Ms. Alaleh Jenkins, Assistant Deputy Chief

Financial Officer

ASMC PDI, March 9, 2017

Office of the Under Secretary of Defense (Comptroller)

Office of the Deputy Chief Financial Officer

DoD Audit:

The Race to the Finish Line

DoD Audit: The Race to the Finish Line

2

• DoD FY17–18 Audit Priorities

• Driving Solutions

• Consolidated Audit Strategy

• Update on Critical Capabilities

• Prioritizing, Monitoring, and

Remediating Auditor Findings

DoD FY17–18 Audit Priorities

DoD FY17-18 Audit Priorities

4

• FY17 Audits/Exams - continue to expand:

– Military Departments will continue with audits

– Marine Corps, DLA, DISA under full audit

– Several Defense Agencies will have expanded scope exams.

• Prepare for full scope FY18 financial statement audits

• Turn focus on remediating auditor findings

– Put processes/infrastructure in place to prioritize and track audit

findings and remediation activities

– USD(C) and DCMO will continue to monitor remediation progress

• OSD focusing on preparing for DoD-wide consolidated

audit while addressing DoD-wide issues

ODCFO FY17-18 Priorities

Supporting Audit Preparations

5

• Policy 1) Updating the FMR Policies

2) Working with FASAB to establish updated implementation guidance

• Solutions Produce recommended solutions to address long-standing DoD-wide financial statement, business

process, or IT issues

• Audit Infrastructure and Remediation 1) Tracking of DoD-wide, SSAE18, and 4th Estate auditor findings

2) Provide audit response infrastructure support to the 4th Estate

3) Provide assistance to the development and implementation of DoD-wide CAPs and 4th Estate CAPs

• Compliance and Reporting1) Reporting of the Annual Financial Report (to include the Statement of Assurance)

2) Produce mandated reporting (such as IPERA, ADA, DATA Act, Agency Performance Report)

• Communication to the DoD Community and Oversight Bodies1) Internal: FIAR Meetings, newsletters, website

2) External: GAO, DoDIG, FASAB, HASC/SASC

ODCFO Representation and Governance

Governance of DoD-Wide Audit

• Provides Strategy/Guidance

• NDAA Rankings

• Notice of Findings (NFR)/ Corrective

Action (CAP) Tracking

• Addressing Enterprise-Wide

Dependencies

• Prepare Information Related to

Sensitive Activities

• Coordination of DoD-wide

Consolidated Audit

• A-123 ICOFR/ICOFS/SOA Processes

• Coordinating Service Provider support

Governance of 4th Estate Audit

• Component Report Cards - measuring

Defense Agencies’ progress in areas

within their control

• Notice of Findings (NFR)/ Corrective

Action (CAP) Tracking

• Provides Audit Infrastructure

Audit liaison

End-to-end process documentation

Training

Build universe of transactions

capability

• Entity-level controls

• Review and feedback on CUECs

6

Driving Solutions

Resolving Key Impediments –How Do We Get to the Solution Faster?

• Many of the methodologies used

today get “stuck” because of all of

the noise related to small issues

• Targeting and prioritizing the most

pervasive issues will accelerate

progress

8

Defense Accounting Solutions Board “DASB” - proposed

Advise DoD management on all DoD accounting and financial management policies and procedures

in accordance with federal GAAP

Provide any necessary interpretation of accounting standards for application to the DoD financial

management environment

Facilitate the entity-wide participation of DoD stakeholders to discuss and resolve unique DoD

technical issues, as well as the impact from the implementation of new accounting principles or

regulations

Act in the same capacity to help resolve complex DoD-wide audit issues and disputes as they arise

