Bureau of Medicine and Surgery 2012 Navy Medicine Audit Readiness Training Symposium Contract Administration: Path to Audit Readiness June 5 th – 6 th, 2012

FOR OFFICIAL USE ONLY Audit Readiness Context DoD is required to assert audit readiness for the Statement of Budgetary Resources (SBR) by the end of Fiscal Year As part of Navy Medicines audit readiness effort, the Contracts Administration business process has been identified as an assessable unit for which assertion must take place. Purpose To discuss the Key Control Objectives (KCOs), Key Supporting Documents (KSDs), identified gaps and potential corrective actions for Contracts Administration. Outcome An understanding of the status of the Contracts Administration assessable unit, including major deficiencies and what can be done now at the field level to facilitate a successful financial statement audit. Some assessable units may not require field action at this time. 2

Contracts Administration Scope/Definition FOR OFFICIAL USE ONLY 3 Definition Involves managing the establishment, maintenance and modification, vendor pay, and closeout of contracts. Major business processes include: Execute requisition / Commitment Source of goods Contract Award / Obligation Receipt and acceptance Expenditure / Disbursement Contract Close-out / De-obligation Assessable Unit Lead/Team CAPT James Poindexter Bert Hovermale Assessable Unit Support Kevin Norman – Kim Mackey – Q1 FY12 Obligations $ 729.8M

Audit Readiness Timeline FOR OFFICIAL USE ONLY 4 FY12FY13FY14 Assessable Units – Wave 2 Max Assertion Date Q1Q2Q3Q4Q1Q2Q3Q4Q1Q2 Travel 4 SEP 2012 Consumables 3 DEC 2012 Reimbursable Work Orders – Grantor 3 DEC 2012 Reimbursable Work Orders – Performer (Non-UBO) 1 APR 2013 Military Payroll (including RPN) 1 APR 2013 Contract Administration 1 JUL 2013 Non-Federal Receivables (UBO/Medical Treatment) 1 JUL 2013 Federal Receivables (UBO/Medical Treatment) 3 SEP 2013 Civilian Payroll 2 DEC 2013 Financial Reporting 2 DEC 2013 Funds Management (FBWT) 2 DEC 2013 Assessable Unit Assertion Interim Progress Milestones (90 Days, 50 %, 75 %) Control Testing Time Period

Audit Readiness Process FOR OFFICIAL USE ONLY 5 TasksWork ProductsCompleted Document Assessable Units 1 Determine which key business processes are Assessable Units Process Narrative Process Flowchart Mar. 1st 2 Document Assessable Units through site interviews and observation Assess Internal Controls 3 Determine control objectives for each Assessable Unit Control AssessmentMar. 1st 4 Highlight internal controls in process documentation 5 Assess whether controls are effective in meeting control objectives Assess Supporting Documentation 6 Determine what supporting documents exist for each transaction type Key Supporting Document Matrix Apr. 16th 7 Assess whether there are any unsupported transactions Identify and Prioritize Deficiencies 8 Create list of deficiencies for any objectives that are not met or transactions that are not supported Deficiencies ListingApr. 30th 9 Prioritize deficiency list based on audit criteria

Key Control Objectives (KCOs) KCO #KCO Description Execute Requisition (Need for Contract) 1 Requested amounts do not exceed the funds available Source Goods 2 All contracts/purchase orders are recorded in the proper period 3a All contracts/purchase orders are recorded in the correct amount and line of accounting 3b All contracts/purchase orders represent a valid need that is authorized and approved FOR OFFICIAL USE ONLY 6 KCOs – Represent outcomes needed to achieve proper financial reporting and are a basis by which the effectiveness of control activities can be evaluated.

Key Control Objectives (KCOs) KCO #KCO Description Receipt/Acceptance 4aAll invoices are recorded in the proper period 4b All invoices represent valid transactions that are authorized and approved 4c All invoices are recorded in the correct amount and line of accounting Disbursement 5All payments are recorded in the proper period 6a All payments are recorded in the correct amount and line of accounting 6b All payments represent valid transactions that are authorized and approved FOR OFFICIAL USE ONLY 7

Key Control Objectives (KCOs) KCO #KCO Description De-obligation 7a All excess funds are recorded in the proper period 7b All excess funds are recorded in the correct amount and line of accounting 7c All excess funds represent a valid need that is authorized and approved Information Technology 8 User access is consistent with assigned rights and privileges in accordance with Federal Information System Controls Audit Manual (FISCAM) requirements FOR OFFICIAL USE ONLY 8

Key Supporting Documentation(KSDs) Execution Code Description of TransactionKey Supporting Documentation 915To record Commitments NC To record Contract/purchase order and reduce Commitments Contract Purchase Order 530To record Contract/purchase order with advance payment and reduce Commitments Contract Purchase Order 510To record the invoice amount and reduce the funds from the contract/purchase order Shipping documents Timesheets Invoice FOR OFFICIAL USE ONLY 9 KSDs – Documentation retained to support individual financial transactions and accounting events.

