|
|
|
 |
www.dol.gov
|
 |
 |
 |
| November 4, 2008 DOL Home > About DOL > 2007 PAR > Independent Auditors' Report |
|
DOL Annual Report, Fiscal Year
2007 
Independent Auditors' Report KPMG LLP Secretary and Inspector General We have audited the accompanying consolidated balance sheets of the U.S. Department of Labor (DOL) as of September 30, 2007 and 2006, and the related consolidated statements of net cost, changes in net position, and custodial activity, and combined statements of budgetary resources for the years then ended; and the statements of social insurance as of September 30, 2007 and 2006 (hereinafter referred to as "consolidated financial statements"). The objective of our audits was to express an opinion on the fair presentation of these consolidated financial statements. In connection with our fiscal year 2007 audit, we also considered the DOL's internal controls over financial reporting and performance measures and tested the DOL's compliance with certain provisions of applicable laws, regulations, contracts, and grant agreements that could have a direct and material effect on these consolidated financial statements. We have also examined DOL's compliance with section 803a of the Federal Financial Management Improvement Act of 1996 (FFMIA) as of September 30, 2007. SUMMARY As stated in our opinion on the consolidated financial statements, we concluded that the DOL's consolidated financial statements as of and for the years ended September 30, 2007 and 2006, are presented fairly, in all material respects, in conformity with U.S. generally accepted accounting principles. As discussed in our opinion on the consolidated financial statements, DOL changed its method of reporting the reconciliation of budgetary resources obligated to the net cost of operations and its method of reporting the proprietary activities related to its allocation transfers in fiscal year 2007. Our consideration of internal control over financial reporting resulted in the following conditions being identified as significant deficiencies:
However, none of the significant deficiencies are believed to be material weaknesses. We noted no deficiencies involving the design of the internal control over the existence and completeness assertions related to key performance measures. The results of our tests of compliance with certain provisions of laws, regulations, contracts, and grant agreements disclosed two instances of Anti-deficiency Act noncompliance that are required to be reported under Government Auditing Standards, issued by the Comptroller General of the United States, and Office of Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements for Federal Financial Statements. As stated in our opinion on DOL's compliance with FFMIA, we concluded that DOL complied, in all material respects, with the requirements of FFMIA as of September 30, 2007. The following sections discuss our opinion on the DOL's consolidated financial statements; our consideration of the DOL's internal controls over financial reporting and performance measures; our tests of the DOL's compliance with certain provisions of applicable laws, regulations, contracts, and grant agreements; and management's and our responsibilities. OPINION ON THE FINANCIAL STATEMENTS We have audited the accompanying consolidated balance sheets of the DOL as of September 30, 2007 and 2006, and the related consolidated statements of net cost, changes in net position, and custodial activity, and the combined statements of budgetary resources for the years then ended; and the statement of social insurance as of September 30, 2007 and 2006. The accompanying statements of social insurance as of September 30, 2003 through 2005 were not audited by us and, accordingly, we do not express an opinion on them. In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the U.S. Department of Labor as of September 30, 2007 and 2006, and its net costs, changes in net position, budgetary resources, and custodial activity for the years then ended, and the financial condition of its social insurance program as of September 30, 2007 and 2006, in conformity with U.S. generally accepted accounting principles. As discussed in Note 1B to the consolidated financial statements, DOL changed its method of reporting the reconciliation of budgetary resources obligated to the net cost of operations and its method of reporting the proprietary activities related to its allocation transfers in fiscal year 2007. The information in the Management's Discussion and Analysis, Required Supplementary Stewardship Information, and Required Supplementary Information sections is not a required part of the consolidated financial statements, but is supplementary information required by U.S. generally accepted accounting principles and OMB Circular No. A136, Financial Reporting Requirements. We have applied certain limited procedures, which consisted principally of inquiries of management regarding the methods of measurement and presentation of this information. However, we did not audit this information and, accordingly, we express no opinion on it. The information in the Secretary's Message, Performance Section, and Appendices are presented for purposes of additional analysis and are not required as part of the consolidated financial statements. This information has not been subjected to auditing procedures and, accordingly, we express no opinion on it. INTERNAL CONTROL OVER FINANCIAL