publicly describe how those changes-developed in the context of other government-wide initiatives-apply to DATA Act data element definitions.

Recommendation: The Director of OMB should ensure that the June 2018 policy changes regarding DATA Act data definition standards are clearly identified and explained in the official repository or another authoritative public source of DATA Act standards and guidance, such as by including a revision history along with the current version of the definitions. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In January 2020, OMB staff cited its Federal Spending Transparency Data Standards website and specifically notations on that site regarding the dates of revisions made to those standards as being responsive to this recommendation. However, the specific notations cited by OMB only show changes made back in 2015 and do not reflect nor explain some of the more recent revisions that led to GAO making this recommendation.

Recommendation: The Director of OMB should make available more disaggregated data on fees, fines, and penalties that it maintains in its OMB MAX database. For example, OMB could report data on fee collections by agency in Analytical Perspectives. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) did not provide comments on our draft report and therefore neither agreed nor disagreed with this recommendation. As of October 2020, OMB had not provided evidence of any actions taken to implement this recommendation.

Recommendation: The Director of OMB should instruct agencies to regularly review the application of the user fee designation in the OMB MAX data and update the designation, as needed, to meet the criteria in OMB Circular No. A-11. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: OMB did not provide comments on our draft report and therefore neither agreed nor disagreed with this recommendation. As of October 2020, OMB had not provided evidence of any actions taken to implement this recommendation.

Recommendation: The Program Director for Financial Integration should collect and document requirements to define project scope and meet project objectives. These requirements should be updated periodically throughout the life of the project. (Recommendation 2)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of August 2020, NNSA provided a project plan for tasks to be completed for common financial reporting through 2021. However, NNSA has not developed requirements that define specific or detailed requirements for successful implementation of common financial reporting, such as the types of information that program managers need.

Recommendation: The Program Director for Financial Integration should develop a detailed project schedule. The detailed schedule should be documented as part of the annual report to Congress required in the National Defense Authorization Act for Fiscal Year 2017. (Recommendation 3)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of August 2020, NNSA established a detailed project schedule for the common financial reporting effort through fiscal year 2021. However, NNSA should communicate this detailed project schedule for the effort to Congress on an annual basis.

Recommendation: The Program Director for Financial Integration should develop a formal process to identify risks, document those risks, and plan how to minimize risk exposure. (Recommendation 6)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: In June 2020, NNSA developed a risk management plan for common financial reporting which established a framework for identifying and managing risks. GAO will continue to monitor NNSA's efforts to implement the plan, including how NNSA identifies and documents risks and mitigates risk exposure using its management plan.

Recommendation: The Program Director for Financial Integration should develop an approach to effectively engage with all project stakeholders that incorporates their expectations into project decisions. (Recommendation 7)

Agency: Department of Energy: National Nuclear Security Administration
Status: Open

Comments: As of September 2020, NNSA has continued to engage on a regular basis with its M&O contractors. However, similar efforts have not continued with stakeholders of the program offices.

Recommendation: The Director of OMB should take steps to update OMB guidance to specify other types of quality information that agencies with programs noncompliant for 3 or more consecutive years should include in their notifications to Congress, such as significant matters related to risks, issues, root causes, measurable milestones, designated senior officials, accountability mechanisms, and corrective actions or strategies planned or taken by agencies to achieve compliance. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: The Office of Management and Budget (OMB) neither agreed or disagreed with the recommendation but stated that it had no comments. In January 2020, OMB informed us that it had no status updates to provide at this time. We will continue to monitor agency's actions to address this recommendation.

Recommendation: The Director of OMB should enhance the guidelines for agencies to establish the controls required by FRDAA, by clarifying the difference between FRDAA and ERM requirements, and through collaboration with agencies to determine what additional information agencies need to implement the controls. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In March 2020, the Payment Integrity Information Act of 2019 (PIIA) was enacted to improve efforts to identify and reduce government-wide improper payments, including payments that are the result of fraud. PIIA repealed and replaced FRDAA. However, OMB and the other agencies subject to PIIA essentially must satisfy the same requirements established under FRDAA, including adhering to OMB's related guidelines. OMB has not updated its published guidelines for FRDAA as we recommended. If OMB takes additional actions to supplement guidelines under PIIA, we will review the guidelines to determine whether it addresses our recommendation.

Recommendation: The Director of OMB should enhance FRDAA reporting guidelines by directing agencies to report complete and detailed information on each of the reporting elements specified by FRDAA, which should include information related to financial and nonfinancial fraud. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: In March 2020, the Payment Integrity Information Act of 2019 (PIIA) was enacted to improve efforts to identify and reduce government-wide improper payments, including payments that are the result of fraud. PIIA repealed and replaced FRDAA, but maintained similar reporting requirements for federal agencies regarding fraud risks and also extended the time line for reporting by a year. OMB did not update its previous reporting guidance for FRDAA as we recommended. If OMB takes additional actions to supplement reporting guidelines under PIIA, we will review the guidelines to determine whether it addresses our recommendation.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment assesses whether DLA Document Services' single manager role for printing and reproduction provides the best value to the government--as determined by quality, price, and delivery time and in light of DLA Document Services' transformation plan--and whether any additional efficiencies are possible, and use the results of that assessment to inform the revision of DOD Instruction 5330.03. (Recommendation 1)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. By July 2019, DOD had completed a study of printing and reproduction services to determine the best value to the department. As of December 2019, according to a DOD official, the Office of the Under Secretary of Defense for Acquisition and Sustainment plans to develop steps toward achieving the best value to the government based on the study results, and update DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services by July 2020. Completion of these actions would allow DOD to determine if further efficiencies in its document services are possible.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense for Acquisition and Sustainment assesses whether DOD's current approach to obtaining print devices represents the best value to the government or whether other approaches, such as further consolidations under DLA Document Services as a proposed single manager for print device procurement, would be more cost effective. (Recommendation 2)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. In July 2019, DOD had completed a study of printing and reproduction services to determine the best value to the department. As of December 2019, according to a DOD official, the Office of the Under Secretary of Defense for Acquisition and Sustainment plans to develop steps toward achieving the best value to the government based on the study results, and update DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services by July 2020. Completion of these actions would allow DOD to determine if further efficiencies in its document services are possible.

