Air Force: Enhanced Enterprise Risk Management and Internal Control Assessments Could Improve Accountability over Mission-Critical Assets

OMB Circular No. A-123 requires agencies to provide an annual assurance statement that represents the agency head's informed judgment as to the overall adequacy and effectiveness of internal controls related to operations, reporting, and compliance objectives. Although the Air Force is required annually to assess and report on its control effectiveness and to correct known deficiencies, it has been unable to demonstrate basic internal control, as identified in previous audits, that would allow it to report, with reasonable assurance, the reliability of internal controls, including those designed to account for mission-critical assets.

This report, developed in connection with fulfilling GAO's mandate to audit the U.S. government's consolidated financial statements, examines the extent to which the Air Force has incorporated ERM into its management practices and designed a process for assessing internal control, including processes related to mission-critical assets.

GAO reviewed Air Force policies and procedures and interviewed Air Force officials on their process for fulfilling ERM and internal control assessments.

The Air Force's efforts to implement Enterprise Risk Management (ERM) are in the early stages, and accordingly, it has not fully incorporated ERM into its management practices as outlined in Office of Management and Budget (OMB) Circular No. A-123. As a result, the Air Force is not fully managing its challenges and opportunities from an enterprise-wide view. Until it fully incorporates ERM—planned for some time after 2023—the Air Force will continue to leverage its current governance and reporting structures as well as its existing internal control reviews.

The Air Force has not designed a comprehensive process for assessing internal control, including processes related to mission-critical assets. GAO found that existing policies and procedures that Air Force staff follow to perform internal control assessments do not accurately capture the requirements of OMB Circular No. A-123. For example, the Air Force does not require (1) an assessment of each internal control element; (2) test plans that specify the nature, scope, and timing of procedures to conduct; and (3) validation that the results of internal control tests are sufficiently clear and complete to explain how units tested control procedures, what results they achieved, and how they derived conclusions from those results. Also, Air Force guidance and training was not adequate for conducting internal control assessments.

In addition, GAO found that the Air Force did not design its assessment of internal control to evaluate all key areas that are critical to meeting its mission objectives as part of its annual Statement of Assurance process.

Furthermore, GAO found that procedures the Air Force used to review mission-critical assets did not (1) evaluate whether the control design would serve to achieve objectives or address risks; (2) test operating effectiveness after first determining if controls were adequately designed; (3) use process cycle memorandums that accurately reflected the current business process; and (4) evaluate controls it put in place to achieve operational, internal reporting, and compliance objectives. GAO also found that the results of reviews of mission-critical assets are not formally considered in the Air Force's assessment of internal control.

Without performing internal control reviews in accordance with requirements, the Air Force increases the risk that its assessment of internal control and related Statement of Assurance may not appropriately represent the effectiveness of internal control, particularly over processes related to its mission-critical assets.

GAO is making 12 recommendations to the Air Force, which include improving its risk management practices and internal control assessments. The Air Force agreed with all 12 recommendations and cited actions to address them.

The U.S. Air Force received a budget of more than $250 billion and  reported total assets of more than $398 billion for fiscal year 2019. Of that  total asset amount, it identified over $230 billion, or 58 percent, as  mission-critical items, such as buildings, aircraft, satellites, missiles,  vehicles, weapons, munitions, and spare parts. In carrying out its mission,  Air Force senior leaders work to achieve complex and inherently risky  objectives, such as keeping track of mission-critical assets that are not  centrally located and may be damaged in the normal course of operation.  To achieve its objectives, leadership must put in place processes to  manage risk as well as a system of internal control in accordance with  applicable legal requirements and guidance.

Although the Air Force has been working on improving its risk  management and internal control practices, including remediation of  deficiencies in its internal control over financial reporting identified during  its financial statement audit process, it still faces significant challenges.  For example, as identified by its financial statement auditors, it continues  to have problems in tracking and reporting, with reasonable accuracy,  financial information about what mission-critical assets it has, where they  are located, what condition they are in, or how much they cost. These  ongoing challenges directly affect the Air Force’s ability to efficiently  support the warfighter, achieve its objectives, and accomplish its mission  through reliable, useful, and readily available information for day-to-day  decision-making.

Since the early 1980s, agencies have been tasked with improving the  management of risks and accountability over federal programs and  operations. Specifically, the Federal Managers’ Financial Integrity Act  (FMFIA) provides the statutory basis for management’s responsibility for,  and assessment of, internal control, and the Office of Management and  Budget’s (OMB) Circular No. A-123, issued under the authority of  FMFIA, requires executive agencies to evaluate the risks to  accomplishing their strategic, operations, reporting, and compliance  objectives and provide an annual Statement of Assurance that represents  the agency head’s informed judgment as to the overall adequacy and  effectiveness of the agency’s internal control. In addition, OMB Circular  No. A-123 describes four types of material weaknesses—that is, serious  problems with internal processes that hamper an agency’s ability to  reasonably assure that internal control objectives are achieved—that may  result from an agency’s overall assessment of internal control  effectiveness. These material weaknesses in internal control are  categorized as related to operations, reporting, external financial  reporting, and compliance.

In July 2016, OMB issued an updated Circular No. A-123, Management’s  Responsibility for Enterprise Risk Management and Internal Control,  which requires executive agencies to implement enterprise risk  management (ERM) in their management practices. OMB defines ERM  as an agency-wide approach to addressing the full spectrum of the  agency’s significant internal and external risks, by understanding the  combined effect of risks as an interrelated portfolio rather than addressing  risks one by one. ERM is a management tool that can help leaders  anticipate and manage risks that could affect the achievement of an  agency’s objectives as well as consider how multiple risks, when  examined as a whole, can present even greater challenges and  opportunities.

