financial audit tricks of the trade: tying out a transaction … · office of the under secretary...

Office of the Under Secretary of Defense (Comptroller)

Financial Audit Tricks of the Trade: Tying Out a

Transaction Universe

Ms. Margo Sheridan, OUSD Ms. Michele Gaw, DFAS

2

• There is no one agency that has authority over the various entities that execute Defense-wide funds

• Defense-wide funds that are material for the audit are executed by approximately 40 Other Defense Organizations (ODOs)

• All 3 Military Services, the Joint Chiefs of Staff, and 9 of the 16 Principal Staff Assistant (PSA) Offices execute Defense-wide funds

• Defense-wide funds are executed in 21 general ledger (G/L) systems for the General Fund alone

Defense-wide ODO Audit Strategy Complexities

3

Execution of Material Defense-wide Funds

OUSD(AT&L)

Legend

Non-ODO which executes material Defense-wide funding

ODO which executes material Defense-wide funding

Does not execute a material amount of Defense-wide funding, but included to show hierarchy

Other PSAs

Military Services OUSD(P&R)

4

Military Services

Office of the Secretary of Defense

Department of the Army

Transportation Command Military

Surface Deployment and Distribution

Command

Service Medical Activity Army

Department of the Navy

Service Medical Activity Navy

Department of the Air Force

Service Medical Activity Air Force

Transportation Command Air Mobility

Command Defense Health Agency

United States Special Operations Command

Legend



5

Office of the Secretary of

Defense

Office of the Under Secretary of

Defense Personnel & Readiness

Office of the Assistant Secretary

of Defense Readiness and

Force Management

Defense Commissary Agency

Department of Defense Education

Activity

Office of the Assistant Secretary of Defense Health

Affairs

Defense Health Agency

Service Medical Activity Army

Service Medical Activity Navy

Service Medical Activity Air Force

Department of Defense Human

Resources Agency

OUSD(P&R)

• Medicare-eligible Retiree Healthcare Fund (MERHCF)

• Payment to MERHCF • Uniformed Services

University of Health Sciences

Legend




• Military Trust Fund

6


Defense

Office of the Under Secretary of Defense

Acquisitions, Technology and

Logistics

Office of the Assistant

Secretary of Defense

Acquisition

Defense Acquisition University

Defense Contract

Management Agency

Missile Defense Agency

Department of Defense

Test Resource

Management Center



Logistics and Materiel

Readiness

Defense Logistics Agency



Nuclear & Chemical & Biological Defense

Programs

Defense Threat

Reduction Agency

Chemical Biological Defense Program


Secretary of Defense Research

and Engineering

Defense Advanced Research

and Engineering

Defense Technical

Information Center

OUSD(AT&L)

Legend




7


Defense

Office of the Under Secretary

of Defense Policy

Defense Security

Cooperation Agency


of Defense Comptroller

Defense Contract Audit

Agency

Defense Finance and Accounting

Service


of Defense Intelligence

Defense Security Service

Office of the Director

Administration and

Management

Washington Headquarters

Services


Secretary of Defense Public

Affairs

Defense Media Activity

Office of the Department of Defense Chief Information

Officer

Defense Information

Systems Agency

Office of the Joint Chiefs of

Staff

Office of the Department of

Defense Inspector General

Other PSAs

Legend




8

Fourth Estate Systems Landscape

Complex / Dynamic systems environment with dependencies on multiple organizations.

• Dependency on financial information from 21 general ledger systems.

• Over 70 financial, mixed, and non-financial feeder systems and micro-applications including personnel, time & attendance, payroll, purchasing, contracting, entitlement, disbursing, billing, collections, treasury reconciliation, equipment, etc. which are:

• “Owned” by multiple Service Providers and Military Services including DFAS, DLA, DCMA, WHS, DCPAS, DHA, AT&L, Army, Navy, and USAF.

• Comprised of a variety of hardware / database / operating system technology platforms including both legacy and ERP systems.

• Hosted in data centers “owned” by multiple Service Providers and Military Services including DISA, DFAS, DLA, DCMA, WHS, DCPAS, Army, Navy, USAF, and external commercial organizations.

• Multiple ODOs are in a transitional state between legacy systems and ERP systems (i.e., DAI).