Recommendation: The Secretary of Defense should ensure that the DOD Chief Information Officer (CIO) implements controls, such as reporting procedures, to routinely monitor actions to reduce the number of print devices, consistent with department-wide goals for reducing the number of print devices that are included in the CIO's 2012 memorandum. (Recommendation 3)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. As of December 2019, DOD had ongoing actions intended to address the recommendation. For example, according to a DOD official, the DOD Chief Information Officer (CIO) will collaborate with the Under Secretary of Defense for Acquisition and Sustainment to define the necessary responsibilities, policy, and procedures in the planned revision of DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services. DOD plans to update the instruction by July 2020. Implementing controls, such as clarifying responsibilities, policy, and procedures would better enable DOD to achieve department-wide goals for reducing print devices it established in the CIO's 2012 memorandum.

Recommendation: The Secretary of Defense should ensure that the DOD CIO assigns responsibility for implementing the CIO's 2012 memorandum on optimizing the use of employee information technology devices. (Recommendation 4)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with GAO's October 2018 recommendation. As of December 2019, DOD had ongoing actions intended to address the recommendation. For example, according to a DOD official, the DOD Chief Information Officer (CIO) will collaborate with the Under Secretary of Defense for Acquisition and Sustainment to define the necessary responsibilities, policy, and procedures in the planned revision of DOD Instruction 5330.03, which describes the mission, responsibilities, functions, and relationships of DLA Document Services. DOD plans to update the instruction by July 2020. Implementing controls, such as clarifying responsibilities, policy, and procedures would better enable DOD to achieve department-wide goals for reducing print devices it established in the CIO's 2012 memorandum.

Recommendation: The Secretary of Defense should ensure that the Under Secretary of Defense (Comptroller), in consultation with the military services and DLA, evaluates options to report more accurate funding information and takes steps to improve the accuracy of its budgetary and financial information reporting on document services internally and to Congress, including making distinctions between printing and non-printing-related costs and information on device procurement and electronic content management. This information could be provided as part of DOD's annual Operation and Maintenance budget justification materials. (Recommendation 6)

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) partially concurred with this recommendation. As of July 2019, DOD had ongoing actions intended to address the recommendation. For example, according to DOD documentation, the offices of the Under Secretary of Defense for Acquisition and Sustainment and Under Secretary of Defense (Comptroller) planned to examine the Service-related definitions of printing and reproduction for potential process improvements. DOD anticipated completing this action by July 2020. Examining opportunities to improve the definitions of printing and reproduction services would better position DOD to report more accurate funding information for document services, as GAO recommended in October 2018

Recommendation: The Secretary of the Treasury should include in Treasury's fiscal year 2018 AFR information about all civil monetary penalties within its jurisdiction, including the inflation adjustment of the civil monetary penalties. (Recommendation 5)

Agency: Department of the Treasury
Status: Open

Comments: In November 2018, Treasury issued its fiscal year 2018 agency financial report and included information about all civil monetary penalties within its jurisdiction. However, it did not adjust two civil monetary penalty amounts for inflation and indicated that it planned to complete the regulations to adjust these two amounts for inflation by the end of 2018. In November 2019, Treasury issued its fiscal year 2019 agency financial report and included information about all civil monetary penalties within its jurisdiction. However, it did not adjust one of the two civil monetary penalty amounts for inflation in our finding. As of June 2020, Treasury has not taken the necessary corrective actions to completely address this recommendation.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials, based on IRS's research and determination, design and implement the corrective actions necessary to reasonably assure that IRS effectively resolves and records unpostable transactions in a timely manner, including establishing clearly defined time frames in the Internal Revenue Manual (IRM) by which the IRS operating divisions should correct unpostable transactions and appropriate related oversight and review processes. (Recommendation 18-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. As of September 30, 2019, three of the four operating divisions involved in this recommendation designed and implemented the corrective actions necessary to reasonably assure that IRS effectively resolved and recorded unpostable transactions in a timely manner. In March 2019, one operating division determined that based on the research performed, no actions needed to be taken by the operating division to effectively resolve and record unpostable transactions in a timely manner. We will continue to evaluate IRS's actions to address this recommendation during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials develop and implement policies in the IRM for conducting and monitoring the Submission Processing internal control review. These policies should include or be accompanied by procedures to (1) assess and update the review questions and cited IRM criteria to reasonably assure they align with the controls under review; (2) periodically evaluate and document a review of the error threshold methodology to assess its current validity based on changes to the operating environment; (3) report findings identified in the Findings and Corrective Actions Report; and (4) assess and monitor (a) safeguarding internal control activities across all work shifts, particularly during peak seasons, (b) safeguarding internal control activities for the appropriate use and destruction of hard copy taxpayer information, and (c) the results of relevant functional level reviews. (Recommendation 18-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, IRS developed policies in the Internal Revenue Manual (IRM) for conducting and monitoring the Submission Processing internal control review. Specifically, the IRM addresses the (1) designated roles and responsibilities among IRS business units for ensuring the review questions and associated criteria are assessed and updated to align with internal controls under review; (2) requirements for periodically evaluating the error threshold methodology used in the review; (3) procedures for the review to assess and monitor (a) internal control activities across work shifts and (b) internal control activities for appropriate use and destruction of hard-copy taxpayer information. However, the IRM did not include requirements for reporting findings identified during all components of the internal control review and for assessing and monitoring results of relevant functional level reviews. Since IRS developed the relevant IRM policies and procedures after we had already performed our fiscal year 2019 internal control testing, we will evaluate IRS's implementation of the established procedures during our fiscal year 2020 audit.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials develop and implement policies in the IRM for conducting and monitoring the Audit Management Checklist review. These policies should include or be accompanied by procedures for IRS management responsible for establishing policies related to safeguarding controls to (1) periodically monitor the results of the review; (2) clarify the minimum requirements for how frequently the review should be completed at its various facilities while considering factors that may affect the most appropriate timing of these reviews, such as changes in personnel, operational processes, or information technology; and (3) reasonably assure that corrective actions for all identified deficiencies are tracked until fully implemented. (Recommendation 18-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2019, IRS notified stakeholders of the added procedures to the Internal Revenue Manual (IRM) for (1) conducting the Audit Management Checklist reviews, including how frequently the reviews should be completed; (2) developing corrective actions for deficiencies; and (3) tracking the status of the corrective actions until fully implemented. Since IRS provided us the IRM procedures after the end of our fiscal year 2019 audit, we will evaluate IRS's implementation of the established procedures during our fiscal year 2020 audit.