We performed this audit in connection with fulfilling our mandate to audit  the U.S. government’s consolidated financial statements, which are  required to cover all accounts and associated activities of executive  agencies, such as the Department of Defense (DOD) and its military  services. Our objectives were to determine the extent to which the Air  Force (1) incorporated ERM in its management practices and (2)  designed an approach for assessing internal control, including processes  related to mission-critical assets. We included mission-critical assets as a  focus because DOD’s first consolidated, department-wide, full financial  statement audit completed in November 2018 identified material  weaknesses in internal control over financial reporting related to mission- critical assets, among other areas.

To address our first objective, we reviewed relevant criteria for  establishing an ERM framework contained in OMB Circular No. A-123  (July 2016). We obtained documentation from DOD and the Air Force  related to ERM and compared it with the requirements contained in OMB  Circular No. A-123. We interviewed DOD and Air Force officials to obtain  additional information related to their plans and timelines for implementing  ERM.

To address our second objective, we reviewed and analyzed DOD and  Air Force policies and procedures related to internal control assessments  and interviewed agency officials to gain an understanding of the Air  Force’s process for assessing internal control. We compared the Air  Force’s current assessment efforts with relevant criteria contained in  Standards for Internal Control in the Federal Government and OMB  Circular No. A-123 for performing an assessment of internal control.

We conducted this performance audit from March 2019 to June 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

OMB provides guidance to federal managers on how to improve  accountability and effectiveness of federal programs and operations by  identifying and managing risks. OMB updated its Circular No. A-123 in  July 2016 to establish management’s responsibilities for ERM. As part of  the overall governance process, ERM calls for the consideration of a risk  across the entire organization and how it may interact with other identified  risks. When used appropriately, ERM is a decision-making tool that  allows agency leadership to view risks across an organization and helps  management understand an organization’s portfolio of top risk exposures,  which could affect achievement of the agency’s goals and objectives. In  December 2016, we issued a report that provided an overall framework  for agencies to build an effective ERM program.

In July 2016, OMB also updated Circular No. A-11, Preparation,  Submission, and Execution of the Budget. In Circular No. A-11, OMB  referred agencies to Circular No. A-123 for requirements related to ERM  implementation, including for developing a risk profile as a component of  the agency’s annual strategic review. A risk profile is a prioritized  inventory of the most significant risks identified and assessed through the  risk assessment process. It considers risks from a portfolio perspective,  identifies sources of uncertainty that are both positive (opportunities) and  negative (threats), and facilitates the review and regular monitoring of  risks. Together, these two OMB circulars constitute the ERM policy  framework for executive agencies by integrating and operationalizing  specific ERM activities and helping to modernize existing risk  management efforts.

Internal Control Requirements and Guidance

Standards for Internal Control in the Federal Government describes  internal control as a process put in place by an entity’s oversight body,  management, and other personnel that provides reasonable assurance  that objectives related to performing operations effectively and efficiently,  producing reliable internal and external reports, and complying with  applicable laws and regulations will be achieved. Internal control serves  as the first line of defense in safeguarding assets. Its importance to  federal agencies is further reflected in permanent requirements enacted  into law. The internal control processes required by FMFIA and the  Standards for Internal Control in the Federal Government help to form an  integrated governance structure designed to improve mission delivery,  reduce costs, and focus corrective actions toward key risks. OMB Circular  No. A-123 precludes agencies from concluding that their internal control  is effective if there are one or more material weaknesses identified from  its assessment.

Air Force’s Annual Statement of Assurance and Financial Audit

As a component of DOD, the Air Force is required to (1) identify and  manage risks, (2) establish and operate an effective system of internal  control, (3) assess and correct control deficiencies, and (4) report on the  effectiveness of internal control through an annual Statement of  Assurance. In addition, the Chief Financial Officers Act of 1990 (CFO  Act), as amended by the Government Management Reform Act of 1994  and implemented by guidance in OMB Bulletin No. 19-03, Audit  Requirements for Federal Financial Statements (August 27, 2019),  requires the Air Force to annually undergo a financial statement audit.  However, since 1990, the Air Force has continued to be unable to  demonstrate basic internal control that would allow it to pass a financial  statement audit, which has contributed to DOD’s financial management  remaining on the GAO High-Risk List since 1995.

For fiscal year 2018, the Air Force reported 11 material weaknesses in  internal control over operations and 14 material weaknesses in internal  control over reporting in its Statement of Assurance. For fiscal year 2019,  it reported the same number of operations-related material weaknesses,  and its reporting-related material weaknesses increased to 25. During the  Air Force’s fiscal years 2018 and 2019 financial statement audits,  independent auditors specifically considered the Air Force’s internal  control over financial reporting in order to determine appropriate audit  procedures to perform in order to express an opinion on the financial  statements. The independent auditors disclaimed an opinion on the Air  Force’s fiscal years 2018 and 2019 financial statements, stating that the  Air Force continued to have unresolved accounting issues, and for each  year, the auditors reported 23 material weaknesses in internal control  over financial reporting. These material weaknesses included control  deficiencies in processes related to the Air Force’s mission-critical assets  and involved a lack of policies and procedures, inadequate financial  information systems and reporting, and inaccurate and incomplete  information in its accountability records and financial reports.

