DOD Financial Management

Marine Corps Statement of Budgetary Resources Audit Results and Lessons Learned [Reissued on October 17, 2011] Gao ID: GAO-11-830 September 15, 2011

Long-standing weaknesses in Department of Defense (DOD) business processes, systems, and controls have hindered efforts to achieve financial audit readiness. Because DOD relies heavily on budget information for day-to-day management decisions, in August 2009, the DOD Comptroller designated the Statement of Budgetary Resources (SBR) as an audit priority. The U.S. Marine Corps was identified as the pilot military service for an SBR audit. GAO was asked to determine (1) the primary reasons the Marine Corps was unable to obtain an opinion on its fiscal year 2010 SBR; (2) the effectiveness and status of the Marine Corps' remediation plan, and (3) military service efforts to leverage Marine Corps SBR audit lessons. GAO reviewed auditor findings and recommendations, evaluated the Marine Corps corrective action plans, and reviewed documentation on military service audit readiness and lessons learned efforts. During its work, GAO met with DOD, Marine Corps, military service, and Defense Finance and Accounting Service (DFAS) officials and the auditors..

The Marine Corps received a disclaimer of opinion on its Fiscal Year 2010 SBR because it could not provide supporting documentation in a timely manner, and support for transactions was missing or incomplete. Auditors also reported that the Marine Corps did not have adequate processes, systems controls, and controls for accounting and reporting on the use of budgetary resources. Further, the Marine Corps could not provide evidence that reconciliations for key accounts and processes were being performed on a monthly basis. The auditor also identified ineffective controls in key information technology (IT) systems used by the Marine Corps to process financial data. The auditors provided 139 recommendations to correct identified weaknesses. The Marine Corps developed action items and milestones in response to the auditor's findings. But its remediation plan was focused on near-term outcomes and did not adequately specify key elements, including goals and objectives, actions for addressing those objectives, and associated performance measures. GAO previously reported that it is standard practice to have strategy that includes these features. GAO found that many of the Marine Corps' actions did not address the specific auditor recommendations, and other actions were not adequate to correct underlying problems or root causes. Further, many of the remediation actions would require steps on the part of other DOD components, such as DFAS and the Defense Contract Management Agency. As of July 2011, the Marine Corps reported that actions on 88 of the 139 auditor recommendations were fully implemented. Auditors will assess the effectiveness of these actions as part of the fiscal year 2011 SBR audit effort. However, because many of the actions do not address the underlying internal control weaknesses, the Marine Corps risks continuing disclaimers of opinion. The Marine Corps' fiscal year 2010 SBR audit results provide valuable lessons on preparing for a first-time financial statement audit. GAO identified five fundamental lessons that are critical to success. Specifically, the Marine Corps' experience demonstrated that prior to asserting financial statement audit readiness, DOD components must (1) confirm completeness of populations of transactions and address any abnormal transactions and balances, (2) test beginning balances, (3) perform key reconciliations, (4) provide timely and complete response to audit documentation requests, and (5) verify that key IT systems are compliant and auditable. These issues are addressed in Internal Control Standards and audit requirements as well as DOD's Financial Improvement and Audit Readiness Guidance, which the military services are to follow in developing their respective Financial Improvement Plans (FIP). Navy, Army, and Air Force FIP officials stated that they were aware of the Marine Corps lessons. Navy officials stated that they are in the process of updating their audit readiness plan to address all five areas. Army and Air Force officials indicated their plans addressed some but not all of the lessons. GAO makes recommendations to (1) the Marine Corps to develop a riskbased remediation plan and confirm its actions fully respond to auditor recommendations and (2) DOD to direct other military services to consider key lessons learned in their audit readiness plans, as appropriate. DOD concurred with three of four recommendations but said the recommendation for a risk-based plan was too prescriptive. GAO believes this is needed for the long term.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Asif A. Khan Team: Government Accountability Office: Financial Management and Assurance Phone: (202) 512-9869


GAO-11-830, DOD Financial Management: Marine Corps Statement of Budgetary Resources Audit Results and Lessons Learned This is the accessible text file for GAO report number GAO-11-830 entitled 'DOD Financial Management: Marine Corps Statement of Budgetary Resources Audit Results and Lessons Learned' which was released on September 15, 2011. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Report to Congressional Requesters: September 2011: DOD Financial Management: Marine Corps Statement of Budgetary Resources Audit Results and Lessons Learned: GAO-11-830: GAO Highlights: Highlights of GAO-11-830, a report to congressional requesters. Why GAO Did This Study: Long-standing weaknesses in Department of Defense (DOD) business processes, systems, and controls have hindered efforts to achieve financial audit readiness. Because DOD relies heavily on budget information for day-to-day management decisions, in August 2009, the DOD Comptroller designated the Statement of Budgetary Resources (SBR) as an audit priority. The U.S. Marine Corps was identified as the pilot military service for an SBR audit. GAO was asked to determine (1) the primary reasons the Marine Corps was unable to obtain an opinion on its fiscal year 2010 SBR; (2) the effectiveness and status of the Marine Corps‘ remediation plan, and (3) military service efforts to leverage Marine Corps SBR audit lessons. GAO reviewed auditor findings and recommendations, evaluated the Marine Corps corrective action plans, and reviewed documentation on military service audit readiness and lessons learned efforts. During its work, GAO met with DOD, Marine Corps, military service, and Defense Finance and Accounting Service (DFAS) officials and the auditors. What GAO Found: The Marine Corps received a disclaimer of opinion on its Fiscal Year 2010 SBR because it could not provide supporting documentation in a timely manner, and support for transactions was missing or incomplete. Auditors also reported that the Marine Corps did not have adequate processes, systems controls, and controls for accounting and reporting on the use of budgetary resources. Further, the Marine Corps could not provide evidence that reconciliations for key accounts and processes were being performed on a monthly basis. The auditor also identified ineffective controls in key information technology (IT) systems used by the Marine Corps to process financial data. The auditors provided 139 recommendations to correct identified weaknesses. The Marine Corps developed action items and milestones in response to the auditor‘s findings. But its remediation plan was focused on near- term outcomes and did not adequately specify key elements, including goals and objectives, actions for addressing those objectives, and associated performance measures. GAO previously reported that it is standard practice to have strategy that includes these features. GAO found that many of the Marine Corps‘ actions did not address the specific auditor recommendations, and other actions were not adequate to correct underlying problems or root causes. Further, many of the remediation actions would require steps on the part of other DOD components, such as DFAS and the Defense Contract Management Agency. As of July 2011, the Marine Corps reported that actions on 88 of the 139 auditor recommendations were fully implemented. Auditors will assess the effectiveness of these actions as part of the fiscal year 2011 SBR audit effort. However, because many of the actions do not address the underlying internal control weaknesses, the Marine Corps risks continuing disclaimers of opinion. The Marine Corps‘ fiscal year 2010 SBR audit results provide valuable lessons on preparing for a first-time financial statement audit. GAO identified five fundamental lessons that are critical to success. Specifically, the Marine Corps‘ experience demonstrated that prior to asserting financial statement audit readiness, DOD components must: * confirm completeness of populations of transactions and address any abnormal transactions and balances, * test beginning balances, * perform key reconciliations, * provide timely and complete response to audit documentation requests, and, * verify that key IT systems are compliant and auditable. These issues are addressed in Internal Control Standards and audit requirements as well as DOD‘s Financial Improvement and Audit Readiness Guidance, which the military services are to follow in developing their respective Financial Improvement Plans (FIP). Navy, Army, and Air Force FIP officials stated that they were aware of the Marine Corps lessons. Navy officials stated that they are in the process of updating their audit readiness plan to address all five areas. Army and Air Force officials indicated their plans addressed some but not all of the lessons. What GAO Recommends: GAO makes recommendations to (1) the Marine Corps to develop a risk- based remediation plan and confirm its actions fully respond to auditor recommendations and (2) DOD to direct other military services to consider key lessons learned in their audit readiness plans, as appropriate. DOD concurred with three of four recommendations but said the recommendation for a risk-based plan was too prescriptive. GAO believes this is needed for the long term. View [hyperlink, http://www.gao.gov/products/GAO-11-830] or key components. For more information, contact Asif A. Khan at (202) 512- 9869 or khana@gao.gov. [End of section] Contents: Letter: Background: Inadequate Support for Accounting Transactions and Ineffective Controls Led to Disclaimer on the Marine Corps' SBR: Marine Corps Remediation Plan Is Focused on Near-Term Outcomes: Lessons Learned from the Marine Corps' SBR Audit Effort: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Objectives, Scope, and Methodology: Appendix II: Reported Status of Marine Corps Actions on Recommendations from the Fiscal Year 2010 Statement of Budgetary Resources Audit Effort: Appendix III: Comments from the Department of Defense: Appendix IV: GAO Contact and Staff Acknowledgments: Tables: Table 1: DOD IG Recommendations, Reported Status of USMC Actions on Accounting and Financial Reporting Process Issues as of July 18, 2011, and DOD IG Confirmation of Status as of August 25, 2011: Table 2: DOD IG Recommendations, Reported Status of USMC Actions on MCTFS Information Technology System Issues as of July 18, 2011, and DOD IG Confirmation of Marine Corps Statuses as of August 25, 2011: Table 3: DOD IG Recommendations, Reported Status of USMC Actions SABRS Information Technology System Issues as of July 18, 2011, and DOD IG Confirmation of Marine Corps Status as of August 25, 2011: Table 4: DOD IG Recommendations, Reported Status of USMC Actions on DDRS Information Technology System Issues as of July 18, 2011, and DOD IG Confirmation of Status as of August 25, 2011: Figure: Figure 1: Marine Corps Trend Analysis on Estimated Obligations and Liquidations Related to Fiscal Year 2010 Officer PCS Moves: Abbreviations: ACAT: Acquisition Category: ACID: Accessor Identification: ADA: Antideficiency Act: AG: Software AG: BIA: Business Impact Analysis: BTA: Business Transformation Agency: CA: Computer Associates: C&A: Certification and Accreditation: CAC: Common Access Card: CCB: Configuration Control Board: CFO: Chief Financial Officer: CI: Configuration Items: CICS: Customer Information Control System: CL: Cleveland: CMB: Configuration Management Board: COE: Commit, Obligate, and Expend: COOP: Continuity of Operations: COTR: Contracting Officer Technical Representative: DAA: Designated Accrediting Authority: DBA: Database Administrator: DCAA: Defense Contract Audit Agency: DCAS: Defense Cash Accountability System: DCMA: Defense Contract Management Agency: DCPS: Defense Civilian Pay System: DDRS: Defense Departmental Reporting System: DDRS-AFS: Defense Departmental Reporting System-Agency Financial Reporting: DDRS-B: Defense Departmental Reporting System-Budgetary: DDRS-DCM: Defense Departmental Reporting System-Data Collection Module: DEAMS: Defense Enterprise Accounting and Management System: DECC: Defense Enterprise Computing Centers: DIC: Document Identifier Code: DLT: Design Logic Tool: DFAS: Defense Finance and Accounting Service: DFAS-CL: Defense Finance and Accounting Service-Cleveland: DFAS-CO: Defense Finance and Accounting Service-Columbus: DFAS-IN: Defense Finance and Accounting Service-Indianapolis: DIACAP: DOD Information Assurance Certification and Accreditation Process: DISA: Defense Information System Agency: DOD: Department of Defense: DON: Department of the Navy: DSSN: Disbursing Station Symbol Number: ELSIG: Electronic Signature: eMASS: Enterprise Mission Assurance Support System: ERP: Enterprise Resource Planning: FASAB: Federal Accounting Standards Advisory Board: FBWT: Fund Balance with Treasury: FIAR: Financial Improvement and Audit Readiness: FIP: Financial Improvement Plan: FM: Functional Manager: FMR: Financial Management Regulation: FOS: Family of Systems: FRD: Functional Requirements Document: GAAP: Generally Accepted Accounting Principles: GDA: Global Data Area: GFEBS: General Fund Enterprise Business System: GL: General Ledger: HQMC: Headquarters Marine Corps: IA: Information Assurance: IAO: Information Assurance Officer: ICOFR: Internal Control over Financial Reporting: IG: Inspector General: IT: Information Technology: JADS: Joint Application Development Sessions: JV: Journal Voucher: LOA: Line of Accounting: MCCAT: Marine Corps Administrative Analysis Team: MCO: Marine Corps Order: MCPDT: Marine Corps Permanent Duty Travel: MCPRT: Marine Corps Program Review Team: MCTFS: Marine Corps Total Force System: MI: Manpower Information: MILSTRIP: Military Standard Requisition and Issue Procedures: MISSO: Manpower Information Systems Support Office: MOA: Memorandum of Agreement: MOCAS: Mechanization of Contract Administration Services: MRCV: Monthly Reconciliation/Certification Voucher: N/A: Not applicable: NDAA: National Defense Authorization Act: NFR: Notice of Findings and Recommendations: OMB: Office of Management and Budget: PanAPT: Panvalet Automated Production Turnover Software: PCS: Permanent Change of Station: PIN: Personal Identification Number: PMO: Program Management Office: POAM: Plan of Action and Milestones: PPA: Prior Period Adjustment: PTR: Production Trouble Report: Pub. L. No.: Public Law Number: RFA: HQMC, Programs and Resources Department, Fiscal Division, Accounting Branch: RFF: HQMC, Programs and Resources Department, Fiscal Division, Finance Branch: SAAR: System Access Authorization Request: SABRS: Standard Accounting, Budgeting, and Reporting System: SAT: System Acceptance Testing: SBR: Statement of Budgetary Resources: SCA: System Connection Agreement: SCR: System Change Request: SDN: Standard Document Number: SDP: System Development Plan: SF: Standard Form: SFIS: Standard Financial Information Structure: SI-DI: System Integration-Data Integrity: SIT: System Integration Testing: SLA: Service-Level Agreement: SMD: System Management Directorate: SMD-CL: System Management Directorate-Cleveland: SOD: Segregation of Duties: SPO: Standard Operating Procedure: SR: Software Release: STARS-FL: Standard Accounting and Reporting System-Field Level: Stat.: Statute: TAR: Tri-Annual Review: TASO: Terminal Area Security Officer: TRF: Transaction Research File: TSO: Technology Services Organization: TSO-CL: Technology Services Organization-Cleveland: UD/MIPS: Unit Diary/Marine Integrated Personnel System: U.S.C.: United States Code: USMC: United States Marine Corps: USSGL: United States Standard General Ledger: WAWF: Wide Area Work Flow: [End of section] United States Government Accountability Office: Washington, DC 20548: September 15, 2011: Congressional Requesters: The Chief Financial Officers Act of 1990 (CFO Act), as amended, established requirements for 24 agencies, including the Department of Defense (DOD) to prepare annual financial statements and have them audited.[Footnote 1] As we have previously reported, DOD's many challenges in resolving its pervasive and long-standing weaknesses in financial management, business operations, and systems, have inhibited its ability to meet this requirement.[Footnote 2] These weaknesses have also adversely affected DOD's ability to control costs; ensure basic accountability; anticipate future costs and claims on the budget; measure performance; maintain funds control; and prevent and detect fraud, waste, and abuse. DOD has undertaken several financial management improvement initiatives over the years, but it remains one of two CFO Act agencies that are unable to prepare auditable financial statements as of fiscal year 2010.[Footnote 3] The National Defense Authorization Act (NDAA) for Fiscal Year 2010 mandated that DOD be prepared to validate (certify) that its consolidated financial statements are ready for audit by September 30, 2017.[Footnote 4] In 2005, the Under Secretary of Defense (Comptroller/Chief Financial Officer) first prepared the Financial Improvement and Audit Readiness (FIAR) Plan to improve DOD business processes with the goal of producing timely, reliable, and accurate financial information that could generate audit-ready annual financial statements. The FIAR Plan is DOD's strategic plan and management tool for guiding, monitoring, and reporting on the department's financial management improvement efforts. As such, the plan communicates progress in addressing the department's financial management weaknesses and achieving financial statement auditability. The DOD Comptroller announced in August 2009 that in DOD's effort to improve its financial management information, priority would be given to improving those processes and controls that produce information on which DOD managers rely most heavily to run the agency. Because budgetary information is widely and regularly used for management, the DOD Comptroller designated as one of DOD's highest priorities the improvement of its budgetary information and processes underlying the Statement of Budgetary Resources (SBR). The SBR is the only financial statement predominantly derived from an entity's budgetary accounts in accordance with budgetary accounting rules, which are incorporated into generally accepted accounting principles (GAAP) for the federal government. The SBR is designed to provide information on authorized budgeted spending authority and links to the Budget of the United States Government (President's Budget), including budgetary resources, availability of budgetary resources, and how obligated resources have been used.[Footnote 5] The United States Marine Corps was identified as the pilot military service for an audit of the SBR. For fiscal year 2010, the Marine Corps reported more than $37.5 billion in total budgetary resources, including over $32.1 billion in net outlays (spending, net of offsetting collections[Footnote 6] and receipts). The Marine Corps is a military service within the Department of the Navy, and its success in achieving audit readiness is intended to pave the way for the Navy to be the second military service to undergo an SBR audit. The DOD Inspector General (IG) contracted with an independent public accounting firm to conduct the audit of the Marine Corps' Fiscal Year 2010 SBR. Based on the results of the auditors' work, the DOD IG issued a disclaimer of opinion[Footnote 7] on the fiscal year 2010 SBR. During a September 2010 hearing held by the Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security, Senate Committee on Homeland Security and Governmental Affairs, DOD witnesses noted that the Marine Corps' SBR audit efforts had identified significant problems with the Marine Corps' documentation of business systems and processes, support for transactions, and proper and timely recording of transactions, which contributed to the disclaimer of opinion. The Subcommittee expressed concern about the current status of the Marine Corps' audit readiness, the effectiveness of its remediation efforts, and the effects on DOD's overall financial audit readiness timeline. This report responds to the request that we determine (1) the primary reasons the Marine Corps was unable to obtain an opinion on its Fiscal Year 2010 SBR, (2) the effectiveness and reported status of the Marine Corps' remediation plan, and (3) the military services' efforts to leverage Marine Corps SBR audit lessons learned. For the first objective, we reviewed pertinent documentation, including the auditors' report and DOD IG audit documentation. For the second objective, we analyzed the Marine Corps' remediation plans to determine whether corrective actions were appropriately designed using relevant criteria and reviewed the Marine Corps' milestone dates and reported status as of July 18, 2011. For the third objective, we met with Army, Navy, Air Force, and Defense Finance and Accounting Service (DFAS) officials responsible for financial improvement and audit readiness efforts to obtain information on corrective actions they have initiated as a result of the Marine Corps SBR audit effort. We also reviewed DOD's FIAR Plan and FIAR Guidance and met with DOD Comptroller officials to obtain information on DOD-wide audit readiness initiatives. We conducted this performance audit from February 2011 through September 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix I provides further details on our scope and methodology. Background: DOD's FIAR Plan focuses on three goals: (1) achieve and sustain audit readiness; (2) achieve and sustain unqualified assurance on the effectiveness of internal controls; and (3) attain Federal Financial Management Improvement Act of 1996 (FFMIA) compliance for financial management systems that support effective financial management. [Footnote 8] The NDAA for Fiscal Year 2010 requires DOD to report to relevant congressional committees on the status of the implementation of the FIAR Plan twice a year--no later than May 15 and November 15. Consistent with prior GAO recommendations[Footnote 9] and the NDAA for Fiscal Year 2010, the DOD Comptroller issued FIAR Guidance in May 2010 to provide standardized guidance for DOD components to follow in developing their Financial Improvement Plans (FIP). DOD components are expected to prepare a FIP in accordance with the FIAR Guidance for each of their assessable units. The FIPs are intended to both guide and document financial improvement efforts. When a component determines that it has completed sufficient financial improvement efforts for an assessable unit so that it is ready for audit, the FIP documentation is used to support its conclusion of audit readiness. The Marine Corps SBR Effort: The United States Marine Corps was established on November 10, 1775, to provide security to naval vessels and boarding parties and to conduct limited land engagements in support of naval operations. While the Marine Corps is a separate military service, it also is a component of the Department of the Navy, accounting for approximately $33.6 billion out of a total $179.4 billion in reported Department of the Navy fiscal year 2010 obligations.