DOD Financial Management: Continued Efforts Needed to Correct Material Weaknesses Identified in Financial Statement Audits
Fast Facts
Since 1995, the Department of Defense's financial management has been on our High Risk List. Thousands of audit findings from DOD's department-wide financial statement audits in 2018 show the extent of improvements needed. Our 2017 recommendation prompted DOD to develop a centralized database that uses real-time data to track audit findings and its progress in addressing them.
However, some of the data used to report on DOD's progress is inaccurate and incomplete. We made 5 recommendations, including that DOD improve the quality of its corrective action plans to address audit findings and its database information used to report progress.
Highlights
What GAO Found
The Department of Defense (DOD) continues to face financial management issues and challenges that have prevented it from obtaining a clean audit opinion on the fair presentation of its financial statements. Specifically, financial statement auditors issued disclaimers of opinion on DOD's and the military services' fiscal year 2018 and 2019 financial statements. These disclaimers resulted from numerous material weaknesses based on thousands of notices of findings and recommendations (NFR) that the auditors issued. Of the 2,409 NFRs issued to DOD and its components in fiscal year 2018, DOD's auditors were able to close 623 (26 percent) in fiscal year 2019; the remaining 1,786 (74 percent) remained open. These results provide useful insights on DOD's remediation progress since beginning department-wide full audits in fiscal year 2018; it is important for DOD to equal or exceed this progress in the future.
Financial statement audits have value beyond the audit opinion and can help management save resources and improve military readiness. DOD leadership identified a number of benefits that resulted from these financial statement audits. For example, the Navy identified a warehouse that was not in its property records that contained approximately $126 million in aircraft parts. The Navy was able to fill over $20 million in open orders for these parts. By using these parts, aircraft were repaired quicker and made available for use, which improved military readiness. To help guide and prioritize department-wide efforts, DOD identified eight audit remediation priority areas (four in 2019 and four in 2020), seven of which specifically related to material weaknesses that its auditor reported. The military services also developed methodologies to prioritize NFRs and determined that over half of their fiscal year 2018 NFRs are high priority and significant to their financial statement audits.
DOD and its components have taken steps to develop corrective action plans (CAP) to address NFRs. However, most of the CAPs that GAO tested did not include at least one data element or evidence that a root-cause analysis was performed, as directed by Office of Management and Budget (OMB) and other related guidance, in part, because DOD guidance and monitoring efforts did not clearly identify the need for such documentation. As a result, DOD and its components may lack sufficient information and assurance that their remediation efforts will resolve the underlying causes associated with the NFRs and related material weaknesses. Based on these issues, DOD and its components are at increased risk that their actions may not effectively address identified deficiencies in a timely manner.
DOD developed an NFR Database that contains useful information on deficiencies that financial auditors identified and actions to address them, which has improved its ability to monitor and report on audit remediation efforts using dashboard reports based on real-time data contained in the database. However, certain database information on which these reports are based may not be accurate, reliable, and complete. For example, although DOD reviews NFR Database information monthly, it does not follow up on instances of outdated information or other exceptions identified to ensure components resolve them timely. Without complete and reliable information on DOD's audit remediation efforts, internal and external stakeholders may not have quality information to effectively monitor and measure DOD's progress.
Why GAO Did This Study
DOD is responsible for about half of the federal government's discretionary spending, yet it remains the only major federal agency that has been unable to receive a clean audit opinion on its financial statements. After years of working toward financial statement audit readiness, DOD underwent full financial statement audits in fiscal years 2018 and 2019.
This report, developed in connection with fulfilling GAO's mandate to audit the U.S. government's consolidated financial statements, examines the (1) actions taken by DOD and the military services to prioritize financial statement audit findings; (2) extent to which DOD and its components developed CAPs to address audit findings in accordance with OMB, DOD, and other guidance; and (3) extent to which DOD improved its ability to monitor and report on audit remediation efforts.
GAO reviewed documentation and interviewed officials about DOD's and the military services' audit remediation prioritization, monitoring, and reporting. GAO selected a generalizable sample of 98 NFRs to determine whether CAPs to address them were developed according to established guidance.