Recommendation: The Acting Commissioner of Internal Revenue should ensure that the appropriate IRS officials develop and implement policies in the IRM for conducting and monitoring the All Events History Report review. These policies should include or be accompanied by procedures for IRS management responsible for establishing policies related to safeguarding controls to (1) periodically monitor the results of the review and (2) reasonably assure that corrective actions for all identified deficiencies are tracked until fully implemented. (Recommendation 18-05)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2019, IRS notified stakeholders of the added procedures to the Internal Revenue Manual (IRM) for conducting the All Events History Report reviews, including developing and monitoring corrective actions for deficiencies until fully implemented. Since IRS provided us the IRM procedures after the end of our fiscal year 2019 audit, we will evaluate IRS's implementation of the established procedures during our fiscal year 2020 audit.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement the audit plans for the 12 systems and applications that we reviewed in the production computing environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, but the agency provided some evidence of its progress in implementing this recommendation. When IRS fully implements this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should ensure that system administrators and security operations analysts are alerted in the event of audit processing failures.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should regularly update configuration standards and guidelines for network devices to incorporate recommendations from industry leaders, security agencies, and key practices from IRS partners to address known vulnerabilities applicable to IRS's environment.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should implement a compliance verification application, or other appropriate process, to ensure configuration policies are comprehensively tested on the mainframe.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: To help strengthen information security controls over key financial and tax processing systems, and to more effectively implement security-related policies and plans, the Commissioner of Internal Revenue, in addition to addressing previously made but still unresolved recommendations from our prior audits, should identify and review service organizations' listing of user controls that are deemed relevant and test those controls to appropriately draw conclusions about the operating effectiveness of controls.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During GAO's audit of FY 2019 IRS financial statements, IRS did not submit this recommendation for closure, nor did the agency provide evidence that it had implemented this recommendation. When IRS indicates that it has implemented this recommendation, we will review relevant IRS actions.

Recommendation: The Secretary of the Treasury should direct the Fiscal Assistant Secretary, working in coordination with the Controller of OMB, to improve corrective action plans for (1) treaties and international agreements, (2) additional audit procedures for intragovernmental activity and balances, and (3) the Reconciliation Statements so that they include sufficient information to address the control deficiencies in these areas effectively.

Agency: Department of the Treasury
Status: Open
Priority recommendation

Comments: As of the completion of our fiscal year 2019 audit of the consolidated financial statements of the U.S. government (CFS), we determined that this recommendation remained open. Treasury believes that its current remediation plan, including its various corrective action plans (CAPs), is comprehensive, appropriate, and effective, with robust and ongoing monitoring processes in place. However, we continue to note that the CAPs in these three areas do not include sufficient steps to effectively address related control deficiencies involving processes used to prepare the CFS. We will follow-up on progress made by Treasury and OMB as part of our fiscal year 2020 CFS audit.

Recommendation: The IRS Commissioner should direct the appropriate IRS officials to strengthen the process for reasonably assuring that the Internal Revenue Manual (IRM) is reviewed annually to align with the current control procedures and guidance being implemented by agency personnel. This should include a mechanism for reasonably assuring that program owner directors (1) review their respective program control activities and related guidance annually and timely update the IRM as needed, (2) document their reviews, and (3) utilize interim guidance and supplemental guidance correctly for their intended purposes.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. During fiscal year 2018, IRS created an annual Internal Revenue Manual (IRM) review and certification requirement to reasonably assure that all IRM sections align with the current control procedures and guidance that IRS personnel are implementing. In addition, the Small Business/Self-Employed (SB/SE) and Tax Exempt & Government Entities (TE/GE) organizations developed action plans to achieve substantial compliance with this requirement. During fiscal year 2019, the SB/SE organization completed its action plan; however, IRS officials stated that the TE/GE organization will complete its action plan during fiscal year 2020. Further, in fiscal year 2019, the Large Business & International organization reviewed and analyzed the results of its involvement in the annual IRM certification process. Based on the results of its analysis, the organization developed an action plan to achieve substantial compliance with the IRM review and certification requirement, which IRS officials stated it will complete by December 2021.