• IT controls testing must be completed by the ODOs for self-owned systems and for systems owned by others (Complementary User Entity Controls).

9

Defense-wide ODO Audit Strategy, by ODO, for FY2015 and FY2016

10

Number of Reporting Entities by Category Under Different Materiality Analyses

Material Reporting Entities Determined Based on Total Budgetary Resources

Material Reporting Entities Determined Based on Material SBA Line Items

FY 2009 SBR Data - FIAR Guidance Analysis

FY 2012 SBR Data - FIAR Guidance Analysis

FY 2013 SBR Data - 2014 Approach - Analysis of Three High Priority SBA Line Items (Appropriations Received,

Obligations Incurred, Outlays)

Immaterial Reporting Entities 28 29 18

ODO General Fund - Material Reporting Entities (Under Audit or Consolidated)

25 28 40

Military Retirement Trust Fund (MRF) 1 1 1

Military Services (Army, Navy and Marine Corps, Air Force, USACE)

4 4 4

4 4 4 1 1 1

25 28

40

28

29

18

Nu

mb

er

of

Re

po

rtin

g En

titi

es

11

Amount of Total FY13 Budgetary Resources Associated with Each Material Reporting Entity*, Organized by G/L System

Trust Fund Reporting System $91,176,093,737.43

41%

Various $26,516,876,677.33

12%

Army Service G/Ls $23,303,895,015.08

10%

DAI $19,152,699,031.42

9%

Oracle Federal Financials $15,614,485,216.89

7%

WHS WAAS $11,052,521,684.89

5%

Air Force Service G/Ls $9,729,561,390.72

4%

Navy Service G/Ls $7,225,833,734.86

3%

DFAS WAAS $4,964,601,638.01

2%

DoDEA WAAS $3,907,641,415.65

2%

DBMS $2,901,726,944.99

1%

DISA WAAS $2,566,915,929.05

1%

EBS $1,891,718,149.15

1%

Misc. - Unobligated Balances/DFAS Adjustments/etc.

$1,770,207,566.74 1%

EBAS-JCS Instance $822,866,990.08

0%

CEFMS $373,424,067.72

0%

Marine Corps Service G/Ls $127,004,388.39

0%

Unknown $119,414,435.85

0%

eBiz $16,588,916.45

0%

General ledger systems noted in red text are not in the top 99% of total budgetary resources.

**The “Various” general ledger system includes the DoD Component Level Account and the Emergency Response Fund, Defense.

*Based on a materiality level established using only the ODO General Fund, without considering the impact of the Military Services, USACE, or MERHCF on materiality. The Military Retirement Trust Fund and all DoD working capital funds have been excluded from this analysis.

**

12

Amount of Total Budgetary Resources for Material ODO Reporting Entities Associated with Service G/L Systems

SMA Army $12,249,772,403.41

29%

Other '97' Funds Provided to the Army by OSD

$4,381,796,643.55 10%

US Special Operations Command $4,302,188,443.00

10%

Chemical Biological Defense Program

$1,303,673,215.26 3% Defense Acquisition University

$1,066,464,309.86 3%

SMA Navy $5,558,132,523.99

13%

US Special Operations Command (Navy)

$978,025,330.00 2%

Other '97' funds provided to the Navy by OSD

$685,986,565.99 2%

Chemical Biological Defense Program (Navy)

$3,689,314.88 0%

US Special Operations Command (Marine Corps)

$127,003,348.00 0%

Chemical Biological Defense Program (Marine Corps)

$1,040.39 0%

US Special Operations Command (Air Force)

$5,108,447,786.00 12%

SMA Air Force $3,538,467,841.77

8%

Other '97' Funds Provided to the Air Force by OSD

$1,080,645,762.95 3%

Chemical Biological Defense Program (Air Force)

$2,000,000.00 0%

Financial Improvement and Audit Readiness (FIAR)


14

Audit challenges noted during FIAR review of 3/31 ODO Assertion Packages:

– Feeder System to SBR Reconciliations

• Not completed or submission requires walk through with Defense Agency

– End-to-End Process Coverage

• Pervasive control gaps and deficiencies noted (e.g. controls not identified, lack of documentation for attributes reviewed and evidence of reviews):