REPORTING Our consideration of the internal control over financial reporting was for the limited purpose described in the Responsibilities section of this report and would not necessarily identify all deficiencies in the internal control over financial reporting that might be significant deficiencies or material weaknesses. A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the DOL's ability to initiate, authorize, record, process, or report financial data reliably in accordance with U.S. generally accepted accounting principles such that there is more than a remote likelihood that a misstatement of the DOL's consolidated financial statements that is more than inconsequential will not be prevented or detected by the DOL's internal control over financial reporting. A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected by the DOL's internal control. In our fiscal year 2007 audit, we consider the deficiencies described in Exhibit I to be significant deficiencies in internal control over financial reporting. However, we believe that none of the significant deficiencies presented in Exhibit I are material weaknesses. We noted certain additional matters that we will report to management of DOL in a separate letter. INTERNAL CONTROL OVER PERFORMANCE MEASURES Our tests of internal control over performance measures, as described in the Responsibilities section of this report, disclosed no deficiencies involving the design of the internal control over the existence and completeness assertions related to key performance measures. COMPLIANCE AND OTHER MATTERS Our tests of compliance with certain provisions of laws, regulations, contracts, and grant agreements, as described in the Responsibilities section of this report, exclusive of those referred to in the Federal Financial Management Improvement Act of 1996 (FFMIA), disclosed two instances of Anti-deficiency Act noncompliance that are required to be reported herein under Government Auditing Standards or OMB Bulletin No. 07-04, and are described in Exhibit II. The results of our tests of compliance as described in the Responsibilities section of this report, exclusive of those referred to in FFMIA, disclosed no other instances of noncompliance or other matters that are required to be reported herein under Government Auditing Standards or OMB Bulletin No. 07-04. Other Matter. DOL is currently reviewing two incidents regarding potential violations of the Anti-deficiency Act. As of the date of this report, no final noncompliance determination has been made for either of the two incidents. We noted certain additional matters that we will report to management of DOL in a separate letter. OPINION ON COMPLIANCE WITH FFMIA DOL represented that, in accordance with the provisions and requirements of FFMIA, the Secretary of Labor determined that the U.S. Department of Labor's financial management systems are in substantial compliance with FFMIA. We have examined the U.S. Department of Labor's compliance with section 803a of the Federal Financial Management Improvement Act of 1996 as of September 30, 2007. Under section 803a of FFMIA, DOL's financial management systems are required to substantially comply with (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, and (3) the United States Government Standard General Ledger at the transaction level. We used OMB's Revised Implementation Guidance for the Federal Financial Management Improvement Act, dated January 4, 2001, to determine compliance. In our opinion, the U.S. Department of Labor complied, in all material respects, with the aforementioned requirements as of September 30, 2007. RESPONSIBILITIES Management's Responsibilities. The United States Code Title 31 Section 3515 and 9106 require agencies to report annually to Congress on their financial status and any other information needed to fairly present their financial position and results of operations. To meet these reporting requirements, the DOL prepares and submits financial statements in accordance with OMB Circular No. A-136. Management is responsible for the consolidated financial statements, including:
In fulfilling this responsibility, management is required to make estimates and judgments to assess the expected benefits and related costs of internal control policies. Auditors' Responsibilities. Our responsibility is to express an opinion on the fiscal year 2007 and 2006 consolidated financial statements of the DOL based on our audits. We conducted our audits in accordance with auditing standards generally accepted in the United States of America; the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States; and OMB Bulletin No. 07-04. Those standards and OMB Bulletin No. 07-04 require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement. An audit includes consideration of internal control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the DOL's internal control over financial reporting. Accordingly, we express no such opinion. An audit also includes:
We believe that our audits provide a reasonable basis for our opinion. In planning and performing our fiscal year 2007 audit, we considered the DOL's internal control over financial reporting by obtaining an understanding of the DOL's internal control, determining whether internal controls had been placed in operation, assessing control risk, and performing tests of controls as a basis for designing our auditing procedures for the purpose of expressing our opinion on the consolidated financial statements. We limited our internal control testing to those controls necessary to achieve the objectives described in Government Auditing Standards and OMB Bulletin No. 07-04. We did not test all internal controls relevant to operating objectives as broadly defined by the Federal Managers' Financial Integrity Act of 1982. The objective of our audit was not to express an opinion on the effectiveness of the DOL's internal control over financial reporting. Accordingly, we do not express an opinion on the effectiveness of the DOL's internal control over financial reporting. As required by OMB Bulletin No. 07-04 in our fiscal year 2007 audit, with respect to internal control related to performance measures determined by management to be key and reported in the Management's Discussion and Analysis and Performance sections, we obtained an understanding of the design of internal controls relating to the existence and completeness assertions and determined whether these internal controls had been placed in operation. We limited our testing to those controls necessary to report deficiencies in the design of internal control over key performance measures in accordance with OMB Bulletin 07-04. However, our procedures were not designed to provide an opinion on internal control over reported performance measures and, accordingly, we do not provide an opinion thereon. As part of obtaining reasonable assurance about whether the DOL's fiscal year 2007 consolidated financial statements are free of material misstatement, we performed tests of the DOL's compliance with certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have a direct and material effect on the determination of the consolidated financial statement amounts, and certain provisions of other laws and regulations specified in OMB Bulletin No. 07-04, including certain provisions referred to in FFMIA. We limited our tests of compliance to the provisions described in the preceding sentence, and we did not test compliance with all laws, regulations, contracts, and grant agreements applicable to the DOL. However, providing an opinion on compliance with laws, regulations, contracts, and grant agreements was not an objective of our audit and, accordingly, we do not express such an opinion. Our responsibility also included expressing an opinion on DOL's compliance with FFMIA section 803a requirements as of September 30, 2007, based on our examination. Our examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants and the standards applicable to attestation engagements contained in Government Auditing Standards issued by the Comptroller General of the United States and, accordingly, included examining, on a test basis, evidence about DOL's compliance with the requirements of FFMIA section 803a and performing such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion. Our examination does not provide a legal determination on DOL's compliance with specified requirements. The DOL's response to the findings identified in our audit is summarized in Exhibit I. We did not audit the DOL's response and, accordingly, we express no opinion on it. This report is intended solely for the information and use of the DOL's management, the DOL's Office of Inspector General, OMB, the U.S. Government Accountability Office, and the U.S. Congress and is not intended to be and should not be used by anyone other than these specified parties. 
November 9, 2007 Significant Deficiencies Exhibit I 1. Lack of Adequate Controls over Access to Key Financial and Support Systems The Office of Inspector General (OIG) has been reporting access control weaknesses over the U.S. Department of Labor's (DOL) financial systems since fiscal year (FY) 2001 and application access control weaknesses since FY 2004. In FY 2006, we reported two reportable conditions relating to system access controls over financial reporting:
The OIG recommended that management:
During our FY 2007 audit, we noted that 51 prior year agency-specific recommendations addressing access controls have not been corrected (12 in the Office of the Chief Financial Officer (OCFO), 13 in the Employment and Training Administration (ETA), 12 in the Office of the Assistant Secretary for Administrative Management (OASAM), and 14 in the Employment Standards Administration (ESA)). In addition, in FY 2007, we identified weaknesses that resulted in 112 new recommendations related to access controls (23 in the OCFO, 52 in ETA, 20 in OASAM, and 17 in ESA). The specific nature of these weaknesses, their causes, and the systems impacted by them has been communicated separately to management. New weaknesses detected during FY 2007 and the prior year control weaknesses represent a significant deficiency over access to key financial and support systems. These weaknesses include deficiencies in key financial information technology (IT) controls in the areas of security and system software controls that directly impact access to financial systems. In summary, we noted issues with account management, configuration management, and review of system audit logs in our FY 2007 testing of DOL's IT systems, each of which present a reasonably possible chance to adversely affect DOL's ability to initiate, authorize, record, process or report DOL financial data. Specifically, the following control weaknesses were present in multiple financial systems across various DOL agencies.