Recommendation: To improve consistency in CMS oversight of federal spending under section 1115 demonstrations, the Secretary of Health and Human Services should require the Administrator of CMS to develop and document standard operating procedures for monitoring spending under demonstrations that (1) require setting reporting requirements for states that provide CMS the data elements needed for CMS to assess compliance with demonstration spending limits; (2) require consistent enforcement of states' compliance with financial reporting requirements; and (3) require consistent tracking of the amount of unspent funds under demonstration spending limits.

Agency: Department of Health and Human Services
Status: Open

Comments: The Department of Health and Human Services (HHS) has taken steps to improve the consistency of oversight of federal spending under section 1115 demonstrations. In November 2018, HHS officials reported that they have developed draft guidance, including a standard reporting tool for states, to better ensure consistent reporting of the elements needed to assess compliance with demonstration spending limits and was in the process of testing the tool with two states. In addition, the agency is developing standard operating procedures for agency staff to require consistent tracking of unspent funds under the spending limit. As of November 2019, HHS has not provided any updates. GAO will continue to monitor HHS's actions and once procedures are in place, GAO will assess whether they address our recommendation.

Recommendation: To help improve oversight of the concessions program, the Secretary of the Interior should direct the Director of the National Park Service to develop performance goals with targets and timeframes in its commercial services strategic plan.

Agency: Department of the Interior: National Park Service
Status: Open

Comments: In May 2019, the agency provided an update of their recent efforts, including their revised Commercial Services Improvement Plan. This plan include performance goals and general time frames , however did not include performance measures or specific targets for each of the initiatives. The agency has subsequently reviewed this plan and determined that many of the goals and time frames identified were not realistic to achieve, making it difficult to establish performance measures or targets. As of July 2020, the agency is currently updating its 2015 Strategic Plan and reviewing the improvement plan to identify those items that will be feasible to implement. According to agency officials, they plan to develop goals and performance targets where feasible and develop time estimates for achieving them. Since this effort is currently underway, we will update the status of their efforts in the summer of 2021.

Recommendation: The Secretary of the Army should direct the Accountability and Audit Readiness Directorate under the Assistant Secretary of the Army, Financial Management and Comptroller, to enhance the directorate's policies and procedures for (1) tracking and prioritizing all financial management-related audit findings and recommendations under its purview and (2) developing and monitoring CAPs for all such recommendations so that they include sufficient details, such as the criteria used to prioritize the CAPs, the recommended CAP elements, and the process for monitoring and documenting the progress and status of CAPs.

Agency: Department of Defense: Department of the Army
Status: Open
Priority recommendation

Comments: The Army concurred with this recommendation. The Army stated that the Accountability and Audit Readiness Directorate has completed actions to enhance its current standard operating procedures to include (1) updating its corrective action plan (CAP) database and reporting tool, (2) documenting its reporting procedures, and (3) updating its CAP template to include additional elements recommended by the Implementation Guide for OMB Circular A-123. In addition, the Army stated that its policies and procedures include steps to incorporate external financial management-related audit findings assigned to the Accountability and Audit Readiness Directorate by the Internal Review Directorate and that the existing process the Army uses to prioritize findings and the related CAPs and to monitor the progress and status of CAPs has been documented. We reviewed Army's documentation that was provided in January 2020. Army's documentation did not show that it has a process for ensuring that all financial management related findings and recommendations are identified and tracked. To implement this recommendations Army needs to enhance their policies and procedures related to tracking and monitoring the status of these audit findings.

Recommendation: The Secretary of the Air Force should design and document a comprehensive process to ensure that the complete universe of all financial management-related findings and recommendations from all audit sources is identified and tracked.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that it continues to develop a process for identifying and tracking financial management-related findings and recommendations from all audit sources by updating its process guidance. In August 2019, we received draft guidance that Air Force is developing as guidance and procedures for a universe of financial management-related findings and recommendations. In January 2020, we also received a list of the Air Force deficiencies being tracked in the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database. After assessing the provided documentation, we found that the draft does not include procedures for identifying GAO, DODOIG, and Air Force Audit Agency (AFAA) findings and the database did not include deficiencies identified by those external auditors. As a result of our review of the documentation provided, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: The Secretary of the Air Force should update the Air Force's written policies and procedures for prioritizing financial management-related audit findings and recommendations from all audit sources and for developing and monitoring CAPs so that they include sufficient details. These procedures should include the following details: (1) The process to be followed for prioritizing the financial management-related findings and recommendations from audit sources. (2) The guidance for developing CAPs for all financial management-related audit findings and recommendations from all audit sources to include complete details, including the elements recommended by the Implementation Guide for OMB Circular A-123. (3) The process for monitoring the status of the CAPs for all financial management-related audit findings and recommendations from all audit sources, including the documentation to support any corrective actions taken, as recommended by the Implementation Guide for OMB Circular A-123.

Agency: Department of Defense: Department of the Air Force
Status: Open
Priority recommendation

Comments: The Air Force concurred with this recommendation. In January 2018, the Air Force stated that its Air Force Deficiency Remediation Tracking processes and guides were being refined. In December 2019, Air Force provided a document titled "NFR Prioritization Process." We found that this document included Air Force's priority categories. However, the document does not include information on determining the priority level or applying the priority levels when addressing the deficiencies. We also received a copy of Air Force's guide for the Corrective Action Plan (CAP) process dated July 2019. We found that this guide does not fully incorporate CAP development for deficiencies from all sources. Additionally, the guide does not provide information on the process for (1) determining resources and other requirements for remediating the deficiency, (2) conducting a cost benefit analysis, and (3) developing criteria for validating that the deficiency has been remediated. The guide also includes a template for conducting a root cause analysis. However, the instructions for conducting a root cause analysis are somewhat limited for determining the initial cause or underlying reason for the deficiency. Per the guide, the Air Force uses the Office of the Under Secretary of Defense (Comptroller) (OUSD(C)) database to monitor and report on Air Force's deficiencies and remediation CAP status. We obtained a listing of the NFRs and related CAPS in the database as of December 2019. We found that deficiencies from all audit sources were not included in the listing, only the independent public accountant's NFRs. The results of our review of a limited number of CAPs indicate that Air Force staff does not always comply with the Air Force's CAP requirements. As a result of our assessment of the Air Force documentation, we determined that the actions taken were not sufficient to close the recommendation.

