DFAS Did Not Fully Implement Its Contract Pay FIP in Compliance with the FIAR Guidance

DFAS recognized the importance of implementing a FIP to improve its  contract pay processes, systems, and controls, and performed steps  required by the FIAR Guidance, such as performing internal control,  information technology (IT), and substantive testing. Further, the deficiencies noted will affect the components’  ability to rely on DFAS’s controls over contract pay, ultimately increasing  the risk that DOD’s goal for an auditable SBR will not be achieved in its  planned time frame. However, we found that DFAS did not (1) adequately  perform the required planning activities for its contract pay FIP, such as  assessing the materiality of its processes and systems; (2) adequately  perform the required testing; and (3) properly classify the identified  deficiencies. Specifically, based  on our review of the contract pay FIP, DFAS did not: prepare a memorandum of understanding for each of the DOD  components that documented roles and responsibilities for  transactions, supporting documentation retention, and audit readiness  activities; prepare detailed flowcharts and narratives for three of the seven key  processes: (1) reporting of disbursements to Treasury, (2) accounting  and reconciliation of contract pay disbursements to the components’  general ledgers, and (3) contract closeout; and assess the materiality of its processes and systems based on dollar  activity and risk factors. These processes excluded by DFAS from its FIP are intended to help  ensure that the contract disbursements processed by DFAS are  accurately recorded and maintained in the components’ general ledgers  and that the status of DOD’s contract obligations is accurate and up-to- date. As  a result, even though DFAS has already asserted audit readiness, DFAS  does not have assurance that its FIP will satisfy the needs of the  components or provide the expected benefits to the department-wide  efforts to assert audit readiness for contract pay as a key element of the  SBR. In response to our inquiries, DFAS officials stated that they had validated  the populations and provided to us a copy of a data reliability  assessment. However, because  DFAS did not validate the population used to perform internal control and  substantive testing, additional deficiencies may exist in DFAS’s contract  pay controls and errors may exist in the recorded transactions activity and  balances. Further, as stated earlier, DFAS  did not perform sufficient testing of its entity-level controls. Of these 25 deficiencies, we found that DFAS had adequately developed  and implemented the necessary corrective action plans for 7. Standards for Internal Control in  the Federal Government states that control activities such as  reconciliations are an integral part of an entity’s planning,  implementing, reviewing, and accountability for stewardship of  government resources and achieving effective results. In addition,  DFAS did not provide support that a corrective action had been tested  and had successfully remediated the deficiency, and for another  deficiency the test results showed that it had not been successfully  remediated by the implemented corrective action. However, we found that in 3 of the 18 instances, corrective  actions had not been taken as required by the FIAR Guidance and that  the documentation provided by DFAS for the other 15 deficiencies was  insufficient. However, DFAS did not fully comply with the  requirements in the FIAR Guidance for the Discovery and Corrective  Action Phases; therefore, the FIP did not support DFAS’s October 2013  assertion that its contract pay controls were suitably designed and  operating effectively. For example, DFAS did not  perform adequate planning and testing activities for the Discovery Phase  of its FIP. Until DFAS does so, its ability to properly process, record,  and maintain accurate and reliable contract pay transaction data is  questionable. Recommendations for Executive Action

To ensure that DFAS is able to obtain the necessary assurance that its  contract pay end-to-end process can produce, maintain, and sustain  accurate, complete, and timely information in support of the components’  and DOD-wide financial improvement and audit readiness efforts, we  recommend that the Under Secretary of Defense (Comptroller)/Chief  Financial Officer direct the Director of the Defense Finance and  Accounting Service to take the following nine actions:  Address deficiencies in its Discovery Phase planning activities for  contract pay by performing the following:
Document its contract pay end-to-end process by developing the  necessary flowcharts and narratives for those processes excluded  from the FIP. Appendix I: Objective, Scope, and Methodology

