Light at the end of the tunnel for DoD audit?

It would be a bad idea for anyone to predict the exact year in which the Defense Department will relieve itself of its status as the only federal department unable to pass a financial audit. But the oversight body closest to the process seems to think there are glimmers of light at the end of what’s still a very long tunnel.

And that’s a change from as recently as two years ago. In its annual plain-language explanation of the audit process, the DoD inspector general’s office cautioned in 2021 that after four years of very expensive full-scope financial audits, progress toward a clean opinion had stalled. The latest version, covering the fiscal 2023 audit process, is much more optimistic.

That’s certainly understandable, considering the biggest success story to date in the long DoD audit saga: the Marines became the first DoD service to earn a clean opinion last year. If the Coast Guard’s first clean audit in 2013 didn’t prove to the workforce that modern financial standards can be applied to military spending, this one definitely did.

“We have been in this disclaimer world for a while, and to see a larger component obtain a clean opinion, even if it was laborious — it’s inspiring,” Dr. Coralis Rodriguez, a financial management and reporting analyst who co-led the OIG’s latest summary report told me. “I think that people are looking to other components now and the lessons about the collaboration that took place in the Marine Corps … I think that if the tone is set and the commitment is made to work towards this, other components can also achieve it. It’s just going to take a lot of work, a lot of collaboration, and the understanding that financial management is everyone’s business.”

And although DoD has long emphasized that getting itself into shape for financial audits is commanders’ business — not just a responsibility for financial managers — the shift in tone to the task being everyone’s business has been noticeable recently, said Troy Robertson, the project manager for the plain-language report, officially called Understanding the Results of the Audit of the 2023 DoD Financial Statements.

“When the financial statement audits first started and we had DoD OIG and independent public accounting firms coming in, you saw a lot of resistance from leadership — folks at the component working level. The attitude was, basically, ‘They don’t understand how DoD does business,’” he said. “That mentality has matured over time, and progressed to, ‘Okay, how do we answer the auditors and get them the information that they need?’ In some of the components, that’s even matured to the point where they’re asking how to improve their financial control environment in ways that would not only help us make better decisions financially and provide transparency, but also help operationally. So that maturity aspect and the involvement of DoD leadership is where I’ve seen the biggest improvement across the years.”

And that willingness to make whatever specific changes are needed at the component level is what’s going to matter. It’s not as though every other DoD component can simply follow the Marine Corps’ template and call it a day. In fact, not even the Marines can do that.

Clean, but laborious

In order to earn the clean opinion for 2023, the service had to undergo an unprecedented two-year audit cycle. Auditors first needed to obtain reliable beginning balances for that year, which required intensive manual work poring over financial transactions around the world for 2022. Then, a similarly labor-intensive process for 2023, to validate that that year’s financial statements were trustworthy from the beginning to the end of the fiscal year.

Auditors have long resisted that type of approach, Robertson said. In almost every other organization, they test an organization’s internal controls in order to determine whether transactions are likely to be processed and accounted for accurately.

“I worked on the Marine Corps audit personally from 2017 through 2019, and the Marine Corps has has maintained that they would be able to pass an audit if their auditors took a substantive approach, which means, if the auditors tested more and put their hands on transactions and validated those transactions as they happen through the Marine Corps’ business processes. Auditors are reluctant to do that because it requires a lot more testing, a lot more site visits,” he said. “It’s complex because of volume, so we’ve never really gone down that path.”

So complex, in fact, that the volume of audit work can’t be realistically completed in one year, which sort of defeats the purpose of annual audits. But the Marines wanted to prove their case, and successfully petitioned the Office of Management and Budget to try the two-year audit cycle, in order to prove their books were accurate and auditable.

“It sparked off a huge audit effort across the world to really substantiate the balances the Marine Corps presented on their financial statements, but it was a huge success story,” Robertson said. “There’s still a lack of controls in place at the Marine Corps, but they also closed over 50% of their notices of findings and recommendations — from 194 NFRs in 2021 to 84 in 2023, so that’s a huge success. It shows that the Marine Corps balances were able to be substantiated by auditors.”

The Marines’ success does seem to validate the position Defense financial management officials have long held: that they’re spending money in exactly the ways Congress authorized, they just can’t document it in ways that live up to audit standards.

Weak internal control environments

To do that — and to make audits sustainable year-after-year — every DoD component will need to have solid internal controls that auditors have confidence in. If those control processes are reliable, auditors generally feel comfortable that the inputs and outputs of individual transactions are reliable, so there’s no need to send armies of staff to examine transaction-level data.

“At the end of the day, that is the issue. If there is not a reliable control system, the auditors have to spend so much more time,” Rodriguez said. “And that can cause scope limitations where the auditors can’t actually complete their procedures. So to get to a place where it won’t take a significant amount of effort to get through an audit, it’s going to take that sound control environment.”

Bad control environments often translate into “material weaknesses” — systemic procedural shortcomings that cause auditors to question whether organizations have a reasonable basis to know what they’re doing with their money. In 2023, DoD had 28, a number that’s held fairly steady over the past five years of audits.

Material weaknesses aren’t a death knell for a clean audit. The Marines still have several. But this year’s report specifically calls out “scope limiting” weaknesses — the kind that make it difficult-to-impossible for auditors to validate financial information unless they’re willing to undertake the levels of effort that happened with the Marine Corps. Across DoD, there are still 17 weaknesses in that category, ranging from decades-old financial IT systems to the F-35 program.

“That’s still what’s going to plague the Marine Corps today. They had a control environment material weakness in 2021, they still have it in 2023, and that’s what’s going to be the challenge for them going forward,” Robertson said. “Obviously, the Marine Corps is much smaller than the Navy, Air Force and the Army, so likely the Marine Corps approach won’t work for another component. Even in two years, we probably couldn’t do it because of the amount of money and resources that that would take. It’s just not feasible.”

Measuring progress

A key component of the audit process has been the individual notices of findings and recommendations auditors issue to Defense components each year. Starting in 2018, when the full-scope audits began, DoD’s policy has been to assign an accountable official to deal with them one-by-one, and gradually close them out.

By that metric alone, subjecting DoD to audit procedures has been wildly unsuccessful. In 2023, for example, DoD components closed out 1,045 NFRs to auditors’ satisfaction. But that year’s audit teams reissued 2,644 NFRs from prior years, and issued 569 new ones.

But counting the total number of outstanding NFRs is not a good metric for success, Rodriguez argued. In some ways, it’s good news that the number is growing in the near-term: it means audit teams and DoD components are continually kicking over new rocks and finding new issues that can only be discovered by the resolution of prior ones.

“I’m biased because I’m an auditor, but to me, a good way of measuring progress is the fact that our audit staff has access to more information to actually review — I think that’s huge progress, because missing data completely limits our ability to finish an audit,” she said. “So to me, the huge progress is the fact that our auditors are able to get their hands on more information, and are able to complete their procedures and truly review more data. That is part why you’re seeing an increase in the NFRs:  it’s good, because we’re able to to fully review the scope of the audit.”

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.