Recommendation: To improve DOD management's process for monitoring the military services' audit remediation efforts and to provide timely and useful information to stakeholders as needed, the Secretary of Defense should direct the Secretary of the Army, the Secretary of the Navy, and the Secretary of the Air Force to prepare and submit to the Under Secretary of Defense (Comptroller), on at least a bimonthly basis for availability at the FIAR Governance Board meetings, a summary of key information included in the CAPs that at a minimum contains the data elements recommended by the Implementation Guide for OMB Circular A-123 for each CAP related to critical capabilities for achieving audit readiness.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD concurred with this recommendation. DOD stated that it solicits input on a bi-monthly basis, on critical capability corrective action plans (CAPs) at a summary level. This information is provided routinely at regularly scheduled FIAR Governance Board meetings. DOD also stated that an updated notice of finding and recommendation (NFR) form template is being developed and will be provided to the military services to use for reporting this information so that it will include the recommended standard data elements outlined in OMB Circular A-123 to provide greater transparency into the nature of remediation plans. DOD also stated that FIAR Guidance will be updated to explicitly state that military services should include the OMB recommended standard data elements in CAPs. To implement this recommendation, DOD needs to provide documentation that shows that the military services are able to provide a summary of key information in the corrective action plans that at a minimum contains data elements recommended by the Implementation Guide for OMB Circular A-123. .

Recommendation: To reasonably assure that DOD management and external stakeholders have a comprehensive picture of the status of corrective actions needed for audit readiness throughout the department, the Secretary of Defense should direct the Under Secretary of Defense (Comptroller) to prepare a consolidated CAP management summary on a bimonthly basis that includes the data elements referred to above on the status of all CAPs related to critical capabilities for the military services and for the service providers and other defense organizations.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: DOD partially concurred with this recommendation. According to DOD, the military services already provide summary-level updates on their critical capability corrective action plans (CAPs) at FIAR Governance Board meetings. It also stated that the template that is used to present CAPs to the FIAR Governance Board meetings at the summary level has been updated to align CAPs to critical capabilities. DOD still needs to address how all of the data elements from the Implementation Guide for OMB Circular A-123 will be summarized or otherwise reported for all CAPs pertaining to critical capabilities across the Department. In addition, DOD stated that because the Under Secretary of Defense (Comptroller) takes responsibility for maintaining, monitoring, and reporting on the status of CAPs for the service providers and other defense organizations and of DOD-wide issues, the Comptroller will also summarize this information. However, DOD has not clarified what information from the military services will be summarized. To implement this recommendation, DOD needs to provide documentation that shows the Comptroller has prepared a consolidated CAP management summary on a bimonthly basis.

Recommendation: To help IRS improve its process for determining IT funding priorities and to provide timely information on the progress of its investments, the Commissioner of IRS should direct the Chief Technology Officer to establish, document, and implement policies and procedures for selecting new and reselecting ongoing business systems modernization activities, consistent with IRS's process for prioritizing operations support priorities, which addresses (1) prioritization and comparison of IT assets against each other, (2) criteria for making selection and prioritization decisions, and (3) ensuring IRS executives' final funding decisions on IT proposals are based on IRS's prioritization process.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2018, IRS provided GAO a slide deck titled "Prioritization Process for the Business Systems Modernization (BSM) Program/Projects" which describes a process for prioritizing BSM investments and capabilities within the investments. However, the slides were labeled "pre-decisional." In addition, they did not include specific procedures for prioritizing investments. In April 2020, IRS informed us that it had moved its target for fully implementing the recommendation to November 2020. We will continue to monitor IRS's efforts to implement the recommendation.

Recommendation: To help IRS improve its process for determining IT funding priorities and to provide timely information on the progress of its investments, the Commissioner of IRS should direct the Chief Technology Officer to modify existing processes for Foreign Account Tax Compliance Act (FATCA) and Return Review Program (RRP) for measuring work performed by IRS staff to incorporate best practices, including accounting for actual work performed and using the level of effort measure sparingly.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In May 2018, IRS told GAO it had implemented the recommendation. As supporting evidence, the agency provided an April 2018 update to its Investment Performance Tool user guide along with briefing slides specifying actions taken to modify its processes to measure work performed by IRS staff. We reviewed the evidence provided and determined that it was not sufficient to close the recommendation as implemented. Specifically, while the Investment Performance Tool user guide included updated procedures for measuring work performed by IRS staff which aligned with best practices, it did not clearly state that earned value (or work performed) during an iteration should always be based on to the percentage of planned features or user stories that were completed for that iteration. In addition, IRS did not provide evidence that it had used its updated procedures for the Return Review Program investment. We followed up with IRS to obtain this documentation. The agency subsequently provided the requested documentation to us and, as of July 2020, we were reviewing it to determine the extent to which it addresses the recommendation.

Recommendation: To provide reasonable assurance that the property, equipment, and software transactions are properly tracked and capitalized or expensed as appropriate, the Director of CFPB should direct the program offices to require vendors to provide detailed invoices with costs broken out by project.

