OMB provides guidance to federal managers on how to improve accountability and effectiveness of federal programs and operations by identifying and managing risks. OMB updated its Circular No. A-123 in July 2016 to establish management’s responsibilities for ERM. As part of the overall governance process, ERM calls for the consideration of a risk across the entire organization and how it may interact with other identified risks. When used appropriately, ERM is a decision-making tool that allows agency leadership to view risks across an organization and helps management understand an organization’s portfolio of top risk exposures, which could affect achievement of the agency’s goals and objectives. In December 2016, we issued a report that provided an overall framework for agencies to build an effective ERM program. In July 2016, OMB also updated Circular No. A-11, Preparation, Submission, and Execution of the Budget. In Circular No. A-11, OMB referred agencies to Circular No. A-123 for requirements related to ERM implementation, including for developing a risk profile as a component of the agency’s annual strategic review. A risk profile is a prioritized inventory of the most significant risks identified and assessed through the risk assessment process. It considers risks from a portfolio perspective, identifies sources of uncertainty that are both positive (opportunities) and negative (threats), and facilitates the review and regular monitoring of risks. Together, these two OMB circulars constitute the ERM policy framework for executive agencies by integrating and operationalizing specific ERM activities and helping to modernize existing risk management efforts. Standards for Internal Control in the Federal Government describes internal control as a process put in place by an entity’s oversight body, management, and other personnel that provides reasonable assurance that objectives related to performing operations effectively and efficiently, producing reliable internal and external reports, and complying with applicable laws and regulations will be achieved. Internal control serves as the first line of defense in safeguarding assets. Its importance to federal agencies is further reflected in permanent requirements enacted into law. The internal control processes required by FMFIA and the Standards for Internal Control in the Federal Government help to form an integrated governance structure designed to improve mission delivery, reduce costs, and focus corrective actions toward key risks. OMB Circular No. A-123 precludes agencies from concluding that their internal control is effective if there are one or more material weaknesses identified from its assessment. As a component of DOD, the Air Force is required to (1) identify and manage risks, (2) establish and operate an effective system of internal control, (3) assess and correct control deficiencies, and (4) report on the effectiveness of internal control through an annual Statement of Assurance. In addition, the Chief Financial Officers Act of 1990 (CFO Act), as amended by the Government Management Reform Act of 1994 and implemented by guidance in OMB Bulletin No. 19-03, Audit Requirements for Federal Financial Statements (August 27, 2019), requires the Air Force to annually undergo a financial statement audit. However, since 1990, the Air Force has continued to be unable to demonstrate basic internal control that would allow it to pass a financial statement audit, which has contributed to DOD’s financial management remaining on the GAO High-Risk List since 1995. For fiscal year 2018, the Air Force reported 11 material weaknesses in internal control over operations and 14 material weaknesses in internal control over reporting in its Statement of Assurance. For fiscal year 2019, it reported the same number of operations-related material weaknesses, and its reporting-related material weaknesses increased to 25. During the Air Force’s fiscal years 2018 and 2019 financial statement audits, independent auditors specifically considered the Air Force’s internal control over financial reporting in order to determine appropriate audit procedures to perform in order to express an opinion on the financial statements. The independent auditors disclaimed an opinion on the Air Force’s fiscal years 2018 and 2019 financial statements, stating that the Air Force continued to have unresolved accounting issues, and for each year, the auditors reported 23 material weaknesses in internal control over financial reporting. These material weaknesses included control deficiencies in processes related to the Air Force’s mission-critical assets and involved a lack of policies and procedures, inadequate financial information systems and reporting, and inaccurate and incomplete information in its accountability records and financial reports. The Air Force’s efforts to implement ERM are in the early stages, and accordingly, it has not fully incorporated ERM into its management practices. Since the July 2016 update to OMB Circular No. A-123 required agencies to implement ERM, the Air Force has been leveraging and relying on its existing risk management practices. To date, these practices have focused on the organizational unit level and not at the entity level, as required by OMB Circular No. A-123. The Air Force plans to integrate ERM increasingly into its management practices over the next several years, with expectations of a fully developed ERM approach after fiscal year 2023. The Air Force has taken the initial steps to establish an ERM governance structure, define risk classifications, and develop its ERM framework. For instance, the Air Force has drafted charters updating responsibilities for two senior management advisory councils—(1) the Enterprise Productivity Improvement Council (EPIC) and (2) the Executive Steering Committee (ESC)—to implement OMB Circular No. A-123. EPIC will oversee the agency’s risk management function, with a specific emphasis on overseeing the regular assessment of risk and approving risk responses and the Air Force’s risk profile. ESC will lead the implementation, assessment, and documentation of risk management over financial reporting, financial systems, all associated activities, and oversight with respect to the Air Force’s internal control program. EPIC is designed to focus exclusively on potential operational material weaknesses, and ESC will focus on potential