– Purchase Requisition, Commitment and Obligation, Receipt and Acceptance, Accruals, Tri-Annual Review, Reconciliations

• CAPs not adequately documented to cover GAPs or deficiencies:

– Inadequate documentation to support outcome, No CAP implementation plan, Missing CAPs

Even with support from the FIAR office, reconciliations (feeder system to GL) and accruals may still be an issue after 9/30/14

ODO SBA Audit Challenges

15

• Incomplete System Inventory: One or more important components/ pieces of the system environment excluded from audit readiness testing

• Audit-Relevant Control Objectives Not Included: Audit-relevant IT General and/or Application control objectives not documented or excluded from the scope of testing

• Incomplete Documentation of Controls: Written description of controls do not provide enough information for the reader to understand the design of the actual control in place

• Improperly Designed Tests of Controls / Unsupported Reliance on Test Results: Selection of incorrect testing techniques(s), incorrect testing population, or inadequate sample sizes. Concluding control is effective when test results indicate otherwise or the control was not tested.

• Corrective Actions Not Implemented: Assertions of audit readiness before important / key controls have been remediated

IT Audit Readiness Challenges

16

• Complex and undefined system landscape (many systems – multiple service providers)

• Significant interdependencies with Service Providers

• Complexities related suballotments

• Ill-defined chain of command; lines of authority and communication are not codified

• Lack of entity level controls including Defense-wide management structure

• Limited experienced audit personnel throughout DoD infrastructure

Other Strategic Challenges

17

DFAS Slides

18

DoD Current State Overview Current State Summary: DFAS is heavily dependent on manual reconciliation processes to validate the completeness and accuracy of the various

Legacy and ERP general ledgers and accounting details. To meet the FIAR requirements, DoD customers, in collaboration with DFAS centers, have

developed, or are developing, custom reconciliation tools targeted at specific processes (e.g. FBwT tools such as CCAS & DRRT). Significant data

architecture and information management challenges exist in consolidating the disparate reconciliation efforts into a single process.

Lack of visibility into the reconciliation process and a clearly defined audit trial

Limited availability of reports to monitor and review outstanding items on a timely basis

Manual audit requests and review of account reconciliation

Difficulty validating the completeness of a transaction population based on feeder system inputs

Difficulty drilling down from the Financial Statements to the lowest transaction detail level

DFAS Auditability Pain Points Manual intensive process (matching, processing, follow-up on outstanding items, and corrective actions)

Reliance on Excel and Access as the primary tool for performing matching which is time consuming and error prone

Starting to develop reconciliations using tools like ACL and SAS

Review and approval processes performed outside the system using paper reconciliations including supporting documents

Custom FBwT tools provide a more mature reconciliation process at a significant investment to DFAS

Each reconciliation tool is dependent on unique data extraction methods – both manual and automated

Minimal standardization of reconciliation reports and issue identification, investigation, and resolution

Reconciliation Current State

DFAS Reconciliation Tool Maturity

Developing

(Manual and Labor Intensive)

Defined

(Analytical Focused)

Advanced

(Automated & Recon-Targeted)

Leading

(End-to-End Recon Process)

• +80% of DFAS Recon Processes

• Report, Excel, or Access-Focused

• Some ACL, SAS, and Informatica

efforts across DFAS

• Does not integrate analysis with issue

tracking, investigation, and resolution

• Custom developed FBwT Tools align

here

• BAM Workbenches

• DFAS does not have any leading

reconciliation tools or processes

6/11/2014

19

• Focus on current activity on the SBR (SBA)

• Determine a medium for centralizing all current month activity from necessary entitlement, disbursing, accounting, and reporting systems for each activity.

• Establish procedures for all necessary systems to submit current month files to the centralized medium, including a standard reporting format.