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: During our fiscal year 2019 audit, we continued to find control deficiencies over CFPB's accounting for its property, equipment, and software. CFPB was still in the process of working with its Office of Procurement and program offices to require more detailed invoices with costs broken out by project. We will continue to evaluate CFPB's actions to address this recommendation during our fiscal year 2020 financial statement audit.

Recommendation: The IRS Commissioner should direct the appropriate IRS officials to determine the reason(s) why staff did not always comply with IRS's established policies and procedures related to initiating, monitoring, and reviewing the monitoring of manual refunds and, based on this determination, establish a process to better enforce compliance with these requirements.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, we identified instances where staff did not comply with IRS's policies and procedures related to monitoring and reviewing the monitoring of manual refunds. IRS officials stated that the Wage and Investment (W&I) organization determined that a fully automated process to perform monitoring of manual refunds is the optimal solution to address, at an enterprise level, deficiencies associated with reliance on employees to monitor refunds in process and take appropriate action when potential duplicate or erroneous refund conditions are encountered. In addition, IRS officials indicated that the W&I organization will develop business requirements and request programming through the Unified Work Request process; however, limited resources and competing priorities prevent the identification of an implementation date. As a result, IRS will place this recommendation on hold until an implementation date is known.

Recommendation: The IRS Commissioner should direct the appropriate IRS officials to identify the cause of and implement a solution for dealing with the periodic backlogs of ICO inventory that is hampering the performance of quality reviews.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: During fiscal year 2019, the Wage and Investment (W&I) organization determined that periodic backlogs of Input Correction Operation (ICO) inventory were caused by a combination of factors, such as systemic issues, fluctuations in projected filings, and hiring challenges. IRS officials stated that the W&I organization has also identified and implemented several strategies to address ICO backlogs and mitigate the impact on the quality review program, including hiring more staff in ICO functions, using seasonal employees, cross-training, overtime, transferring of work, and updating the Internal Revenue Manual. Since IRS provided us with this information near the end of our fiscal year 2019 audit in September 2019, we will evaluate IRS's actions to address this recommendation during our fiscal year 2020 audit.

Recommendation: The IRS Commissioner should direct the appropriate officials to establish and implement monitoring procedures designed to reasonably assure that the key detailed information for tangible capitalized P&E is properly recorded and updated in the KISAM system.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS established the Asset Management Program Monitoring and Review procedure, effective October 1, 2016, for performing quarterly sample reviews of Information Technology (IT) assets in the Knowledge, Incident/Problem, Service Asset Management (KISAM) system. In September 2017, IRS also revised the Internal Revenue Manual to require Facilities Management and Security Services territory managers or section chiefs to review KISAM key data elements for non-IT assets to verify that they are correct and updated. However, during our fiscal year 2018 floor-to-book inventory testing, we identified exceptions where (1) a key detailed information element (e.g., building code) for property and equipment (P&E) assets was not properly recorded in KISAM and (2) P&E assets found on the floor did not have asset records in KISAM. We will conduct inventory testing and follow-up to determine the status of this issue during our audit of IRS's fiscal year 2020 financial statements.

Recommendation: To ensure that federal program spending data are provided to the public in a transparent, useful, and timely manner, the Director of OMB should accelerate efforts to determine how best to merge DATA Act purposes and requirements with the GPRAMA requirement to produce a federal program inventory.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB issued guidance in June 2019 that provides an overview and timeline for merging DATA Act reporting with implementation of a federal program inventory. To fully address this recommendation, OMB needs to provide additional details on the implementation of these requirements.

Recommendation: To ensure that the integrity of data standards is maintained over time, the Director of OMB, in collaboration with the Secretary of the Treasury, should establish a set of clear policies and processes for developing and maintaining data standards that are consistent with leading practices for data governance.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB issued several guidance documents in 2019 that set out key aspects of a process for agencies to establish standards for, and practices for governing, managing, and protecting, all federal data. These and related efforts represent significant progress, but OMB needs to ensure this broad guidance is followed by clear and specific requirements for agency data governance to ensure the quality of their DATA Act reporting.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to estimating improper payments, to establish and implement key quality assurance procedures, such as reconciliations, to ensure the completeness and accuracy of the sampled populations.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: The Department of Defense (DOD), in concurring with this recommendation, stated that DOD will work with the Defense Finance and Accounting Service (DFAS) to implement key quality assurance procedures, such as reconciliations, to ensure the completeness and accuracy of sampled populations. In August 2017, DOD officials stated that its Office of the Under Secretary of Defense (Comptroller) will continue its work with DFAS to annually reconcile gross outlays (as stated on its Statement of Budgetary Resources) with outlays as reported in its Agency Financial Report. These reconciliations are currently done only on a summary level. In the future, DOD's validation of its universe of transactions combined with planned reconciliations with the Defense Departmental Reporting System trial balance and transaction data from DOD's entitlement systems will provide more complete reconciliations. As of December 2019, DOD officials stated that DOD needs to resolve its material weakness relating to the universe of transactions. This material weakness is preventing the department from performing the reconciliations necessary to ensure that the populations, from which the samples are drawn to estimate improper payments, are complete and accurate. As of May 2020, DOD had developed a spreadsheet including over 80 financial management and disbursing systems. The Office of the Under Secretary of Defense, OUSD(C), is planning to review and analyze these systems to (1) determine the types of payments and lists of systems used to process the types of payments; (2) confirm if reconciliations are done to verify the total outlays; and (3) determine the testing status of the universe of payments. As of September 30, 2020, this recommendation remains open.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to implementing recovery audits, to monitor the implementation of the revised FMR chapter on recovery audits to ensure that the components either develop recovery audits or demonstrate that it is not cost effective to do so.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: Department of Defense (DOD) officials, in concurring with this recommendation, stated that DOD would work with the applicable components to monitor the implementation of the revised Financial Management Regulation (FMR) chapter on recovery audits (subsequently renamed as payment recapture audits). According to DOD officials, this action would help to ensure that recovery audits are developed, or will demonstrate that it is not cost-effective to do these audits. In July 2015, DOD was working to update the FMR chapter on recovery audits to reflect revised Office of Management and Budget (OMB) guidance issued in October 2014. DOD issued its revised FMR chapter in November 2015. This chapter requires components to develop cost-effective payment recapture audits or to submit a quantitative justification to the Office of the Under Secretary (Comptroller) for approval. However, we consider this recommendation to be open because DOD did not provide documentation demonstrating that the Office of the Under Secretary of Defense (Comptroller) is monitoring component implementation of recovery auditing. Further, as of April 2017, DOD's efforts to develop cost-estimates for recovery audits were still under way. As of October 2018, this recommendation remains open. As of December 2019, DOD stated that in FY 2020, the Office of the Under Secretary (Comptroller) will coordinate with the DOD improper payment reporting components to analyze whether it would be cost effective to implement payment recapture audit programs for their payments. In a March 20, 2020 memorandum, the Deputy CFO asked DOD components, programs, or activities with annual payments exceeding $1 million to submit a payment recapture plan by June 30, 2020. If a component determines that payment recapture audits are not cost-effective, then the plan must provide the specific analysis and documentation used to reach that conclusion. When completed, the results of the evaluation will serve the Department's final position on payment recapture audit programs. As of September 30, 2020, this recommendation remains open as this evaluation was not yet complete.