Air Force Has Not Fully Integrated ERM into Its Management Practices

The Air Force’s efforts to implement ERM are in the early stages, and  accordingly, it has not fully incorporated ERM into its management  practices. Since the July 2016 update to OMB Circular No. A-123  required agencies to implement ERM, the Air Force has been leveraging  and relying on its existing risk management practices. To date, these  practices have focused on the organizational unit level and not at the  entity level, as required by OMB Circular No. A-123. The Air Force plans  to integrate ERM increasingly into its management practices over the next  several years, with expectations of a fully developed ERM approach after  fiscal year 2023.

The Air Force has taken the initial steps to establish an ERM governance  structure, define risk classifications, and develop its ERM framework. For  instance, the Air Force has drafted charters updating responsibilities for  two senior management advisory councils—(1) the Enterprise  Productivity Improvement Council (EPIC) and (2) the Executive Steering  Committee (ESC)—to implement OMB Circular No. A-123. EPIC will  oversee the agency’s risk management function, with a specific emphasis  on overseeing the regular assessment of risk and approving risk  responses and the Air Force’s risk profile. ESC will lead the  implementation, assessment, and documentation of risk management  over financial reporting, financial systems, all associated activities, and  oversight with respect to the Air Force’s internal control program. EPIC is  designed to focus exclusively on potential operational material  weaknesses, and ESC will focus on potential financial reporting and  financial systems material weaknesses. Air Force officials informed us  that both councils would share responsibility for compliance objectives  and resulting material weaknesses.

During our audit, we analyzed the Air Force’s financial reports beginning  with those for fiscal year 1999 and noted that the agency and the external  auditors have generally reported material weaknesses each year  involving the tracking, reporting, location, accountability, and cost of  certain mission-critical assets. These weaknesses identified risks that  decreased the Air Force’s ability to perform operations efficiently, prepare  reliable financial reports, and comply with applicable laws and  regulations.

EPIC and ESC currently assess proposed material weaknesses that the  primary reporting elements (PRE) submit and determine whether to  recommend them to the Secretary of the Air Force for reporting in the  annual Statement of Assurance. However, the Air Force’s governance  structure does not include a mechanism for EPIC or ESC to oversee the  management of risk associated with material weaknesses and consider  its effect across the entire agency. Based on our review of the draft  charters and documentation from governance meetings, the Air Force  included provisions for ESC to identify material weaknesses related to  financial reporting and financial systems and EPIC to identify material  weaknesses related to operations objectives. However, there were no  charter provisions for either council to identify, assess, respond to, and  report on the risks associated with those material weaknesses or material  weaknesses identified through external audits. A material weakness,  reported by either the agency or an external auditor, by definition  indicates a significant decrease in an agency’s ability, during the normal  course of operations, to achieve objectives and address related risks.

Under OMB Circular No. A-123, an agency’s risk management  governance structure helps ensure that the agency identifies risks that  have the most significant effect on the mission outcomes of the agency.  Without a thorough and integrated ERM governance structure that  includes oversight responsibilities managing risks associated with  material weaknesses in internal control, there is an increased risk that the  Air Force will not properly identify, assess, and respond to significant  entity-level risks.

Air Force Has Not Designed a Comprehensive Approach for Assessing Internal Control, Including Processes Related to Mission-Critical Assets

The Air Force’s current internal control assessment process is not  designed to facilitate the timely identification and correction of internal  control deficiencies or to be used to support the Air Force’s annual  Statement of Assurance. Specifically, Air Force management has not  designed an adequate process for assessing internal control. Further, the  process does not focus on areas with the greatest risk, such as mission- critical assets. In addition, the reviews of mission-critical assets in fiscal  years 2018 and 2019 in support of the financial statement audit did not  result in adequate assessments of internal control.

The Air Force’s policy for assessing the effectiveness of its internal  control system and for preparing the agency’s annual Statement of  Assurance is based on DOD Instruction 5010.40, Managers’ Internal  Control Program Procedures, dated May 2013. The Air Force’s policy is  outlined in Air Force Policy Directive 65-2, Managers Internal Control  Program. This policy is supported by the procedures outlined in Air Force  Instruction (AFI) 65-201, Managers Internal Control Program Procedures,  dated February 2016, which the Air Force currently is revising to address  the July 2016 OMB Circular No. A-123 update. The Air Force provides  additional guidance to supplement AFI 65-201 in its Statement of  Assurance Handbook and its Internal Control Playbook.

The Air Force’s OMB Circular No. A-123 program comprises 17  designated PREs, including the Secretariat and Air Force staff offices,  major commands, the Army and Air Force Exchange Service, and direct- reporting units. The Air Force subdivides each PRE along organizational  lines into more than 6,500 organizational assessable units (organizational  units), such as a squadron or wing, and other specific programs and  functions, where it evaluates internal controls per AFI 65-201. Each of the  organizational units has an assessable unit manager (unit manager) who  has authority over the unit’s internal control, including continual  monitoring, testing, and improvement. Figure 1 illustrates how the Air  Force’s organizational structure informs its overall annual Statement of  Assurance.

The Air Force requires each unit manager to submit an annual supporting  statement of assurance providing the manager’s opinion on whether the  unit has reasonable assurance that its internal controls are effective. The  units submit the statements to the Assistant Secretary of the Air Force,  Financial Management and Comptroller (SAF/FM), the office responsible  for OMB Circular No. A-123 implementation and compilation of the annual  Statement of Assurance. Based on discussions with Air Force officials,  SAF/FM uses the unit managers’ supporting statements of assurance to  develop the overall Air Force annual Statement of Assurance.