Key Supporting Documentation(KSDs) Execution Code Description of TransactionKey Supporting Documentation 511To record the invoice amount and reduce the funds from the contract/purchase order with advance payment Contract (Advance Payment Terms) 610To record the payment of the invoice Invoice 611To record the advance payment of the invoice Certified Invoice WRTTo record excess funds of the closed contract Final Certified Invoice DD1594 FOR OFFICIAL USE ONLY 10

Deficiency Types Material Weakness: A deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entitys financial statements will not be prevented, or detected and corrected timely. Significant Deficiency: A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. Control Deficiency: A deficiency that exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements in a timely manner. FOR OFFICIAL USE ONLY 11

Considerations For Deficiency Type Quantitative Materiality - Dollar impact or potential impact to the financial statements Qualitative Materiality - Non-quantitative factors such as complexity of transactions, legal or regulatory concern or system deficiencies Pervasiveness - Number of activities or transactions affected by the deficiency Audit Dealbreaker - Issues that prevent an audit from occurring Existing Guidance - Determining whether current policy or SOP is in place that meet financial reporting requirement FOR OFFICIAL USE ONLY 12

Contracts Administration Material Weaknesses Material Weakness 1: Inadequate proof of receipt General Causes: Lack of Compliance with Established Guidance for Receipt & Disbursement Material Weakness 2: Inadequate documentation to support Closed Contracts General Causes: Full Implementation of Contract Closeout SOP Access to Documentation FOR OFFICIAL USE ONLY 13

FOR OFFICIAL USE ONLY Inadequate Proof of Receipt Issue Detail The Assessable Unit Team identified transactions of purchased goods, where the proof of receipt was insufficient, not retained for recordkeeping, or was not generated at time of delivery. Without proof of receipt, it is difficult to determine whether goods have been received in accordance with the contracted statement of work. Additionally, the proof of receipt is required to verify the quantity or services invoiced to the quantity or services actually received. Impact on Audit Readiness Proof of receipt documents are key supporting documents used to ensure that accounts payable are recorded properly and for the correct amount. A lack of the appropriate type of receipt document could cause disbursements to be made for which no actual goods were received, overstating Gross Outlays. 14

FOR OFFICIAL USE ONLY Inadequate Proof of Receipt Path Forward A Corrective Action Plan will be Developed for implementation by the Activities. It must include: Proper guidance via SOP or other Navy Medicine policy that designates what proof of receipt is required for different types of purchases (i.e., DD250 for goods, timesheets for personal services, etc.) Optimally, an auditor vetted checklist for the certifier of invoices to review and sign-off on prior to certification of invoices for payment Optimally, a built in segregation of duties between invoice receptor and invoice certifier (LPO) in WAWF Clearly defined document retention policy for Proof of receipt support, consistent with Navy Medicine policies. 15

FOR OFFICIAL USE ONLY Inadequate documentation to support Closed Contracts Issue Detail Among the activities, there were many contracts that lacked evidence of communication by the vendor that the final invoice had been delivered prior to closing contracts, in accordance with the Contract Closeout SOP. In addition, there were contracts closed that lacked the required DD1594 or other similar contract completion form. This form or other contract completion forms have not been consistently used for all contracts. Additionally, these forms are completed prior to de-obligations being posted to STARS-FL, and there is no check that these transactions are posted accurately. Impact on Audit Readiness Lack of sufficient documentation for closed contracts means that accounting transactions could be posted incorrectly, and this error might not be identified during a financial statement audit. 16

FOR OFFICIAL USE ONLY Inadequate documentation to support Closed Contracts Path Forward A Corrective Action Plan will be Developed for implementation by the Activities. It must include: A process that includes additional controls, after authorization of the de-obligaton via DD1594, that ensures that accounting transactions are recorded accurately in STARS-FL. A method for ensuring that transactions are not recorded in STARS-FL until a valid & authorized DD1594 is provided. This may require coordination with accounting services provider DFAS. Optimally, coordination with other contracting agencies (NAVFAC, FISC) to ensure that adequate documentation is provided in a timely manner for potential contract close-out opportunities. Potential Activity Actions Continued implementation of Contract Closeout SOP 17

Other Contracts Deficiencies Significant Deficiency 1: Inconsistent use and lack of required approvals of the Request for Contractual Procurement form (NC 2276) Control Deficiency 1: Significant delays in resolving rejected payments FOR OFFICIAL USE ONLY 18

FOR OFFICIAL USE ONLY Inconsistent Use and lack of approvals for NC2276s Issue Detail The Assessment Team identified some Activities that are using locally prepared forms instead of the NC2276 form. The NC2276s are not always filled out completely/accurately or contain required approvals Impact on Audit Readiness Incomplete or unapproved forms for Commitments could potentially lead to the risk of Anti-Deficiency Act violations Path Forward / Potential Activity Actions Complete NC2276 forms in accordance to the Contract Establishment SOP 19

FOR OFFICIAL USE ONLY Significant delays in resolving rejected payments Issue Detail The Assessment Team identified some Activities with rejected payments listed on the IDA 128/129 report that were over 30 days old Impact on Audit Readiness Untimely resolutions to rejected payments could potentially lead to the risk of Prompt Pay Act violations resulting in interest payment penalties Path Forward / Potential Activity Actions Resolve all rejected payments on the IDA 128/129 report within 30 days or less Follow the Daily/Non-Daily Accounting SOP 20

FOR OFFICIAL USE ONLY Questions? 21