financial reporting and financial systems material weaknesses. Air Force officials informed us that both councils would share responsibility for compliance objectives and resulting material weaknesses. During our audit, we analyzed the Air Force’s financial reports beginning with those for fiscal year 1999 and noted that the agency and the external auditors have generally reported material weaknesses each year involving the tracking, reporting, location, accountability, and cost of certain mission-critical assets. These weaknesses identified risks that decreased the Air Force’s ability to perform operations efficiently, prepare reliable financial reports, and comply with applicable laws and regulations. EPIC and ESC currently assess proposed material weaknesses that the primary reporting elements (PRE) submit and determine whether to recommend them to the Secretary of the Air Force for reporting in the annual Statement of Assurance. However, the Air Force’s governance structure does not include a mechanism for EPIC or ESC to oversee the management of risk associated with material weaknesses and consider its effect across the entire agency. Based on our review of the draft charters and documentation from governance meetings, the Air Force included provisions for ESC to identify material weaknesses related to financial reporting and financial systems and EPIC to identify material weaknesses related to operations objectives. However, there were no charter provisions for either council to identify, assess, respond to, and report on the risks associated with those material weaknesses or material weaknesses identified through external audits. A material weakness, reported by either the agency or an external auditor, by definition indicates a significant decrease in an agency’s ability, during the normal course of operations, to achieve objectives and address related risks. Under OMB Circular No. A-123, an agency’s risk management governance structure helps ensure that the agency identifies risks that have the most significant effect on the mission outcomes of the agency. Without a thorough and integrated ERM governance structure that includes oversight responsibilities managing risks associated with material weaknesses in internal control, there is an increased risk that the Air Force will not properly identify, assess, and respond to significant entity-level risks. The Air Force’s current internal control assessment process is not designed to facilitate the timely identification and correction of internal control deficiencies or to be used to support the Air Force’s annual Statement of Assurance. Specifically, Air Force management has not designed an adequate process for assessing internal control. Further, the process does not focus on areas with the greatest risk, such as mission- critical assets. In addition, the reviews of mission-critical assets in fiscal years 2018 and 2019 in support of the financial statement audit did not result in adequate assessments of internal control. The Air Force’s policy for assessing the effectiveness of its internal control system and for preparing the agency’s annual Statement of Assurance is based on DOD Instruction 5010.40, Managers’ Internal Control Program Procedures, dated May 2013. The Air Force’s policy is outlined in Air Force Policy Directive 65-2, Managers Internal Control Program. This policy is supported by the procedures outlined in Air Force Instruction (AFI) 65-201, Managers Internal Control Program Procedures, dated February 2016, which the Air Force currently is revising to address the July 2016 OMB Circular No. A-123 update. The Air Force provides additional guidance to supplement AFI 65-201 in its Statement of Assurance Handbook and its Internal Control Playbook. The Air Force’s OMB Circular No. A-123 program comprises 17 designated PREs, including the Secretariat and Air Force staff offices, major commands, the Army and Air Force Exchange Service, and direct- reporting units. The Air Force subdivides each PRE along organizational lines into more than 6,500 organizational assessable units (organizational units), such as a squadron or wing, and other specific programs and functions, where it evaluates internal controls per AFI 65-201. Each of the organizational units has an assessable unit manager (unit manager) who has authority over the unit’s internal control, including continual monitoring, testing, and improvement. Figure 1 illustrates how the Air Force’s organizational structure informs its overall annual Statement of Assurance. The Air Force requires each unit manager to submit an annual supporting statement of assurance providing the manager’s opinion on whether the unit has reasonable assurance that its internal controls are effective. The units submit the statements to the Assistant Secretary of the Air Force, Financial Management and Comptroller (SAF/FM), the office responsible for OMB Circular No. A-123 implementation and compilation of the annual Statement of Assurance. Based on discussions with Air Force officials, SAF/FM uses the unit managers’ supporting statements of assurance to develop the overall Air Force annual Statement of Assurance. The Air Force’s internal control assessment process does not require (1) an assessment of all required elements of an effective internal control system; (2) test plans that specify the nature, scope, and timing of procedures to conduct; and (3) management validation of results. In addition, existing policies and procedures that staff follow to perform the assessments do not fully implement OMB Circular No. A-123. Further, the Air Force provided inadequate training to those responsible for conducting and concluding on the internal control assessments. Although not required by policy, the Air Force performed its first assessment of the five components of internal control during fiscal year 2019 through an SAF/FM review of entity-level controls, which are controls that have a pervasive effect on an entity’s internal control system and may pertain to multiple components. Based on this assessment, SAF/FM concluded in the Air Force’s Statement of Assurance for fiscal year 2019 that three components of internal control (i.e., risk assessment, control activities, and information and communication) were not designed, implemented, or operating effectively. Although SAF/FM performed this assessment in 2019, the assessment did not include a