To determine the extent to which the Defense Finance and Accounting  Service (DFAS) implemented its contract pay Financial Improvement Plan  (FIP) in accordance with the Financial Improvement and Audit Readiness  (FIAR) Guidance, we compared DFAS’s contract pay FIP with the FIAR  Guidance to determine if the FIP contained all steps and supporting  documentation that the FIAR Guidance requires the components to  complete.
Why GAO Did This Study

The National Defense Authorization Act for Fiscal Year 2013 mandated that DOD's FIAR Plan include the goal of validating that DOD's Statement of Budgetary Resources (SBR) is audit ready by no later than September 30, 2014. DOD identified contract pay as one of the key elements of its SBR. DFAS, the service provider responsible for the department's contract pay, asserted that its processes, systems, and controls over contract pay were suitably designed and operating effectively to undergo an audit.
DOD's FIAR Guidance provides a methodology DOD components are required to follow to develop and implement FIPs to improve financial management and assert audit readiness. The FIP is a framework for planning, executing, and tracking the steps and supporting documentation necessary to achieve auditability.
GAO is mandated to audit the U.S. government's consolidated financial statements, including activities of executive branch agencies such as DOD. This report discusses the extent to which DFAS implemented its contract pay FIP in accordance with the FIAR Guidance. GAO reviewed the FIP and related work products, such as process flowcharts, test plans, and test results, and interviewed DFAS and DOD officials.

What GAO Found

The Defense Finance and Accounting Service (DFAS) is responsible for processing and disbursing nearly $200 billion annually in contract payments (contract pay) for the Department of Defense (DOD). DFAS recognized the importance of implementing a Financial Improvement Plan (FIP) to improve its contract pay processes, systems, and controls, and performed steps required by DOD's Financial Improvement and Audit Readiness (FIAR) Guidance, such as performing testing of internal controls, and substantive processes. However, GAO found that DFAS did not fully implement the steps required by the FIAR Guidance. GAO found numerous deficiencies in the implementation of DFAS's contract pay FIP, including the following:
DFAS did not adequately perform certain planning activities for its contract pay FIP as required by the FIAR Guidance. For example, DFAS did not assess the dollar activity and risk factors of its processes, systems, and controls, which resulted in the exclusion of three key processes from the FIP, including the reconciliation of its contract pay data to the components' general ledgers. Standards for Internal Control in the Federal Government states that control activities such as reconciliations are an integral part of an entity's planning, implementing, reviewing, and accountability for stewardship of government resources and achieving effective results. As result, DFAS did not obtain sufficient assurance that the contract disbursements are accurately recorded and maintained in the components' general ledgers, and that the status of DOD's contract obligations is accurate and up-to-date.
DFAS did not adequately perform required testing of its contract pay controls, processes, and balances. For example, DFAS did not adequately validate the populations used to perform substantive and internal control testing as required by the FIAR Guidance. DFAS officials stated that they validated that the population that was tested; however, GAO found that the process followed by DFAS for validating the population did not include a reconciliation of the population to the components' general ledgers. As a result, additional deficiencies may exist in DFAS's contract pay controls and additional errors may exist in the recorded transactions activity and balances, which affects the components' ability to rely on DFAS's controls over contract pay.
DFAS did not provide adequate documentation to support that it had remediated all of the identified control deficiencies that DFAS stated had been corrected. GAO's review of a nongeneralizable sample of 25 of these deficiencies found that in 3 instances, corrective actions had not been taken as required, and in 15 other instances, the documentation provided by DFAS did not sufficiently support that the identified deficiencies were remediated. DFAS had adequately developed and implemented the necessary corrective action plans for 7 of the deficiencies GAO reviewed.
Although DFAS has asserted audit readiness, until it corrects the deficiencies and fully implements its FIP in accordance with the FIAR Guidance, its ability to process, record, and maintain accurate and reliable contract pay transaction data is questionable. Therefore, DFAS does not have assurance that its FIP will satisfy the needs of the components or provide the expected benefits to department-wide audit readiness efforts.

What GAO Recommends

GAO is making nine recommendations for DFAS to fully implement the requirements in the FIAR Guidance in the areas of planning, testing, and corrective actions. DOD concurred with the recommendations and described its actions to address them.