These findings are a result of issues in the implementation and monitoring of Departmental processes and procedures. For example, management has not incorporated adequate testing of system controls as part of their Office of Management and Budget (OMB) Management and Control (OMB Circular No. A-123) program. These access control weaknesses could lead to users with inappropriate access to financial systems; inefficient processes; lack of completeness, accuracy, or integrity of financial data; and/or the lack of detection of unusual activity within financial systems. In addition, as a result of the identified weaknesses, the DOL OIG reported an access control significant deficiency in conjunction with its FY 2007 testing of compliance with the Federal Information Security Management Act (FISMA), which was passed as part of the Electronic Government Act of 2002. Based on these facts noted as part of our FY 2007 audit, we revised the status of the recommendations related to this finding from resolved and open to unresolved. Additionally, we recommend that management complete the following actions to address the specific issues identified during our FY 2007 audit:
Management's Response: Management is pursuing an aggressive remediation process that has resulted in substantial improvements to the Department's overall IT control environment. Management continues to believe that controls inherent to specific applications, as well as manual and other compensating controls already in place, are sufficiently designed and effective to prevent or detect unauthorized access to DOL financial systems. Management concurs with and will implement the auditor's 2007 recommendations to enhance the testing of key controls as part of DOL's A-123 program. DOL's Office of Chief Information Officer operates a monitoring program that is applied on a quarterly, semiannual and annual basis for every DOL major information system to determine security control implementation compliance. The monitoring program ensures that agencies document all identified weaknesses, regardless of the oversight sources in the agencies' system-specific Plans of Actions and Milestones (PO&AM). DOL has enhanced its security control testing and evaluation (SCT&E) program which will provide detailed reporting on and tracking of agency access control deficiencies and will closely address the access control and configuration management controls areas identified by the OIG in the FY 2007 FISMA consolidated report. Auditor Response. Based on management's response, the unresolved recommendations cited above are now resolved and open. 2. Weakness Noted over Payroll Accounting During FY 2006, the U.S. Department of Agriculture's (USDA) Office of Chief Financial Officer (OCFO)/National Finance Center (NFC) processed DOL's payroll. The Fiscal Year 2006 — Office of the Chief Financial Officer/National Finance Center General Control Review dated September 21, 2006, and issued by the USDA's Office of Inspector General (Report No. 11401-24-FM) reported a qualified opinion regarding the effectiveness of NFC's internal controls for the period October 1, 2005 through June 30, 2006. During FY 2006, DOL did not have policies and procedures in place to reconcile the payroll information it submitted to the NFC to that received and processed by the NFC. For each FY 2006 pay period, DOL submitted to the NFC payroll information that included all DOL employees for the period, along with their hours worked, leave used, and other payroll related information for the period. The NFC processed the payroll for DOL each period and made available for download a Detail Pay and Deduct Register report for each DOL Human Resources office. We noted that DOL did not utilize these reports to perform reviews or reconciliations of data processed by the NFC, and no other controls were in place during the year to ensure that what was submitted to NFC via Time and Attendance records were reconciled to what was shown as paid in the Detail Pay and Deduct Register. We recommended that management develop and implement policies and procedures to reconcile payroll information provided to the NFC to the payroll information processed by the NFC each pay period. These reconciliations should be documented, reviewed and approved by an appropriate supervisor, and maintained. During FY 2007, the NFC continued to process DOL's payroll. The Fiscal Year 2007 — Office of the Chief Financial Officer/National Finance Center General Control Review dated September 27, 2007, and issued by the USDA's Office of Inspector General (Report No. 11401-26-FM) reported a qualified opinion regarding the effectiveness of NFC's internal controls for the period July 1, 2006 through June 30, 2007. As part of DOL's corrective action plan for FY 2007, the OCFO's PeoplePower Task Force created a Time and Attendance Reconciliation Report based on the NFC's Detail Pay and Deduct Register to be used to reconcile information sent to NFC to that received and processed by NFC. In March 2007, the DOL OCFO issued policies and procedures that state that each DOL Human Resource