determination of whether each internal control principle was designed, implemented, and operating effectively. Also, there was no indication that the Air Force designed the assessment of entity-level controls to be pertinent to all Air Force objectives, such as those related to operations, reporting, or compliance. In addition, SAF/FM did not provide the assessment results to the unit managers for input or consideration in their unit-specific control assessments and supporting statements of assurance. The Air Force’s Internal Control Playbook directs unit managers to assess the design and operating effectiveness of the relevant entity-level controls within their purview. However, for fiscal year 2019, SAF/FM performed this assessment, and officials informed us that it was not their intent for unit managers to assess entity-level controls. According to OMB Circular No. A-123, management must summarize its determination of whether each of the five components and 17 principles from Standards for Internal Control in the Federal Government are designed, implemented, and operating effectively and components are operating together in an integrated manner. The determination must be a “yes/no” response. If one or more of the five components are not designed, implemented, and operating effectively, or if they are not operating together in an integrated manner, then an internal control system is ineffective. AFI 65-201 states, as part of its discussion on assessing internal control over financial reporting, that OMB Circular No. A-123 prescribes a process to evaluate controls at the entity level for the five components of internal control (i.e., control environment, risk assessment, control activities, information and communication, and monitoring). The Air Force’s assessment lacked required determinations related to internal control principles because the Air Force lacked policies or procedures for the following: Clearly delineating who within the Air Force (e.g., unit managers or SAF/FM) is responsible for assessing the components and principles of internal control, how often assessments are performed, at what level (e.g., entity or transactional) components and principles are to be evaluated, what objectives are covered in the assessment of entity-level controls, to whom to communicate the results if the results are relevant to others performing assessments of internal control, and what Air Force guidance to follow. Documenting management’s summary, whether performed by the unit managers as outlined in the guidance or by SAF/FM as performed during fiscal year 2019, of its determination of whether each component and principle is designed, implemented, and operating effectively and whether components are operating together in an integrated manner. By not ensuring that management is assessing whether each internal control component and principle is designed, implemented, and operating effectively, the Air Force cannot determine whether internal control is effective at reducing the risk of not achieving its stated mission and objectives to an acceptable level. Moreover, given the entity-wide relevance of SAF/FM’s conclusions, unit managers may not be aware of all the necessary information with which to draw conclusions about the effectiveness of their organizational units’ internal control. Further, management’s assurances on internal control effectiveness, as reported in the Statement of Assurance, may not appropriately represent the effectiveness of the Air Force’s internal control. The Air Force did not have a process in place to base its annual assessment of internal control and Statement of Assurance preparation on uniform testing performed across its agency. Although the Air Force had standard test plans for reviews associated with financial reporting objectives, SAF/FM could not demonstrate what procedures are performed to support its assessment of internal control over its operational, internal reporting, and compliance objectives. Specifically, for these objectives, the Air Force did not develop guidance for those responsible for assessing internal controls on which tests to conduct to obtain the best evidence of whether controls are designed, implemented, and operating effectively; how much testing is needed in each area; when to conduct the tests; how to ensure that current year conclusions are based on current year how assessment procedures are to be adjusted or amended to reflect a consideration of prior year self-identified control deficiencies and internal and external audit results. Additionally, standard test plans for the reviews conducted as part of the Air Force’s financial statement audit remediation efforts did not include guidance on how to consider prior year self-identified control deficiencies and internal and external audit results in determining the nature, timing, and extent of procedures to be conducted for the current year. Further, although the Air Force outlines 20 overall objectives in its 2019 through 2021 Business Operations Plan (dated January 2019), it did not document the specific procedures the Air Force planned and performed to support an evaluation of its internal control over these 20 objectives. According to Standards for Internal Control in the Federal Government, management should establish and operate activities to monitor the internal control system and evaluate the results and should remediate identified internal control deficiencies on a timely basis. For example, as part of its monitoring activities, agency management responsible for the OMB Circular No. A-123 program could design a test plan or establish a baseline to monitor the current state of the internal control system and compare that baseline to the results of its internal control tests. The Air Force’s assessment of internal control and Statement of Assurance are not clearly supported by completed test plans or other documented monitoring activities because SAF/FM does not have a policy or procedures for conducting internal control assessments that require documented test plans that (1) tie back to specific objectives included in the Business Operations Plan; (2) specify the nature, scope, and timing of procedures to conduct under the OMB Circular No. A-123 assessment process; and (3) reflect a consideration of prior year self- identified control deficiencies and results of other internal and external audits. By not ensuring that