• Align IPA identified reconciliations to categories and rank based on risk

• Identify elements from each system that can be used to reconcile between them

• Identify AU’s responsible for each reconciliation and researching out of balances

1. Determine requirements and prioritize

• Determine population of reconciliations residing with each AU and how they are performed

• Identify gaps and deficiencies between reconciliation needed and what is being performed through FISCAM and FMFIA reviews

2. Identify current state of environment

• Determine the driver of deficiencies on recons currently established

• Identify most effective method of implementing remaining reconciliations

• Ensure proper documentation of all procedures to support MICP

3. Prioritize and close gaps

• Identify lingering deficiencies requiring elevation

• Identify additional deficiencies as they develop

• Obtained IPA validations of remediated state

4. Continuously monitor revised state

• Identify future opportunities for standardization across sites/services

• Eliminate redundancy across different operation levels

• Evaluate future need to create a common data repository for storage of data 5. Develop synergies

Reconciliation Strategy: The Five Phases

20

Maturity Model

6/11/2014 20

Companies typically mature from an unstructured approach towards information management and Business Intelligence and toward a more mature and structured process. At a high-level, the development often follows a path such as this:

Current Status

Short Term Goal

Long Term Goal

21

Ad-hoc

Tools

Analytic/

Repository Tools

• Manual Matching

• Manual Issue Tracking

Integrated

Solutions

Analytic

Tools

Defined Leading Advanced

Maturity

• Auto-matching and auto-certification logic • Automation and repeatability • Direct connection to data sources

•Manual Issue Tracking and supporting documentation external to tool •Non-standard reports

• Auto-matching and auto-certification logic • Automation and repeatability • Direct connection to data sources • Maturing standardization of report templates • Manual issue tracking • Supporting Documentation stored within tool • Integration with business processes

• Auto-matching and auto-certification logic • Automation and repeatability • Direct connection to data sources • Most Mature standardization of report templates • Auto-workflow integrated into tool providing issue tracking • Supporting Documentation stored within tool •Evidence for JVs produced within tool. •Dashboards and other reporting functionality integrated.

Developing

Key Activities

Key Activities

Key Activities

Key Activities • MS Access

• MS Excel

• ACL Desktop

• SAS

• ACL AX

• Informatica

• DFAS Custom Tools (CCAS,

ART, AFT, DRRT)

• SmartStream • Oversight

Workbench

(BAM)

• IDEA

• Arbutus

• ACL AX with GRC

• Chesapeake

• Trintech

• Checkfree

• BlackLine

This chart demonstrates the level of maturity of different reconciliation tools. Both the tools used by DFAS and the

commercial-focused 3rd party reconciliation tools are listed.

• SAS Enterprise GRC

DFAS Current State

• Archer eGRC

Potential Maturity Phases: Reconciliation Tools

21 6/11/2014

22

DFAS Current State – Beginning/Developing Phase

22

This diagram represents DFAS current approach to reconciliations. Processes are siloed; data source dependencies are complex and

over-lapping; minimal standardization of reconciliation reports and approaches; and, no central issue tracking.

*

6/11/2014

23

Defined Phase: Analytic Tools

6/11/2014 23

24

Leading Phase: Integrated Solutions

6/11/2014 24

25

Required Levels of Reconciliation: Agency Level

6/11/2014 25

Legend

= Flow of Transactions = Required Reconciliations = New Processes/Reports

26

Required Levels of Reconciliation: AU Level

6/11/2014 26

Legend

= Flow of Transactions = Required Reconciliations

27

27

Integrity - Service - Innovation

Phase Actions Notes

1 GL UTB (Step 0)

1A) Field Level GL UTB compiled with validation that Proprietary Debits = Credits and Budgetary Debits = Credits

Reconcile The GL UTB should balance & reconcile

prior to transmission to DDRS-B 1B) Validate GL account balances crosswalk to GL UTB Test Posting Logic

2 Transmit GL UTB to DDRS-B and

Create DDRS-B UTB (Step 1-4)

2A) Validate interface control Key Control

The GL UTB should reconcile to DDRS-B UTB

2B) Reconcile GL UTB to DDRS-B UTB Perform data steps (0-4)

2C) Validate GL UTB to DDRS-B UTB cross-walks Identified through data steps (0-4); Working group

2D) Validate GL UTB to DDRS-B UTB exclusions Key controls

2E) Validate adjusting entries Key controls

3 Produce DDRS-B ATB and

generate SF-133 (Steps 5-7)

3A) Reconcile DDRS-B UTB to DDRS-B ATB Perform data recon (steps 5-10) for consolidated view of SBR

