DoD Financial Statement Opinions

Mr. Paul J. Granetto, CPAAssistant Inspector General and Director

Defense Financial Auditing ServicesDepartment of Defense Office of the

Inspector General

12-Month Update and Preparing for Audit

7-2

Topics to be Discussed

• What Has Changed in the Last 12 Months• IPA Audit of U.S. Army Corp of Engineers

– IPA Process– Lessons Learned– Clarification on DoD OIG Role

• Line Item Approach vs. Audit Readiness Approach

• How to Prepare for an Audit in the Middle of a War• Be More Efficient with the Funds Available• OIG Expectations for an Assertion to Become an Assessment or Audit• Familiarize Yourself with Your Own Data

• Continuing Challenges• System Limitations • Auditor Access• Audit Trails

7-3

IPA Audit of USACE

• More than 30 DoD OIG auditors and statisticians were needed to oversee, review, and retest the work of the IPA.

• Prior to sample testing, the OIG statisticians reviewed and approved the IPA sampling methodology, which was a critical step.

• OIG auditors accompanied the IPA during site visits (more than 20 sites) and documented the testing procedures and meetings.

• Because of the inherent risk and unreliable control environment, we followed FAM 650.43 and .44 which encourages supplemental testing in some instances. Therefore, we retested approximately 20% of the IPA’s test samples.

7-4

IPA Audit of USACE

• The DoD OIG issued a Disclaimer of Opinion on November 8, 2006, for the FY 2006 Financial Statements.

• The DoD OIG auditors are reviewing the beginning balances for the Building & Structures line item in order to issue an out-of-cycle opinion.

• At peak, the IPA used approximately 200 auditors for the FY 2006 USACE audit.

• The FY 2007 contract was awarded in May 2007.

• At peak, the IPA will use 100 auditors for the FY 2007 USACE audit

7-5

Lessons Learned

This is hard work for everyone.

7-6

Lessons Learned

For IPAs and Auditees:

• Be careful what you ask forbecause sometimes you get it.

7-7

Lessons Learned

It doesn’t matter what the client thinks, what the IPA thinks, or what we think, a first-year audit of a major DoD Entity is always high

risk.

7-8

Lessons Learned

• As the principal auditor, remain neutral to the last second. Do not even breathe words like QUALIFIED or DISCLAIMER.

• If you want to get a reaction from the client, OSD Comptroller, OMB, and the world in general, walk down the halls and mumble “ADVERSE” under your breath.

7-9

Lessons Learned (cont’d)

• Ensure the auditee’s assertion for audit readiness and correction of prior deficiencies is valid and complete.

• A first-time audit should begin no later than January.

• IPAs should be aware of DoD OIG workpaper documentation and preparation standards and held to those standards throughout the audit.

7-10

Clarification on DOD OIG Role

Webster’s Dictionary defines opinion as a personal view, attitude, or appraisal; the formal expression of a professional judgmentthe formal expression of a professional judgment.

The Financial Audit Manual states:• When reporting on financial statements, the auditor considers the following areas: (1) audit scope, (2) uncertainties, (3) consistency, and (4) departures from GAAP. • The auditor considers these four areas and the results of all audit procedures performed to determine if an opinion can be expressed on the financial statements and, if so, the type of opinion.

• If an opinion cannot be expressed, the auditor should issue a disclaimer report. If an opinion can be expressed, the auditor may issue one of the following opinion types: unqualified, unqualified with an explanatory paragraph, qualified, or adverse.

7-11

Clarification on DOD OIG Role

Opinion Audits are NOT Performance Audits

When the DoD OIG expresses an opinion on the financial statements of an entity, the opinion belongs to theDoD OIG. The DoD OIGis responsible for thevalidity of thatopinion, and it is final.

7-12

Line Item vs. Audit Readiness Approach

• The audit strategy has been refined with more focus on sustaining “segments” of line items rather than pursuing annual audits of line items.

• Audit “segments” are generally portions of line items or logically related business cycles.

• Audit engagements will be undertaken only after the total financial statement has been independently validated as audit ready.

• The goal is a more cost effective approach rather than annually auditing lines until the entire financial statement is audit ready.

7-13

Revised Business Rules

• Discovery and Correction: Management evaluates segments, identifies weaknesses, and implements corrective actions.

• Segment Assertion: Management asserts audit readiness to the OIG and the OUSD (C) for concurrence.

• Audit Readiness Validation: OIG or IPA firm validates management’s assertion using an examination engagement.

• Audit Readiness Sustainment: Management will use OMB A-123 Appendix A as guidance to annually verify segment audit readiness.