office should review the Time and Attendance Reconciliation Reports each pay period and research and resolve differences identified. No offices that we tested complied with the new OCFO procedures, but two offices that we tested performed their own reconciliation procedures. The lack of reconciliation controls implemented department-wide around the NFC outputs, compounded by the control weaknesses identified at the NFC, increased the risk that payroll-related line items in the FY 2007 financial statements could be misstated because of errors in payroll processing by the NFC. Federal agencies that use external service providers, such as the NFC, should have controls in place to ensure the accuracy of processing outputs. As stated by the USDA OIG in its FY 2007 Report No. 11401-26-FM, "The accuracy and reliability of data processed by OCFO/NFC and the resultant reports rests with the customer agency and any compensating controls implemented by the agencies." OMB Circular No. 123, Management's Responsibility for Internal Control, states, "Application control should be designed to ensure that transactions are properly authorized and processed accurately and that the data is valid and complete. Controls should be established at an application's interfaces to verify inputs and outputs, such as edit checks." Additionally, per the Government Accountability Office's (GAO) Standards for Internal Control in the Federal Government, "Internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations. It is performed continually and is ingrained in the agency's operations. It includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties." Although the OCFO issued the policies and procedures discussed above, DOL did not implement these policies and procedures, and the OCFO did not monitor to ensure that the reconciliations were completed, documented, reviewed and approved by an appropriate supervisor, and maintained. As such, we consider the recommendation we made in FY 2006 as resolved and open. To close this recommendation in the future, the DOL OCFO should ensure (a) that Human Resource offices are reconciling payroll information provided to the NFC to the payroll information processed by the NFC each pay period in compliance with DOL's current policies and procedures, and (b) that these reconciliations are documented, reviewed and approved by an appropriate supervisor, and maintained. Management's Response: Management accepts that more uniform reconciliation procedures and monitoring would improve internal controls for payroll expenses. As such, OCFO issued a policy memorandum on October 23, 2007, to agencies requiring monthly reconciliation of NFC payroll expenses to DOL payroll personnel data and maintenance of documentation of the work performed. OCFO will perform a monthly reconciliation audit on a sample basis. These audits will begin in FY 2008 and documentation of each audit will be maintained. 3. Weakness Noted over Budgetary Accounting During FY 2006, we reported that the OCFO did not complete timely reconciliations related to the Apportionment and Reapportionment Schedules (SF-132) and the Report on Budget Execution and Budgetary Resources (SF-133). We recommended that management ensure that current policies and procedures over SF132 and SF-133 reconciliations are enhanced to require (a) quarterly reconciliations be prepared and documented, (b) the completion of documented supervisory reviews over the reconciliations, and (c) the completion of these procedures by a certain date (e.g., 15 days after each quarter-end). During our FY 2007 audit work, we requested quarterly reconciliations of the SF-132 to the SF-133. However, the first quarter reconciliation was not completed, and the second quarter reconciliation was not provided to us until June 2007. In addition, these reconciliations identified several necessary corrections to amounts posted in the general ledger, and various differences remained unresolved. We also requested the reconciliation of the FY 2006 Statement of Budgetary Resources (SBR) to the FY 2006 President's Budget of the United States; however, we noted the reconciliation was not reviewed timely. FY 2006 and 2007, the OCFO did not have adequate resources and did not adequately enforce policies to ensure the reconciliations were completed and any identified reconciling items resolved in a timely manner. The lack of timely and complete reconciliations increases the risk that material differences in external reports and in the general ledger may not be detected and corrected in a timely manner during the year or for year-end reporting. Additionally in FY 2006, we reported that 6 of the 10 requested budgetary to proprietary account relationship tests were not completed as of March 31, 2006, and explanations were not provided for variances identified in the four analyses that were completed. We recommended that management develop and implement policies and procedures that require (a) the preparation and documentation of quarterly budgetary to proprietary relationship analyses, (b) the completion of documented