[Footnote 10] At the end of fiscal year 2010, the Marine Corps comprised 202,441 active duty Marines and 39,222 reserves. In addition, the Marine Corps employed approximately 17,000 civilian employees. The Marine Corps first asserted financial audit readiness for its General Fund SBR on September 15, 2008. The DOD IG reviewed the Marine Corps' assertion package and, on April 10, 2009, reported that the assertion of audit readiness was not accurate, and that its documentation supporting the assertion was not complete. The DOD IG also reported that the Marine Corps had identified remediation activities that must be accomplished before an audit of its SBR was undertaken. While the Marine Corps made progress toward audit readiness during fiscal year 2009, the DOD IG reported that a number of issues led auditors to conclude that an audit of the Marine Corps' Fiscal Year 2009 SBR would not have positive results. The DOD IG reported that unless the issues were resolved, the risk of a disclaimer of opinion would be high. The DOD IG suggested that the Marine Corps consider requesting an audit of its Fiscal Year 2010 SBR and subsequently awarded a contract for the Marine Corps' Fiscal Year 2010 SBR audit. Purpose of the Statement of Budgetary Resources: The SBR is designed to provide information on budgeted spending authority reported in the Budget of the United States Government (President's Budget), including budgetary resources, availability of budgetary resources, and how obligated resources have been used. The SBR is an agencywide report that aggregates account-level information reported in the SF 133, Report on Budget Execution and Budgetary Resources,[Footnote 11] and links to the Program and Financing schedules in the President's Budget.[Footnote 12] The SBR consists of four separate but related sections that provide information about budgetary resources, status of budgetary resources, changes in obligated balances, and outlays for major budgetary accounts. Budgetary Resources. This section shows total budgetary resources made available to the agency for obligation during the reporting period. It consists of new budget authority, unobligated amounts available from prior reporting periods, transfers available from prior-year balances, reimbursements and other income, and adjustments such as recoveries of prior-year obligations. This information ties to information reported in related Program and Financing schedules in the President's Budget. Status of Budgetary Resources. This section displays the status of budgetary resources at the end of the period and consists of obligations incurred and the unobligated balances at the end of the period that are available for future use and those that are unavailable except to adjust or liquidate obligations chargeable to prior period appropriations. The total for this section and for the Budgetary Resources section must be reconciled to the total status reported for the aggregate of all budget accounts on the Marine Corps SF-133, Report on Budget Execution and Budgetary Resources. Change in Obligated Balance. This section displays the change in obligated balances during the reporting period. It consists of unpaid obligations brought forward from the previous year and obligations incurred in the current year, less current year outlays and recoveries of prior year unpaid obligations. The total change in obligated balance reflects the amount of unpaid obligations at the end of the accounting period and brought forward in the next period's financial statements. This information is reported in the related Program and Financing schedules in the President's Budget. Outlays. This section shows the relationship between obligations and outlays and discloses the payments made to liquidate obligations, net of offsetting collections. Obligations are usually liquidated by means of cash payments (outlays) such as currency, checks, or electronic fund transfers. This section reconciles outlays with obligations incurred and the change in obligated balances during the year. Outlays also are reported in the related SF-133 Report and Program and Financing Schedules in the President's Budget. Inadequate Support for Accounting Transactions and Ineffective Controls Led to Disclaimer on the Marine Corps' SBR: The DOD IG reported a disclaimer of opinion on the Marine Corps' Fiscal Year 2010 SBR because the Marine Corps did not provide timely and relevant supporting documentation for accounting transactions and disbursements in key areas, which prevented the auditors from completing the audit by the November 15, 2010, reporting deadline. A lack of documentation limited the scope of work the auditors could accomplish such that they were unable to render an opinion on the information presented. In addition, the auditors reported that ineffective internal control and ineffective controls in key financial systems should be addressed to ensure the reliability of reported Marine Corps financial information.[Footnote 13] The auditors identified 70 findings and made 139 recommendations to address the issues. The 139 recommendations related to support for transactions and internal control over basic accounting and financial systems. (See appendix II for a complete list of the audit findings, related recommendations, and Marine Corps action plans and reported status.) Inadequate Support for Transactions: The auditors reported that they did not receive timely, relevant, and complete supporting documentation for the accounting transactions selected for testing. The Defense Finance and Accounting Service location in Cleveland, Ohio, (DFAS-CL)--which performs accounting, disbursing, and financial reporting services for the Marine Corps--did not have effective procedures in place to ensure that supporting documentation for transactions was complete and readily available to pass basic audit transaction testing. For example, the auditors found that DFAS staff had only retained selected pages of the documents supporting payment vouchers, such as the voucher cover sheet and did not have the purchase order, receiving report, and the invoice to support payments made. Payment voucher documentation should include evidence of a contract or purchase order, a receiving report for the goods delivered, and an invoice showing evidence of review and approval. Documentation should also include evidence that the completeness and accuracy of its support for the related transactions has been verified. To address this problem, DFAS-CL staff took immediate action and conducted an extensive effort to re-image supporting documentation for transactions. GAO's Standards for Internal Control in the Federal Government states that transactions and other significant events need to be clearly documented, the documentation should be readily available for examination for actions such as approvals, authorizations, verifications, reconciliations, monitoring, and performance reviews. [Footnote 14] Without such supporting documentation, it is not possible to verify whether payments were made in the appropriate amount for authorized purposes, and to the appropriate parties. Other problems with documentation included the following: * Difficulty identifying and providing complete populations of transactions that the auditors could confirm and use for substantive testing.[Footnote 15] The auditors made repeated requests to the Marine Corps for transaction-level detail for major accounts in order to select samples for their substantive testing. These delays had a negative effect on the timeline of the audit effort, and as a result, the auditors were able to perform only limited testing. This limited testing, however, identified 14 accounting and financial reporting weaknesses, resulting in 52 recommendations. * Not providing timely and complete supporting documentation in response to auditor requests to support testing of beginning balances. For example, our review of auditor documentation showed that during the testing of four material accounts related to obligations for delivered and undelivered orders totaling $44.1 billion, 86 of the 897 sample items selected, with a dollar value of $1.3 billion, were not supported. Ineffective Internal Control over Basic Accounting and Financial Systems: During the planning phase of an audit, auditors assess the effectiveness of the design and operation of internal controls to determine control risk, which is used in determining the nature, extent, and timing of substantive procedures needed to achieve the desired level of detection risk. Auditors generally rely on the effectiveness of internal controls to reduce the level and amount of substantive testing required. However, in planning the fiscal year 2010 SBR audit effort, the auditors determined that they could not rely on the internal controls in the Marine Corps' processes and systems for assurance of the reliability of financial reporting on the information presented in its SBR. Ineffective internal controls require the auditors to expand their substantive testing. Accordingly, the auditors had to increase their substantive tests for the first- year SBR audit effort. Even with the increased audit testing, many key items remained unauditable as a result of the internal control problems. For example, the auditors reported the following: * The Marine Corps could not provide evidence to the auditors that reconciliations for key accounts and accounting processes were being performed on a monthly basis. Specifically, the auditors could not test Fund Balance with Treasury (FBWT)--a key internal control for SBR audits--because the Marine Corps was unable to tie its balances to Treasury balances and transaction-level detail, leaving the FBWT unauditable. * The Marine Corps recorded payments prior to recording the expense for various transactions, creating abnormal balances in the "Delivered orders, unpaid" account. The Marine Corps lacked effective processes and controls to assure timely recognition of expenses. * The Marine Corps also did not have effective controls in place to support estimated obligations, referred to as "bulk obligations," to record a payment liability and as a result, was not able to reconcile the related payment transactions to the estimates. The Marine Corps estimates obligations in a bulk amount to record payment liabilities where it does not have a mechanism to identify authorizing documentation as a basis for recording the obligations. The auditors also tested the controls over three major information technology (IT) systems used by the Marine Corps and reported numerous problems that required resolution. The three systems are the Marine Corps Total Force System (MCTFS), which is an integrated military personnel and payroll system; the Standard Accounting, Budgeting, Reporting System (SABRS), which is the Marine Corp's general ledger accounting system; and the Defense Departmental Reporting System (DDRS), which is a DOD-wide financial reporting system. The auditors found ineffective IT controls over all three systems. Examples of issues reported by the auditors include the following. * Segregation of duties weaknesses caused by staff with incompatible functional access to the systems. For example, the auditors reported that the lack of segregation of duties allowed a user to both authorize and approve payment of transactions within SABRS. Segregation of duties is a key internal control described in federal government internal control standards as the division of duties and responsibilities among different people to reduce the risk of error or fraud, and it includes the separation of responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets.[Footnote 16] The control is designed to help ensure completeness, accuracy, authorization, and validity of all transactions. * A lack of controls over interfaces between systems to ensure completeness of the data being transferred. System interface controls are critical for ensuring the completeness and accuracy of data transferred between systems. The standards also call for controls to be installed at a system's interfaces with other systems to ensure that all inputs are received and valid and outputs are correct and properly distributed.[Footnote 17] If system interface controls are ineffective, the reliability of the data used for financial management is questionable. * The lack of procedures to provide evidence of periodic review and approval of systems changes to assure their proper and timely implementation. Marine Corps Remediation Plan Is Focused on Near-Term Outcomes: The Marine Corps did not develop an overall corrective action or remediation plan that includes key elements of a risk-based plan. Instead, its approach to addressing auditor findings and recommendations focuses on short-term corrective actions based on extensive manual effort and adjustments to produce reliable financial reporting at year-end. Such efforts may not result in sustained improvements over the long term that would help ensure that the Marine Corps could routinely produce sound data on a timely basis for decision making. We previously reported that using principles of risk management helps policymakers make informed decisions about best ways to prioritize investments, so that the investments target the areas of greatest need.[Footnote 18] We also previously reported that it is standard practice to have a strategy that lays out goals and objectives, identifies actions for addressing those objectives, allocates resources, identifies roles and responsibilities, and measures performance against objectives.[Footnote 19] However, we found that the Marine Corps' SBR Remediation Plan focused on individual initiatives to address 70 auditor Notices of Findings and Recommendations (NFR) that included 139 recommendations, without assessing risks, prioritizing actions, or ensuring that actions adequately responded to recommendations.[Footnote 20] Further, the plan did not identify resources, roles and responsibilities, or include performance indicators to measure performance against action plan objectives.[Footnote 21] Given the current efforts, goals, and timeframes for achieving auditability of the Marine Corps' Fiscal Year 2011 SBR, the current approach is understandably focused on short-term actions. However, achieving financial accountability that is sustainable in the long term will require reliable financial systems and sound internal controls. An effective remediation plan would help ensure that audit recommendations are fully addressed to deal with the short-term and long-term goals. GAO's Standards for Internal Control in the Federal Government states that managers are to (1) promptly evaluate findings from audits and other reviews, (2) determine proper actions in response to findings and recommendations from audits and reviews, and (3) complete within established time frames, all actions that correct or otherwise resolve the matters brought to management's attention. [Footnote 22] The Marine Corps has implemented an extensive SBR remediation effort that is focused on individual initiatives, referred to by the Marine Corps as plans of action and milestones (POAM), to address the 70 audit findings and 139 related recommendations aimed at remediating documentation, internal control, accounting, and information systems weaknesses. The Marine Corps reported that actions on 88 of the 139 recommendations, including weaknesses related to accounting and financial reporting and IT systems, were fully implemented; however, the completeness and effectiveness of most Marine Corps' actions have not yet been tested. DOD IG auditors told us that tests performed during the Marine Corps' fiscal year 2011 SBR audit effort will determine whether and to what extent the problems identified during the fiscal year 2010 SBR audit effort have been resolved. They also confirmed that as of August 25, 2011, the Marine Corps had remediated the problems on 11 of the IT audit recommendations. (Appendix II includes a list of auditor recommendations and the Marine Corps' planned remediation actions, targeted completion dates, and reported status.) Remediation Actions Related to Accounting and Financial Reporting Process Issues: The design of many of the actions taken by the Marine Corps relied on monitoring, a detective control, and high-level initial fixes to account balances that did not address root causes as well as other actions that were not consistent with the related auditors' recommendations. For example: * Numerous action plans relied on issuing guidance and monitoring without correcting root causes. Marine Corps' remediation actions on 22 of the 56 accounting and financial reporting recommendations rely on issuing guidance, monitoring, or both in an attempt to quickly address identified weaknesses. Correcting underlying causes requires process improvements and in some cases, system changes. For example, the Marine Corps does not have a process for capturing actual costs and expenditures for travel and shipments of household goods related to permanent change of station (PCS) moves associated with reassignments and military separations. Instead, it currently relies on data calls to estimate the population of obligations that need to be recorded to reflect a payment liability. As noted previously, these estimates are referred to as "bulk obligations." The auditors reported that the Marine Corps did not ensure that the estimated amount recorded for bulk obligations was reviewed and adjusted to reflect actual costs and expenditures. To address these findings, the Marine Corps developed additional guidance to support its current process for estimating bulk obligations and implemented a process to monitor the liquidation (payment) of bulk obligations. This process includes performing monthly and quarterly trend analysis of the estimated bulk obligations and liquidations. However, the guidance does not address the need for monthly reconciliations to identify and record necessary adjustments to reflect actual costs and expenditures. Marine Corps officials stated that they are working on a process to capture the related travel and household goods shipment authorizations as a basis for establishing and liquidating obligations, but they said they will need to rely on trend analysis and monitoring until process improvements are in place. Recording and liquidating obligations associated with travel and moving expenses often occurs over 2 or more fiscal years because for PCS moves that occur in the summer months, final bills may not be received until after the current fiscal year ends on September 30, or sometimes even later, for example, when household goods are stored during lengthy deployments. As shown in figure 1, during fiscal year 2010, the Marine Corps had recorded $43 million (unaudited) estimated bulk obligations for these types of expenses. As of September 30, 2010, Marine Corps had recorded only $20.2 million (unaudited) payments against those obligations. Payments against the 2010 obligations continued into 2011, with the liquidated amount of 2010 obligations increasing to $28.5 million (unaudited) at June 30, 2011. Figure 1: Marine Corps Trend Analysis on Estimated Obligations and Liquidations Related to Fiscal Year 2010 Officer PCS Moves: [Refer to PDF for image: multiple line graph] Fiscal quarter: Q1, 2010: Cumulative estimated obligation: $11.757 million; Cumulative reported liquidation: $0.204 million. Fiscal quarter: Q2, 2010: Cumulative estimated obligation: $39.272 million; Cumulative reported liquidation: $2.023 million. Fiscal quarter: Q3, 2010: Cumulative estimated obligation: $35.491 million; Cumulative reported liquidation: $5.307 million. Fiscal quarter: Q4, 2010: Cumulative estimated obligation: $43.044 million; Cumulative reported liquidation: $20.248 million. Fiscal quarter: Q1, 2011: Cumulative estimated obligation: $43.318 million; Cumulative reported liquidation: $25.724 million. Fiscal quarter: Q2, 2011: Cumulative estimated obligation: $43.266 million; Cumulative reported liquidation: $27.524 million. Fiscal quarter: Q3, 2011: Cumulative estimated obligation: $43.197 million; Cumulative reported liquidation: $28.48 million. Source: Unaudited Marine Corps data. [End of figure] Ineffective monitoring of estimated bulk obligations is a funds control weakness that can lead to ineffective use of budgetary resources if the estimates are too high and poses a risk of Antideficiency Act (ADA) violations if the estimates are too low. [Footnote 23] For example, if during the second year, the Marine Corps determined that estimated bulk obligations are higher than needed to cover the related payments, these 1-year funds will have expired and cannot be used for other priorities. However, if the estimated bulk obligations were lower than the amount needed to cover the related payments, the Marine Corps could incur an ADA violation if it did not have sufficient funds otherwise available to cover the shortfall. The Army and the Navy experienced ADA violations related to their fiscal year 2008 military personnel appropriations as a result of the failure to monitor bulk obligations and determine whether obligations and expenditures were within statutory allocations of funds and appropriated amounts.