Air Force Has Not Designed an Adequate Process for Assessing Internal Control

The Air Force’s internal control assessment process does not require (1)  an assessment of all required elements of an effective internal control  system; (2) test plans that specify the nature, scope, and timing of  procedures to conduct; and (3) management validation of results. In  addition, existing policies and procedures that staff follow to perform the  assessments do not fully implement OMB Circular No. A-123. Further, the  Air Force provided inadequate training to those responsible for  conducting and concluding on the internal control assessments.

Assessment of Internal Control Not Designed to Evaluate All Required Elements

Although not required by policy, the Air Force performed its first  assessment of the five components of internal control during fiscal year  2019 through an SAF/FM review of entity-level controls, which are  controls that have a pervasive effect on an entity’s internal control system  and may pertain to multiple components. Based on this assessment,  SAF/FM concluded in the Air Force’s Statement of Assurance for fiscal  year 2019 that three components of internal control (i.e., risk assessment,  control activities, and information and communication) were not designed,  implemented, or operating effectively.

Although SAF/FM performed this assessment in 2019, the assessment  did not include a determination of whether each internal control principle  was designed, implemented, and operating effectively. Also, there was no  indication that the Air Force designed the assessment of entity-level  controls to be pertinent to all Air Force objectives, such as those related  to operations, reporting, or compliance. In addition, SAF/FM did not  provide the assessment results to the unit managers for input or  consideration in their unit-specific control assessments and supporting  statements of assurance. The Air Force’s Internal Control Playbook  directs unit managers to assess the design and operating effectiveness of  the relevant entity-level controls within their purview. However, for fiscal  year 2019, SAF/FM performed this assessment, and officials informed us  that it was not their intent for unit managers to assess entity-level  controls.

According to OMB Circular No. A-123, management must summarize its  determination of whether each of the five components and 17 principles  from Standards for Internal Control in the Federal Government are  designed, implemented, and operating effectively and components are  operating together in an integrated manner. The determination must be a  “yes/no” response. If one or more of the five components are not  designed, implemented, and operating effectively, or if they are not  operating together in an integrated manner, then an internal control  system is ineffective. AFI 65-201 states, as part of its discussion on  assessing internal control over financial reporting, that OMB Circular No.  A-123 prescribes a process to evaluate controls at the entity level for the  five components of internal control (i.e., control environment, risk  assessment, control activities, information and communication, and  monitoring).

The Air Force’s assessment lacked required determinations related to  internal control principles because the Air Force lacked policies or  procedures for the following:

Clearly delineating who within the Air Force (e.g., unit managers or  SAF/FM) is responsible for assessing the components and principles  of internal control, how often assessments are performed, at what  level (e.g., entity or transactional) components and principles are to  be evaluated, what objectives are covered in the assessment of  entity-level controls, to whom to communicate the results if the results  are relevant to others performing assessments of internal control, and  what Air Force guidance to follow.

Documenting management’s summary, whether performed by the unit  managers as outlined in the guidance or by SAF/FM as performed  during fiscal year 2019, of its determination of whether each  component and principle is designed, implemented, and operating  effectively and whether components are operating together in an  integrated manner.

By not ensuring that management is assessing whether each internal  control component and principle is designed, implemented, and operating  effectively, the Air Force cannot determine whether internal control is  effective at reducing the risk of not achieving its stated mission and  objectives to an acceptable level. Moreover, given the entity-wide  relevance of SAF/FM’s conclusions, unit managers may not be aware of  all the necessary information with which to draw conclusions about the  effectiveness of their organizational units’ internal control. Further,  management’s assurances on internal control effectiveness, as reported  in the Statement of Assurance, may not appropriately represent the  effectiveness of the Air Force’s internal control.

Assessment of Internal Control Not Designed to Use Consistent Test Plans

The Air Force did not have a process in place to base its annual  assessment of internal control and Statement of Assurance preparation  on uniform testing performed across its agency. Although the Air Force  had standard test plans for reviews associated with financial reporting  objectives, SAF/FM could not demonstrate what procedures are  performed to support its assessment of internal control over its  operational, internal reporting, and compliance objectives.

Specifically, for these objectives, the Air Force did not develop guidance  for those responsible for assessing internal controls on which tests to conduct to obtain the best evidence of whether controls  are designed, implemented, and operating effectively; how much testing is needed in each area; when to conduct the tests; how to ensure that current year conclusions are based on current year how assessment procedures are to be adjusted or amended to reflect  a consideration of prior year self-identified control deficiencies and  internal and external audit results.

Additionally, standard test plans for the reviews conducted as part of the  Air Force’s financial statement audit remediation efforts did not include  guidance on how to consider prior year self-identified control deficiencies  and internal and external audit results in determining the nature, timing,  and extent of procedures to be conducted for the current year.

Further, although the Air Force outlines 20 overall objectives in its 2019  through 2021 Business Operations Plan (dated January 2019), it did not  document the specific procedures the Air Force planned and performed to  support an evaluation of its internal control over these 20 objectives.

According to Standards for Internal Control in the Federal Government,  management should establish and operate activities to monitor the  internal control system and evaluate the results and should remediate identified internal control deficiencies on a timely basis. For example, as  part of its monitoring activities, agency management responsible for the  OMB Circular No. A-123 program could design a test plan or establish a  baseline to monitor the current state of the internal control system and  compare that baseline to the results of its internal control tests.

