Management Report: Opportunities for Improvement in FHFA's Evaluation of Internal Control over Financial Reporting
Highlights
What GAO Found
During its audit of the Federal Housing Finance Agency's (FHFA) fiscal years 2016 and 2015 financial statements, GAO identified deficiencies in FHFA's evaluation of internal control over financial reporting. This includes the FHFA Office of the Inspector General's (FHFA-OIG) evaluation of its own internal control over financial reporting as FHFA-OIG's reported amounts constitute a material portion of the consolidated FHFA financial statements. Specifically, GAO found that during FHFA's internal control evaluation, FHFA and the FHFA-OIG did not (1) adequately document their consideration of materiality thresholds and risk assessments, (2) adequately document their consideration of all internal control components and related principles, and (3) adequately identify and document financial reporting control activities. In addition, FHFA did not maintain independent roles in the implementation and monitoring of control activities. GAO did not consider these deficiencies to be material weaknesses or significant deficiencies, either individually or collectively, but nonetheless they warrant FHFA management's attention. GAO is making nine recommendations to FHFA to address the deficiencies identified related to FHFA's evaluation of internal control over financial reporting that were identified by GAO during the fiscal year 2016 FHFA audit. FHFA stated that it agreed with the nine recommendations GAO made in the report and described actions it is taking or plans to take to address each recommendation. GAO will evaluate FHFA's actions for addressing the deficiencies identified in the report as part of GAO's audit of FHFA's fiscal year 2017 financial statements.
Why GAO Did This Study
The purpose of this report is to present internal control deficiencies identified during GAO's audit of FHFA's fiscal years 2016 and 2015 financial statements. There were no prior recommendations outstanding for FHFA related to past financial statement audits.
Recommendations
GAO is making nine recommendations to FHFA to address the deficiencies identified related to FHFA's evaluation of internal control over financial reporting that were identified by GAO during the fiscal year 2016 FHFA audit. FHFA stated that it agreed with the nine recommendations GAO made in the report and described actions it is taking or plans to take to address each recommendation. GAO will evaluate FHFA's actions for addressing the deficiencies identified in the report as part of GAO's audit of FHFA's fiscal year 2017 financial statements.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to develop a mechanism that captures all of the key factors to be considered, such as materiality and risk, when designing the evaluation of internal control over financial reporting and collaborate, as appropriate, with the Inspector General to develop a similar mechanism for use by FHFA-OIG. |
In their fiscal year 2017 evaluations of internal control over financial reporting, FHFA and FHFA-OIG developed a mechanism to document how they considered materiality and risk to determine which processes to test in fiscal year 2017 as part of their evaluations of internal control over financial reporting. FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to coordinate with the Inspector General, as appropriate, when calculating materiality thresholds to reasonably assure that materiality determinations are appropriate for the agency as a whole and rationale is adequately documented. |
In their fiscal year 2017 evaluations of internal control over financial reporting, FHFA developed a process to provide FHFA-OIG with its materiality calculation to ensure that both were consistent. As part of this process, FHFA's Chief Financial Officer reviews FHFA-OIG's materiality calculation prior to testing to ensure both are consistent and appropriate to use in their evaluations of internal control over financial reporting. FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to coordinate with the Inspector General, as appropriate, to assess and document the aggregate effect of all deficiencies identified at the agency-wide level during the evaluation of internal control over financial reporting. |
In their fiscal year 2017 evaluation of internal control over financial reporting, the FHFA Chief Financial Officer reviewed and approved the planning documentation of FHFA's and FHFA-OIG's Office of Management and Budget Circular A-123 review, noting that the FHFA reporting entity comprises both FHFA and FHFA-OIG. Following the testing performed as part of the A-123 review, the FHFA CFO again reviewed FHFA and FHFA-OIG documentation to make an agency-wide evaluation based on any deficiencies identified on a combined basis. FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to (1) summarize in sufficient detail by internal control principle those activities from the program offices that have an effect on internal control over financial reporting to reasonably assure the consideration of all internal control components and related principles; (2) collaborate, as appropriate, with the Inspector General to implement corresponding actions at FHFA-OIG; and (3) document how that information is used to conclude on the internal control components and related principles for financial reporting. |
In the fiscal year 2017 evaluations of internal control over financial reporting, FHFA and FHFA-OIG incorporated the individual program offices' assessments into a detailed summary of how the agency adheres to the internal control components and related principles. At the end of their summaries, FHFA and FHFA-OIG provided conclusions to document whether the agency achieved all internal control components and related principles for financial reporting. FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to enhance the evaluation of internal control over financial reporting by identifying and testing all key control activities, including those related to the preparation of the financial statements. |
In its fiscal year 2017 evaluation of internal control over financial reporting, FHFA identified and documented the key controls over preparing the financial statements as part of a new financial reporting process cycle. FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to (1) thoroughly document FHFA's review of SSAE No. 16 reports issued for the period under evaluation by reasonably assuring that all applicable control objectives and related control activities are clearly identified and described and the evaluation of user entity controls is adequately explained and (2) collaborate, as appropriate, with the Inspector General to implement corresponding actions at FHFA-OIG. |
In their fiscal year 2017 evaluations of internal control over financial reporting, FHFA and FHFA-OIG prepared a schedule mapping the internal control objectives in the SSAE No. 18 reports to each process cycle in the Office of Management and Budget Circular A-123 review in order to show that the review considered all objectives deemed relevant. (The American Institute of Certified Public Accountants replaced the SSAE No. 16 with a new standard, SSAE No. 18, effective for reports dated on or after May 1, 2017.) FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to (1) clearly define and document an approach that identifies the information systems that are key to financial reporting, the process areas these information systems support, the key control activities for each information system, and how the key control activities are evaluated and (2) collaborate, as appropriate, with the Inspector General to implement corresponding actions at FHFA-OIG. |
In their fiscal year 2017 evaluations of internal control over financial reporting, FHFA and FHFA-OIG considered the impact of information systems by identifying the key information systems for each process tested and identifying the key controls related to these information systems. For each information systems key control identified, FHFA and FHFA-OIG either performed the testing themselves or relied on the testing in the Statement on Standards for Attestation Engagements No. 18 report. FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to collaborate, as appropriate, with the Inspector General to (1) develop a complete list of the specific provisions of laws and regulations that may have an effect on material amounts and related disclosures in the financial statements that are applicable to FHFA-OIG and (2) prepare documentation that clearly links each applicable provision of law or regulation to the key control activities tested. |
In its fiscal year 2017 evaluation of internal control over financial reporting, FHFA-OIG compiled a separate list of laws and regulations that were significant to financial reporting. For each law on the list of laws and regulations, FHFA-OIG documented the key controls deemed relevant to the law it identified and tested those controls to ensure its compliance. FHFA's actions sufficiently address our recommendation.
|
| Federal Housing Finance Agency | The Director of the Federal Housing Finance Agency should direct the Chief Financial Officer to design an evaluation process that reasonably assures assignment of independent roles between the implementation and monitoring of control activities that are significant to the evaluation of internal control over financial reporting. |
For its fiscal year 2017 evaluation of internal control over financial reporting, FHFA hired a contractor to complete the planning, testing, and reporting phases of the Office of Management and Budget Circular A-123 review process. This contractor did not perform any of the control activities being evaluated through the Circular A-123 process, which ensured the contractor's independence. FHFA's actions sufficiently address our recommendation.
|