its more than 6,500 unit managers are evaluating internal control based on the agency’s established baseline, the Air Force cannot ensure that it is consistently and effectively assessing its internal control in order to timely identify and correct deficiencies or that its design of internal control reduces, to an acceptable level, the risk of not achieving agency operational, reporting, and compliance objectives. As a result, Air Force management’s assurances on internal control, as reported in the overall agency Statement of Assurance, may not appropriately represent its internal control effectiveness. Air Force management did not have a process to validate whether its unit managers appropriately performed and documented their internal control assessments. During our review, Air Force management was uncertain about how many internal control assessments were being performed or by whom. SAF/FM officials initially stated that there were 5,567 organizational units responsible for assessing internal control, but officials later informed us that the actual number was more than 6,500. Furthermore, Air Force officials were unable to provide information on how many organizational unit managers failed to report on their specific internal control assessments or received waivers from performing such assessments. Finally, management lacked a process to ensure that results used to compile the current year Statement of Assurance are based upon current fiscal year assessments. The Air Force requires unit managers to assess internal control and submit results to SAF/FM through the automated statement of assurance submission system. SAF/FM then compiles the supporting statements of assurance submissions and prepares the Air Force’s annual Statement of Assurance. However, we found that the automated system that collects the annual assessments from more than 6,500 unit managers allows these managers to import internal control testing activities from the prior fiscal year. Air Force officials were unable to provide information about how they ensure that unit managers were not importing prior year results without performing current year testing. OMB Circular No. A-123 requires documentation to demonstrate and support conclusions about the design, implementation, and operating effectiveness of an entity’s internal control system, and requires agencies to consider carefully whether systemic weaknesses exist that adversely affect internal control across organizational or program lines. The Air Force’s process lacks management validation of results because it has not developed a documented policy or procedures to ensure that management can readily review and validate the results of its internal control testing. The Air Force has not required SAF/FM to validate (1) the number of organizational units reporting for its overall internal control assessment; (2) how it tested control procedures, what results it achieved, and how it derived conclusions from those results; and (3) whether it based the results used to compile the current year Statement of Assurance on current fiscal year assessments. Additionally, when PRE management waives assessments, SAF/FM does not have a process to track waivers and assess how they affect the current year assessment of internal control, determination of systemic weaknesses, and compilation of the Air Force’s overall Statement of Assurance. By not validating the internal control assessment results, Air Force management cannot ensure that the assessment was performed as expected to support related conclusions and timely identify internal control deficiencies. Further, management’s assurance on internal control, as reported in the overall Statement of Assurance, may not appropriately represent the internal control effectiveness. Air Force guidance for its assessment of internal control neither accurately nor completely reflects definitions included in OMB Circular No. A-123. For example, AFI 65-201 and the Statement of Assurance Handbook provided to unit managers for conducting internal control assessments, and the Internal Control Playbook that the Air Force developed in August 2019 to address internal control over reporting objectives, do not include the complete definitions of the four material weakness categories for deficiencies related to (1) operations, (2) reporting, (3) external financial reporting, and (4) compliance objectives, consistent with guidance in OMB Circular No. A-123. Additionally, the handbook does not define internal control as a process that provides reasonable assurance that objectives will be achieved or an internal control system as a continuous built-in component of operations, affected by people, that provides reasonable assurance that an entity’s objectives will be achieved. Although the playbook does adequately define internal control and a system of internal control, the Air Force developed this guidance after we initiated our review, and the guidance only addresses internal control over reporting objectives and not operational and compliance objectives. These inaccuracies and incomplete descriptions occurred because the Air Force did not provide its internal control assessment guidance preparers or reviewers with training to assist them in writing and reviewing the guidance to ensure proper application of the fundamental concepts of internal control and OMB Circular No. A-123, such as those related to definitions of internal control and material weakness. By not ensuring that Air Force guidance reflects accurate and complete definitions included in OMB Circular No. A-123, the Air Force is at increased risk that its officials performing internal control assessments will not properly conclude on the results; therefore, management’s assurances on internal control, as reported in the Statement of Assurance, may not appropriately represent the effectiveness of internal control. Among other things, OMB Circular No. A-123 requires staff to identify objectives, assess related risks, document internal controls, evaluate the design of controls, conduct appropriate tests of the operating effectiveness of controls, report on the results of these tests, and appropriately document the assessment procedures. However, the Air Force’s training provided to unit managers responsible for assessing internal control lacks sufficient instructions on how to perform such assessments. Specifically, the current annual