The Air Force’s assessment of internal control and Statement of  Assurance are not clearly supported by completed test plans or other  documented monitoring activities because SAF/FM does not have a  policy or procedures for conducting internal control assessments that  require documented test plans that (1) tie back to specific objectives  included in the Business Operations Plan; (2) specify the nature, scope,  and timing of procedures to conduct under the OMB Circular No. A-123  assessment process; and (3) reflect a consideration of prior year self- identified control deficiencies and results of other internal and external  audits.

By not ensuring that its more than 6,500 unit managers are evaluating  internal control based on the agency’s established baseline, the Air Force  cannot ensure that it is consistently and effectively assessing its internal  control in order to timely identify and correct deficiencies or that its design  of internal control reduces, to an acceptable level, the risk of not  achieving agency operational, reporting, and compliance objectives. As a  result, Air Force management’s assurances on internal control, as  reported in the overall agency Statement of Assurance, may not  appropriately represent its internal control effectiveness.

Assessment of Internal Control Not Designed to Include Management Validation of Results

Air Force management did not have a process to validate whether its unit  managers appropriately performed and documented their internal control  assessments. During our review, Air Force management was uncertain  about how many internal control assessments were being performed or  by whom. SAF/FM officials initially stated that there were 5,567  organizational units responsible for assessing internal control, but officials  later informed us that the actual number was more than 6,500.  Furthermore, Air Force officials were unable to provide information on  how many organizational unit managers failed to report on their specific  internal control assessments or received waivers from performing such  assessments.

Finally, management lacked a process to ensure that results used to  compile the current year Statement of Assurance are based upon current  fiscal year assessments. The Air Force requires unit managers to assess  internal control and submit results to SAF/FM through the automated  statement of assurance submission system. SAF/FM then compiles the  supporting statements of assurance submissions and prepares the Air  Force’s annual Statement of Assurance. However, we found that the  automated system that collects the annual assessments from more than  6,500 unit managers allows these managers to import internal control  testing activities from the prior fiscal year. Air Force officials were unable  to provide information about how they ensure that unit managers were not  importing prior year results without performing current year testing.

OMB Circular No. A-123 requires documentation to demonstrate and  support conclusions about the design, implementation, and operating  effectiveness of an entity’s internal control system, and requires agencies  to consider carefully whether systemic weaknesses exist that adversely  affect internal control across organizational or program lines.

The Air Force’s process lacks management validation of results because  it has not developed a documented policy or procedures to ensure that  management can readily review and validate the results of its internal  control testing. The Air Force has not required SAF/FM to validate (1) the  number of organizational units reporting for its overall internal control  assessment; (2) how it tested control procedures, what results it  achieved, and how it derived conclusions from those results; and (3)  whether it based the results used to compile the current year Statement  of Assurance on current fiscal year assessments. Additionally, when PRE  management waives assessments, SAF/FM does not have a process to  track waivers and assess how they affect the current year assessment of  internal control, determination of systemic weaknesses, and compilation  of the Air Force’s overall Statement of Assurance.

By not validating the internal control assessment results, Air Force  management cannot ensure that the assessment was performed as  expected to support related conclusions and timely identify internal  control deficiencies. Further, management’s assurance on internal  control, as reported in the overall Statement of Assurance, may not  appropriately represent the internal control effectiveness.

Guidance for Assessment of Internal Control Does Not Properly Define Material Weaknesses and Internal Control

Air Force guidance for its assessment of internal control neither  accurately nor completely reflects definitions included in OMB Circular  No. A-123. For example, AFI 65-201 and the Statement of Assurance  Handbook provided to unit managers for conducting internal control  assessments, and the Internal Control Playbook that the Air Force  developed in August 2019 to address internal control over reporting  objectives, do not include the complete definitions of the four material  weakness categories for deficiencies related to (1) operations, (2)  reporting, (3) external financial reporting, and (4) compliance objectives,  consistent with guidance in OMB Circular No. A-123. Additionally, the  handbook does not define internal control as a process that provides  reasonable assurance that objectives will be achieved or an internal  control system as a continuous built-in component of operations, affected  by people, that provides reasonable assurance that an entity’s objectives  will be achieved. Although the playbook does adequately define internal  control and a system of internal control, the Air Force developed this  guidance after we initiated our review, and the guidance only addresses  internal control over reporting objectives and not operational and  compliance objectives.

These inaccuracies and incomplete descriptions occurred because the Air  Force did not provide its internal control assessment guidance preparers  or reviewers with training to assist them in writing and reviewing the  guidance to ensure proper application of the fundamental concepts of  internal control and OMB Circular No. A-123, such as those related to  definitions of internal control and material weakness.

By not ensuring that Air Force guidance reflects accurate and complete  definitions included in OMB Circular No. A-123, the Air Force is at  increased risk that its officials performing internal control assessments will  not properly conclude on the results; therefore, management’s  assurances on internal control, as reported in the Statement of  Assurance, may not appropriately represent the effectiveness of internal  control.

Air Force Lacks Adequate Training for Employees on How to Perform Assessments of Internal Control

Among other things, OMB Circular No. A-123 requires staff to identify  objectives, assess related risks, document internal controls, evaluate the  design of controls, conduct appropriate tests of the operating  effectiveness of controls, report on the results of these tests, and  appropriately document the assessment procedures.

However, the Air Force’s training provided to unit managers responsible  for assessing internal control lacks sufficient instructions on how to  perform such assessments. Specifically, the current annual training  provided by SAF/FM  lacks instruction on how to prepare documentation to adequately  support conclusions, identify and test the key internal controls, and  evaluate and document test results;  limits discussion of OMB Circular No. A-123 internal control  assessments to internal control over external financial reporting  objectives and does not cover internal control over operational,  compliance, and internal reporting objectives;  lacks adequate definitions of material weaknesses included in OMB  Circular No. A-123;  lacks instruction on how to interpret, respond to, and correct self- identified deficiencies (control deficiencies, significant deficiencies,  and material weaknesses); and  is not required for individuals performing reviews related to external  financial reporting.