[Footnote 24], [Footnote 25] In addition, to assist the Marine Corps in monitoring key accounts, SABRS produces a variety of exception reports on a scheduled basis (daily, weekly, or monthly), which are sent to designated recipients throughout the Marine Corps. The reports identify abnormal transactions and balances that meet certain criteria, such as the transaction resulted in an accounting error, the transaction is dormant or has not been active for an inappropriate time, and the account balance is a negative instead of a positive amount. The guidance for the report recipients contains general instructions on correcting the transactions, but does not include any instruction on how the problem could be avoided in the future. While monitoring key accounts is a helpful tool to ensure the accuracy of the Marine Corps' accounting, it does not resolve the underlying accounting problems that caused the abnormal accounting conditions to occur. * Many planned actions were not consistent with the related recommendations. Our analysis of the Marine Corps' remediation action plans found that actions on 20 of the 139 recommendations were not consistent with recommendations. For example, auditor tests of fiscal year 2010 beginning balances for "Delivered orders-obligations, unpaid" identified unliquidated obligations on old contracts for which performance was substantially complete. The Marine Corps had not reviewed the obligations to determine whether they should be adjusted, as required by DOD policy.[Footnote 26] The DOD Financial Management Regulation (FMR) requires DOD components to perform Tri-annual Reviews (TAR) to monitor and confirm commitments, obligations, liquidations, accounts payable, and accounts receivable. The auditors found that the Marine Corps did not have an effective process for reviewing undelivered orders and unliquidated obligations, and recommended that they strengthen the TAR controls, whose weaknesses were the root cause of the finding. The lack of review of these "stale obligations" can be a significant problem in managing budgetary resources because unneeded funds are not identified in a timely manner, and once the related appropriation accounts expire, unneeded funds that were obligated cannot be used for other priorities. In response to these findings, Marine Corps officials stated that they have implemented a robust Tri-annual Review and Confirmation process for validating obligations. The auditors reported that the Marine Corps developed effective written procedures, but they found problems with the implementation of those procedures. Marine Corps officials told us that its TAR procedures will be included in its August 2011 review of internal controls over financial reporting. * The Marine Corps has not fully addressed service-provider recommendations. At least 12 of the 139 recommendations and Marine Corps action plans directly address service-provider agreements and coordination. For example, the auditors recommended that the Marine Corps strengthen controls surrounding the monitoring of the coding of expenditures by DFAS to help ensure that contract payments will be recorded properly. The auditors also recommended that the Marine Corps establish policies and procedures for service-provider monitoring of system log-on controls and handling lost or compromised passwords. In addition, the auditors recommended that the Marine Corps strengthen controls over the review of open obligations to identify any related to contracts that were no longer valid or open, or for which deliveries of goods or services were completed and needed to be billed. The effectiveness of contract monitoring efforts by Marine Corps program managers and buying commands and the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA) are an important element to Marine Corps review and management of commitments, obligations, liquidations, accounts payable, and accounts receivable. Service-provider agreements are important for assuring the effectiveness of contract monitoring, audit, and closeout. As discussed in DOD's FIAR Guidance, service providers working with reporting entities are responsible for audit readiness efforts surrounding service-provider systems and data, processes and controls, and supporting documentation that have a direct effect on reporting entities' auditability. The FIAR Guidance also specifies that service- provider and reporting entity communications and understandings must be documented in a Service-Level Agreement or Memorandum of Understanding. The Marine Corps has been attempting to develop a new service-provider agreement with DFAS for nearly a year. However, the agreement remains in draft. Further, while the Marine Corps has no service-provider agreements with DCMA and DCAA, Marine Corps officials told us they discussed this matter with the FIAR Directorate as a DOD- wide issue. Remediation Actions Related to IT System Weaknesses: The Marine Corps' remediation action plans dealing with IT weaknesses do not adequately address recommendations on a number of issues, including system access controls, feeder systems, and the audit trail on the change-management process. Specific issues include the following: * The Marine Corps disagreed with six auditor recommendations to strengthen SABRS IT system controls over information processing. For three recommendations related to password and log-on controls, the Marine Corps action states that the Defense Information System Agency (DISA) and not DFAS is responsible for the actions. However, Marine Corps officials told us they had not contacted DISA officials to ensure that they would address the recommendations. For two recommendations related to data transfers between feeder system and SABRS, the Marine Corps action states that legacy systems cannot accept acknowledgment of received transactions from SABRS. However, the Marine Corps did not take alternative action to assure the completeness and accuracy of data transfers. The sixth recommendation related to implementing edit checks to assure that transactions processed from a feeder system could only be entered into SABRS once. The Marine Corps action stated that DFAS and the Marine Corps already have sufficient checks in place to prevent the processing of the same transaction more than once. However, the Marine Corps did not explain these edit checks, or indicate that they had been tested and deemed to be effective. * The auditors recommended that the Marine Corps work with DFAS to implement a solution to allow them to track all SABRS system changes being migrated to production and to retain evidence of management approval for all changes to SABRS. The Marine Corps reported that actions on this recommendation have been fully implemented. However, the Marine Corps reported its action on this recommendation as "The signature approval block has been removed as signature is no longer required." This reported action does not explain how the recommendation was addressed and raises questions about whether the recommendation has in fact been addressed. Lessons Learned from the Marine Corps' SBR Audit Effort: The Marine Corps' fiscal year 2010 SBR audit results provide valuable lessons on preparing for a first-time financial statement audit. As we recently testified, lessons learned from the Marine Corps' SBR audit effort can provide a roadmap to help other DOD components achieve audit readiness through strengthening their financial management processes to increase data reliability as they develop their own action plans in preparation for their first-time audits.[Footnote 27] While the Marine Corps SBR effort and resulting auditor findings and recommendations identified numerous issues for the other military services to consider in their audit readiness efforts, we identified five overall lessons that are critical to success. Specifically, the Marine Corps' experience demonstrated that prior to asserting financial statement audit readiness, DOD components must: * confirm completeness of populations of transactions and address any abnormal transactions and balances, * test beginning balances, * perform key reconciliations, * provide timely and complete response to audit documentation requests, and: * verify that key IT systems are compliant and auditable. Officials responsible for Navy, Army, and Air Force FIPs as well as other financial management officials told us that they are aware of the Marine Corps lessons. Navy officials told us they are updating their audit readiness plan to address all five areas. Navy officials discussed several examples of actions they plan to include in their revised audit readiness plan. However, the plan, which is still in draft, is incomplete, and Navy officials did not provide us a copy of the draft document. Navy officials explained that the initial POAM, which is targeted for completion by December 16, 2011, is a living document that would be modified as the evaluation of Navy business and financial processes unfold, deficiencies are identified, and corrective actions are implemented. Army and Air Force officials indicated that they are addressing some but not all of these lessons in their audit readiness efforts. Overall, the procedures required by DOD's FIAR Guidance are consistent with Internal Control Standards and selected procedures for conducting financial statement audits, such as reconciling the population of transactions to be tested and conducting tests of information system controls. We found that the five issues identified as critical lessons from the Marine Corps SBR audit effort are addressed in the FIAR Guidance. As the Navy, Army, and Air Force move forward in developing and implementing their FIPs, it will be critical for them to take into account the lessons learned during the course of pilot audit efforts, such as the Marine Corps SBR. Adherence to the FIAR Guidance in these areas can help ensure that the military service FIPs provide the needed audit readiness procedures. The following sections discuss each of the five lessons resulting from the Marine Corps SBR effort and the status of the military services' efforts to ensure that their respective FIPs address these lessons in accordance with FIAR Guidance. * Confirm completeness of transaction populations. DOD's FIAR Guidance includes steps to address the completeness of transaction populations during the audit readiness work. During the fiscal year 2010 SBR audit effort, the auditors made multiple requests for Marine Corps transaction-level detail for key SBR accounts, such as "Undelivered orders-obligations, unpaid." The multiple attempts caused significant delays and the auditors were not able to complete their audit effort. Navy FIP and other financial management officials told us that they identified problems with the way transactions map to general ledger accounts and make it difficult to identify transaction populations. For example, the officials explained that general ledger account numbers changed over the years, requiring multiple maps from accounting systems to the Defense Departmental Reporting System, and field staff had occasionally created their own general ledger accounts without coordinating with DFAS officials who maintain the U.S. Standard General Ledger (USSGL) chart of accounts. Navy officials noted that these problems prevent the reconciliation of Unadjusted to Adjusted Trial Balances and FBWT reconciliations, and impede overall funds control. The officials explained that the Navy is updating its audit readiness plan to address these problems. Army and Air Force FIP officials we met with said they were aware of the Marine Corps audit findings. However, they did not discuss efforts to identify complete populations of transactions or ensure that transactions properly map to USSGL accounts. * Test beginning balances. DOD's FIAR Guidance discusses the importance of confirming beginning balances. A first-year SBR audit requires substantial testing to confirm beginning balances. Because this testing involves transactions that originated in prior years, the auditors examine documents from current and prior periods, including contracts, receiving reports, invoices, and disbursement records to verify beginning balances. During its fiscal year 2010 SBR audit effort, the Marine Corps did not provide complete supporting documentation, resulting in this key lesson learned. Navy audit readiness efforts and DOD's FIAR Guidance include steps to address the testing of beginning balances during the audit readiness work. The Navy FIP and other financial management officials we interviewed noted that earlier audit readiness discovery efforts were not sufficient to confirm beginning balances, and problems subsequently identified with assignment of USSGL account numbers and mapping of transactions to the proper accounts will need to be resolved to ensure the auditability of beginning balances. DFAS is actively working with the Navy in this effort. Army and Air Force FIP officials recognized the importance of confirming beginning balances, but they did not provide information on their efforts in this area. * Perform key reconciliations. DOD's FIAR Guidance includes steps to perform key reconciliations during the audit readiness efforts. The completion of key reconciliations is essential to financial statement auditability. During the fiscal year 2010 Marine Corps' SBR audit effort, the Marine Corps did not have processes in place to reconcile key accounts. For example, without transaction-level detail, the Marine Corps was unable to reconcile its FBWT. In addition, the Marine Corps had to make repeated attempts to reconcile the Unadjusted Trial Balance to the Adjusted Trial Balance. Navy FIP and financial management officials told us that the Navy has identified Unadjusted to Adjusted Trial Balance and FBWT reconciliations as key requirements to be completed before asserting audit readiness. The Navy's target for FBWT audit readiness is the fourth quarter of fiscal year 2012. In December 2010, the Air Force asserted that its FBWT was auditable. The Air Force FBWT audit readiness assertion is currently under review by an independent public accounting firm The Army's target for FBWT audit readiness is the first quarter of 2015. * Provide timely and complete responses to audit documentation requests. DOD's FIAR Guidance includes steps for achieving a timely and complete response to audit documentation requests during the audit readiness work. The auditors reported that the Marine Corps did not consistently provide timely and accurate audit documentation. DFAS stated that this NFR was its responsibility. Such documentation is needed to determine whether a transaction being tested was authorized, the goods and services were received, the invoice was approved for payment, and the funds disbursed were correct. Navy FIP and other financial management officials told us they are working closely with DFAS-CL and DFAS-Columbus (DFAS-CO) to ensure that audit documentation will be available to support auditor requests. The DFAS-Indianapolis (DFAS-IN) FIAR team officials are aware of this requirement. Army and Air Force FIP officials we met with did not discuss audit readiness efforts in this area. The Marine Corps established a Web site to facilitate the exchange of audit information, including auditor requests for information, samples, and supporting documentation, and financial manager submission of documents in response to auditor requests. Web sites for timely exchange of a high volume of documentation are useful to facilitating audits of large organizations. However, Army and Air Force FIP officials told us they do not have plans to establish such a Web site for exchanging information. * Verify that key IT systems are compliant and auditable. DOD's FIAR Guidance includes steps for verifying that key IT systems are auditable. During the Marine Corps SBR audit effort, the auditors issued numerous Notices of Findings and Recommendations reporting that key application systems used by the Marine Corps did not have effective controls, which impacted their auditability. The auditability of key application systems, including military payroll systems, accounting systems, and financial reporting systems, is essential to achieving and sustaining an audit opinion. The Navy FIP Leader and other Navy officials told us that they have determined that the Navy's Standard Accounting and Reporting System-Field Level (STARS- FL) general ledger accounting system does not append account identifiers to transactions. Without this identifier, the Navy will be unable to reconcile its FBWT at the appropriation level. The lack of an account identifier also impairs the resolution of problem disbursements. The Navy also is implementing the Navy Enterprise Resource Planning System (Navy ERP), which is intended to standardize the acquisition, financial, program management, maintenance, plant and wholesale supply, and workforce management capabilities at Navy commands. Once it is fully deployed, the Navy estimates that the system will control and account for approximately $71 billion, or 50 percent, of the Navy's estimated appropriated funds, after excluding the appropriated funds for the Marine Corps and military personnel pay and allowances. In October 2010, we reported that the Navy ERP schedule for full deployment had slipped 2 years from 2010 to 2012. [Footnote 28] DOD officials have said the successful implementation of enterprise resource planning (ERP) is key to resolving the long-standing weaknesses in the department's business operations in areas such as business transformation and financial management. The Army has acknowledged problems with its General Fund Enterprise Business System (GFEBS). These problems include incomplete data, which affects the reliability of financial reporting and the lack of visibility of available funds and poses a risk of ADA violations. The Army estimates that when fully implemented, GFEBS will be used to control and account for about $140 billion in spending. Army officials told us that GFEBS deployment consists of eight waves with full implementation in July 2012 to support the ultimate goal of audit readiness by 2017. The Air Force is developing a new ERP general ledger system--called the Defense Enterprise Accounting and Management System (DEAMS). DEAMS is intended to provide the Air Force the entire spectrum of General Fund financial management capabilities, including collections, commitments and obligations, cost accounting, general ledger, funds control, receipts and acceptance, accounts payable, and disbursement, billing, and financial reporting. According to Air Force FIP officials, when DEAMS is fully operational, it is expected to maintain control and accountability for about $160 billion. In October 2010, we reported that the Air Force's schedule for full deployment of DEAMS had slipped 3 years from 2014 to 2017.