The DDRS-B ATB should reconcile to DDRS-AFS ATB

3B) Validate Journal Voucher entries Key control

3C) Validate proprietary to budgetary tie points Key control

3D) Validate DDRS-B ATB (debits = credits) Key control

3E) Reconcile DDRS-B SF-133 to FMB SF132 funding Key control

4 Transmit DDRS-B ATB to DDRS-AFS and produce DDRS-AFS ATB

(Steps 8-9)

4A) Validate interface control Key control

4B) Reconcile DDRS-B ATB to DDRS-AFS ATB Perform data steps (5-10)

4C) Validate DDRS-B to DDRS-AFS crosswalks Key controls

4D) Validate Journal Voucher entries Key controls

4E) Validate proprietary to budgetary tie points Identified for steps (5-10)

4F) Validate DDRS-AFS ATB (debits = credits) Key controls

5 Produce SBA

(Step 10)

5A) Reconcile DDRS-AFS ATB to the SBA and validate cross-walks Automated Process – FISCAM The DDRS-AFS ATB should reconcile to the SBA Financial Statement & the

Budgetary SF-133 report 5B) Reconcile SBA to SF-133 Automated Process – FISCAM

6/11/2014

Financial Reporting Business Process Summary – SBA

28

GL UTB to DDRS-AFS ATB Reconciliation

6/11/2014 28

FSCR GL UTB – DDRS-AFS ATB Reconciliation For SBAD

ata

Wit

hin

DD

RS-

ICe

Dat

a N

ot

Wit

hin

DD

RS-

ICe

Pictural Flow

3.0Memo Crosswalked

GL’s

4.0Unadjusted SFIS

Trial Balance

Start

2.0LOA Excludes

STARS-FL UTB 1.1

STARS-HCM UTB 1.2

NSMA UTB 1.3

Navy ERP UTB 1.4

PBIS Feeder File 1.5

DCAS Feeder File 1.6

(=)(-)

(=)

5.0DDRS-B UTB

Beg. Balance +Year to Date

7.0DDRS-B ATB

Ending Amount

8.0Crosswalks + Import Adjustments + AFS

JV Amounts+ Adjust Report

Mappings

9.0DDRS-AFS ATBEnding Amount

10.0Apply Report

Mapping

End

6.0DDRS-B Beg. Balance

Adj.+

Budget JV Amount

(+)

(=)

(+/-)

(=)

11.0SBA/FinancialStatements

(=)

(+/-)

29

UTB-ATB Process Flow

29

DDRS-ICe BE Beg Bal

Field Level Feeder Files

DDRS-ICe YTD

DDRS-ICe AFS Ending

Amount

Derived ICe SBR Line Items

DDRS-ICe Import Adj

DDRS-ICe BE JV Amount

DDRS-ICe BE Ending Amount

DDRS-ICe Unknown Feeder TB

DDRS-ICe BE Beg Bal Adj

DDRS-B Excluded TB

List

DDRS-ICe AFS JV Amount

DDRS-B JV Log

DDRS-B Ending TB

DDRS-AFS Import Adj Log

DDRS-AFS JV Log

DDRS-AFS Ending TB

Reconciliation (by DFAS/Component)

DDRS-B/AFS to DDRS-ICe Validation

DDRS-AFS SBR


Support Slides

31

• The following are the 9 of the 16 Principal Staff Assistant (PSA) Offices that execute Defense-wide funds:

– Office of the Under Secretary of Defense (OUSD) Policy

– OUSD Personnel and Readiness

– OUSD Comptroller

– OUSD Intelligence

– Office of the Director of Administration and Management

– Department of Defense Office of the Inspector General

– Office of the Assistant Secretary of Defense Public Affairs

– Office of the Department of Defense Chief Information Officer

– OUSD Acquisition, Technology, and Logistics

Defense-wide ODO Audit Strategy Complexities: PSAs

32

• System landscape is complex and undefined

– Currently identified over 70 systems with significant financial statement impact, with several not FISCAM compliant

Many systems (e.g., GFEBS, EBS, etc.) are not ready to support the audit (i.e., FISCAM ready) or configured to support compliance with FFMIA requirements (e.g., ensuring accurate, reliable, timely financial management information)

• Significant interdependencies with Service Providers

‒ Multiple Services Providers at various stages of audit readiness

‒ Identification of key stakeholders, particularly those individuals/agencies external to ODOs, not happening early enough in the process

• Complexities related suballotments

– The ODOs who are suballotting the funds do not have control over the execution of the funds

Other Strategic Challenges

33

• Ill-defined chain of command

– Many of the Financial Statement Reporting Entities (FSREs) do not have the organizational authority to the agency that is executing the Defense-wide funds

Service Medical Agency (SMA) is comprised of three FSREs: SMA-Army, SMA-Navy, and SMA-Air Force. However, the funds are executed by MEDCOM, BUMED, and AFMS. These agencies are structured under the Military Services line of authority.