training provided by SAF/FM lacks instruction on how to prepare documentation to adequately support conclusions, identify and test the key internal controls, and evaluate and document test results; limits discussion of OMB Circular No. A-123 internal control assessments to internal control over external financial reporting objectives and does not cover internal control over operational, compliance, and internal reporting objectives; lacks adequate definitions of material weaknesses included in OMB Circular No. A-123; lacks instruction on how to interpret, respond to, and correct self- identified deficiencies (control deficiencies, significant deficiencies, and material weaknesses); and is not required for individuals performing reviews related to external financial reporting. SAF/FM officials informed us that the definitions of material weakness and instructions on how to interpret, respond to, and correct deficiencies were included in other guidance documents, such as the newly created Internal Control Playbook. However, the Air Force did not provide the playbook to PREs during the fiscal year 2019 training, and it is not officially named as guidance in the Air Force’s policy for assessments of internal control. Although the Air Force has described the playbook as supplemental guidance, it does not refer to the playbook as such in its policy for assessing the effectiveness of its system of internal control to provide reasonable assurance that operational, reporting, and compliance objectives are achieved. These inadequacies occurred because SAF/FM has not fully evaluated and incorporated the requirements for assessing an internal control system into its training and has not designed training that (1) enhances skills in evaluating an internal control system and documenting the results; (2) reflects all OMB Circular No. A-123 requirements, such as those related to assessing controls for all objectives and determining material weaknesses; and (3) is provided to all who are responsible for performing internal control assessments. According to federal internal control standards, management should demonstrate a commitment to developing competent individuals. For example, management could provide training for employees to develop skills and competencies needed for key roles and responsibilities in assessing internal control. Without appropriate training, those responsible for assessing internal control may not do so adequately enough to identify internal control deficiencies timely and support the agency’s internal control assessments with appropriate documentation and summarization of the results. OMB Circular No. A-123 requires an agency to evaluate whether a system of internal control reduces the risk of not achieving the entity’s objectives using a risk-based assessment approach. However, the Air Force’s current AFI 65-201 approach calls for assessing internal control at more than 6,500 organizational units without regard to quantitative or qualitative risks. As previously discussed, the Air Force lacks procedures to verify whether its unit managers are performing internal control assessments as intended and does not provide guidance for uniform testing across the organization. Therefore, the Air Force’s current approach for assessing internal control does not ensure that areas of greatest risk are addressed, such as mission-critical assets, and instead may unnecessarily focus on areas of lower risk. As a result, the Air Force may not be using resources efficiently. The Air Force’s current design of assessing internal control does not ensure, at a minimum, the evaluation of internal control over areas key to meeting its mission. Specifically, the Air Force does not have a policy requiring evaluation of whether its internal control over processes related to areas of highest risk—such as processes related to mission-critical assets, including equipment, government-furnished equipment, and weapons-system spare parts managed and held by contractors and working capital fund inventory—reduces the risk of not achieving specific operation, reporting, or compliance objectives to an acceptable level. The Acting Secretary of Defense, during fiscal year 2019, emphasized two of these areas—government property in the possession of contractors, which includes government-furnished equipment, and working capital fund inventory—as high priority for corrective actions related to financial statement audit remediation. The Air Force’s current approach for assessing internal control calls for more than 6,500 organizational units to perform assessments without regard to risk because the Air Force has not developed a policy or procedures providing guidance on how to perform the assessment using a risk-based approach. A risk-based approach provides a methodology for Air Force management to focus and prioritize its internal control assessments on areas and activities of greater risk and importance to accomplishing mission and strategic objectives. By not evaluating internal control with a risk-based approach, Air Force management lacks the assurance that resources are used efficiently to assess key controls associated with achieving Air Force objectives subject to the highest risks along with those designated as high priority by agency management, such as controls over accounting for, managing, and reporting on mission-critical assets. Although the Air Force has not designed a process for performing OMB Circular No. A-123 internal control assessments based on risk, it did review certain business process assessable units, such as mission-critical assets, as part of its financial statement audit remediation efforts. However, Air Force’s reviews of internal control over processes related to mission-critical assets did not meet OMB Circular No. A-123 requirements or federal internal control standards for evaluating a system of internal control. During fiscal years 2018 and 2019, the Air Force engaged the Air Force Audit Agency (AFAA) to review control activities for five processes related to mission-critical assets and instructed business process assessable unit leads to conduct additional internal control reviews for select mission-critical asset areas during fiscal year 2019. However, the organizational unit managers did not formally consider the results of these reviews when concluding on their assessments of internal control. For fiscal year 2018, AFAA