[Footnote 29] The Marine Corps SBR audit effort also identified problems with DOD- wide systems, including the Defense Departmental Reporting System, the Defense Cash Accountability System, and the Mechanization of Contract Administration Services (MOCAS). MOCAS is a 50-year-old legacy system. Navy officials noted that MOCAS processes about one third of the Navy's transactions. Navy officials also told us that DOD has serious data reliability concerns with MOCAS, including proper recording and reporting of contract payment accruals. Navy and Air Force FIP officials told us they are coordinating with DFAS-CO on MOCAS audit readiness support and Army FIP officials said they plan to do so in the fall of 2011 or winter of 2012. Conclusions: The Marine Corps learned some valuable lessons in the attempted fiscal year 2010 audit of its SBR; however, it still faces significant challenges in achieving auditability of its basic budgetary and spending information. In addition, lessons learned from the Marine Corps' SBR audit effort can provide a valuable roadmap to help other DOD components strengthen their financial management processes and achieve audit readiness. The Marine Corps has undertaken numerous actions to correct the many deficiencies identified during its SBR audit effort, but many actions are incomplete, rely on detective controls rather than preventive controls, and do not address the underlying weaknesses. Many of the actions are also dependent on the effectiveness of DOD-wide system and process improvements, which are still in process. In order to help ensure that actions dependent on other components are implemented in an effective manner, it is critical that the Marine Corps develop effective service-provider agreements with DFAS and other DOD service providers. Finally, in meeting DOD's overall goals of financial management improvement and audit readiness, it is essential that the other military services and DOD components, such as DFAS, take timely, diligent action to fully leverage the fundamental lessons resulting from the Marine Corps SBR audit effort. Unless the military services embrace basic accounting and internal control steps, such as confirming beginning balances and performing needed reconciliations, the prospects for achieving audit readiness in any area will remain uncertain. DOD's FIAR Guidance, if effectively implemented, would help the military services ensure that their FIPs include these basic steps. A successful SBR audit is an important tool in providing accountability and discipline over the budgetary resources provided by Congress and ultimately by the American taxpayers. Such accountability and transparency is a basic responsibility made even more critical given the current fiscal constraints faced by our nation. Recommendations for Executive Action: We are making four recommendations to improve Marine Corps and Department of Defense (DOD) audit readiness efforts. First, we make three recommendations to the Secretary of the Navy to direct the Commandant of the Marine Corps to take the following actions: * Using the results of the fiscal year 2010 and 2011 SBR audit efforts, develop a comprehensive, risk-based plan for designing and implementing corrective actions that provide sustainable solutions for SBR auditor recommendations. Such a plan should identify goals and objectives, identify and prioritize actions for addressing those objectives, allocate resources, assign roles and responsibilities, and measure performance against objectives. * Review Marine Corps SBR remediation actions under way and confirm that actions are fully responsive to the auditor recommendations. * For remediation actions that require coordination and action on the part of other DOD components, such as DFAS, DCMA, and DCAA, require the Marine Corps to develop and implement timely and effective service- provider agreements with the appropriate DOD components in accordance with the FIAR Guidance. These agreements should identify roles and responsibilities, the individuals responsible for those activities, and performance measures that establish accountability. In addition, to help fully leverage lessons learned from the first- year Marine Corps SBR audit effort, we recommend that the Secretary of Defense direct the Secretaries of the Army, the Navy, and the Air Force to consider the fundamental lessons resulting from the Marine Corps effort and incorporate the lessons, as appropriate, in their respective FIPs. Agency Comments and Our Evaluation: We received written comments from the Department of Defense (DOD) on September 13, 2011, stating that the department agreed with three of our four recommendations. DOD also stated that as we pointed out, most issues identified are not unique to the Marine Corps and noted that all DOD reporting components are working with the Defense Finance and Accounting Service and other service-providers to address these issues. However, DOD's letter states that the Marine Corps and its service providers have made far more progress in remediation than our report indicates. DOD's letter also states that it disagrees with several of the statements in our report related to the Marine Corps' remediation plan and that the report does not present a fair assessment of the Marine Corps' remediation efforts as a whole. However, most Marine Corps' corrective actions have not yet been confirmed by the DOD Inspector General (IG), and accordingly, the success of the Marine Corps' efforts to date in remediating weaknesses is unknown at this time. DOD's written comments are reprinted in appendix III. We summarize and evaluate DOD's comments and responses to our recommendations below. We made technical corrections and clarifications suggested by DOD in the body of our report, where appropriate. DOD did not agree with our recommendation that the Marine Corps develop a comprehensive, risk-based plan for designing and implementing corrective actions to its Statement of Budgetary Resources, commenting that the recommendation was overly prescriptive. As stated in our report, we are concerned that the Marine Corps' approach to addressing auditor findings and extensive manual effort and adjustments to produce reliable financial reporting at year-end. Such efforts may not result in sustained improvements over the long term that would help ensure that the Marine Corps routinely produces sound data on a timely basis for decision making. In response to DOD's comment, we clarified our recommendation to indicate that fiscal year 2010 and 2011 audit results should be considered in developing a comprehensive plan to address auditor recommendations. DOD also stated that the Marine Corps contends that the referenced Standards for Internal Control in the Federal Government[Footnote 30] does not have a requirement that management must identify resources, roles and responsibilities, or include performance indicators to measure performance against action plan objectives. DOD stated that the Marine Corps fully complied with the three requirements noted in the standard to (1) promptly evaluate findings from audits and other reviews, (2) determine proper actions in response to findings and recommendations from audits and reviews, and (3) complete within established time frames, all actions that correct or otherwise resolve the matters brought to management's attention. Our reference to the internal control standards relates to our finding that the Marine Corps had not fully addressed all audit recommendations. As stated in our report, the Marine Corps' remediation action plans dealing with information technology (IT) system weaknesses do not adequately address recommendations on a number of issues, including system access controls, federal systems, and the audit trail on the change- management process. In addition, as noted in appendix II of our report, the Marine Corps disagreed with several IT system recommendations and did not plan corrective actions to address them. However, our overall concern with the Marine Corps' remediation plan is that given the large number of recommendations and the need for long-term actions that will result in sustainable improvement, the Marine Corps could benefit from a risk-management approach to its remediation plan. Such an approach helps policymakers make informed decisions about the best ways to prioritize investments, so that the investments target the areas of greatest need. This is particularly important in an environment where resources are limited. Further, as additional findings and recommendations are identified during the Marine Corps' Fiscal Year 2011 SBR audit, it will be important to assess risk and prioritize actions to address them. We therefore continue to believe that this recommendation, as revised, has merit. We are sending copies of this report to the Secretary of Defense, the Under Secretary of Defense (Comptroller/Chief Financial Officer), the Secretary of the Navy, the Assistant Secretary of the Navy for Financial Management and Comptroller, the Commandant of the Marine Corps; the Fiscal Director of the Marine Corps; the Directors of DFAS, DFAS-Cleveland, and DFAS-Columbus; the Director of the Office of Management and Budget; and appropriate congressional committees. In addition, the report is available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. If you or your staffs have any questions about this report, please contact me at (202) 512-9869 or khana@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Signed by: Asif A. Khan: Director, Financial Management and Assurance: List of Requesters: The Honorable Thomas R. Carper: Chair: The Honorable Scott P. Brown: Ranking Member: Subcommittee on Federal Financial Management, Government Information, Federal Services and International Security: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Claire McCaskill: Chair: Subcommittee on Contracting Oversight: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Tom Coburn: Ranking Member: Permanent Subcommittee on Investigations: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable John McCain: United States Senate: [End of section] Appendix I: Objectives, Scope, and Methodology: We were requested to determine (1) the primary reasons why the Marine Corps was unable to obtain an opinion on its Fiscal Year 2010 SBR, (2) the effectiveness and reported status of the Marine Corps' remediation plan design and implementation, and (3) military service and Defense Finance and Accounting Service (DFAS) efforts to leverage Marine Corps SBR audit lessons learned. To determine the primary reasons for the disclaimer of opinion, we reviewed DOD IG audit documentation, the auditor notices of findings and recommendations (NFR), the Marine Corps' response to the auditors' findings and conclusions, the Marine Corps' management assertion letter, the auditors' report and more detailed management letter, and the Marine Corps' response to the report. To determine the effectiveness and reported status of the Marine Corps' remediation plan design and implementation, we reviewed the Marine Corps' action plans for addressing auditor NFRs, which are described in Program Objectives and Milestone (POAM) documents. We considered corrective action guidance included in DOD's Financial Improvement and Audit Readiness (FIAR) Guidance as well as GAO's Standards for internal Control in the Federal Government.[Footnote 31] We analyzed the Marine Corps' remediation plans to determine whether Marine Corps corrective actions were appropriately designed to resolve the problems identified during the audit effort, including actions to address identified weaknesses in accounting and financial reporting and key information technology (IT) systems. We also reviewed the Marine Corps' milestone dates for completing remediation actions, the reported status of Marine Corps actions as of July 18, 2011, and DOD IG confirmation of Marine Corps implementation. To determine the military service efforts to leverage Marine Corps SBR audit lessons learned, we met with Army, Navy, Air Force, and Defense Finance and Accounting Service (DFAS) financial managers to discuss actions they had initiated as a result of the Marine Corps audit effort. We also reviewed DOD's FIAR Plan and FIAR Guidance and met with DOD Comptroller and FIAR officials to determine the status of their efforts to ensure the lessons are addressed in the military service's audit readiness plans. We reviewed lessons learned documentation provided by the military services. We also reviewed the FIAR Guidance to determine whether it included information that would help address the key lessons learned from the Marine Corps SBR audit effort. We conducted this performance audit from February 2011 through September 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate audit evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Reported Status of Marine Corps Actions on Recommendations from the Fiscal Year 2010 Statement of Budgetary Resources Audit Effort: This appendix presents the recommendations related to accounting and financial reporting findings and information technology (IT) system findings from the United States Marine Corps (USMC) Fiscal Year 2010 Statement of Budgetary Resources (SBR) audit effort. The auditors communicated 14 notices of findings and recommendations (NFR) related to accounting and financial reporting processes and 56 findings related to IT system weaknesses. These NFRs resulted in 139 recommendations, which are shown in tables 1 through 4. The USMC has indicated that several actions had been completed as of July 18, 2011, but the effectiveness of all but 11 Marine Corps' actions had not yet been confirmed by the auditor. Department of Defense (DOD) Inspector General (IG) auditors stated that ongoing testing for the audit of the Marine Corps Fiscal Year 2011 Statement of Budgetary Resources likely would confirm the effectiveness of Marine Corps remediation actions. The DOD IG's report on the Marine Corps' fiscal year 2011 SBR audit will be issued in November 2011. Table 1 presents the recommendations related to the Marine Corps' accounting and financial reporting processes; the Marine Corps' action plans to remediate these recommendations, reported implementation status, and targeted completion dates; and notes whether the DOD IG has confirmed the effectiveness of the Marine Corps' implementation. Table 1: DOD IG Recommendations, Reported Status of USMC Actions on Accounting and Financial Reporting Process Issues as of July 18, 2011, and DOD IG Confirmation of Status as of August 25, 2011: NFR 1: Improper Accrual of Delivered Orders, Unpaid: Recommendations: 1. Analyze or reconcile all delivered orders recorded as commit, obligate, and expend (COE) for the noted types of bulk obligations and any other obligation types that are known to management as of 9/30/09; USMC action plan: NFR 1: Improper Accrual of Delivered Orders, Unpaid: All USMC Commands and HQMC participated in a data call to identify the universe and value of all bulk obligations and expense transactions using a standard document template. Improper accrual transactions are closely related to the bulk obligations that are referenced in "NFR 2: Lack of Review of Estimated Bulk Obligations"; Targeted completion date: 7/21/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: The USMC Marine Corps Programs, Resources, Accounting and Financial Systems Branch (commonly referred to as the Accounting Branch, or RFA) independently queried the core accounting system to identify the universe of manually entered COE transactions into SABRS; Targeted completion date: 8/18/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Analyzed validity of Delivered and Undelivered Orders; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Audit Support team selected a sample of documents related to COE transactions under review to evaluate implementation of management guidance and the adjusted values reported on the financial statements. This review included a validation of a system change that eliminates the manual entry of a COE in SABRS; Targeted completion date: 10/14/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. For any unsupported amounts and/or any amounts that may no longer be necessary to remain in delivered or open status, adjustments should be recorded to reverse or decrease the accrued delivered orders; USMC action plan: Developed a Prior Period Adjustment (PPA) package which contained JV adjustments and approvals for unsupported COE transactions and which will be corroborated by a detail schedule of unsupported transactions; Targeted completion date: 10/20/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Stop recording COEs unless there are strong reconciliation controls implemented to ensure that amounts that remain open beyond fiscal year-end are related to amounts that will actually be delivered against the related obligation; USMC action plan: USMC initiated Systems Change Requests (SCR) to eliminate the Document Identifier Code (DIC) COE for the movement of household goods via the Marine Corps Permanent Duty Travel (MCPDT) application as well as for manual COEs in SABRS; Targeted completion date: 9/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 4. Strengthen internal controls surrounding the substantiation of obligated amounts recorded for bulk obligations by preparing and maintaining detailed schedules that agree to the amounts recorded within the general ledger; USMC action plan: The USMC has developed and distributed bulk obligation and expense management guidance to define monitoring efforts to ensure obligation accuracy, accrual estimation, and sustainment via reconciliation procedures; Targeted completion date: 8/13/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 5. Make sure that all recorded amounts are supported by sufficient, competent audit evidence, such as the calculation bases or historical analysis for any recorded estimates; USMC action plan: Based on remediation actions and previous efforts to monitor abnormal condition, the USMC effectively eliminated the recognition of manual accruals that are unsupported or lack appropriate audit evidence given the system changes which have eliminated manual expense entries. Therefore, historical analysis is only applicable to timing differences at period end (e.g., MOCAS JV process) where additional analysis is ongoing. The USMC is proceeding with improved accrual estimation via the implementation of an automated accrued liability module that will allow for accurate recognition of period-end expenses. SABRS functional requirements have been designed and implemented; Targeted completion date: 6/30/2010; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 6. Implement review controls at least annually, if not quarterly, to reconcile amounts of accrued delivered orders and identify potential amounts that should be deobligated; USMC action plan: The USMC has developed and distributed bulk obligation and expense management guidance to define monitoring efforts that ensure obligation accuracy, accrual estimation, and sustainment via reconciliation procedures; Targeted completion date: 8/13/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR 2: Lack of Review of Estimated Bulk Obligations: Recommendations: 1. Correct all noted errors identified during Beginning Balance Testing; USMC action plan: The USMC analyzed the validity of delivered and undelivered orders recorded in the Statement of Budgetary Resources; Targeted completion date: 7/21/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: For unsupported amounts, the USMC prepared adjusting journal entries to correct the overstatement of unpaid obligations impacting the presentation of the Fiscal Year 2010 Statement of Budgetary Resources; Targeted completion date: 10/20/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Ensure that expenses are recorded when a liability exists and not at the time of obligations; USMC action plan: USMC initiated Systems Change Requests (SCR) to eliminate the Document Identifier Code (DIC) COE for the movement of Household Goods via the Marine Corps Permanent Duty Travel (MCPDT) application as well as for manual COEs in SABRS. This essentially eliminates the manual recording of the expense at the time when the obligation is entered into the core accounting system (SABRS). Additional monitoring via abnormal and periodic reporting requirements has consistently been a component to the USMC "Deadly Sins" reporting package and Tri-Annual Review (TAR) process. These are monitoring mechanisms that are codified within Marine Corps Order (MCO) 7300.21A, Marine Corps Financial Management Standard Operating Procedure Manual. Action beyond these steps would reside within the Marine Corps' accrual estimation process that is currently under implementation (referenced above); Targeted completion date: 9/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. The use of bulk/estimated obligations should be limited to extreme instances when actual amounts are not known; USMC action plan: The USMC developed and distributed bulk obligation and expense management guidance to define monitoring efforts that ensure obligation accuracy, accrual estimation, and sustainment via reconciliation procedures; Targeted completion date: 8/13/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 4. When bulk/estimated obligations are necessary, strengthen the controls regarding the use of estimates and support the estimation methodology; USMC action plan: The USMC developed and distributed bulk obligation management guidance to define monitoring efforts that ensure obligation accuracy, accrual estimation, and sustainment via reconciliation procedures; Targeted completion date: 8/13/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 5. Ensure existing bulk obligation documents must be reviewed for activity and the beginning balance for obligation be adjusted accordingly; USMC action plan: The USMC analyzed the validity of delivered and undelivered orders recorded in the Statement of Budgetary Resources; Targeted completion date: 7/21/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: For unsupported amounts, the USMC prepared adjusting journal entries to correct the overstatement of unpaid obligations; Targeted completion date: 10/20/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 6. All current year and future transactions that used the bulk/estimated obligation and expense must be reviewed and fully supported as proper; USMC action plan: The USMC developed and distributed bulk obligation management guidance to define monitoring efforts that ensure obligation accuracy, accrual estimation, and sustainment via reconciliation procedures; Targeted completion date: 8/13/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: The Marine Corps audit support team selected a sample of bulk documents in order to evaluate both the implementation of the guidance and the adjusted values reported on the financial statements; Targeted completion date: 10/21/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-3: Liquidation Precede the Recording of Expenses: Recommendations: 1. Strengthen controls surrounding the recordation of expenses prior to, or at the point, of funds disbursal; USMC action plan: Developed management guidance and produce monthly reports from which USMC Commands and HQMC can monitor and address abnormal accounting conditions; Targeted completion date: 8/23/2010; Status according to Marine Corps: Fully Implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Created and implemented a rigorous TAR and Confirmation process to ensure accurate and judicious financial information that provides USMC financial managers and senior leadership with a clear financial picture in order to be good stewards of public funds, accurately account for funds spent, and to comprehend the impact when expending limited financial resources; Targeted completion date: 2/1/2011; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: NFR 1: As a normal course of business, intragovernmental transactions often result in disbursement processing where the USMC is not in receipt of substantiating documentation to ensure delivery, receipt and acceptance of goods or service. While the USMC has published guidance to address proper due diligence in obtaining substantiating evidence to support the proper recording of the expense, the performing activities are remiss in supporting our