SAF/FM officials informed us that the definitions of material weakness  and instructions on how to interpret, respond to, and correct deficiencies  were included in other guidance documents, such as the newly created  Internal Control Playbook. However, the Air Force did not provide the  playbook to PREs during the fiscal year 2019 training, and it is not  officially named as guidance in the Air Force’s policy for assessments of  internal control. Although the Air Force has described the playbook as  supplemental guidance, it does not refer to the playbook as such in its  policy for assessing the effectiveness of its system of internal control to  provide reasonable assurance that operational, reporting, and compliance  objectives are achieved.

These inadequacies occurred because SAF/FM has not fully evaluated  and incorporated the requirements for assessing an internal control  system into its training and has not designed training that (1) enhances  skills in evaluating an internal control system and documenting the  results; (2) reflects all OMB Circular No. A-123 requirements, such as  those related to assessing controls for all objectives and determining  material weaknesses; and (3) is provided to all who are responsible for  performing internal control assessments.

According to federal internal control standards, management should  demonstrate a commitment to developing competent individuals. For  example, management could provide training for employees to develop  skills and competencies needed for key roles and responsibilities in  assessing internal control. Without appropriate training, those responsible  for assessing internal control may not do so adequately enough to identify  internal control deficiencies timely and support the agency’s internal  control assessments with appropriate documentation and summarization  of the results.

Air Force Has Not Designed a Process for Assessing Internal Control Based on Risk

OMB Circular No. A-123 requires an agency to evaluate whether a  system of internal control reduces the risk of not achieving the entity’s  objectives using a risk-based assessment approach. However, the Air  Force’s current AFI 65-201 approach calls for assessing internal control  at more than 6,500 organizational units without regard to quantitative or  qualitative risks. As previously discussed, the Air Force lacks procedures  to verify whether its unit managers are performing internal control  assessments as intended and does not provide guidance for uniform  testing across the organization. Therefore, the Air Force’s current  approach for assessing internal control does not ensure that areas of  greatest risk are addressed, such as mission-critical assets, and instead  may unnecessarily focus on areas of lower risk. As a result, the Air Force  may not be using resources efficiently.

The Air Force’s current design of assessing internal control does not  ensure, at a minimum, the evaluation of internal control over areas key to  meeting its mission. Specifically, the Air Force does not have a policy  requiring evaluation of whether its internal control over processes related  to areas of highest risk—such as processes related to mission-critical  assets, including equipment, government-furnished equipment, and  weapons-system spare parts managed and held by contractors and  working capital fund inventory—reduces the risk of not achieving specific  operation, reporting, or compliance objectives to an acceptable level.  The Acting Secretary of Defense, during fiscal year 2019, emphasized  two of these areas—government property in the possession of  contractors, which includes government-furnished equipment, and  working capital fund inventory—as high priority for corrective actions  related to financial statement audit remediation.

The Air Force’s current approach for assessing internal control calls for  more than 6,500 organizational units to perform assessments without  regard to risk because the Air Force has not developed a policy or  procedures providing guidance on how to perform the assessment using  a risk-based approach. A risk-based approach provides a methodology  for Air Force management to focus and prioritize its internal control  assessments on areas and activities of greater risk and importance to  accomplishing mission and strategic objectives. By not evaluating internal  control with a risk-based approach, Air Force management lacks the  assurance that resources are used efficiently to assess key controls  associated with achieving Air Force objectives subject to the highest risks  along with those designated as high priority by agency management,  such as controls over accounting for, managing, and reporting on  mission-critical assets.

Current Reviews Do Not Adequately Assess Internal Control over Processes Related to Mission-Critical Assets

Although the Air Force has not designed a process for performing OMB  Circular No. A-123 internal control assessments based on risk, it did  review certain business process assessable units, such as mission-critical  assets, as part of its financial statement audit remediation efforts.  However, Air Force’s reviews of internal control over processes related to  mission-critical assets did not meet OMB Circular No. A-123 requirements  or federal internal control standards for evaluating a system of internal control. During fiscal years 2018 and 2019, the Air Force engaged the Air  Force Audit Agency (AFAA) to review control activities for five processes  related to mission-critical assets and instructed business process  assessable unit leads to conduct additional internal control reviews for  select mission-critical asset areas during fiscal year 2019. However, the  organizational unit managers did not formally consider the results of these  reviews when concluding on their assessments of internal control.

For fiscal year 2018, AFAA performed certain agreed-upon procedures to  confirm current transactional processes and related internal control over  external financial reporting for five mission-critical asset areas as  documented in the related business process cycle memorandums. In  order to perform the procedures, AFAA used SAF/FM-prepared templates  to confirm certain processes and key controls included in the respective  process cycle memorandums. However, the procedures SAF/FM  instructed AFAA to perform in 2018 did not meet the requirements of an  assessment of an internal control system as prescribed in OMB Circular  No. A-123. Specifically:

Procedures to test design of controls did not include steps for  evaluating whether the controls individually or in combination with  other controls would achieve objectives or address related risks.  Instead, SAF/FM instructed AFAA to confirm whether the process  cycle memorandums accurately reflected the controls and processes  in place.