performed certain agreed-upon procedures to confirm current transactional processes and related internal control over external financial reporting for five mission-critical asset areas as documented in the related business process cycle memorandums. In order to perform the procedures, AFAA used SAF/FM-prepared templates to confirm certain processes and key controls included in the respective process cycle memorandums. However, the procedures SAF/FM instructed AFAA to perform in 2018 did not meet the requirements of an assessment of an internal control system as prescribed in OMB Circular No. A-123. Specifically: Procedures to test design of controls did not include steps for evaluating whether the controls individually or in combination with other controls would achieve objectives or address related risks. Instead, SAF/FM instructed AFAA to confirm whether the process cycle memorandums accurately reflected the controls and processes in place. Procedures to test operating effectiveness of controls were conducted even though there was no determination of whether the controls were designed to achieve objectives or address related risks. Procedures performed involved the use of process cycle memorandums as a baseline, which, as noted by the Air Force’s auditor, did not always reflect the current process, and there was no process in place for management to assess whether the differences related to an inaccurate cycle memorandum or improper implementation of the process. For fiscal year 2019, tests continued to (1) address operating effectiveness without first determining if the controls were designed to meet objectives and reduce risks and (2) involve the use of process cycle memorandums as a baseline that did not always reflect the current business process. For fiscal year 2019, business process assessable unit leads conducted the additional internal control reviews for select processes related to mission-critical assets based on the templates for tests of design and tests of operating effectiveness in Internal Control Playbook appendixes. Similar to the procedures developed for AFAA, the Air Force did not devise the fiscal year 2019 playbook’s template procedures to support conclusions on the design, implementation, and operating effectiveness of internal control over processes that are key to achieving Air Force operational, internal reporting, and compliance objectives. For example, the procedures that the Air Force used to assess the design of internal control over a process related to spare engines at one air base only considered controls related to external financial reporting objectives. The Air Force did not provide evidence that it tested additional controls key to achieving internal reporting, operating, and compliance objectives, such as improving and strengthening business operations and harnessing the power of data for timely decision-making and mission success, or evidence that the Air Force would test such controls during future reviews. Additionally, the Air Force lacked a process for the organizational unit managers or PREs to consider the results of internal control reviews performed at the business process assessable unit level in assessing internal control when they assess and report on the status of internal control for the overall Air Force Statement of Assurance (see fig. 2). Specifically, the current and draft AFI 65-201 and Statement of Assurance Handbook do not include procedures for how information gathered from AFAA agreed-upon procedures or business process unit leads’ testing of internal control over processes related to mission-critical assets is considered in the conclusions reported through the organizational unit managers’ supporting statements of assurance. OMB Circular No. A-123 requires that management, in accordance with federal standards for internal control, evaluate whether a system of internal control reduces the risk of not achieving the entity’s objectives related to operations, reporting, or compliance to an acceptable level. According to the federal internal control standards, when evaluating the design of internal control, management determines if controls individually and in combination with other controls are capable of achieving an objective and addressing related risks. A control cannot be effectively operating if it was not properly designed and implemented. Further, management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. For example, once established, management can use the baseline, or current state of the internal control system, as criteria in evaluating the internal control system and make changes to reduce the difference between the criteria (what is expected) and condition (what Air Force staff did do instead of what was expected). Also, per OMB Circular No. A-123, an agency may document its assessment of internal control using a variety of information sources, such as management reviews conducted expressly for the purpose of assessing internal control (e.g., AFAA agreed-upon procedures and Internal Control Playbook procedures). Air Force reviews of internal control over processes related to mission- critical assets were inadequate because SAF/FM did not include in the agreed-upon procedures or the Internal Control Playbook tests of design to determine if controls individually and in combination with other controls are capable of achieving an objective and addressing related risks, tests of implementation and operating effectiveness only after a favorable assessment of the design of control, and a baseline that has accurate descriptions of business processes and identifies key internal controls as designed by management to respond to risks. Further, SAF/FM did not document its approach for using results from the AFAA agreed-upon procedures in assessing the Air Force’s internal control over processes related to mission-critical assets because the Air Force did not provide guidance establishing the process and reporting lines of all the sources of information that it considered in preparing its overall Statement of Assurance. Also, SAF/FM did not have a documented process for integrating the results of internal control reviews performed at the business process assessable unit level into the organizational units’ assessment of internal control. Moreover, Air Force did not have guidance describing how often, through which conduit, or when the results from the business process