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to implementing recovery audits, to develop and submit to OMB for approval a payment recapture audit plan that fully complies with OMB guidance.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: Department of Defense (DOD) officials, in concurring with this recommendation, stated that DOD would develop and submit to the Office of Management and Budget (OMB) a payment recapture plan that fully complies with OMB guidance and is informed by a cost-effectiveness analysis. In July 2015, DOD's Office of the Under Secretary of Defense (Comptroller) efforts to develop a payment recapture audit plan to ensure cost-effectiveness were ongoing and these efforts must be completed before a plan can be submitted to the OMB. In June 2016, DOD officials stated that the Comptroller's efforts to develop a payment recapture audit plan to ensure cost-effectiveness were ongoing. As of August 28, 2017, DOD officials stated that the Office of the Under Secretary of Defense (Comptroller) will determine if a payment recapture audit plan was developed and submitted to OMB for approval in the previous fiscal years. If so, the Office of the Under Secretary of Defense (Comptroller) will determine its relevance and significance (i.e. cost effectiveness)to the improper payments program. If the payment recapture audit plan is considered to be applicable, the Office of the Under Secretary of Defense (Comptroller) will update the previous plan to comply with current OMB guidance. As of October 2018, this recommendation remains open. As of December 2019, DOD stated that in FY 2020, the Office of the Under Secretary (Comptroller) will coordinate with the DOD improper payment reporting components to analyze whether it would be cost effective to implement payment recapture audit programs for their payments. In a March 20, 2020 memorandum, the Deputy CFO asked DOD components, programs, or activities with annual payments exceeding $1 million to submit a payment recapture plan by June 30, 2020. If a component determines that payment recapture audits are not cost-effective, then the plan must provide the specific analysis and documentation used to reach that conclusion. When completed, the results of the evaluation will serve the Department's final position on payment recapture audit programs. As of September 30, 2020, this recommendation remains open as this evaluation was not yet complete..

Recommendation: The Secretary of Defense should direct the Under Secretary of Defense (Comptroller), with regard to reporting, to design and implement procedures to ensure that the department's annual improper payment and recovery audit reporting is complete, accurate, and in compliance with IPERA and OMB guidance.

Agency: Department of Defense
Status: Open
Priority recommendation

Comments: Department of Defense (DOD) officials, in concurring with this recommendation, stated that DOD would design and implement procedures to further ensure that its annual improper payment and recovery audit reporting is complete, accurate, and in compliance with the Improper Payments Elimination and Recovery Act (IPERA) requirements and Office of Management and Budget (OMB) guidance. In June 2015, DOD revised its FMR chapter on improper payments to require components to provide information needed to report on improper payment and recovery audit activities in its annual financial report (AFR) in accordance with IPERA requirements and OMB guidance. DOD's fiscal year 2015 AFR reflected its implementation of the revised FMR. We found that DOD's improper payment reporting in its fiscal year 2015 AFR had improved. However, we were not provided with evidence that Office of the Under Secretary of Defense (Comptroller) is performing oversight and monitoring activities to ensure the accuracy and completeness of the improper payment and recovery audit data submitted by DOD components for inclusion in the AFR. DOD is continuing to work on procedures for ensuring that its reporting on improper payment and recovery audits is accurate, complete, and in compliance with IPERA and OMB guidance. The Office of the Under Secretary of Defense (Comptroller) has developed and implemented a Payment Integrity Checklist to ensure that the department's annual improper payment and recovery audit reporting was complete, accurate, and in compliance with IPERA and OMB guidance. However, the DOD Inspector General in its May 2020 report, stated that while DOD published improper payment estimates for all eight programs for fiscal year 2019, it did not publish reliable estimates for five of the eight programs: Military Health Benefits, Civilian Pay, Military Retirement, DOD Travel Pay, and Commercial Pay. Moreover, DOD did not use accurate populations in calculating the improper payment estimates for the Military Retirement, Commercial Pay, and DOD Travel Pay programs. Based on these issues affecting improper payment reporting, we consider this recommendation to be open as of September 30, 2020.