supervisory reviews over the analyses, and (c) the completion of these analyses by a certain date (e.g., 15 days after each quarter-end). During our FY 2007 procedures over budgetary to proprietary account relationship analyses, we noted that the OCFO is in the process of automating this analysis and is developing a review policy over the automated analysis. However, the automated analysis and review policy had not been completed and performed during the fiscal year. The lack of timely and complete budgetary to proprietary analyses increases the risk that material differences in external reports and in the general ledger may not be detected and corrected in a timely manner during the year or for year-end reporting. Furthermore, we identified certain errors during our FY 2007 Treasury warrant budgetary testwork that could have been detected by the analysis and reconciliation controls discussed above. Specifically, three budgetary and proprietary entries were not posted concurrently; requiring a net $22 million adjustment to increase budget authority, and one budgetary entry was miscoded to the incorrect budgetary account, requiring a $693 million reclassification entry. In FY 2007, we also identified the improper use of certain U.S. Standard General Ledger (USSGL) accounts related to obligation adjustments in certain situations. Per GAO's Standards of Internal Control in the Federal Government, "Internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations. It is performed continually and is ingrained in the agency's operations. It includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties." In addition, it states, "Control activities occur at all levels and functions of the entity. They include a wide range of diverse activities such as approvals, authorizations, verifications, reconciliations, performance reviews, maintenance of security, and the creation and maintenance of related records which provide evidence of execution of these activities as well as appropriate documentation." According to OMB's Circular No. A-136 (June 2007), section II.4.6.11, "...Information on the SBR should be reconcilable to the budget execution information reported on the SF 133 Report on Budget Execution and Budgetary Resources and with information reported in the Budget of the United States Government to ensure the integrity of the numbers presented. The SBR is an agency-wide report, which aggregates account-level information reported in the SF 133. Consistency between information presented in the financial statements and the Budget of the United States Government is critical to ensure the integrity of the numbers presented. The FACTS II helps to ensure the consistency of data. The FACTS II data submitted by agencies are USSGL-based trial balances, which are used to populate the SF 133 and the actual column of the Program and Financing Schedule of the Budget. The USSGL-based trial balance is also used to prepare the SBR." Since the OCFO did not complete the budgetary and proprietary analysis during FY 2007 and did not complete the SF-132 to SF-133 reconciliations accurately and timely, the recommendations we made in FY 2006 remain resolved and open. We also recommend that management develop clearly defined transaction codes within DOLAR$ to ensure that adjustments to obligations are recorded in the proper USSGL account depending on the situation and strengthen manual controls related to the processing of obligation adjustments. This recommendation is resolved and open. Management's Response: Management is confident that the design and effectiveness of its four layers of operating controls used for end-of-year financial reporting would detect improper balances in the relationships between budgetary and proprietary accounts. These controls ensure the reliability of data for end-of-year financial reporting. With the addition of some final policy documentation in FY 2008 and further strengthening of OCFO monitoring and oversight, management expects to improve the timeliness and effectiveness of the controls over budgetary accounting so that all elements of this finding will be resolved in FY 2008. Regarding the $693 million budgetary entry miscoding error, OCFO provided documentation demonstrating that the end-of-year reconciliations would have detected the misclassified budgetary entry had the auditor not detected it during the course of the audit. This reconciliation, along with other key analytics, confirmed the accuracy of budgetary and proprietary accounting as part of the annual financial statement preparation process. Beginning in December 2007, management will perform these analytical procedures monthly to further strengthen DOL's financial processes. Management is developing new, and strengthening existing, manual and system controls relating to obligation adjustments. 