requests. Therefore, this matter has been elevated for support and substantiation by the Defense Finance and Accounting Service (DFAS) and other service support agencies and departments; Targeted completion date: 10/1/2011; Status according to Marine Corps: Action initiated; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Correct the errors noted during testing of the beginning balances; USMC action plan: Initiated an adjusting journal entry to address auditor identified concerns relating to the noted NFR and other similarly identified issues in order to effect the correct representation on the financial statement; Targeted completion date: 10/20/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Record the liability prior to the disbursement/ liquidation so that account 4801 - Undelivered Orders is reduced and amounts are posted to 4901-Delivered Orders, Unpaid; USMC action plan: Implementing automated accrued liability module that will allow for accurate recognition of period-end expenses. SABRS functional requirements have been designed and implemented. Monthly accruals are anticipated to begin 30 June 2011; Targeted completion date: 6/30/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-4: Lack of Sufficient Audit Evidence to Substantiate Obligations, Expenses, and Disbursements Recorded;: Recommendations: 1. Analyze the identified transactions from Beginning Balance Testing that were unsupported and obtain the related supporting documentation. If not available, record adjustments to remove any unsubstantiated amounts from the general ledger; USMC action plan: USMC initiated a JV adjusting entry in the DDRS-AFS for bulk transactions where no support can be obtained or derived; Targeted completion date: 10/20/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: For COE transactions where no support or adjustment is evident, RFA initiated a comprehensive adjustment initiative that will effectively eliminate all remaining balances for all manually entered COE transactions; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: NFR 1: Initiated Internal Control over Financial Reporting (ICOFR) review of TAR functions and management support for TAR certifications in order to strengthen responsiveness and reliability of fund holder review of obligation, expenses, and liquidations; Targeted completion date: 6/17/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Identify if there are any consistent themes noted during the analysis of the noted errors, such as common transaction types or any specific commands that seem to have a higher error rate than others, we recommend that further efforts be undertaken to perform additional review of these types of transactions or transactions running through any identified commands. If any common themes and/or problem commands are identified, we recommend that management develop and implement the appropriate internal controls guidance, and provide training to the necessary personnel; USMC action plan: Performed analysis of core remediation areas and implemented updates and corrections to systems and management guidance on proper recording and review of financial events. Guidance updates include improved FBWT Standard Operating Procedure (SOP), Military Payroll reconciliation SOPs, and updates to MCO 7300.21A with forthcoming Document Type Code and Reimbursable Type Code documentation and analysis. Audit remediation efforts also yielded improved systems functionality and representation of transaction-level details; Targeted completion date: 7/11/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Implement internal controls to ensure that sufficient, competent, and independent evidence is maintained and readily available upon request pursuant to USMC, DOD, GAO, and OMB guidance. Additionally, we recommend that the USMC ensure this documentation traces to and supports the amounts recorded within SABRS; USMC action plan: Published management guidance that empowers Commands and HQMC with information resource tools that enable the timely retrieval of source documentation to support audit requirements and assist in providing complete audit sample documentation; Targeted completion date: 9/3/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-5: Advances Recorded That Are Actually Contract Financing Payments: Recommendations: 1. Correct errors noted during the performance of Beginning Balance Testing; USMC action plan: The Marine Corps and DFAS teams have identified all 6W transactions impacting all general ledger balances. The universe was confirmed as accurate via a comparative assessment of independent data extracts that were independently performed by DFAS and USMC RFA (resources and accounting and personnel); Targeted completion date: 8/31/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Based on the universe identified with the above corrective action, the DFAS audit support team engaged in an exhaustive reconciliation of the 6W transaction type code processing in order to ensure that progress payments are properly classified and/or updated for noted variances; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: RFA initiated a comprehensive adjustment initiative that will effectively reclassify progress payments from general ledger accounts 4802 to 4902; Targeted completion date: 9/30/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Strengthen controls surrounding the monitoring of the coding of expenditures by the accounting service provider (DFAS) so that the contract financing payments will be recorded properly; USMC action plan: An SCR has been processed that effectively eliminates the automatic change of the transaction type code reflected in Defense Cash Accountability System. Subsequent to SCR processing, DFAS review of associated Marine Corps transactions indicates that the system change was successful. In addition, DCAS users at DFAS-Columbus were provided instruction on the proper processing of transaction type codes; Targeted completion date: 4/10/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Evaluate contract payments at the transaction level to determine if the payment should be classified as an advance or as a contract financing payment and correct the beginning balances accordingly; USMC action plan: The USMC and DFAS teams are engaged in processing appropriate redistribution of payments to correct the erroneous transaction type code postings; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: The USMC has initiated a process to correct the SABRS table posting logic to correctly classify contract financing payments; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: RFA has initiated a comprehensive adjustment initiative that will effectively reclassify progress payments from general ledger accounts 4802 to 4902; Targeted completion date: 9/30/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 4. Correct current year transactions that used the same process to contract payments and ensure future payments are recorded properly; USMC action plan: RFA has initiated a comprehensive adjustment initiative that will effectively reclassify progress payments from general ledge accounts 4802 to 4902; Targeted completion date: 9/30/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-6: Lack of Review of Stale Obligations Recorded: Recommendations: 1. Analyze the noted errors in appropriate U.S. Standard General Ledger (USSGL) accounts 4801, 4802, and 4901, and determine whether these amounts are still valid. Analyze all other open undelivered orders and delivered orders to make sure that these amounts remain valid. If not, then adjustments need to be recorded accordingly; USMC action plan: For each bulk transaction identified in the data call, HQMC have initiated an analysis of the validity of delivered and undelivered orders recorded in the SBR; Targeted completion date: 7/15/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: For each COE transaction identified, RFA has initiated an analysis of the validity of delivered and undelivered orders recorded in the SBR; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: The USMC developed management guidance and produce monthly reports from which Marine Corps Commands can monitor and address abnormal accounting conditions; Targeted completion date: 8/23/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Initiated Internal Control over Financial Reporting (ICOFR) review of Tri-annual Review (TAR) functions and management support for TAR certifications in order to strengthen responsiveness and reliability of fund holder review of obligation, expenses and liquidations; Targeted completion date: 6/17/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Identify if there are any consistent themes within these problem items, such as common transaction types or any specific commands that seem to have a higher error rate than others, we recommend that further efforts be undertaken to perform additional review of these types of transactions or transactions running through any identified commands, and adjustments be made accordingly to correct any noted error. If so, we also recommend the development and implementation of guidance and training to prevent these deficiencies from occurring in the future; USMC action plan: Performed analysis of core remediation areas and implemented updates and corrections to systems and management guidance on proper recording and review of financial events. Guidance updates include improved FBWT SOP, Military Payroll reconciliation SOPs, and updates to MCO 7300.21A with forthcoming Document Type Code and Reimbursable Type Code documentation and analysis. Audit remediation efforts also yielded improved systems functionality and representation of transaction-level details; Targeted completion date: 7/11/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Strengthen controls for those contracts that are managed internally by USMC contracting officers surrounding the review of open obligations and more specifically related to the use of procurement appropriations to ensure a more timely and active review of the contracts and identification of needs that are no longer valid. Funds Managers, Contracting Officer Technical Representatives (COTR), and Contracting Activities should be corresponding on or about, if not prior to the expiration of the period of performance to ensure timely contract closeout; USMC action plan: Created and implemented a rigorous TAR and confirmation process to ensure accurate and judicious financial information provides Marine Corps financial managers and senior leadership with a clear financial picture in order to be good stewards of public funds, accurately account for funds spent, and comprehend the impact when expending limited financial resources; Targeted completion date: 2/1/2011; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 4. For those contracts that are managed externally by trading partners, strengthen the controls surrounding the review of open obligations and have the COTRs, Funds Managers, and/or using units more actively communicate with the trading partners to close any contracts that are no longer valid/open, or for which deliveries of goods/services are completed and need to be billed/invoiced. These communications should take place on or about, if not prior to, the expiration of the period of performance to ensure timely contract closeout; USMC action plan: The USMC updated the verbiage within Military Interdepartmental Purchase Request (MIPR) with an explicit clause highlighting the need by the performing activity to provide supporting documentation on a monthly basis; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Provided consistent guidance and update in maintaining all level of due diligence to ensure that supporting documentation is obtained from the performing activity. This is explicitly highlighted in MCO 7300.21A; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: The USMC coordinated improved retention and transmission practices by DFAS in order to strengthen Intra- Governmental Payment and Collection processing. This requires DFAS to provide substantiating details that support the processing of intra- departmental disbursements; Targeted completion date: 9/30/2011; Status according to Marine Corps: Action; initiated; Confirmed by DOD IG (yes/no): No. Recommendations: 5. Ensure compliance with USMC policy on daily Funds Manager reviews; USMC action plan: Developed management guidance and produce monthly reports from which Marine Corps Commands and HQMC can monitor and address abnormal accounting conditions; Targeted completion date: 8/23/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 6. Strengthen the Tri-annual Review Controls to ensure reviews of all open obligations, travel advances, and accrued expenses are occurring as required by the DOD FMR and that any necessary adjustments are being made in a timely manner; USMC action plan: Created and implemented a rigorous TAR and Confirmation process to ensure accurate and judicious financial information provides USMC financial managers and senior leadership with a clear financial picture in order to be good stewards of public funds, accurately account for funds spent, and comprehend the impact when expending limited financial resources. Inaccurate accounting of limited financial resources ultimately leads to lost opportunities to provide critical support to the war-fighter; Targeted completion date: 2/1/2011; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-7: Lack of Completeness of Delivered Orders: Recommendations: 1. Analyze the subsequent disbursements identified in the Beginning Balance Testing and record the necessary adjustments to the financial statements; USMC action plan: Initiated an adjusting journal entry to address auditor identified concerns relating to the noted NFR and other similarly identified issues in order to effect the correct representation on the financial statement; Targeted completion date: 10/20/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Strengthen internal controls surrounding the recording of delivered orders by ensuring that receivers understand how to assign the dates of receipt and acceptance to correspond to the actual dates of delivery of goods and/or services; USMC action plan: Performed analysis of core remediation areas and implemented updates and corrections to systems and management guidance on proper recording and review of financial events. Guidance updates include improved FBWT SOP, Military Payroll reconciliation SOPs, and updates to MCO 7300.21A with forthcoming Document Type Code and Reimbursable Type Code documentation and analysis. Audit remediation efforts also yielded improved systems functionality and representation of transaction-level details; Targeted completion date: 7/11/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Develop a search for unrecorded liabilities at fiscal year-end to be accrued during preparation of the annual financial statements; USMC action plan: Implementing automated accrued liability module that will allow for accurate recognition of period-end expenses. SABRS functional requirements have been designed and implemented. Monthly accruals are anticipated to begin by 30 June 2011; Targeted completion date: 6/30/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 4. Implement a review control for Wide Area Work Flow (WAWF) invoices entered at fiscal year-end that do not have accounting station codes assigned to identify items to be accrued; USMC action plan: Action is congruent with policy and guidance updates associated with Marine Corps Order (MCO) 7300.21A. The USMC is coordinating with its service providers in order to ensure proper data entry in WAWF; Targeted completion date: 7/11/2011; Status according to Marine Corps: Action initiated; Confirmed by DOD IG (yes/no): No. Recommendations: 5. Develop and deploy policy guidance to ensure personnel in the field record accruals for delivered orders as required by the Federal Accounting Standards Advisory Board (FASAB), Treasury, DOD, and USMC requirements; USMC action plan: Action is congruent with policy and guidance updates associated with MCO 7300.21A. The USMC is coordinating with its service providers in order to ensure proper data entry in WAWF; Targeted completion date: 7/11/2011; Status according to Marine Corps: Action initiated; Confirmed by DOD IG (yes/no): No. NFR-8: Lack of Timely Funds Manager Reviews: Recommendations: 1. Correct errors noted during the performance of Beginning Balance Testing,; USMC action plan: Initiated USMC command review of abnormal accounting conditions with emphasis on resolving all errors identified in RFA provided reports; Targeted completion date: 8/18/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Strengthen controls surrounding daily Funds Manager reviews; USMC action plan: Developed management guidance and produce monthly reports from which Marine Corps Commands and HQMC can monitor and address abnormal accounting conditions; Targeted completion date: 8/23/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Implement reviews of Military Standard Requisition and Issue Procedures (MILSTRIP) transactions/orders in an effort to limit post closeout adjustments that cause abnormal balances; USMC action plan: Developed management guidance and produce monthly reports from which Marine Corps Commands and HQMC can monitor and address abnormal accounting conditions; Targeted completion date: 8/23/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 4. Implement/improve financial reporting controls over abnormal balances to ensure timely reviews, investigations, and corrections of abnormal balances; USMC action plan: Developed management guidance and produce monthly reports from which Marine Corps Commands and HQMC can monitor and address abnormal accounting conditions; Targeted completion date: 8/23/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-9: Recording of 6W Transactions in the MOCAS System: Recommendations: 1. Correct errors noted during the Beginning Balance Testing for the identified sample items; USMC action plan: The Marine Corps and DFAS teams have identified all 6W transactions impacting all general ledger balances. The universe was confirmed as accurate via a comparative assessment of independent data extracts that were independently performed by DFAS and RFA personnel; Targeted completion date: 8/31/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: The DFAS audit support team engaged in an exhaustive reconciliation of the 6W transaction type code processing in order to ensure that progress payments are properly classified and/or updated for noted variances; Targeted completion date: 9/30/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Strengthen controls surrounding the use of the 6W and 6W--Credit Mechanization of Contract Administration Services (MOCAS) transactions; USMC action plan: An SCR has been processed that effectively eliminates the automatic change of the transaction type code reflected in DCAS. Subsequent to SCR processing, DFAS review of associated Marine Corps transactions indicates that the system change was successful. In addition, DCAS users at DFAS-Columbus were provided instruction on the proper processing of transaction type codes; Targeted completion date: 4/10/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Marine Corps has initiated a process to correct the SABRS table posting logic to correctly classify contract financing payments to the correct budgetary account; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Use the 6W transactions be used only when the USMC truly has an advance and not in the instance of a contract financing payment; USMC action plan: Marine Corps has initiated a process to correct the SABRS table posting logic to correctly classify contract financing payments to the correct budgetary account; Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 4. Review the 6W MOCAS transactions those that are actually contract financing payments be reclassified into USSGL 4902 - Delivered Orders, Paid and out of USSGL 4802 Undelivered Orders, Paid; USMC action plan: RFA will initiate a comprehensive adjustment initiative that will effectively reclassify progress payments. This will involve initiating a JV adjusting entry in DDRS-AFS that will be corroborated by a detailed schedule of unsupported transactions and their amounts; Targeted completion date: 9/30/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-10: Reconciliation of MCTFS to MRCV to DCAS Disbursement Data to SABRS Balances: Recommendations: 1. Strengthen controls surrounding the monthly reconciliation of MCTFS to Monthly Reconciliation/Certification Voucher (MRCV) to DCAS Disclosure Data to SABRS. Specifically, USMC needs to perform these four-way reconciliations starting October 2009; USMC action plan: Implemented military (active duty) entitlements pay reconciliation that compares the interfaced amounts from MCTFS, SABRS, and DCAS by document number, voucher, appropriation, and Disbursing Station Symbol Number (DSSN); Targeted completion date: 10/1/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-11: Temporary and Permanent MILPAY Standard Document Numbers (SDN) Balances: Recommendations: 1. Strengthen controls surrounding the timely recording of net payroll reversals to temporary SDNs so that such reversals are completed in the same month as the payroll to which they correspond; USMC action plan: The Marine Corps Program Review Team (MCPRT) refined its reconciliation practices to better account for current-year temporary SDN balances. SOPs and other operating documents have been developed to ensure process transparency, consistency, and repeatability; Targeted completion date: 10/14/2010; Status according to Marine Corps: Fully Implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Reconcile the temporary SDNs for prior years and adjust the beginning balance of 4902-Delivered Orders, Paid, accordingly; USMC action plan: MCPRT refined its reconciliation practices to better account for current-year temporary SDN balances. SOPs and other operating