Procedures to test operating effectiveness of controls were conducted  even though there was no determination of whether the controls were  designed to achieve objectives or address related risks.

Procedures performed involved the use of process cycle  memorandums as a baseline, which, as noted by the Air Force’s  auditor, did not always reflect the current process, and there was no  process in place for management to assess whether the differences  related to an inaccurate cycle memorandum or improper  implementation of the process.

For fiscal year 2019, tests continued to (1) address operating  effectiveness without first determining if the controls were designed to  meet objectives and reduce risks and (2) involve the use of process cycle  memorandums as a baseline that did not always reflect the current  business process.

For fiscal year 2019, business process assessable unit leads conducted  the additional internal control reviews for select processes related to  mission-critical assets based on the templates for tests of design and  tests of operating effectiveness in Internal Control Playbook appendixes.  Similar to the procedures developed for AFAA, the Air Force did not  devise the fiscal year 2019 playbook’s template procedures to support  conclusions on the design, implementation, and operating effectiveness  of internal control over processes that are key to achieving Air Force  operational, internal reporting, and compliance objectives. For example,  the procedures that the Air Force used to assess the design of internal  control over a process related to spare engines at one air base only  considered controls related to external financial reporting objectives. The  Air Force did not provide evidence that it tested additional controls key to  achieving internal reporting, operating, and compliance objectives, such  as improving and strengthening business operations and harnessing the  power of data for timely decision-making and mission success, or  evidence that the Air Force would test such controls during future  reviews.

Additionally, the Air Force lacked a process for the organizational unit  managers or PREs to consider the results of internal control reviews  performed at the business process assessable unit level in assessing  internal control when they assess and report on the status of internal  control for the overall Air Force Statement of Assurance (see fig. 2).  Specifically, the current and draft AFI 65-201 and Statement of Assurance  Handbook do not include procedures for how information gathered from  AFAA agreed-upon procedures or business process unit leads’ testing of  internal control over processes related to mission-critical assets is  considered in the conclusions reported through the organizational unit  managers’ supporting statements of assurance.

OMB Circular No. A-123 requires that management, in accordance with  federal standards for internal control, evaluate whether a system of  internal control reduces the risk of not achieving the entity’s objectives  related to operations, reporting, or compliance to an acceptable level.  According to the federal internal control standards, when evaluating the  design of internal control, management determines if controls individually  and in combination with other controls are capable of achieving an  objective and addressing related risks. A control cannot be effectively  operating if it was not properly designed and implemented. Further,  management should establish and operate monitoring activities to monitor  the internal control system and evaluate the results. For example, once  established, management can use the baseline, or current state of the  internal control system, as criteria in evaluating the internal control  system and make changes to reduce the difference between the criteria  (what is expected) and condition (what Air Force staff did do instead of  what was expected). Also, per OMB Circular No. A-123, an agency may  document its assessment of internal control using a variety of information  sources, such as management reviews conducted expressly for the  purpose of assessing internal control (e.g., AFAA agreed-upon  procedures and Internal Control Playbook procedures).

Air Force reviews of internal control over processes related to mission- critical assets were inadequate because SAF/FM did not include in the  agreed-upon procedures or the Internal Control Playbook   tests of design to determine if controls individually and in combination  with other controls are capable of achieving an objective and  addressing related risks,   tests of implementation and operating effectiveness only after a  favorable assessment of the design of control, and a baseline that has accurate descriptions of business processes and  identifies key internal controls as designed by management to  respond to risks.

Further, SAF/FM did not document its approach for using results from the  AFAA agreed-upon procedures in assessing the Air Force’s internal  control over processes related to mission-critical assets because the Air  Force did not provide guidance establishing the process and reporting  lines of all the sources of information that it considered in preparing its  overall Statement of Assurance. Also, SAF/FM did not have a  documented process for integrating the results of internal control reviews  performed at the business process assessable unit level into the  organizational units’ assessment of internal control. Moreover, Air Force  did not have guidance describing how often, through which conduit, or  when the results from the business process internal control reviews were  to be provided to relevant organizational units, or how this information  would affect conclusions made in a unit’s respective assurance  statement.

By not comprehensively evaluating internal control over processes related  to mission-critical assets, the Air Force is at increased risk that it may not  timely identify internal control deficiencies and may lack reasonable  assurance over the effectiveness of internal control over processes  accounting for mission-critical assets. In addition, without performing  internal control assessments in accordance with requirements or having a  formal process to consider the results of the AFAA agreed-upon  procedures and the Internal Control Playbook procedures in the  organizational unit managers’ assessment process, the Air Force  increases the risk that its assessment of internal control and related  Statement of Assurance may not appropriately represent the  effectiveness of internal control.

Air Force senior leaders work to achieve complex and inherently risky  objectives across the agency, while managing over $230 billion in  mission-critical assets available to carry out its mission. To reduce the  risk of not achieving its objectives or efficiently managing its resources,  the Air Force needs to implement an ERM capability that is integrated  with an effective system of internal control, as outlined in OMB Circular  No. A-123 and federal standards for internal control. Although the Air  Force has been working to improve its risk management and internal  control practices, including remediation of deficiencies in its internal  control over financial reporting related to mission-critical assets, it still  faces significant challenges. For example, the agency continues to have  difficulties with tracking and reporting, with reasonable accuracy, financial  information about its mission-critical assets that directly affect its ability to  efficiently support the warfighter, achieve its objectives, and accomplish  its mission through reliable, useful, and readily available information.  Without an effective ERM governance structure, there is an increased risk  that the Air Force will not properly identify, assess, and respond to  significant entity-level risks. In addition, by not comprehensively  implementing and evaluating its internal control system, the Air Force  cannot ensure that it is timely identifying and correcting internal control  deficiencies or effectively reducing, to an acceptable level, the risk of not  achieving its objectives. Further, Air Force management’s assurances on  internal control, as reported in the overall agency Statement of  Assurance, may not appropriately represent its internal control  effectiveness.