internal control reviews were to be provided to relevant organizational units, or how this information would affect conclusions made in a unit’s respective assurance statement. By not comprehensively evaluating internal control over processes related to mission-critical assets, the Air Force is at increased risk that it may not timely identify internal control deficiencies and may lack reasonable assurance over the effectiveness of internal control over processes accounting for mission-critical assets. In addition, without performing internal control assessments in accordance with requirements or having a formal process to consider the results of the AFAA agreed-upon procedures and the Internal Control Playbook procedures in the organizational unit managers’ assessment process, the Air Force increases the risk that its assessment of internal control and related Statement of Assurance may not appropriately represent the effectiveness of internal control. Air Force senior leaders work to achieve complex and inherently risky objectives across the agency, while managing over $230 billion in mission-critical assets available to carry out its mission. To reduce the risk of not achieving its objectives or efficiently managing its resources, the Air Force needs to implement an ERM capability that is integrated with an effective system of internal control, as outlined in OMB Circular No. A-123 and federal standards for internal control. Although the Air Force has been working to improve its risk management and internal control practices, including remediation of deficiencies in its internal control over financial reporting related to mission-critical assets, it still faces significant challenges. For example, the agency continues to have difficulties with tracking and reporting, with reasonable accuracy, financial information about its mission-critical assets that directly affect its ability to efficiently support the warfighter, achieve its objectives, and accomplish its mission through reliable, useful, and readily available information. Without an effective ERM governance structure, there is an increased risk that the Air Force will not properly identify, assess, and respond to significant entity-level risks. In addition, by not comprehensively implementing and evaluating its internal control system, the Air Force cannot ensure that it is timely identifying and correcting internal control deficiencies or effectively reducing, to an acceptable level, the risk of not achieving its objectives. Further, Air Force management’s assurances on internal control, as reported in the overall agency Statement of Assurance, may not appropriately represent its internal control effectiveness. We are making the following 12 recommendations to the Air Force: The Secretary of the Air Force should develop and implement procedures for an ERM governance structure that includes oversight responsibilities for identifying, assessing, responding to, and reporting on the risks associated with agency material weaknesses from all relevant sources. These procedures should clearly demonstrate that risks associated with material weaknesses are considered by Air Force governance, as a whole, and are mitigated appropriately to achieve goals and objectives. (Recommendation 1) The Secretary of the Air Force should develop policies or procedures for assessing internal control to require (1) clearly delineating who within the Air Force is responsible for evaluating the internal control components and principles, how often they are to perform the evaluation, the level (e.g., entity or transactional) of the evaluation, what objectives are covered in the assessment, to whom to communicate the results if they are relevant to others performing assessments of internal control, and what guidance to follow; (2) documenting management’s determination of whether each component and principle is designed, implemented, and operating effectively; and (3) documenting management’s determination of whether components are operating together in an integrated manner. (Recommendation 2) The Secretary of the Air Force should develop policies or procedures for assessing internal control to require the use of test plans that (1) tie back to specific objectives to be achieved as included in the Business Operations Plan; (2) specify the nature, scope, and timing of procedures to conduct under the OMB Circular No. A-123 assessment process; and (3) reflect a consideration of prior year self-identified control deficiencies and results of internal and external audits. (Recommendation 3) The Secretary of the Air Force should develop policies or procedures for assessing internal control to require SAF/FM to validate (1) the number of organizational units reporting for its overall internal control assessment; (2) how control procedures were tested, what results were achieved, and how conclusions were derived from those results; and (3) whether the results used to compile the current year report are based on current fiscal year’s assessments. (Recommendation 4) The Secretary of the Air Force should develop policies or procedures for assessing internal control to require SAF/FM to assess how waivers affect the current year assessment of internal control, the determination of systemic weaknesses, and the compilation of the Air Force’s overall Statement of Assurance. (Recommendation 5) The Secretary of the Air Force should require that developers of the policy and related guidance associated with designing the procedures for conducting OMB Circular No. A-123 assessments receive recurring training and are appropriately skilled in conducting internal control assessments and are familiar with Standards for Internal Control in the Federal Government. (Recommendation 6) The Secretary of the Air Force should analyze all definitions included in Air Force ERM and internal control assessment policy and related guidance to ensure that all definitions and concepts are defined correctly. (Recommendation 7) The Secretary of the Air Force should require SAF/FM to design recurring training for those who will assess internal control that (1) includes enhancing their skills in evaluating the internal control system and documenting results; (2) reflects all OMB Circular No. A-123 requirements, such as those related to identifying objectives, evaluating deficiencies, and determining material weaknesses; and (3) is provided