• Lack of entity level controls including Defense-wide management structure

‒ Several of the ODOs do not have entity level control (e.g., SMAs, SOCOMs, CBDP, etc.)

• Limited experienced audit personnel throughout DoD infrastructure

Other Strategic Challenges (cont.)

34

USAF Balance Sheet Drill Down

6/11/2014 Integrity - Service - 34

Balance Sheet -- Process and System Drill Down Analysis

** GAFS-R Public Civ Pay AP 387,857,276

Correct AP Postings (26,707) Processed Corrections (394,860,491) Pending Corrections 1,070,689 Further Analysis Required (5,959,233)

*** Mil Pay GAFS-R JVs 58,552,174,135

GAFS-R Detail 58,162,466,928 Net Mil Pay 389,707,207

Accomplishments:

• Accounts Payable FY14 Q1 balance “drilled down” to transaction detail

• GAFS-R FY14 Q1 USSGL 4901 (Delivered Orders-Obligations Unpaid) SBA transactions stratified and aged

• Confirmed MOCAS AP accrual JVs were posted to assigned native GLACs 2110.NFM and 2960.NUCM

• MOCAS – Aged public payable clean up actions processed 7 Apr.

Next Steps:

• Capture Vendor Pay (IAPS) accruals

• Implement USAF SBR-ART Leveraging Technology recons impacting Public AP

• Determine materiality of DARTS TBO Prevalidation public AP process

• Validate Mil Pay public AP GAFS-R detail postings

DD

RS-

AFS

Dri

ll D

ow

n

Fin

anci

al

Stat

em

en

t

Li

ne

Ite

m

DD

RS-

AFS

GA

FS-R

Dri

ll D

ow

n

Bu

dge

t Ex

ecu

tio

n

Acc

ou

nti

ng/

Fe

ed

er

Syst

em

s C

ate

gory

/ C

lass

ific

atio

n

Enti

tlem

en

t ES

S Q

uar

terl

y R

ep

ort

CEEMIS

$55,764,216

STARS

$15,279,942

Identified Other *

$771,282,177

Contract Pay (MOCAS & CPAS)

$1,747,496,905

Travel Pay

($105,392,358)

Vendor Pay

($246,851,890)

AFS JVs

$66,151,860

Civ Pay**

$387,857,276

Undistributed JVs

($979,873,021)

Imported TB to AFS

$3,254,537,407

* Identified Other includes PC Z, etc.

and may flow directly into GAFS-R

not through BL

SABRS

$2,568,336

ERP

$5,272,822

Amounts Requiring Additional Research

DEAMS

$5,272,822

Balance Sheet – USAF General Funds

(as of 1QFY2014)

$58,700,659,205** $753,303,887

$502,214,699

$105,392,358 ($557,644,923) ($89,326,899)

AP Public – 4B (Note12) 2110, 2120, 2140, 2960

$3,320,687,267

GAFS-R MOCAS Accrual JVs $849,724,760

GAFS-R Mil Pay JVs***

$58,789,941,955

DJMS

TBD

TBO/State Dept

$17,978,290

MOCAS

$1,245,282,206

DTS/RTS

TBD

IAPS

$310,793,033

DEAMS

$94,599,721

Mil Pay***

($58,700,659,205)

Legacy

($55,865,609,627)

GAFS-BL

($56,146,267,095)

OAC 60, CEEMIS,

STARS, SABRS

$275,384,647

OAC 60, CEEMIS, STARS, SABRS

TBD

$275,384,647

OAC 60

$201,772,152

GAFS-R Civ Pay JVs**

($394,860,491)

GAFS-R Other JVs

$855,511,830

financial audit tricks of the trade: tying out a transaction … · office of the under secretary...

Documents