Recommendations
GAO is making five recommendations to DOD to improve the quality of CAPs to address audit findings and information in the NFR Database and related reports provided to internal and external stakeholders to monitor and assess audit remediation efforts. DOD concurred with three of GAO's recommendations, partially concurred with one recommendation, and disagreed with one recommendation. GAO continues to believe that all the recommendations are valid.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Defense | ODCFO should update the CAP template provided in its guidance to assist components in developing CAPs to include the year deficiencies are first identified data element defined in the Implementation Guide for OMB Circular A-123. (Recommendation 1) |
DOD concurred with this recommendation and stated that the Corrective Action Plan (CAP) template includes data elements defined in OMB Circular A-123, except for the data element related to the year the deficiency was first identified. DOD stated that this missing data element will be added to the CAP template during 2020. In March 2021, DOD informed us that an updated CAP template with the "Year First Identified" field had been communicated to DOD Components in a January 2021 training. We also reviewed the updated CAP template, dated August 2020, and confirmed that it had been revised in accordance with our recommendation.
|
| Department of Defense | ODCFO should update the NFR Database with a field to record the year deficiencies are first identified. (Recommendation 2) |
DOD concurred with this recommendation and stated that a single data field to record the year the deficiency was first identified will be added to the Notice of Findings and Recommendations (NFR) Database. In March 2021, DOD demonstrated that the NFR Database was updated to include a field "First Year Identified" to record the year deficiencies are first identified. Further, in January 2022, DOD provided an extract from the NFR Database with this field populated for all NFRs. We reviewed the data extract and confirmed that that the database was updated in accordance with our recommendation.
|
| Department of Defense |
Priority Rec.
ODCFO should incorporate appropriate steps to improve its CAP review process, including ensuring that (1) data elements not included in CAPs are appropriately identified and communicated to components and resolved, (2) NFRs are appropriately linked to the correct CAPs to address them, and (3) components document their rationale for accepting the risk associated with certain deficiencies and appropriately identify such instances in the NFR Database. (Recommendation 3) |
DOD partially concurred with this recommendation and stated that it ensures that a Notice of Findings and Recommendations (NFR) is appropriately linked to the right Corrective Action Plan (CAP) and that data elements missing from CAPs are identified and communicated to components through its CAP quality and monthly data control review processes. However, based on our testing of CAPs associated with NFRs included in a generalizable sample, we found that NFRs were not always linked to the correct CAP in the NFR Database. For example, one NFR we reviewed was linked to three CAPs-one that was not related to the NFR, another that had been superseded, and another that actually addressed the NFR. We also found that the CAPs for more than half of these NFRs were missing at least one of the data elements defined in the Implementation Guide for OMB Circular A-123. Further, DOD stated that its quality review process ensures that components document their rationale for accepting risk, risk response, and risk identification for deferring remediation activity associated with low-impact deficiencies. However, we found that DOD components did not prepare CAPs for 16 of the 98 NFRs in our sample because they accepted the risks associated with the deficiencies the auditors identified. However, the components did not document their rationale for accepting such risks and a clear risk-mitigation strategy for 3 of these 16 NFRs. To fully implement this recommendation, DOD's Chief Financial Officer needs to improve DOD's review process to ensure that CAPs include all data elements defined in the Implementation Guide for OMB Circular A-123; update its review checklist to include questions specifically related to whether CAPs were linked to the right audit findings in the NFR Database; and review the components' risk acceptance rationale for reasonableness and appropriateness. In January 2024, DOD provided a corrective action plan and the supporting evidence. The plan was consistent with actions that will address the recommendation. However, the evidence provided partially supported the key actions listed in the corrective action plan. The Office of the Deputy Chief Financial Officer is in the process of developing guidance for escalating unresolved exceptions open for over 6 months. Without implementation of this recommendation, DOD and its components may lack the assurance that appropriate corrective actions are being taken to address identified deficiencies in a timely manner. We will continue to monitor DOD's efforts to address this recommendation.
|
| Department of Defense |
Priority Rec.
ODCFO should update DOD guidance to instruct DOD and components to document root-cause analysis when needed to address deficiencies auditors identified. (Recommendation 4) |
DOD concurred with this recommendation and stated that it will update the appropriate DOD guidance to specifically instruct that a Corrective Action Plan (CAP) include documented evidence that a root-cause analysis was conducted and an explanation as to how it was conducted. To fully implement this recommendation, DOD needs to update the DOD Internal Control Over Financial Reporting Guide, which was last issued in May 2018, to instruct DOD and its components to document root-cause analysis when needed. As of March 2024, DOD had not provided us with updated DOD guidance specifically instructing that CAPs include documented evidence that a root-cause analysis was conducted and an explanation as to how it was conducted. Without implementation of this recommendation, DOD lacks assurance that its components are taking appropriate actions to resolve the underlying causes associated with the Notice of Findings and Recommendations and related material weaknesses that collectively prevent the auditability of its financial statements. We will continue to monitor DOD's progress in this area. DOD provided a status update that they plan to have the guidance updated by end of July 2024.
|
| Department of Defense | ODCFO should include appropriate steps in its monthly NFR Database review process to evaluate and follow-up on previously identified exceptions to ensure that they are resolved timely. (Recommendation 5) |
DOD did not concur with this recommendation and stated that this action is already being performed. However, DOD's process does not include steps to determine how long exceptions have existed, and as a result, DOD lacks important information regarding the timeliness of efforts to resolve them. We will continue to monitor DOD's progress to address this recommendation.
|