documents have been developed to ensure process transparency, consistency, and repeatability; Targeted completion date: 10/14/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Perform reconciliations of temporary and permanent SDNs for the current year and all future periods; USMC action plan: MCPRT communicated that approximately 52,000 transactions have been reviewed for correctness and appropriate posting to a permanent SDN. The remaining 4,000 transactions are currently under review; Targeted completion date: 9/1/2010; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-12: Improper Use of Recoveries (Upward/Downward Adjustments): Recommendations: 1. Correct the exceptions noted, and examine amounts recorded in accounts to identify other items that also require adjustment, and record corrections for those items; USMC action plan: DFAS to reclassify current year amounts from General Ledger Accounts 4871/4881 to 4801/4901, respectively, to ensure the accurate reporting of Recoveries; Targeted completion date: 6/30/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Develop, document, and implement policies and procedures to ensure that the subsequent adjustments are recorded in the USSGL accounts; USMC action plan: System adjustment in SABRS will be implemented ahead of DFAS reclassification in order to ensure the proper posting of Recoveries for all future transactions; Targeted completion date: 6/30/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-13: Lack of Timely and Accurate Recording of Transactions: Recommendations: 1. Correct noted errors identified during the performance of Beginning Balance Testing,; USMC action plan: Initiated USMC command review of bulk transactions in order to support the accuracy or adjustment to the transaction balance; Targeted completion date: 8/18/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Strengthen internal controls over the recording of obligations and any related changes by requiring periodic reconciliations of obligations, as well as the recording of corresponding delivered orders; USMC action plan: Initiated USMC command review of abnormal accounting conditions with emphasis on resolving all errors identified in RFA provided reports; Targeted completion date: 8/18/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Initiated Internal Control over Financial Reporting (ICOFR) review of TAR functions and management support for TAR certifications in order to strengthen responsiveness and reliability of fund holder review of obligation, expenses, and liquidations; Targeted completion date: 6/17/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 3. Improve the management review process over recorded transactions ensuring that the recorded amounts are entered properly and supported with appropriate documentation; USMC action plan: Developed management guidance and produce monthly reports from which Headquarters Marine Corps (HQMC) can monitor and address abnormal accounting conditions; Targeted completion date: 8/23/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Published management guidance that empowers Commands and HQMC with information resource tools that enable the timely retrieval of source documentation to support audit requirements and assist in providing complete audit sample documentation; Targeted completion date: 9/3/2010; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-14: Improper Recording of Shared Appropriations with Navy: Recommendations: 1. Correct the misclassifications noted; USMC action plan: Analyzed allocation of Shared Appropriations and provided amplifying guidance on financial statement disclosures related to Shared Appropriations; Targeted completion date: 4/29/2011; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. USMC action plan: Analyzed Shared Appropriations reconciliations to Fund Balance with Treasury (FBWT) and demonstrated relationship to component level Report on Budget Execution and Budgetary Resources (SF- 133); Targeted completion date: 5/4/2011; Status according to Marine Corps: Fully implemented; Confirmed by DOD IG (yes/no): No. Recommendations: 2. Establish policy to record shared appropriations as non-expenditure transfers and implement internal controls to ensure the policy is followed; USMC action plan: Prepared response to support USMC actions in recording the Shared Appropriations with the Department of the Navy (DON). With no specific line for reporting on Allocations Received, the USMC contends that the current representation on the financial statement is accurate and supportable; Targeted completion date: 5/2/2011; Status according to Marine Corps: Partially implemented; Confirmed by DOD IG (yes/no): No. Source: Marine Corps SBR remediation action plan information and DOD IG confirmation of status. [End of table] Table 2 shows the recommendations related to the Marine Corps Total Force system (military payroll system); the Marine Corps' action plans to remediate these recommendations, reported implementation status, and targeted completion dates; and notes whether the DOD IG confirmed the effectiveness of the Marine corps' implementation. Table 2: DOD IG Recommendations, Reported Status of USMC Actions on MCTFS Information Technology System Issues as of July 18, 2011, and DOD IG Confirmation of Marine Corps Statuses as of August 25, 2011: NFR-1: MCTFS Certification and Accreditation Process/DOD Information Assurance Certification and Accreditation Process (DIACAP) Was Still in Process and not Complete: Recommendations: 1. USMC management should complete the DIACAP process and continue to remediate any identified weaknesses to attempt to achieve a full Authority To Operate (ATO). 2. USMC management should ensure that an up-to-date ATO is available for all feeder applications that interface with MCTFS; USMC action plan: NFR-1: MCTFS Certification and Accreditation Process/DOD Information Assurance Certification and Accreditation Process (DIACAP) Was Still in Process and not Complete: The Technology Services Organization (TSO) has completed the DOD Information Assurance Certification and Accreditation Process (DIACAP) process for MCTFS and has received ATO from the USMC Designated Accrediting Authority (DAA); Targeted completion date: 5/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-2: Logging and monitoring is not performed at the local application level. Formal policy and procedures for the monitoring performed by third party providers have not been documented: Recommendations: 1. USMC management establish a formal process for monitoring activity, including the interaction with third party service providers and execute that process on a periodic basis. 2. USMC management ensure that responsibilities for logging and monitoring of logs are addressed and defined in service level agreements (SLA) with third party providers. 3. USMC management incorporate Privacy Act compliance into the SLA; USMC action plan: The TSO Management will update and incorporate the following in our guidance documents: - Formal policy and procedures for monitoring third-party providers - Formal requirements to review audit logs on a periodic basis; Targeted completion date: 10/01/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-3 Marine Corps Total Force System (MCTFS) Password Management: Recommendations: 1. USMC management formally document a policy and procedures for MCTFS password management. 2. USMC management implement an electronic signature (ELSIG) personal identification number (PIN) expiration setting that will force PIN changes on a periodic basis.; USMC action plan: The TSO Management has updated its Desk-Top- Procedures to incorporate policy and procedures for password management; Targeted completion date: 5/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): Yes. NFR-4 Supporting Documentation for 7 out of 45 Change Management Sample Items Could not Be Provided: Recommendations: 1. USMC management should establish a policy to review the system change request (SCR) approval package to ensure all Configuration Items (CI) are included. 2. Management should also ensure an audit trail exists that includes a mapping of System Change Requests (SCR) to their associated CIs and classification of change; USMC action plan: NFR-1: MCTFS Certification and Accreditation Process/DOD Information Assurance Certification and Accreditation Process (DIACAP) Was Still in Process and not Complete: These seven items referenced were either non-MCTFS related modules that are not associated with any MCTFS SCR or symbolic maps which are generated out of a Customer Information Control System (CICS) map compile. These are system generated and not a CI maintained by MCTFS; Targeted completion date: N/A; Status according to USMC: Non-concur; Confirmed by DOD IG (yes/no): No. NFR-5 Emergency Changes Are not Able To Be Separately Identified from the Overall Change Management Population: Recommendations: 1 USMC management should implement a process or identifier to enable the identification of changes that relate to emergency changes so they may be tracked and analyzed.; USMC action plan: The TSO understands and accepts the risks identified; Targeted completion date: 5/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-6 Marine Corps Total Force System (MCTFS) Configuration Management Compliance Audit: Recommendations: 1. USMC management establish a periodic review of changes that are migrated to production that includes a complete, accurate population of CIs (both PanAPT and non-PanAPT changes). The frequency of review should be commensurate with the level of risk. 2. USMC management follow-up and research potentially unauthorized changes be performed by individuals not involved with the CI migration process and the follow-up should be formally documented.; USMC action plan: The TSO Management has established criteria and has started performing periodic reviews of changes that are migrated into production. In addition, the TSO Management has established guidance, performed, and documented follow- up for any authorized changes that are found; Targeted completion date: 5/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-7 Marine Corps Total Force System (MCTFS) Contingency Plan Has not Been Approved or Tested: Recommendations: 1. USMC management finalize the MCTFS contingency plan so that it can be approved by the appropriate individual of the organization. 2. USMC management develop a Business Impact Analysis (BIA) for MCTFS. 3. USMC management test the MCTFS contingency plan to evaluate its effectiveness on an annual basis; USMC action plan: A test of the MCTFS Contingency Plan is planned for 2011. A MCTFS BIA is being developed; Targeted completion date: 10/01/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-8 Marine Corps Total Force System (MCTFS) Data Strategy and Design Is not Formally Documented: Recommendations: 1. USMC management develop a data management strategy and design that includes requirements specific to MCTFS, including regulatory requirements and database standards; USMC action plan: TSO will coordinate with the Functional Managers (FM) to formalize the Data Management Strategy, which is an FM responsibility; Targeted completion date: 10/01/2011; Status according to USMC: Actions underway; Confirmed by DOD IG (yes/no): Yes. NFR-9 Marine Corps Total Force System (MCTFS) Tolerance and Parameter Review: Recommendations: 1. USMC management implement a periodic review of the input processing edit checks, warnings/alerts, parameters, and tolerance values for the MCTFS application. If an improper configuration status is identified in the review, changes should follow an established change management process; USMC action plan: The same processes that are currently in place for new legislative changes are also in place for Marine Corps identified issues above and beyond legislation mandated changes to the system. Marine Corps Administrative Analysis Team (MCAAT) performs monitoring activities and provides feedback reports. The Manpower Information Systems Support Office (MISSO) also holds training and feedback sessions with the administrative units to solicit changes. MI and RFF hold annual MCTFS conferences and workshops to solicit changes. Also, the Configuration Management Board (CMB) holds a periodic review where system changes are reviewed. The semi-annual Configuration Control Board (CCB) performs another periodic review. In fact, the TSO submits technical projects (developed as a result of internal periodic reviews as well as joint application development sessions (JADS)) to the functional managers for approval and subsequent inclusion into the CCB approval process; Targeted completion date: N/A; Status according to USMC: Non-concur; Confirmed by DOD IG (yes/no): Yes. NFR-10 There Is No Data Design and Strategy Documentation or Operating Procedures Available for Data Processing Between the Unit Diary/Marine Integrated Personnel System (UD/MIPS) and the Marine Corps Total Force System (MCTFS): Recommendations: 1. USMC management develops interface design and strategy documentation for the data processing between Unit Diary Marine Integrated Personnel System (UD/MIPS) and MCTFS in order to reasonably assure that the data processed is accurate and complete; USMC action plan: Both UD/MIPS and MCTFS Certification and Accreditation (C&A) package contain system interface information wherein both interfaces are annotated and described. Both these systems are in the same family of systems (FOS), meaning that they are internal interfaces not external. No system interface agreement (SIA) is needed. Additionally, all interfaces are documented in data manager and a file layout is included in the Design Logic Tool (DLT). We have documentation for all MCTFS interfaces in Data Manager, but not "interface design documentation". We keep purely meta data about the interface: Dataset names, input or output, sponsors etc.; Targeted completion date: N/A; Status according to USMC: Non-concur; Confirmed by DOD IG (yes/no): No. NFR-11 Developer Access to Production Environment of the MCTFS Collection Server: Recommendations: 1. USMC management enforce a user account policy for the collection server that establishes accountability at the individual user level. 2. USMC management should grant administrative level access only if the individual's job functions require such access. 3. USMC management limit any developer access to production as read- only access; USMC action plan: This issue will be mitigated once the TSO completes its migration to the Kansas City IT Center and are connected to Active Directory allowing Common Access Card (CAC) authentication and logging for each user; Targeted completion date: 11/01/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-12 Not all transactions are properly recorded between the entitlements and feeder applications into MCTFS: Recommendations: 1. USMC management implement a mechanism that ensures that all transactions entered and processed through MCTFS are backed up and are able to be restored and recreated if required. 2. Additionally, it is recommended that USMC management implement a mechanism that ensures that transactions processed through MCTFS cannot be back-dated; USMC action plan: This issue is the risk that transactions will fall off the Transaction Research File (TRF) after 180 days. If a diary that was 190 days old was certified, it's true that it would immediately fall off the TRF, however, the input transaction datasets could be restored from the archives. There is no possibility of data not being able to be restored; Targeted completion date: N/A; Status according to USMC: Non-concur; Confirmed by DOD IG (yes/no): N/A. NFR-13 Marine Corps Total Force System (MCTFS) System Authorization Access Request (SAAR) Forms: Recommendations: 1. USMC management should implement a procedure to properly retain the System Access Authorization Request (SAAR) forms for authorizing access to MCTFS; USMC action plan: TSO Management will work with the FM to implement procedures to retain SAAR forms for establishing and authorizing user access to MCTFS and will update the Security Management Plan to include the SAAR Retention process; Targeted completion date: 9/01/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-45 Marine Corps Total Force System (MCTFS) User Account Review: Recommendations: 1. USMC management develop a formal procedure to properly document the daily user access audits. 2. USMC management develop a procedure to ensure that a member cannot have multiple MCTFS end-user Accessor Identification (ACID); USMC action plan: The TSO management has established procedures to formally document that daily audits are performed when the TSO mainframe security personnel perform reviews to ensure that MCTFS application users are limited to one end-user ACID; Targeted completion date: NFR-1: MCTFS Certification and Accreditation Process/DOD Information Assurance Certification and Accreditation Process (DIACAP) Was Still in Process and not Complete: 5/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-46 The Software Development Plan for MCTFS Release SR 2-10 Has not Been Formally Approved and Signed by Management: Recommendations: 1. USMC management formally document their review and approval for System Development Plans (SDP) for every scheduled configuration management release; USMC action plan: The SDP for SR 2-10 is signed indicating approval. Future SDPs will be signed for scheduled configuration management releases as is the documented practice; Targeted completion date: 5/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): Yes. NFR-56 MCTFS A-123 Assessment: Recommendations: 1. USMC management should perform a review of internal controls in accordance with OMB Circular A-123 for MCTFS; USMC action plan: TSO will support higher headquarters A-123 Compliance Assessment initiatives as directed; Targeted completion date: 9/30/2011; Status according to USMC: Actions underway; Confirmed by DOD IG (yes/no): No. Source: Marine Corps SBR remediation action plan information and DOD IG confirmation of status. [End of table] Table 3 shows the recommendations related to the Marine Corps; Standard Accounting, Budgeting, and Reporting System (general ledger accounting system); the Marine Corps' action plans to remediate these recommendations, reported implementation status, and targeted completion dates; and notes whether the DOD IG has confirmed the effectiveness of the Marine Corps' implementation. Table 3: DOD IG Recommendations, Reported Status of USMC Actions SABRS Information Technology System Issues as of July 18, 2011, and DOD IG Confirmation of Marine Corps Status as of August 25, 2011: NFR-14 Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) Package Inherited Services: Recommendations: 1. USMC management coordinate with DFAS management to assign ownership and responsibility for those information assurance (IA) controls identified under USMC control and ensure all other IA controls are handled by third-party providers; USMC action plan: System Management Directorate (SMD)-CL will coordinate with DFAS-CL and TSO-KC & correctly assign ownership and responsibility for all IA controls not inherited by DISA. SABRS DIACAP packages will be updated to reflect changes; Targeted completion date: 8/05/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-15 Standard Accounting, Budgeting and Reporting System (SABRS) Feeder Systems Authority to Operate (ATO) and Security Control Validation: Recommendations: 1. USMC management coordinate with DFAS management to request an up-to-date ATO (or equivalent authorization) and verification of the last time security controls were tested for each of its feeder application systems that interface with SABRS; USMC action plan: Authority to operate documentation has been requested from System Managers and will be provided once received; Targeted completion date: 10/01/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-16 Standard Accounting, Budgeting and Reporting System (SABRS) Application Level Logging and Monitoring: Recommendations: 1. USMC management coordinate with DFAS management to establish a formal process for monitoring activity, including the interaction with third-party service providers and execute that process on a periodic basis. 2. USMC management coordinate with DFAS management to establish policies and procedures for handling of lost or compromised passwords, including interaction with third-party service providers. 3. USMC management coordinate with DFAS management to ensure that responsibilities for logging and monitoring of logs are addressed and defined in Service Level Agreements (SLA) with third- party providers; USMC action plan: All logging application level logging and monitoring is controlled by the DISA's Defense Enterprise Computing Centers (DECC); Targeted completion date: Date not provided; Status according to USMC: Non-concur; however, partially implemented; Confirmed by DOD IG (yes/no): No. NFR-17 Standard Accounting, Budgeting and Reporting System (SABRS) Emergency Changes: Recommendations: 1. USMC management coordinate with DFAS management to implement a process or identifier to enable the identification of changes that relate to emergency changes so they may be tracked and analyzed; USMC action plan: Configuration management policy and procedures have been updated; Targeted completion date: 1/15/2010; Status according to USMC: Non-concur; however, fully implemented; Confirmed by DOD IG (yes/no): No. NFR-18 SABRS User Provisioning Process: Recommendations: 1. USMC management coordinate with DFAS management to ensure that all access to SABRS, including changes to previous access rights and privileges, follow a consistent process that includes timely documented supervisory review and approval as well as identification and documentation of the specific privileges requested and granted; USMC action plan: Marine Corps order (MCO) P7300 will be updated; Targeted completion date: 8/31/2011; Status according to USMC: Actions underway; Confirmed by DOD IG (yes/no): No. NFR-19 Inappropriate Access to SABRS Tables 204 and 205: Recommendations: 1. USMC management coordinate with DFAS management to remove access to any user who has the ability to execute transactions in both spending and authorization tables to resolve the segregation of duties conflict. 