DASB Reporting Structure

9

Po

liti

cal

Ap

po

inte

eA

cti

on

Off

icers

SE

S

Provides oversight and accountability, and

leads the process for establishing and

monitoring FIAR Plan priorities to ensure

that DoD-wide financial improvement efforts

continue to mature and are integrated with

transformation activities across the DoD to

achieve full financial auditability in line with

congressional mandates

Membership: DCFO (Chair), FIAR Director

(Vice Chair), PSAs, Military Departments,

Defense Agencies, DoD OIG

Provides vision, leadership, oversight, and accountability for the

DoD’s effort to achieve full financial auditability, in line with

congressional mandates

Membership: USD(C) (Co-Chair), DCMO (Co-Chair), PSAs,

Military Departments, DFAS, DLA, DoD OIG

Provides advice and recommendations to

the FIAR & ODO Committees (respectively)

on opportunities to improve DoD financial

management and achieve audit readiness

Membership: FIAR Director (Chair), PSAs,

Military Departments, Defense Agencies

Proposed change

Indicates reach back support

Key

Arrow denotes governance /

authority

Serves as an authoritative body

that makes decisions quickly when

providing technical guidance on

interpretation of standards,

resolving DoD-wide audit findings,

and settling disputes between

auditors and management

Membership: ADCFO (Co-Chair),

DCMO/Director DBM (Co-Chair),

OMB, Highly Qualified Experts

(e.g., Former Audit Partners

and/or CFOs), GAO (Observer),

DoD OIG (Observer)

FIAR & ODO

Subcommittees

FIAR & ODO

Committees

DASB Staff

• PSAs

• Military Departments

• Defense Agencies

• Other DoD or Federal

Agency SMEs

FIAR Governance

Board

Defense

Accounting

Solutions

Board (DASB)• PSAs

• Military Departments

• Defense Agencies

• Other DoD or Federal

Agency SMEs

Supports DASB by performing

research on accounting standards

and other applicable guidance and

developing a position and

recommendations for solutions

Membership: ODCFO, ODCMO

Consolidated Audit Strategy

Consolidated Audit Strategy

11

• Consolidating Schedule for DoD-Wide Audit

(Tiers 3, 4 and Consolidation)

– Consolidating Schedule for DoD-Wide Audit

– Approach for testing elimination entries by tier (intra- and inter-tier)

• Testing Approach– Materiality level is at DoD-Wide level

– Testing approach to determine if Tier 3 examinations are needed going

forward

• DoD Consolidated Audit Infrastructure– Structure for conducting Consolidated Audit, including submission of

PBC lists using FIAR ARC Tool

– FIAR ARC Tool Training

Over the last two years the Department has expanded the scope of audits, while sustaining a stronger, more disciplined environment, until full audit readiness is

achieved in 2018.

DoD-Wide Consolidated Audit Strategy

12

Overview of Consolidated Audit Strategy

Department-wide SSAE No.16 Coverage

ODCFO Audit Infrastructure in Place to Support Fourth Estate ODCFO Audit

Infrastructure in Place to

Support Consolidation

• DoD Consolidation

Process

• DoD Eliminations

• Agency Financial Report

• Other Consolidated Audit

Responsibilities

Internal Control

• Entity-Level Controls

• MICP (incl. Monthly Testing)

• End to End Process

Documentation

• NFR CAP Tracking

• Issue Remediation

Substantive/ Supporting

Documentation

• Universe of Transactions and

Reconciliations

• KSD Matrix

a Given the size and complexity of the Reporting Entities included in Tier 1, each will maintain its own audit infrastructure. This document focuses on the infrastructure for select Tier 2

_Entities as well as the infrastructure for the remaining Tier 3 & Tier 4 Entities. b There are several Tier 2 Entities that may not fully utilize the ODCFO audit infrastructure, including Intelligence Agencies, Working Capital Funds, and other Entities already under audit.

*Includes U.S. Marine Corps.

Percentages based on FY 2015 data.

Audit Liaison Process and Tools

Use the Work of Component Auditors

Group Auditor to assume responsibility for or make reference to audit

opinions of each Component Auditor

Perform Independent Testing Group Auditor to perform internal controls and substantive

testing over activities & balances

Consolidated

Financial

Statements

23% Budget

15% Assets

(e.g. DLA,

SOCOM, DISA)

DoD Designated

Audits

Tier 2ᵇ

Army

GF & WCF

OMB

Designated

Entity Audits

Navy*

GF & WCF

OMB

Designated

Entity Audits

Air Force

GF & WCF

OMB

Designated

Entity Audits

Other Tier

1 Entities

(e.g. USACE,

Military Ret.