• Financial Statement Assertion: Management asserts audit readiness to OIG and OUSD(C) for concurrence.

• Financial Statement Audit: OIG or IPA performs audit of the organization’s financial statements.

7-14

Preparing for Audit in aTime of War

In a time of War the key term is efficiency. With limited funds for priorities other than direct war efforts, activities geared toward financial statement readiness need to make the most of the funds available.

7-15

Preparing for Audit in aTime of War

• Familiarize yourself with your own data by:

– Analyzing accounts (reconciliations, comparisons to prior years, understanding of variances),

– Knowing you control environment,

– Documenting the process,

– Identifying controls and systems,

– Preparing an auditable universe, and

– Ensuring that sufficient, knowledgeable staff is available.

7-16

OIG Expectations for Assertions toBecome Assessments or Audits

The assertion package should demonstrate that all applicable financial statement assertionshave been addressed, to include:

• All transactions exist or have occurred.• Transactions are recorded IAW GAAP.• The Agency has the rights and obligations

for all assets and liabilities.• The financial statement items are valued

and allocated correctly – IAW GAAP.• All information is fairly presented and

disclosed.

7-17

Advice on How to Get Ready for Assessment/Audit

Ensure a sufficient audit trail is available by asking the following questions:

• Do the universe totals equal the amounts on the financial statements?

• Can the sample items be traced to documentation supporting the transaction?

• Can supporting documents be provided in a timely manner?

• Is supporting documentation sufficient, competent and relevant?

7-18

Challenges – System Limitations

• Most DoD Component financial and financial related information systems have not gone through systems audits to assess potential general and application control weaknesses.

• Systems that have successfully completed FFMIA reviews are not necessarily audit ready.

• New systems being developed incorporate increased automation; however, the need to document controls does not go away with automation. Documentation becomes even more critical to managing risk as new vulnerabilities emerge.

• Deficiencies in system design and operating effectiveness are a deterrent to DoD obtaining clean audit opinions; however, disparate and non-compliant accounting processes are an equally, if not greater, deterrent. Fifteen processing centers can not process the same transactions in 15 different ways and expect the general ledgers to balance at the end of the day. Garbage in will always equal garbage out. Until you get the process right, fixing the system will only result in the accurate processing of garbage.

– The audit entity needs to be emphasis on cleaning up the data in the old systems.

7-19

Challenges – System Limitations (cont’d)

• System RFQ Example

– An RFQ stated that the new system had to either interface with or replace a significant number of systems – the exact number of systems is unknown because a study to identify the systems to be replaced or interfaced with had not yet been completed.

– The study disclosed that there were potentially double the original number of systems that needed to be replaced or integrated with.

– This was not communicated to the bidders when they submitted proposals for cost, schedule, and performance on a system without knowine the total requirements.

– Additionally, the entity did not know or could not identify subject matter experts for the original replace or interface systems or make them available to the contractor who needed them for functional and/or technical support.

– Also, the RFQ did not adequately identify the data conversion processes for successful implementation of the new system.

– Finally, the level of data cleansing required for each system to be replaced was not determined prior to issuing the RFQ.

Given the issues mentioned above, how could a contractor accurately estimate cost, schedule, and performance and how could the government really get what it needs to accurately report financial data?

7-20

Challenges – System Limitations (con’t)

7-21

Challenges – Auditor Access

• In a financial statement audit, the burden of proof is not on the auditor, it is on the Agency.

• Auditors must satisfy themselves that the financial statements comply materially with GAAP. To reach that conclusion, auditors must obtain evidence to support that opinion. If auditors cannot obtain sufficient evidence, they must disclaim an opinion.

• Auditor access (quick and easy) to supporting documentation is critical to enable auditors to issue an opinion on the Department’s financial statements.

• Fixed timelines for financial statement audits (opinion reports due to OMB by November 15, just 45 days after the FY ends) necessitate timely access to documentation that auditors need to review in order to issue an opinion.

• A memo on “Auditor Access for Financial Statement Audits” was signed on January 24, 2005. The memorandum requests a change in policies and procedures for financial statement audits.

7-22

Challenges – Adequate Audit Trails

• DoD Components that produce financial statements will be paying for the audits of those statements. If audit trails are time consuming to follow, the Component will be paying CPA firms excessive amounts for struggling through an audit trail. Also, a difficult audit trail could cause a disclaimer of opinion, because the auditors could not complete their work in the allotted time.

• Journal vouchers must be supported by documentation that provides a rationale for the adjustment or entry. Adequate support would be anything that convinces the auditors that the adjustment or entry was factually correct and was in accordance with GAAP. Adequate support could include such things as copies of source documents, explanations of rationale, and methodology for accounting estimates.