Recommendation: The Commission should direct the appropriate officials to establish and implement written procedures for conducting all physical inventory counts of equipment. These procedures, at a minimum, should outline the processes for (1) planning and executing the physical inventory count and (2) analyzing and documenting the results.

Agency: American Battle Monuments Commission
Status: Open

Comments: During our audit of the American Battle Monuments Commission's (Commission) fiscal year 2011 financial statements, we found that the Commission had not performed independent physical inventory of equipment owned by the Commission at the various cemeteries across the world. We found that although the Commission had a policy to perform biennial physical inventory counts of all equipment over $500, this policy was not adhered to during fiscal year 2011. Further, the policy did not explain how to plan, execute, and analyze the results of an inventory count. As a result, we recommended that the Secretary of the Commission instruct the appropriate officials to establish and implement written procedures for conducting all physical inventory counts of equipment. These procedures, at a minimum, should outline the processes for (1) planning and executing the physical inventory count and (2) analyzing and documenting the results. During our follow-up, the Commission informed us that they plan to implement procedures to address this recommendation but have not dedicated resources to it yet. We will continue to follow-up on this recommendation.

Recommendation: The Commission should direct the appropriate officials to establish a mechanism to monitor implementation of existing Commission policy to perform biennial physical inventory counts of all items of equipment with an obligated balance of $500 or more.

Agency: American Battle Monuments Commission
Status: Open

Comments: During our audit of the American Battle Monuments Commission's (Commission) fiscal year 2011 financial statements, we found that the Commission had not performed independent physical inventory of equipment owned by the Commission at the various cemeteries across the world. We found that although the Commission had a policy to perform biennial physical inventory counts of all equipment over $500, this policy was not adhered to during fiscal year 2011. As a result, we recommended that the Secretary of the Commission direct the appropriate officials to establish a mechanism to monitor implementation of existing Commission policy to perform biennial physical inventory counts of all items of equipment with an obligated balance of $500 or more. During our fiscal year 2012 audit, we found that although the Commission had performed a comparison of the equipment on hand to the data recorded in SharePoint (document management web application to share documents internally), an independent physical inventory was not performed. We determined that the Commission had not established a mechanism for performing an inventory of assets. During our follow-up, the Commission informed us that they plan to implement procedures to address this recommendation but have not dedicated resources to it yet. We will continue to follow-up on this recommendation.

Recommendation: While creating control systems at the same time that the emergency programs were being designed and implemented posed unique challenges, the recent crisis provided invaluable experience that the Federal Reserve System can apply in the future should the use of these authorities again become warranted. Going forward, to further strengthen policies for selecting vendors, ensuring the transparency and consistency of decision making involving the implementation of any future emergency programs, and managing risks related to these programs, the Chairman of the Federal Reserve Board should direct Federal Reserve Board and Reserve Bank staff to strengthen procedures in place to guide Reserve Banks' efforts to manage emergency program access for higher-risk borrowers by providing more specific guidance on how Reserve Bank staff should exercise discretion and document decisions to restrict or deny program access for depository institutions and primary dealers that would otherwise be eligible for emergency assistance.

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: We most recently sought information from the Board of Governors of the Federal Reserve System in July 2018 regarding the status of the recommendation but did not receive any new information. Therefore, the recommendation remains open.

Recommendation: While creating control systems at the same time that the emergency programs were being designed and implemented posed unique challenges, the recent crisis provided invaluable experience that the Federal Reserve System can apply in the future should the use of these authorities again become warranted. Going forward, to further strengthen policies for selecting vendors, ensuring the transparency and consistency of decision making involving the implementation of any future emergency programs, and managing risks related to these programs, the Chairman of the Federal Reserve Board should direct Federal Reserve Board and Reserve Bank staff to document a plan for estimating and tracking losses that could occur under more adverse economic conditions within and across all emergency lending activities and for using this information to inform policy decisions, such as decisions to limit risk exposures through program design or restrictions applied to eligible borrowing institutions.

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: We most recently sought information from the Board of Governors of the Federal Reserve System in July 2018 regarding the status of the recommendation but did not receive any new information. Therefore, the recommendation remains open.

Recommendation: While creating control systems at the same time that the emergency programs were being designed and implemented posed unique challenges, the recent crisis provided invaluable experience that the Federal Reserve System can apply in the future should the use of these authorities again become warranted. Going forward, to further strengthen policies for selecting vendors, ensuring the transparency and consistency of decision making involving the implementation of any future emergency programs, and managing risks related to these programs, the Chairman of the Federal Reserve Board should direct Federal Reserve Board and Reserve Bank staff to document the Federal Reserve Board's guidance to Reserve Banks on types of emergency program decisions and risk events that require approval by or consultation with the Board of Governors, the Federal Open Market Committee, or other designated groups or officials at the Federal Reserve Board.

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: We most recently sought information from the Board of Governors of the Federal Reserve System in July 2018 regarding the status of the recommendation but did not receive any new information. Therefore, the recommendation remains open.

Recommendation: The Commissioner of the IRS should direct the appropriate IRS officials to revise the post orders for the service center campuses (SCC) and lockbox bank security guards to include specific procedures for timely reporting exterior lighting outages to SCC or lockbox bank facilities management. These procedures should specify (1) whom to contact to report lighting outages and (2) how to document and track lighting outages until resolved.

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS's actions to address this recommendation are ongoing. IRS officials stated that during fiscal year 2020, Facilities Management and Security Services (FMSS) will update the Internal Revenue Manual to reflect the necessary guidance for service center guards and FMSS physical security specialists to know (1) whom the guards are to contact to report lighting outages and (2) how lighting outages are to be documented and tracked until resolved.