	Objective, Scope, and Methodology

Given DOD’s difficulties in achieving audit readiness and addressing its  long-standing financial management deficiencies, you asked us to assess  DOD’s risk management process for implementing its FIAR Plan. Our  objective was to determine the extent to which DOD has established an  effective process for identifying, analyzing, and addressing risks that  could impede its progress in achieving audit readiness. Based on our analysis, we found commonalities and identified five  basic guiding principles governing effective risk management: (1) identify  risks, (2) analyze risks, (3) plan for risk mitigation, (4) implement a risk  mitigation plan, and (5) monitor risks and mitigation plans. Using these  guiding principles as criteria, we analyzed DOD documents related to risk  management, such as the May 2012 and November 2012 FIAR Plan  Status Reports, which identified DOD’s program risks and mitigation  plans, and FIAR oversight committee meeting minutes, which  documented the results of DOD’s efforts to prioritize and manage these  risks. Most recently, the NDAA for Fiscal Year 2013  made the 2014 target for SBR auditability an ongoing component of the  FIAR Plan by amending the NDAA for Fiscal Year 2010 such that it now  explicitly refers to describing the actions and costs associated with  validating as audit ready both DOD’s SBR by the end of fiscal year 2014  and DOD’s complete set of financial statements by the end of fiscal year  2017. Identify risks. DOD Has Not Established an Effective Risk Management Process

DOD carried out some risk management practices centrally with respect  to implementing the FIAR Plan, but did not follow many risk management  principles necessary for effective risk management and did not document  its risk management policies and procedures. In  January 2012, DOD identified six risks that if not mitigated, could impede  its efforts to achieve auditability. The following is DOD’s  summary of the six risks it identified. A lack of DOD-wide commitment. Insufficient accountability. Poorly defined scope and requirements. Insufficient funding. In addition, guiding  principles state that risk identification is an iterative process where  program stakeholders continually forecast the outcomes of current  strategies, plans, and activities and exercise their best judgment to  identify new risks as the program progresses throughout its life cycle. Although DOD indicated that risks are discussed on an ongoing basis  during various meetings, the risks it initially identified were not  comprehensive, and it did not provide evidence of efforts to identify  additional risks. Conducting a risk identification process in accordance  with guiding principles would have increased the likelihood of DOD  identifying additional risks that could impede the department’s ability to  achieve its auditability goals. Both the Navy’s and DLA’s identified risks included the  reliance on service providers and the need for better document retention. However, DOD did not have  documented policies and detailed procedures for planning risk mitigation  actions. For example, the plans did not  include (1) assignment of responsibility or ownership of the risk mitigation  actions, (2) information about DOD’s or the components’ roles and  responsibilities in executing these plans, (3) deadlines or milestones for  individual mitigation actions, and (4) resource needs. For example, the risk  mitigation plan for addressing the risk of unqualified or inexperienced  personnel did not provide sufficient information as recommended by  guiding principles. Information system control weaknesses. DOD has taken some actions to manage its  department-level risks associated with preparing auditable financial  statements through its FIAR Plan. To improve management of the risks to the FIAR effort throughout the  department, the risk management processes established by two DOD  components—the Navy and DLA—could serve as a starting point. Recommendations for Executive Action

We recommend that the Secretary of Defense direct the Under Secretary  of Defense, in his capacity as the Chief Management Officer and in  consultation with the Under Secretary of Defense (Comptroller), to take  the following two actions:
Design and implement department-level policies and detailed  procedures for FIAR Plan risk management that incorporate the five  guiding principles for effective risk management. However, DOD cited planned actions  that are consistent with our recommendations and findings, including   (1) improving the documentation related to FIAR risk management  activities, (2) reinforcing the importance of more detailed risk  management activity within each DOD component executing its detailed  FIAR Plan, (3) reinstating the DOD probability and impact matrix for risk  analysis for the FIAR initiative, and (4) reevaluating all metrics used to  monitor progress and risk for audit readiness and developing new  measures as appropriate. While these are good first steps, we continue to  believe additional action is warranted. This raises concerns about whether DOD can effectively  manage and mitigate risks in time to meet its audit readiness goals,  beginning with achieving an audit-ready Statement of Budgetary  Resources by September 30, 2014, as mandated.
Why GAO Did This Study