– The Grand Plug (used to be trillions of dollars)

• The following slides describe the rational for audit trails and then walk you through an example of the audit trails that auditors currently face.

7-23

Audit Trail Background

DoD Financial Management Regulation, Volume 1, Chapter 3 Key Accounting Requirement Number 8

• Audit trails enable an auditor or evaluator to trace transactions through a system.

• All transactions must be traceable to individual source records.

• Audit trails allow auditors and evaluators to ensure transactions are properly accumulated and correctly classified, coded, and recorded in all affected accounts.

• These trails have to allow any transaction to be traced from initiation through processing to final report. In addition, good audit trails allow for the detection and tracing of transactions in a reasonable timeframe.

• A key test of an audit trail is the ability to trace transactions forward from source documentation or back from the resulting report to permit verification of the amount recorded or reported

7-24

Example: Tracing the Audit Trail

• This agency used a trial balance not compliant with the U.S. Standard General Ledger (USSGL).

• To crosswalk the non-compliant accounts to USSGL accounts, an Excel workbook was used rather than an automated accounting system.

• An excel workbook creates the opportunity for manual adjustments, and thus requires compensating controls to ensure transactions are valid and accurate.

7-25

•This is an example of the spreadsheets found within the Excel workbook.

•This specific spreadsheet illustrates the crosswalk from the account codes used in the non-compliant systems to the USSGL account structure used for reporting.

•In total, the Excel workbook contained 29 worksheets used to compile and consolidate financial data.

Tracing the Audit Trail

7-26

•To determine the process used to calculate adjustment amounts, we traced back the formulas in the cells of the adjustments. For example cell J50 represents an adjustment made to account 4901 in the agency’s excel workbook.

•When tracing back the formula used to calculate the adjustment, the amount linked back to 4 other cells located in 3 different tabs within the excel workbook.

Tracing the Audit Trail

7-27

($7,881,346.02)Budgetary USSGL

AFS sheet

($7,881,346.02)Budgetary USSGL

sheet

($964,494.60)Consolidated

TB sheet

$50,333.01Input sheet

$1,268.41Input sheet

($6,968,452.84)Undist in rpts sheet

•The adjustment amount for account 4901 linked to…

•2 of the 4 amounts could be broken down further, for example the following 6 charts show the breakdown of the $964,494.60 credit.

1 2 3 4

4 amounts

located in 3 different spreadsheets within the excel workbook.

7-28

($964,494.60)Consolidated TB sheet

($964,494.60)Input sheet

($964,494.60)FY06 Cash sheet

$52,097,429.73FY06 Cash sheet

($53,061,924.33)FY06 Cash sheet

1

The credit for $964,494.60 traced

back to…

4 cells

7-29

($7,881,346.02)Budgetary USSGL

AFS sheet

($7,881,346.02)Budgetary USSGL

sheet

($964,494.60)Consolidated TB

sheet

$50,333.01Input sheet

$1,268.41Input sheet

($6,968,452.84)Undist in rpts sheet

•Although the adjustment to account 4901 has already been traced to 10 amounts located in 6 different spreadsheets, the credit below for $6,968,452.84 breaks down even further, so we continued to trace the formulas back to the source amount(s).

1 2 3 4

7-30

($6,968,452.84)

$6,847,435.35 $478,317.30 ($1,303,415.91) $5,912,408.09 ($4,966,291.99)

•The credit for $6,968,452.84 was traced back to 5 amounts.

4

•4 of the 5 amounts could be broken down further…

7-31

Formulas in Cells Continue to Trace Back Further and Further

•In addition to having multiple layers of adjustments, there were also amounts that were hard keyed in the cells’ formulas leaving no audit trail to trace the amounts back to a source.

•For example, the adjustment for account 4901 traces back to this ‘PY Research Disbursement’ amount.

•The credit of $9,950,134,18 consists of 5 individually hard keyed amounts leaving no evidence to show where the amounts originated from.

7-32

$(7,881,346.02)

Adjustment for Account 4901 Linked to 48 Amounts Found Within 7 Spreadsheets

7-33

Audit Trail Example Conclusion

• Overall, there were not adequate controls over the processes to adjust the financial data, and the audit trails were not adequate to verify the validity and accuracy of financial data adjustments. – The audit trails did not allow for the detection and tracing of

transactions in a reasonable timeframe. – All transactions were not traceable to individual source records.– We were not able to trace transactions forward from source

documentation or back from the resulting report to permit verification of the amount recorded or reported.

• Without effective controls to ensure that adjustments to financial data are valid, accurate, and approved, there is an increased risk of material misstatement to the financial statements.

7-34

Questions?