Understanding Audit: FY17 Results and Way Ahead UNCLASSIFIED Understanding Audit: FY17 Results and Way Ahead Dr. Dorothy Potter Risk Management Section Head Risk and Compliance Branch Programs and Resources Headquarters, U.S. Marine Corps January 2, 2018 UNCLASSIFIED UNCLASSIFIED

Full Financial Statement Audit What is a Full Financial Statement Audit? Annual, comprehensive review of the health of the Marine Corps measured in dollars. Budget, Balance Sheet, Internal Controls, IT Systems Wide ranging impact from equipment and property accountability, to IT risk management, to business process design and control Goal: “Unmodified” Opinion FY17 Result: Disclaimer 9 Material Weaknesses 134 Notices of Findings or Recommendations (NFRs) Future progress will be measured by fixing NFRs

Audit Return on Investment Clean opinion is a basic expectation from the taxpayer, Congress, and top leadership However, true value to Marines is increased accountability over resources and the promise of increased funding to support operations and investment Example: Accountability of ammunition Example: Equipment accountability and resourcing Example: IT Controls Basic standard of organizational health and risk Senate, SECDEF, SECNAV interest Expected to produce real savings through increased accountability of resources Get the most out of limited resources Examples of wasted resources: Reconciliation of $8B in Ammunition with Army 85% Documented proof of capital equipment

Clifton, Larsen, Allen (SBA) Goal: Unmodified Opinion by FY20 Achieved by incremental reduction of NFRs and Material Weaknesses Grant Thornton (SBA) Clifton, Larsen, Allen (SBA) Kearney and Co, P.C. (FFS) DoN Financial Statement Merge FY2010 FY 2014 FY 2017 FY 2020 - Army Corps of Engineers experience shows that level of effort decreases with successful corrective action

Keys to Success and Questions to Ask Who is reviewing your internal controls? Understanding business process SOPs and “Evidence of Oversight” Not just for financial managers What’s the root cause of the problem? Have we tested to ensure it’s fixed? Are our IT systems and business processes designed with audit in mind?

Questions

Types of Audit Opinions UNCLASSIFIED NOTE: In FY13, the American Institute of Certified Public Accountants (AICPA) issued guidance to clarify the opinion type names to be consistent with the language used in the International Standards on Auditing (ISAs). UNCLASSIFIED

FY17 Material Weaknesses (Slide 1) UNCLASSIFIED FY17 Material Weaknesses (Slide 1) Entity-Level Controls (P&R / C4) Mature Entity Level Control Processes Lacking (Tone, PCN Consistency) Incomplete IT System RMF Entity Rationalization and Implementation Ability to provide complete, timely, and sufficient evidence (All Areas) Timeliness of Business Process Documentation Transaction Level Data Populations Supporting Account Balances Complete and Timely Documentation Supporting Sampled Transactions Financial Reporting and Analysis (P&R, FM Community) Completeness of Financial Statements and Disclosures (A136, GAAP, Aviation, MERCHF) FM Analysis and Oversight (SABRS, DDRS, Oversight of DFAS) Accounting For Estimates (AP Accrual Estimations, Contingent Legal Liabilities, CivPay Labor Accrual Oversight Integrated Financial Management Systems (P&R, I&L) SABRS Interface Controls, SABRs to SMARTS Reconciliation, Feeder to SABRs Reconciliation, SABRS to APSR Reconciliation UNCLASSIFIED

FY17 Material Weaknesses (Slide 2) UNCLASSIFIED FY17 Material Weaknesses (Slide 2) ICOFR – Material Weaknesses (continued…Slide 2) Accounting for Property, Plant, and Equipment (PP&E) (I&L, MCICOM, Commanders) Existence and Completeness of PP&E (Ineffective Inventory Mgmt Controls) Valuation of PP&E (Statements of Differences) Accounting for Operating Materials and Supplies (OM&S) (I&L, LOGCOM, MCSC) Populations and Transactional Data (Temp Storage, Set Assembies, Ammo) Valuation of OM&S (e.g. OIS-MC) Fund Balance with Treasury Controls (P&R) Disbursements and Collections, DFAS Suspense Accounts Business Process Controls (P&R, FM, Supply, Internal Controls) Documentation fully supporting e.g. leave, triannual review, entitlement changes, timekeeping, R&A, Segregation of Duties…etc. Information Systems (IT PMs, Commanders, all users) Continue transition to NIST RMF UNCLASSIFIED