2. USMC review current user privileges for SABRS are reviewed to identify any additional SOD conflicts; USMC action plan: MCO P7300 will be updated; Targeted completion date: 8/31/2011; Status according to USMC: Non-concur; however, actions underway; Confirmed by DOD IG (yes/no): No. NFR-20 Management Does not Perform Formal Periodic Reviews to Recertify SABRS Account Access: Recommendations: 1. USMC management coordinate with DFAS management to establish policies and procedures for access recertification of SABRS users and communicate the requirements to USMC commands and activities that utilize the system. USMC management should coordinate with DFAS to perform periodic reviews of SABRS users in the DFAS organization to detect inappropriate or excessive access and modify user accounts as necessary; USMC action plan: USMC has coordinated with DFAS and established policies/procedures for periodic recertification for SABRS access; Targeted completion date: 8/31/2011; Status according to USMC: Fully implemented (completed ahead of schedule); Confirmed by DOD IG (yes/no): No. NFR-22 The SABRS Change Management Process Does not Include Formal Procedures Documented for Addressing Mass Global Changes: Recommendations: 1. USMC management coordinate with DFAS management to ensure that mass global changes are authorized, approved, and can be audited back to the originating account or transaction prior to the global change. The policies and procedures for mass global changes should provide for the traceability to the associated Configuration Items (CI); USMC action plan: Reference to the Software AG Manual has been added to SABRS Configuration Management Plan to further clarify how Global Data Area (GDA) changes are handled; Targeted completion date: 5/31/11; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-23 Standard Accounting, Budgeting and Reporting System (SABRS) Change Management Process: Recommendations: 1. It is recommended that USMC management coordinate with DFAS management to implement a solution to allow them to track all changes that are moved to production for the SABRS system. This will allow for a complete audit trail to exist and management will have an accurate population of changes being migrated to production. 2. When CIs are deleted from production, evidence of management approval should be retained. Finally, all changes moved to production should have documented authorization and approval from management.; USMC action plan: Part 1: The signature approval block has been removed as signature is no longer required. Part 2: Addressed in NFR 22; Targeted completion date: NFR- 14 Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) Package Inherited Services: 2/28/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-24 The Standard Accounting, Budgeting and Reporting System (SABRS) Continuity of Operations Plan (COOP): Recommendations: 1. USMC management coordinate with DFAS management to obtain the approval for the Continuity of Operations (COOP) from the appropriate individuals of the organization. 2. USMC management coordinate with DFAS management to develop a Business Impact Analysis and a Crisis Communication Plan. 3. USMC management coordinate with DFAS management to test for unauthorized access during a SABRS COOP test exercise; USMC action plan: SABRS Program Management Office has updated the COOP to include test scenarios to restrict access of unauthorized personnel during the test and coordinate for approval. A Business Impact Analysis and Crisis Communication Plan has been developed and included in the appendix of the COOP; Targeted completion date: 4/30/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-25 SABRS Transaction Logging and Monitoring: Recommendations: 1. USMC management coordinate with DFAS management to formalize policies and procedures for conducting periodic reviews of SABRS transactions. The policies and procedures should be established and communicated to DFAS and USMC commands that utilize the SABRS system; USMC action plan: MCO P7300.21 will be updated to task all commands with certification of corrective action on prescribed basis. Updates will include a stronger emphasis on the requirement for continuous review and validation of all financial events recorded in SABRS; Targeted completion date: 8/31/2011; Status according to USMC: Actions underway; Confirmed by DOD IG (yes/no): No. NFR-26 SABRS Business Process Input Edit Checks: Recommendations: 1. USMC management coordinate with DFAS-CL to review the SABRS system to ensure the existing edit check configurations are established in accordance with current and approved Functional Requirements Documents (FRD). 2. USMC management coordinate with DFAS-CL management to establish a method to ensure GL accounts are auto-balanced, and duplicate transactions are blocked/prevented from further processing; USMC action plan: The SABRS Program Management Office and the USMC TSO has included test scenarios for all business rules, validations, and edit checks contained in the design document as part of System Integration Testing (SIT) and System Acceptance Testing (SAT); Targeted completion date: 4/30/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-27 Interface Reconciliation Reports Are not Available for Six SABRS Feeder Systems: Recommendations: 1. USMC management coordinate with DFAS management to develop a reconciliation report for interface data transfer for all feeder systems and develop a policy and procedure for review and investigation of error transactions. 2. DFAS-CL assign responsibility to feeder system owners for adequately confirming that the interface data transfer totals are complete and accurate between the feeder system and SABRS.; USMC action plan: USMC management is coordinating with DFAS management to reviewing internal controls and identifies ways to improve the process by defining additional procedures and policies. The parties are also reviewing the internal reject report and file to provide positive assurance; Targeted completion date: 5/31/2011; Status according to USMC: Non-concur; however, fully implemented; Confirmed by DOD IG (yes/no): No. NFR-28 Retired Document Identifier Codes (DIC) Still Exist in the Active Production SABRS Environment: Recommendations: 1. It is recommended that USMC management coordinate with DFAS management to develop guidance governing the management of SABRS table 200 and perform periodic reviews of all DICs in table 200 to ensure that only DICs that provide valid and current business process functionality are included. Retired DICs should be removed from SABRS table 200, the active production repository for all SABRS DICs, so that users cannot process transactions within SABRS using retired DICs; USMC action plan: SABRS software release (SR) 1-11 was implemented on February 19, 2011, to include comments on retired DICs. USMC management is developing guidance to identify retired DICS and to prevent inappropriate use of the DICS; Targeted completion date: 2/19/2011; Status according to USMC: Non-concur, however, fully implemented; Confirmed by DOD IG (yes/no): No. NFR-29 Functional Requirements Document and Memorandum of Agreement Documentation for SABRS Interfaces Are not Current, Finalized, and Approved by Management: Recommendations: 1. USMC management coordinate with DFAS management to perform a comprehensive review of Functional Requirements Documents (FRD) and Memoranda of Agreement (MOA) for all key feeder systems that interface with SABRS. Documents should include error handling procedures and have formal review and approval from management; USMC action plan: SABRS Program Management Office will coordinate with TSO-KC to perform a comprehensive review of FRDs and System Connection Agreements (SCA) for all feeder systems that interface with SABRS. As necessary, FRDs and SCAs will be updated to include error handling procedures and have formal review and approval from management; Targeted completion date: 8/30/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-30 General Ledger Table Data and User Maintenance Policies, Procedures, and Audit Trail: Recommendations: 1. USMC management coordinate with DFAS management to develop an audit trail to systematically track changes to the GL tables and establish a periodic review policy and procedure for these changes. 2. USMC management coordinate with DFAS management to review the individual user IDs that have the ability to modify the GL tables and remove any individuals whose job description and role do not warrant further access (based upon the concept of least privilege).; USMC action plan: SABRS Program Management Office (PMO) is reviewing additional controls to add an audit trail to maintain the central tables. SABRS PMO is also reviewing profiles for who should have access to the GL tables. General Ledger Team is making changes to the related tables and updating the polices and procedures accordingly.; Targeted completion date: 6/30/2011; Status according to USMC: Non-concur; however, fully implemented; Confirmed by DOD IG (yes/no): No. NFR-31 SABRS Interface Error Reports: Recommendations: 1. USMC management coordinate with DFAS-CL to develop an interface error report for MCTFS and the Defense Civilian Pay System (DCPS). 2. USMC management coordinate with DFAS-CL to establish a policy so that Management can identify and correct any errors that occur during the data transfer between feeder applications and SABRS.; USMC action plan: SABRS Program Management Office has modified the interface with DCPS. DCPS interface errors are now captured in a report that previously did not exist; Targeted completion date: 5/31/2011; Status according to USMC: Non-concur; however, fully implemented; Confirmed by DOD IG (yes/no): No. NFR-32 SABRS Interface Edit Checks to Prevent Duplicate Transactions: Recommendations: 1. USMC management coordinate with DFAS management to implement edit checks that provide reasonable assurance that all transactions processed through a feeder application into SABRS are accepted and processed only once; USMC action plan: DFAS and the USMC have sufficient checks in place to prevent the processing of the same transactions more than once; Targeted completion date: N/A; Status according to USMC: Non-concur; Confirmed by DOD IG (yes/no): N/A. NFR-33 Accountability acknowledgment of received transactions between a feeder system and SABRS: Recommendations: 1. USMC management coordinate with DFAS management to develop a method that would ensure data transfers between a feeder application and SABRS are properly accepted and acknowledged. 2. DFAS-CL develop a method to properly communicate any error notifications to feeder applications in the even of a rejected transaction; USMC action plan: Legacy systems can not accept acknowledgment of received transactions from SABRS; Targeted completion date: Date not provided; Status according to USMC: Non-concur; however, fully implemented; Confirmed by DOD IG (yes/no): No. NFR-47 Inappropriate Access Rights for SABRS Accounts: Recommendations: 1. USMC management coordinate with DFAS management to ensure that all SABRS accounts are reviewed and validated for instances of administrators with access to end user transactions and individuals with multiple Accessor IDs (ACID) assigned to them.; USMC action plan: USMC management coordinated the DFAS management to establish and publish new procedures in April. Complete implementation was completed by June 1, 2010 that required RFA/System Integration- Data Integrity (SI-DI) to validate both (ACID) and name in CA Top Secret (security tool) to prevent the duplicate assignment. USMC management also implemented procedures that when a name is "changed" on an ACID, the Terminal Area Security Officer (TASO) must submit a "delete" request for the old name prior to updating profile with new name; Targeted completion date: 3/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-48 Standard Accounting, Budgeting and Reporting System (SABRS) Configuration Management Baseline Audit: Recommendations: 1. USMC management coordinate with DFAS management to establish procedures that formally document, retain follow-up and research potentially unauthorized changes. 2. Additionally, it is recommended that investigations of CI discrepancies be performed by individuals not involved with the CI migration process; USMC action plan: SABRS Program Management revised configuration management baseline procedures; Targeted completion date: No date provided; Status according to USMC: Non-concur, however fully implemented; Confirmed by DOD IG (yes/no): No. NFR-49 Standard Accounting, Budgeting and Reporting System (SABRS) Interface Edit Check: Recommendations: 1. USMC management coordinate with DFAS management to review and ensure that the existing edit check configurations for interface data processing are established in accordance with current and approved Functional Requirement Documents (FRD); USMC action plan: An SCR was submitted and completed to ensure that the program code and design were in alignment; Targeted completion date: 5/31/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): Yes. NFR-50 SABRS Data Strategy and Design: Recommendations: 1. USMC management coordinate with DFAS management to develop a data management strategy and design that includes specific requirements for SABRS, including regulatory requirements and database standards; USMC action plan: USMC will coordinate with DFAS to see if the Data Management Strategy can be strengthened; Targeted completion date: 10/30/2011; Status according to USMC: Non-concur; however actions underway; Confirmed by DOD IG (yes/no): Yes. Source: Marine Corps SBR remediation action plan information and DOD IG confirmation of status. [End of table] Table 4 shows the recommendations related to the Defense Departmental Reporting System (financial reporting system); the Marine Corps' action plans to remediate these recommendations, reported implementation status, and targeted completion dates; and notes whether the DOD IG has confirmed the effectiveness of the Marine Corps' implementation. Table 4: DOD IG Recommendations, Reported Status of USMC Actions on DDRS Information Technology System Issues as of July 18, 2011, and DOD IG Confirmation of Status as of August 25, 2011: NFR-34 DDRS User Provisioning Process: Recommendations: 1. USMC management coordinate with Business Transformation Agency (BTA) management to ensure that all access to DDRS including changes to previous access rights and privileges follow a uniform process that includes timely documented supervisory review and approval as well as identification and documentation of the specific privileges requested and granted; USMC action plan: DFAS Cleveland Accounting Operations will coordinate with various interested parties from USMC, BTA, and within the various DFAS operational areas to thoroughly review and document the existing process, identify internal control weaknesses and process deficiencies, including the finding under this NFR, and take appropriate action to strengthen policies and procedures; Targeted completion date: 4/30/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): Yes. NFR-35 Configuration Management and Table Maintenance Policies and Procedures: Recommendations: 1. USMC management coordinate with BTA management to formally document their review and approval of the Configuration Management Policy. Additionally, it is recommended that BTA management develops and approve policies and procedures for DDRS table maintenance; USMC action plan: BTA has obtained the required management approval and signatures for the existing Configuration Management Plan and Policies. BTA has included a table maintenance policy within the Configuration Management Plan; Targeted completion date: 4/30/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): Yes. NFR-36 DDRS Third-Party Monitoring: Recommendations: 1. USMC management coordinate with BTA management to establish a formal process for monitoring activity, including the interaction with third-party service providers and execute that process on a periodic basis. 2. USMC management coordinate with BTA management to ensure that responsibilities for logging and monitoring of logs are addressed and defined in agreements with third-party service providers.; USMC action plan: The Information Assurance Officer (IAO) has requested evidence of monitoring from the service providers, and post the artifacts in eMASS and will continue to do so on a regular basis. The IAO has verified that each Service Level Agreement (SLA) covers responsibilities for logging and monitoring; Targeted completion date: 3/2/2011; Status according to USMC: Non-concur; however fully implemented; Confirmed by DOD IG (yes/no): No. NFR-37 DDRS Complete Listing of Configuration Items (CI): Recommendations: 1. USMC management coordinate with BTA and DFAS management to establish a methodology to systematically track all DDRS configuration items that are migrated to production. This will provide an audit trail that will allow closer monitoring and management of the CM process; USMC action plan: TSO Cleveland has modified their policies and procedures to ensure that changes are properly documented before a modification, both normal releases and release exceptions, is applied to DDRS Production. TSO Cleveland, the DDRS developers, has updated Policy 12-Functional Configuration Audit and the DDRS Configuration Management Plan to specify that a listing of CIs will be maintained to support each system modification for normal releases. For Emergency Releases, Policy 18--Release Exceptions has been updated to specify that a monthly audit of all release exceptions will be performed and that a PTR must be created prior to a modification being applied to Production in CMIS for all production problems; Targeted completion date: 3/1/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-38 DDRS Inappropriate Access: Recommendations: 1. USMC management coordinate with BTA and DFAS management to appropriately restrict access to shared drives and user groups that allow access to source code repositories; USMC action plan: TSO Cleveland has implemented new procedures to limit the number of developers authorized to send code to Release Management. All other developers now have "read access" only to the shared drive. TSO Cleveland has updated Policy 13 - Release Management and the DDRS/Corporate Services MOA to specify this new procedure, and have created a new shared drive folder with limited access rights. TSO Corporate Services has removed the five identified users with inappropriate access to the DDRS Production source code from the "dba" user group. All other users in the "dba" user group with appropriate access will continue to have access to the Production source code; Targeted completion date: 3/15/2011; Status according to USMC: Partially concur; however, fully implemented; Confirmed by DOD IG (yes/no): No. NFR-39 DDRS Interface Design and Strategy Documentation: Recommendations: 1. USMC management coordinate with BTA management and DFAS management to develop interface design documentation for the data processing between SABRS and DDRS in order to reasonably assure that the data processed are accurate and complete; USMC action plan: The DDRS Program Management Office (PMO) will modify the SABRS/DDRS Memorandum of Agreement (MOA) to include edits validations, ownership of interface processing, and error correction; Targeted completion date: 9/30/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): Yes. NFR-40 DDRS Interface Data Reconciliation: Recommendations: 1. USMC management coordinate with BTA management and DFAS management to develop a process that would ensure data transfers between SABRS and DDRS are properly accepted and acknowledged. 2. USMC management coordinate with BTA management to establishes a process for data reconciliation between SABRS and DDRS in the interface MOA; USMC action plan: The DDRS PMO has modified the SABRS/DDRS MOA to describe the reconciliation process and include information that addresses how to ensure the data are complete and accurate. (Also see response for NFR #39); Targeted completion date: 4/4/2011; Status according to USMC: Non-concur, however fully implemented; Confirmed by DOD IG (yes/no): No. NFR-41 DDRS Interface Preprocessing Error Report: Recommendations: 1. USMC management coordinate with BTA management and DFAS management to implement a mechanism that would allow for an audit trail to exist for the data received from SABRS that is manually directed to the corresponding line of accounting (LOA) through the preprocessing phase. 