The National Defense Authorization Act (NDAA) of Fiscal Year 2010 mandated that DOD's consolidated financial statements be validated as audit ready by September 30, 2017. The NDAA for Fiscal Year 2012 further mandated that DOD's General Fund Statement of Budgetary Resources be audit ready by the end of fiscal year 2014. DOD issued the FIAR Plan and related guidance to provide a strategy and methodology for achieving its audit readiness goals. However, substantial risks exist that may impede DOD's ability to implement the FIAR methodology and achieve audit readiness.
GAO was asked to assess DOD's risk management process for implementing its FIAR Plan. This report addresses the extent to which DOD has established an effective process for identifying, analyzing, and mitigating risks that could impede its progress in achieving audit readiness. GAO interviewed DOD and component officials, reviewed relevant documentation, and compared DOD's risk management processes with guiding principles for risk management.

What GAO Found

The Department of Defense (DOD) has taken some actions to manage its department-level risks associated with preparing auditable financial statements through its Financial Improvement and Audit Readiness (FIAR) Plan. However, its actions were not fully in accordance with widely recognized guiding principles for effective risk management, which include (1) identifying risks that could prevent it from achieving its goals, (2) assessing the magnitude of those risks, (3) developing risk mitigation plans, (4) implementing mitigating actions to address the risks, and (5) monitoring the effectiveness of those mitigating actions. DOD did not have documented policies and procedures for following these guiding principles to effectively manage risks to the implementation of the FIAR Plan.
In January 2012, DOD identified six departmentwide risks to FIAR Plan implementation: lack of DOD-wide commitment, insufficient accountability, poorly defined scope and requirements, unqualified or inexperienced personnel, insufficient funding, and information system control weaknesses. DOD officials stated that risks are discussed on an ongoing basis during various FIAR oversight committee meetings; however, the risks they initially identified were not comprehensive, and they did not provide evidence of efforts to identify additional risks. For example, based on prior audits, GAO identified other audit-readiness risks that DOD did not identify, such as the reliance on service providers for much of the components' financial data and the need for better department-wide document retention policies. Risk management guiding principles provide that risk identification is an iterative process in which new risks may evolve or become known as a program progresses throughout its life cycle.
Similarly, DOD's actions to manage its identified risks were not in accordance with the guiding principles. GAO found little evidence that DOD analyzed risks it identified to assess their magnitude or that DOD developed adequate plans for mitigating the risks. DOD's risk mitigation plans, published in its FIAR Plan Status Reports, consisted of brief, high-level summaries that did not include critical management information, such as specific and detailed plans for implementation, assignment of responsibility, milestones, or resource needs. In addition, information about DOD's mitigation efforts was not sufficient for DOD to monitor the extent of progress in mitigating identified risks.
Without effective risk management at the department-wide level to help ensure the success of the FIAR Plan implementation, DOD is at increased risk of not achieving audit readiness initially for its Statement of Budgetary Resources and ultimately for its complete set of financial statements.
GAO identified two DOD components--the Navy and the Defense Logistics Agency (DLA)--that had established practices consistent with risk management guiding principles, such as preparing risk registers, employing analytical techniques to assess risk, and engaging internal and external stakeholders consistently to assess and identify new risks. These components' actions could serve as a starting point for improving department-level risk management.

What GAO Recommends

GAO recommends that DOD design and implement policies and procedures for FIAR Plan risk management that fully incorporate the five risk management guiding principles and consider the Navy's and DLA's risk management practices. While DOD did not fully concur, it cited planned actions that are consistent with GAO's recommendations and findings. These are good first steps, but GAO believes additional action is warranted. GAO affirms its recommendations.