4. Lack of Segregation of Duties over Journal Entries During the FY 2006 audit, we noted that accounting staff from all DOL agencies were able to prepare and enter journal entries into the Department of Labor Accounting Related Systems (DOLAR$) without approval. By allowing individuals the authority to prepare and approve their own transactions in DOLAR$, there is an increased risk that a material error would not be prevented or detected and corrected in a timely manner. We recommended that management reconfigure DOLAR$ so that journal entries entered into the DOLAR$ general ledger system and its successor system are required to be approved electronically by an individual other than the preparer before posting. We also recommended that agencies implement manual compensating review controls until system controls have been implemented. During the FY 2007 audit, we found that management had not made the recommended changes to DOLAR$. During the second quarter of FY 2007, the OCFO had developed Department-wide manual policies and procedures designed to ensure the segregation of journal entry preparation and approval authority. However, our test of 21 sample journal entries from October 1, 2006 through June 30, 2007, noted that 16 of the journal entries did not have supporting documentation evidencing management review and approval. Since the Department did not make, or plan, changes to DOLAR$ to segregate journal entry preparation and approval authority in DOLAR$, and has changed its plans to implement a new general ledger system, we consider the system related recommendation we made in FY 2006 unresolved. To resolve the recommendation, management needs to provide a corrective action plan with timeframes to implement a new general ledger system that requires electronic approval by someone other than the preparer before journal entries are posted. Because management implemented new policies and procedures for part of FY 2007, we consider the manual control recommendation made in FY 2006 as resolved and open. To close this recommendation, management should formalize the Department-wide policies and procedures for documenting the preparation and review of journal entries; and enforce these policies and procedures. Management should ensure that all journal entries are properly supported and documented. Documentation should authenticate the posting of the entry and the users who recorded and authorized the transaction in DOLAR$. Management's Response: In the second quarter of FY 2007, management developed and implemented a new policy that has produced positive results in improving management controls associated with DOLAR$ journal vouchers (JV). This new policy requires documentation be maintained with the JV entries to support transactions and requires that proper authorizations and approvals be shown on the documents. While the auditor noted that weak segregation of duties in the JV process increases the risk of potential misstatement, OCFO employs other compensating controls to mitigate this risk and these compensating controls provide reasonable assurance over the accuracy and reliability of JV entries. OCFO will further refine the existing JV policy to strengthen segregation of duties by January 2008. Having addressed the segregation of duties with manual controls in the JV process, OCFO does not intend to automate this control in the current operating environment as the DOLAR$ accounting system is at the end of its planned life-cycle, where extensive system changes are no longer cost effective. Management will ensure that the new system that replaces DOLAR$, planned for implementation by October 2009, dependent on the availability of funding, contains electronic controls over the JV process. Auditor Response. Based on management's response, the unresolved recommendation to implement an electronic approval by someone other than the preparer in the new general ledger system is now resolved and open. Compliance Matters Exhibit II 1. Anti-deficiency Act During FY 2007, DOL management concluded that two Anti-deficiency Act violations had occurred. The first violation totaled $130,569,041 and the second violation totaled $29,103. The DOL Secretary has reported the violations to the President of the United States, the President of the Senate, the Speaker of the House of Representatives, and the Comptroller General of the United States, as required by 31 U.S.C. section 1351. The first violation occurred in the Employment and Training Administration (ETA) Training and Employment Services (TES) account (160174) for Program Year 2005. This violation involved the obligation of budgetary resources in excess of a fiscal year 2006 apportionment, but did not involve obligations in excess of an appropriation. The second violation occurred in the Employment Standards Administration (ESA) Salaries and Expense account (160150) for fiscal years 2005, 2006, and 2007. The violation represents the compensation paid from March 20, 2005 through November 3, 2006 to an ESA employee who was a citizen of Mexico. This action violated a general provision in the fiscal year 2005 and fiscal year 2006 appropriations. No recommendation is considered necessary since management has completed required reporting related to these violations. 1Also cited in the July 2006 version of OMB Circular No. A-136, section II.4.6.1.
|
||||||||
| ||||||||