Trust Fund)

OMB

Designated

Entity Audits

Tier 1ᵃ(72% Budget, 82% Assets)

Tier 3

4% Budget

2% Assets

(e.g. WHS,

DARPA, DTRA)

Other Material

Defense Agencies

Tier 4

1% Budget

1% Assets

(e.g. DHRA, DSS,

DFAS GF)

Immaterial Entities

Tiers 3 and 4 Eliminations

Inte

r-T

ier

Intr

a-T

ier

2

Intr

a-T

ier

3/4

DoD OIG is Group Auditor over DoD-wide Consolidated Audit.

Update on Critical Capabilities

Critical Capabilities for Audit

14

• In 2015, the Department prioritized the most critical capabilities needed to be

in place to support the first full financial statement audit in 2018

• The minimum capabilities to be in place to enter full financial statement

audit:

– Universe of transactions: Population of transactions exists for each financial statement line item,

including sensitive activities and opening balances, and there are reconciliations to each financial

statement line item (existence)

– Fund balance with Treasury: Processes and tools are in place to identify, age, and resolve

differences between the general ledgers and Treasury’s Government-wide Accounting Account

Statement (at voucher level)

– Journal Vouchers (JVs): Ability to provide a universe of JVs and other adjustments that reconciles

to the financial statements; processes and tools are in place to identify, age, and resolve the root

causes of JVs

– Existence and completeness and rights of general property, plant, and equipment and inventory &

related property for material assets:

o Ability to provide a listing of asset items, with acquisition costs that reconcile to the financial statements for real property

o Establish an auditable existence, completeness and rights baseline (with supporting documentation, e.g., physical inventory

counts) for real property

o Ability to provide a listing of asset items, with acquisition costs that reconcile to the financial statements for inventory/operating

material and supplies

o Establish an auditable existence, completeness and rights baseline (with supporting documentation, e.g., physical inventory

counts) for inventory/operating material and supplies

Consolidated Audit / Assertion

Critical Capabilities for Audit (cont.)

15

• Valuation of general property, plant, and equipment and inventory & related property for material

assets:

– Ability to provide a listing of asset items, with acquisition costs that reconcile to the financial statements for real

property

– Establish an auditable valuation baseline for real property

– Ability to provide a listing of asset items, with acquisition costs that reconcile to the financial statements for

inventory/operating material & supplies

– Establish an auditable valuation baseline for inventory/operating material & supplies

– Begin implementing a plan to establish an auditable valuation process for go-forward activity

• Environmental & Disposal Liabilities – Real Property for Material Liabilities: Ability to provide a listing

of environmental and disposal liabilities reconciled to the financial statements, and establish auditable

processes to determine clean-up costs for environmental liabilities

• Environmental & Disposal Liabilities – General Equipment & Chemical Weapons Disposal for

Material Liabilities: Ability to provide a listing of environmental and disposal liabilities reconciled to the

financial statements, and establish auditable processes to determine clean-up costs for environmental

liabilities

Consolidated Audit / Assertion

What Makes These Problems So Difficult?

16

Consolidated Audit / Assertion

• Change management

Driver: Lack of incentive or consequences to embracing audit readiness

from senior leadership to field level

Impact: Limits consistency, discipline, and rigor in adopting new processes

and sustaining audit readiness

• Stove-piped, complex and decentralized IT systems

Driver: Decentralized IT environment with minimal systemic controls

Impact: Limits reconciliation abilities for building an audit trail

Impact: Increases manual rework

• Business practices such as suballotments, cross-disbursements, and pay-and-chase

Driver: The push to move money quickly, pay promptly

Impact: Increased manpower required to trace information and validate payments

• Shared appropriations

Driver: Many Defense Agencies are sharing a checking account and each have a separate check card, but

nobody has a “checkbook”