2. Once the audit trail exists for data processed through the preprocessing phase, BTA should develop a report so that it can be reviewed by management in order to ensure that data is being corrected and resubmitted to the corresponding LOA; USMC action plan: An SCR has been submitted and implemented to now provide a preprocessing audit report; Targeted completion date: 6/29/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-42 DDRS Interface Input Program Documentation- Edit Checks. Recommendations: 1. USMC management coordinate with BTA and DFAS management to perform a comprehensive review of the input process program in order to list, identify, and explain all the edit conditions contained in the program; USMC action plan: TSO Cleveland will document all the edit checks and validations contained in the DDRS input process applicable to the SABRS interface. Two documents will be produced, one detailing general interface edits and one detailing SABRS specific edits; Targeted completion date: 10/1/2011; Status according to USMC: Partially implemented; Confirmed by DOD IG (yes/no): No. NFR-43 DDRS Data Strategy and Design: Recommendations: 1. USMC management coordinate with BTA and DFAS management to incorporate the concepts of cryptography and middleware to the DDRS data management plan; USMC action plan: Documentation has been provided that evidences that a Data Management Plan is not required by DOD for Acquisition Category (ACAT) III Systems; Targeted completion date: 2/11/2011; Status according to USMC: Non-concur; however, fully implemented; Confirmed by DOD IG (yes/no): Yes. NFR-44 DDRS Application Security Logging and Monitoring: Recommendations: 1. USMC management coordinate with BTA management to establish a formal process for logging and monitoring activity, including the interaction with third-party service providers and execute that process on a periodic basis.; USMC action plan: The Information Assurance Officer (IAO) has requested evidence of monitoring from the service providers, and post the artifacts in eMASS and will continue to do so on a regular basis. The IAO has verified that each Service Level Agreement (SLA) covers responsibilities for logging and monitoring; Targeted completion date: 3/2/2011; Status according to USMC: Non-concur; however fully implemented; Confirmed by DOD IG (yes/no): No. NFR-51 No evidence of Periodic Review for Changes Migrated to Production: Recommendations: 1. USMC management coordinate; with BTA and DFAS management to establish a periodic review of changes that are migrated to production that includes a complete, accurate audit trail of Configuration Items (CI). 2. USMC followup and research of potentially unauthorized changes be performed by individuals not involved with the CI migration process and the follow up should be formally documented; USMC action plan: TSO Corporate Services has created a new procedure to be executed as part of each release that captures the state of the application prior to release and after release. The resulting changes are reconciled with the Release documentation to verify all changes are accounted for. The results of this procedure are maintained by the DDRS PMO; Targeted completion date: 5/6/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. NFR-52 DDRS Segregation of Duties Conflict Monitoring: Recommendations: 1. USMC management coordinate with BTA management to review all users with dual access to DDRS and submit appropriate waivers to reflect management's acceptance and acknowledgment of risk. These waivers should be updated in a timely manner prior to granting dual access to a user. 2. USMC management implement the mitigating control of periodically reviewing dual access user activity; USMC action plan: BTA and DFAS have streamlined and modified the role assignment process to ensure that a waiver is obtained prior to granting dual access to a user; BTA has requested that DFAS Standards and Compliance accept the risk of not having tools that permit reviewing activity of specific dual access users. The following risk mitigation controls are in place; (a) A user cannot approve a Journal Voucher or Data Adjustment that it created. (b) Dual user role profiles are reviewed monthly by Security Administrators and Reporting Managers. (c) Users have all agreed to behave responsibly in accepting the BTA Rules of Behavior. (d) Financial statements and reports are all reviewed and/or certified; Targeted completion date: 6/29/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no):No. NFR-57 DDRS Access Recertification: Recommendations: 1. USMC management coordinate with BTA management to establish policies and procedures to ensure the actions requested as a result of periodic access recertification of DDRS users (i.e., remove privileges for a Responsible Work Area, disable an account, etc.) are carried out to completion; USMC action plan: DFAS Cleveland Accounting Operations has coordinated with various interested parties from USMC, BTA, and within the various DFAS operational areas to thoroughly review and document the existing process, including the finding under this NFR, and take appropriate action to strengthen the policies and procedures; Targeted completion date: 4/27/2011; Status according to USMC: Fully implemented; Confirmed by DOD IG (yes/no): No. Source: Marine Corps SBR remediation action plan information and DOD IG confirmation of status. [End of table] [End of section] Appendix III: Comments from the Department of Defense: Under Secretary Of Defense: Comptroller: Defense Pentagon: Washington, DC 20301-1100: September 13, 2011: Mr. Asif A. Khan: Director, Financial Management and Assurance: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Dear Mr. Khan, This is the Department of Defense (DoD) response to the Government Accountability Office (GAO) draft report GA0-11-830, "DoD Financial Management: Marine Corps Statement of Budgetary Resources Audit Results and Lessons Learned," dated August 29, 2011, (GAO Code 197096). Our responses to the recommendations made in the draft report and additional technical comments are enclosed with this letter. Improving DoD financial management information is one of the Department's most important management goals. Over the last two years, your audit reports and testimony have recognized that the Department now has a sound strategy and approach to achieve audit readiness. In July you stated, "GAO supports DoD's current approach of focusing and prioritizing efforts." We appreciate this validation and support, and have taken steps to focus leadership and management on executing this strategy. A key component of the Department's approach is to, where reasonable, engage auditors to validate the progress being made; the United States Marine Corps (USMC) audit does just that. When successful, the USMC financial statement audit will be a significant achievement, as the first such accomplishment for a military service. The audit will have a wider impact beyond the Marine Corps by providing clear, concrete actions to be taken to achieve auditability. As you have pointed out, most issues identified are not unique to the USMC and, therefore, inform the efforts of other DoD Components. The fiscal year 2010 USMC audit has highlighted specific process and systems changes needed to achieve audit. All of our reporting Components are working with the Defense Finance and Accounting Service and other service providers to address these issues and succeed in their audit efforts. Your audit report focuses on the planning of these remediation efforts, rather than on their outcomes. Given our available resources, the USMC and their service providers have made far more progress in remediation than your audit report indicates. It is because of this progress revealed in the fiscal year 2011 USMC audit, in areas such as complete transaction populations and Funds Balance with Treasury reconciliations, that we disagree with several of the statements in your audit report related to the USMC remediation plan. We have included the justification for several technical comments in an attachment to this letter. We have actions underway in the Department to address auditor findings across all service providers and Components consistent with three of your recommendations. We feel that your remaining recommendation on the content of our remediation plans is overly prescriptive. I believe our remediation plans are reasonable and will continue to hold leaders accountable to execute their plans and judge their efforts based on near-term outcomes rather than attempt to manage their plans. I appreciate your recent testimony that -the Department is heading in the right direction and making progress." Additional corrective actions are underway, and there are certainly more needed which have yet to be identified; however, we feel that the USMC audit is on the road to success. While in this case we do not agree with all of the findings in your report, and feel it does not present a fair assessment of the USMC remediation efforts as a whole, we look forward to your continued involvement in and recommendations for improvement of our effort. My point of contact for this effort is Mr. Joseph Quinn. He can be reached at 571-256-2678 or joseph.quinn@osd.mil. Sincerely, Signed by: Robert F. Hale: Enclosures: As stated: [End of letter] GAO Draft Report Dated August 29, 2011: GA0-11-830 (GAO Code 197096): "DOD Financial Management: Marine Corps Statement Of Budgetary Resources Audit Results And Lessons Learned" Department Of Defense Comments To The GAO Recommendations: Recommendation NO. 1: The GAO recommends that the Secretary of the Navy direct the Commandant of the Marine Corps: "develop a comprehensive, risk-based plan for designing and implementing corrective actions to SBR auditor recommendations. Such a plan should identify goals and objectives, identify and prioritize actions for addressing those objectives, allocate resources, assign roles and responsibilities, and measure performance against objectives." (See page 26/GAO Draft Report.) Response: Non-Concur. The Secretary of the Navy does not need to direct the Commandant of the U.S. Marine Corps (USMC) to develop a plan that conforms to GAO's requirements. The USMC contends that the referenced standard (Standards for Internal Control in the Federal Government) does not state that management must "identify resources, roles and responsibilities, or include performance indicators to measure performance against action plan objectives." The USMC fully complied with the three requirements noted in the standard, which are: 1) promptly evaluate findings from audits and other reviews; 2) determine proper actions in response to findings and recommendations from audits and reviews; and 3) complete within established time frames, all actions that correct or otherwise resolve the matters brought to management's attention. In this regard, the USMC will continue to employ all manner of due diligence and professional scrutiny in developing courses of actions and remediation activities, as necessary, in order to correct audit findings given known and anticipated audit workstreams. Furthermore, the remediation efforts taken heretofore may demonstrate appropriate correction of the underlying audit deficiencies as a consequence and outcome to the Fiscal Year (FY) 2011 Statement of Budgetary Resources (SBR) audit. Recommendation NO. 2: The GAO recommends that the Secretary of the Navy direct the Commandant of the Marine Corps to: "review Marine Corps SBR remediation actions under way and confirm that actions are fully responsive to the auditor recommendations." (See page 26/GAO Draft Report.) Response: Concur. Additional actions beyond those currently in support the FY 2011 SBR audit will be undertaken to assess remediation responsiveness to auditor recommendation. This will involve an assessment of financial statement supportability through concurrent review of account balances, system processing and internal control design and effectiveness. Furthermore, the auditors are currently examining corrective actions related to FY 2010 SBR audit findings and have confirmed that several of the FY 2010 SBR audit Notices of Findings and Recommendations have been corrected. Thus, sufficient insight of corrective action adequacy or insufficiency shall be obtained via these ongoing and overlapping remediation review efforts. Recommendation NO. 3: The GAO recommends that the Secretary of the Navy direct the Commandant of the Marine Corps to: "for remediation actions that require coordination and action on the part of other DOD components, such as DFAS, DCMA, and DCAA, require the Marine Corps to develop and implement timely and effective service-provider agreements with the appropriate DOD components in accordance with the FIAR Guidance. These agreements should identify roles and responsibilities, the individuals responsible for those activities, and performance measures that establish accountability. (See pages 26 through 27/GAO Draft Report.) Response: Concur. The USMC will undertake a comprehensive review of its service provider agreements and implement updates that account for improved business processing and audit supportability. The USMC has long recognized the need for coordinated and codified service support from the Defense Finance and Accounting Service (DFAS). To this end, the Marine Corps established a signed Service Level Agreement (SLA) with DFAS-Kansas City before accounting support and financial reporting services were transferred to the consolidated service center in Cleveland, OH. This change was due to a Base Realignment and Closure (BRAC) requirement and the USMC maintained a close relationship with DFAS-Cleveland in order to aid in their BRAC transition and acclimatization. After a short period, efforts were undertaken to begin developing an updated SLA. These continue today and are expected to conclude in FY 2012. With respect to additional agreements with the Defense Contract Management Agency and Defense Contract Audit Agency, these organizations provide Defense-wide services that are not segmented across the Military Services, as in the case with the DFAS centers. Therefore, while the USMC concurs with the recommendation, it requests that such agreements be established and applicable to all of DoD, with the Office of the Under Secretary of Defense (Comptroller) Financial Improvement and Audit Readiness Directorate responsible for coordinating these SLA actions. Recommendation NO. 4: "In addition, to help fully leverage lessons learned from the first-year Marine Corps SBR audit effort, we recommends that the Secretary Defense direct the Secretaries of the Army, the Navy, and the Air Force to consider the fundamental lessons resulting from the Marine Corps effort and incorporate the lessons, as appropriate, in their respective FIPs. (See page 27/GAO Draft Report.) Response: Concur. On behalf of the Secretary of Defense, the Under Secretary of Defense (Comptroller)/Chief Financial Officer (USD(C)/CFO) has directed the military Military Services and other DoD components to consider the key lessons learned from the USMC audit effort, as outlined in this audit report, in their audit readiness plans. The USD(C)/CFO recognizes the importance of sharing audit readiness lessons across the Department, and this direction will serve to underscore an initiative already underway. The Military Services are, in fact, currently in the process of addressing the recommendations from the GAO audit of the Navy Civilian Pay and Air Force Military Equipment financial improvement plans, as well as those from the audit of the USMC SBR, in their audit readiness plans. It has always been the Department's approach to incorporate lessons learned from audit readiness efforts into all future preparations. [End of section] Appendix IV: GAO Contact and Staff Acknowledgments: GAO Contact: Asif A. Khan, (202) 512-9869 or khana@gao.gov: Staff Acknowledgments: In addition to the contact named above, Gayle L. Fischer, Assistant Director; Jacquelyn N. Hamilton, Acting Assistant General Counsel; William F. Wadsworth, Assistant Director, Information Security; Francine DelVecchio; Jason Kirwan; Richard D. Mayfield, Auditor-in- Charge; Carol T. Nguyen; Kerry A. Porter; Eric H. Stalcup; and Carroll M. (CJ) Warfield, Jr., Auditor-in-Charge, made key contributions to this report. [End of section] Footnotes: [1] Pub. L. No. 101-576, 303, 104 Stat. 2838, 2849 (Nov. 15, 1990), codified, as amended, at 31 U.S.C. 3515. [2] GAO, DOD Financial Management: Numerous Challenges Must Be Addressed to Improve Auditability, [hyperlink, http://www.gao.gov/products/GAO-11-864T] (Washington, D.C.: July 28, 2011); DOD Financial Management: Numerous Challenges Must Be Addressed to Improve Reliability of Financial Information, [hyperlink, http://www.gao.gov/products/GAO-11-835T] (Washington, D.C.: July 27, 2011); and High-Risk Series: An Update, [hyperlink, http://www.gao.gov/products/GAO-11-278] (Washington, D.C.: February 2011). [3] The other agency with a disclaimer was the Department of Homeland Security. [4] Pub. L. No. 111-84, 1003(a), (b), 123 Stat. 2190, 2439-40 (Oct. 28, 2009). [5] Budgetary resources include the amount available to enter into new obligations and to liquidate them. Budgetary resources are made up of new budget authority (including direct spending authority provided in existing statute and obligation limitations) and unobligated balances of budget authority provided in previous years. [6] Offsetting collections are collections from government accounts or from transactions with the public. These collections are credited to appropriation or fund accounts. [7] In a disclaimer of opinion, the auditor does not express an opinion on the financial statements. A disclaimer of opinion is appropriate when the audit scope is not sufficient to enable the auditor to express an opinion, or when there are material uncertainties involving a scope limitation--a situation where the auditor is unable to obtain sufficient appropriate audit evidence. [8] CFO Act agencies' financial management systems are required by the Federal Financial Management Improvement Act of 1996 (FFMIA) to comply with federal financial management systems requirements, applicable federal accounting standards, and the United States Government Standard General Ledger at the transaction level. Pub. L. No. 104-208, div. A, title VIII, 803, 110 Stat. 3009, 3009-390 (Sept. 30, 1996). [9] GAO, Financial Management: Achieving Financial Statement Auditability in the Department of Defense, [hyperlink, http://www.gao.gov/products/GAO-09-373] (Washington, D.C.: May 6, 2009). [10] An obligation is a definite commitment that creates a legal liability of the government for the payment of goods and services ordered or received. [11] According to OMB Circular No. A-11, the SF-133, Report on Budget Execution and Budgetary Resources, is intended to provide a consistent presentation of data across programs within each agency, and across agencies, which helps program, budget, and accounting staffs to communicate. SF-133s provide historical reference that can be used to help prepare the President's Budget, program operating plans, and spending estimates. The reports also provide a basis to determine obligation patterns when programs are required to operate under a Continuing Resolution. An agencywide SF-133 should generally agree with an agency's Statement of Budgetary Resources. [12] GAO, Financial Audit Guide: Auditing the Statement of Budgetary Resources, [hyperlink, http://www.gao.gov/products/GAO-02-126G] (Washington, D.C.: December 2001). [13] Internal control comprises the plans, methods, and procedures to provide reasonable assurance that objectives are being achieved in the following areas: (1) effectiveness and efficiency of operations, (2) reliability of financial reporting, and (3) compliance with applicable laws and regulations. [14] GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00.21.3.1] (Washington, D.C.: November 1999). [15] Testing of the reasonableness of account balances or amounts in financial statements is commonly referred to as substantive testing. This is in contrast to testing of the internal controls related to a particular account or balance. [16] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00.21.3.1]. [17] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00.21.3.1]. [18] GAO, Defense Business Transformation: DOD Needs To Take Additional Actions to Further Define Key Management Roles, Develop Measurable Goals, and Align Planning Efforts, [hyperlink, http://www.gao.gov/products/GAO-11-181R] (Washington, D.C.: Jan. 26, 2011); and Risk Management: Strengthening the Use of Risk Management Principles at Homeland Security, [hyperlink, http://www.gao.gov/products/GAO-08-904T] (Washington, D.C.: June 25, 2008). [19] GAO, Intelligence, Surveillance, and Reconnaissance: DOD Needs a Strategic, Risk-Based Approach to Enhance Is Maritime Domain Awareness, [hyperlink, http://www.gao.gov/products/GAO-11-621] (Washington, D.C.: June 20, 2011); High-Risk Series: An Update, [hyperlink, http://www.gao.gov/products/GAO-11-278] (Washington, D.C.: February 2011). [20] The Marine Corps SBR Remediation Plan consists of a written plan covering the initial 11 financial statement process notices of findings and recommendations (NFR) to comply with DOD IG audit requirements and 59 additional NFRs that were addressed in separate plans of action and milestones. [21] Some of these elements are consistent with the FIAR Guidance requirements for a corrective action plan, such as identifying required resources and ensuring that actions address the identified deficiencies. [22] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [23] The Antideficiency Act requires agencies to establish a system for administrative control of funds to, among other things, prevent obligations and expenditures in excess of appropriations and apportionments. 31 U.S.C. 1341, 1514(a), 1517(a). [24] GAO, Department of the Army--The Fiscal Year 2008 Military Personnel, Army Appropriation and the Antideficiency Act, B-318724 (Washington, D.C.: June 22, 2010). [25] Under Secretary of Defense (Comptroller/CFO), March 16, 2011, letter reporting a Department of the Navy violation of the Antideficiency Act, case number 10-03. [26] DOD Financial Management Regulation, Volume 3, Chapter 8, Standards for Recording and Reviewing Commitments and Obligations, Section 0804. [27] GAO, DOD Financial Management: Numerous Challenges Must Be Addressed to Achieve Auditability, [hyperlink, http://www.gao.gov/products/GAO-11-864T] (Washington, D.C.: July 28, 2011). [28] GAO, DOD Business Transformation: Improved Management Oversight of Business System Modernization Efforts Needed, [hyperlink, http://www.gao.gov/products/GAO-11-53] (Washington, D.C.: Oct. 7, 2010). [29] [hyperlink, http://www.gao.gov/products/GAO-11-53]. [30] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [31] GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00.21.3.1] (Washington, D.C.: November 1999). [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO‘s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO‘s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548:

The Justia Government Accountability Office site republishes public reports retrieved from the U.S. GAO These reports should not be considered official, and do not necessarily reflect the views of Justia.