to all who are responsible for performing internal control assessments. (Recommendation 8) The Secretary of the Air Force should develop policy or procedures consistent with OMB Circular No. A-123 to assess the system of internal control using a risk-based approach. (Recommendation 9) The Secretary of the Air Force should develop procedures to assess internal control over processes related to mission-critical assets, including (1) tests of design that evaluate whether controls are capable of achieving objectives, (2) tests of effectiveness only after a favorable assessment of the design of the control, and (3) a baseline that has accurate descriptions of business processes and identifies key internal controls as designed by management to respond to risks. (Recommendation 10) The Secretary of the Air Force should establish a process and reporting lines of all the sources of information, including reviews performed of internal control processes related to mission-critical assets, that will be considered in the Secretary’s Statement of Assurance. (Recommendation 11) The Secretary of the Air Force should develop procedures to require coordination between business process leads and the Air Force’s unit managers to ensure that mission-critical asset–related internal control deficiencies are considered in the unit managers’ assessments of internal control and related supporting statements of assurance. These procedures should include how, when, and with what frequency the results from the business process internal control reviews should be provided to relevant organizational units for consideration in their respective assurance statements. (Recommendation 12) We provided a draft of this report to the Air Force for review and comment. In written comments, the Air Force concurred with all 12 of our recommendations and cited actions to address them. Air Force’s comments are reproduced in appendix I. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Under Secretary of Defense (Comptroller)/Chief Financial Officer, the Secretary of the Air Force, the Assistant Secretary of the Air Force (Financial Management and Comptroller), and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2989 or kociolekk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In addition to the contact named above, John Sawyer (Assistant Director), Russell Brown, Anthony Clark, Oliver Culley, Eric Essig, Patrick Frey, Jason Kelly, Aaron Ruiz, and Vanessa Taja made key contributions to this report.
OMB Circular No. A-123 requires agencies to provide an annual assurance statement that represents the agency head's informed judgment as to the overall adequacy and effectiveness of internal controls related to operations, reporting, and compliance objectives. Although the Air Force is required annually to assess and report on its control effectiveness and to correct known deficiencies, it has been unable to demonstrate basic internal control, as identified in previous audits, that would allow it to report, with reasonable assurance, the reliability of internal controls, including those designed to account for mission-critical assets. This report, developed in connection with fulfilling GAO's mandate to audit the U.S. government's consolidated financial statements, examines the extent to which the Air Force has incorporated ERM into its management practices and designed a process for assessing internal control, including processes related to mission-critical assets. GAO reviewed Air Force policies and procedures and interviewed Air Force officials on their process for fulfilling ERM and internal control assessments. The Air Force's efforts to implement Enterprise Risk Management (ERM) are in the early stages, and accordingly, it has not fully incorporated ERM into its management practices as outlined in Office of Management and Budget (OMB) Circular No. A-123. As a result, the Air Force is not fully managing its challenges and opportunities from an enterprise-wide view. Until it fully incorporates ERM—planned for some time after 2023—the Air Force will continue to leverage its current governance and reporting structures as well as its existing internal control reviews. The Air Force has not designed a comprehensive process for assessing internal control, including processes related to mission-critical assets. GAO found that existing policies and procedures that Air Force staff follow to perform internal control assessments do not accurately capture the requirements of OMB Circular No. A-123. For example, the Air Force does not require (1) an assessment of each internal control element; (2) test plans that specify the nature, scope, and timing of procedures to conduct; and (3) validation that the results of internal control tests are sufficiently clear and complete to explain how units tested control procedures, what results they achieved, and how they derived conclusions from those results. Also, Air Force guidance and training was not adequate for conducting internal control assessments. In addition, GAO found that the Air Force did not design its assessment of internal control to evaluate all key areas that are critical to meeting its mission objectives as part of its annual Statement of Assurance process. Furthermore, GAO found that procedures the Air Force used to review mission-critical assets did not (1) evaluate whether the control design would serve to achieve objectives or address risks; (2) test operating effectiveness after first determining if controls were adequately designed; (3) use process cycle memorandums that accurately reflected the current business process; and (4) evaluate controls it put in place to achieve operational, internal reporting, and compliance objectives. GAO also found that the results of reviews of mission-critical assets are not formally considered in the Air Force's assessment of internal control. Without performing internal control reviews in accordance with requirements, the Air Force increases the risk that its assessment of internal control and related Statement of Assurance may not appropriately represent the effectiveness of internal control, particularly over processes related to its mission-critical assets. GAO is making 12 recommendations to the Air Force, which include improving its risk management practices and internal control assessments. The Air Force agreed with all 12 recommendations and cited actions to address them.