Impact: Limits transparency of transactions allocable to each Component

• Lack of property asset accountability

Driver: Locating, tracking and assigning values to hundreds of thousands of assets deployed across the globe,

purchased over several decades is an unsurmountable effort

Driver: Lack of understanding outside of the FM community as to their influence/responsibility on capturing and

classifying property assets

Driver: Contracts are not written in a way that supports the accountability of individual assets acquired

Impact: Precipitates unnecessary buys and limits visibility into equipment readiness

Prioritizing, Monitoring and

Remediation of Auditor Findings

Notice of Findings (NFRs)

18

Financial

Audits

SSAE 18s

Pool of NFRs

Audit Findings

SSAE 18

NFRs “Opened”Financial and IT

NFRs “Opened”

Root Cause Analysis &

Corrective Action Plans

New Processes/

Controls

NFRs are “Closed”

Ready for another

Audit!

Annual

Audits

We have a long way to go before positive audit opinions will emerge – our commitment to managing the implementation of corrective actions will be important in showing progress towards positive

audit opinions.

NFR Remediation Monitoring Activities

GAO Report on DoD Financial

Management

– Significant Efforts Still Needed for Remediating Audit

Readiness Deficiencies

– Disclaimers of opinions on the 2015 Schedules of

Budgetary Activity

– Resulted in over 700 findings and recommendations

(Notice of Findings or “NFRs”)

– Significant efforts are needed to adequately:

o Provide documentation to support transactions

o Ensure adequate IT system controls are in place

o Oversee the work and support of Service Providers

o Design processes to address financial management

deficiencies and monitor critical capability CAPs.

Identify/track NFRs, prioritize, develop CAPs,

implement CAPs, monitor status of CAPs.

19

Identify and Track

NFRs

Prioritize NFRs

Develop CAPs

Implement and Monitor

Progress

“There are no secrets to success. It is the result of preparation, hard work, and learning from failure.”

~ Colin Powell

NFR Remediation Identify, Track, and Prioritize NFRs

20

Determining Prioritization:

1) Is it a material weakness and how pervasive is it?

2) Is the remediation an interim solution or target solution?

3) Does the cost of remediation outweigh the benefit?

4) What are the risks of not correcting the weakness?

Tier 3

• Identify and Track NFRs– Military Services, Defense Agencies, Service Providers receive NFRs (if any) from the auditors

during their annual audit procedures.

– NFRs are tracked using the following tracking mechanisms:

o Military Service internal tracker for critical capabilities.

o DCFO NFR Tracker for DoD-wide issues, Defense Agency and Service Provider NFRs.

• Prioritization of Findings– NFRs are categorized and prioritized (such as critical path, DoD-wide issues, IT) and assigned an

owner

NFR Remediation Develop, Implement and Monitor CAPs

• Develop and Implement Corrective Action Plans

– Military Services: CAPs are developed and implemented by the Military Services.

CAPs that impact Defense Agencies are reported to the Defense Agencies annually.

– Defense Agencies: CAPs developed and implemented by the Defense Agencies.

Feedback is provided by DCFO and validated once implemented

– Service Providers: CAPs are developed and implemented by service providers and

DCFO provides feedback and monitors implementation of CAPs

• Monitor CAPs and close NFRs

– CAPs are monitored through DoD’s tracking mechanisms and the FIAR Governance

Board performs overall oversight on progress being made to resolve NFRs

o “Interim Milestone” charts to FIAR Governance (for Critical Capabilities) every 60 days

o Military Service and Service Provider updates to FIAR Governance every 60 days

o Through DCFO NFR Tracker for Defense Agencies and DoD-wide Issues monthly

– NFRs will be closed once CAPs are implemented and validated as effective

21

Final Thoughts

The Race to Auditability is Almost Finished –

The DoD will be audit ready and begin full

financial statement audits in FY 2018. We

will continue to monitor progress against

“critical capabilities.”

22

Tier 3

The Race to a Favorable Opinion is

About to Start –

The DoD has long-standing NFRs

that will take the next several years

to resolve and we will continue to

monitor progress against known and

newly identified NFRs.

Open Questions