We are making the following 12 recommendations to the Air Force:  The Secretary of the Air Force should develop and implement procedures  for an ERM governance structure that includes oversight responsibilities  for identifying, assessing, responding to, and reporting on the risks  associated with agency material weaknesses from all relevant sources.  These procedures should clearly demonstrate that risks associated with  material weaknesses are considered by Air Force governance, as a  whole, and are mitigated appropriately to achieve goals and objectives.  (Recommendation 1)

The Secretary of the Air Force should develop policies or procedures for  assessing internal control to require (1) clearly delineating who within the  Air Force is responsible for evaluating the internal control components  and principles, how often they are to perform the evaluation, the level  (e.g., entity or transactional) of the evaluation, what objectives are  covered in the assessment, to whom to communicate the results if they  are relevant to others performing assessments of internal control, and  what guidance to follow; (2) documenting management’s determination of  whether each component and principle is designed, implemented, and  operating effectively; and (3) documenting management’s determination  of whether components are operating together in an integrated manner.  (Recommendation 2)

The Secretary of the Air Force should develop policies or procedures for  assessing internal control to require the use of test plans that (1) tie back  to specific objectives to be achieved as included in the Business  Operations Plan; (2) specify the nature, scope, and timing of procedures  to conduct under the OMB Circular No. A-123 assessment process; and  (3) reflect a consideration of prior year self-identified control deficiencies  and results of internal and external audits. (Recommendation 3)

The Secretary of the Air Force should develop policies or procedures for  assessing internal control to require SAF/FM to validate (1) the number of  organizational units reporting for its overall internal control assessment;  (2) how control procedures were tested, what results were achieved, and  how conclusions were derived from those results; and (3) whether the  results used to compile the current year report are based on current fiscal  year’s assessments. (Recommendation 4)

The Secretary of the Air Force should develop policies or procedures for  assessing internal control to require SAF/FM to assess how waivers  affect the current year assessment of internal control, the determination of  systemic weaknesses, and the compilation of the Air Force’s overall  Statement of Assurance. (Recommendation 5)

The Secretary of the Air Force should require that developers of the  policy and related guidance associated with designing the procedures for  conducting OMB Circular No. A-123 assessments receive recurring  training and are appropriately skilled in conducting internal control  assessments and are familiar with Standards for Internal Control in the  Federal Government. (Recommendation 6)

The Secretary of the Air Force should analyze all definitions included in  Air Force ERM and internal control assessment policy and related  guidance to ensure that all definitions and concepts are defined correctly.  (Recommendation 7)

The Secretary of the Air Force should require SAF/FM to design recurring  training for those who will assess internal control that (1) includes  enhancing their skills in evaluating the internal control system and  documenting results; (2) reflects all OMB Circular No. A-123  requirements, such as those related to identifying objectives, evaluating  deficiencies, and determining material weaknesses; and (3) is provided to  all who are responsible for performing internal control assessments.  (Recommendation 8)

The Secretary of the Air Force should develop policy or procedures  consistent with OMB Circular No. A-123 to assess the system of internal  control using a risk-based approach. (Recommendation 9)

The Secretary of the Air Force should develop procedures to assess  internal control over processes related to mission-critical assets, including  (1) tests of design that evaluate whether controls are capable of achieving  objectives, (2) tests of effectiveness only after a favorable assessment of  the design of the control, and (3) a baseline that has accurate  descriptions of business processes and identifies key internal controls as  designed by management to respond to risks. (Recommendation 10)

The Secretary of the Air Force should establish a process and reporting  lines of all the sources of information, including reviews performed of  internal control processes related to mission-critical assets, that will be  considered in the Secretary’s Statement of Assurance. (Recommendation  11)

The Secretary of the Air Force should develop procedures to require  coordination between business process leads and the Air Force’s unit  managers to ensure that mission-critical asset–related internal control  deficiencies are considered in the unit managers’ assessments of internal  control and related supporting statements of assurance. These  procedures should include how, when, and with what frequency the  results from the business process internal control reviews should be  provided to relevant organizational units for consideration in their  respective assurance statements. (Recommendation 12)

We provided a draft of this report to the Air Force for review and  comment. In written comments, the Air Force concurred with all 12 of our  recommendations and cited actions to address them. Air Force’s  comments are reproduced in appendix I.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, the Under Secretary of Defense  (Comptroller)/Chief Financial Officer, the Secretary of the Air Force, the  Assistant Secretary of the Air Force (Financial Management and  Comptroller), and other interested parties. In addition, the report is  available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-2989 or kociolekk@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Comments from the Department of the Air Force

In addition to the contact named above, John Sawyer (Assistant Director),  Russell Brown, Anthony Clark, Oliver Culley, Eric Essig, Patrick Frey,  Jason Kelly, Aaron Ruiz, and Vanessa Taja made key contributions to  this report.

The Air Force identified more than half of its $398 billion in assets (i.e., aircraft, weapons, vehicles, buildings) as mission-critical in fiscal year 2019. But, for decades, the service has not been accurately tracking and reporting financial information about its mission-critical assets. Without reliable information on this, the Air Force can’t support informed decisions about the condition, cost, or reliability of its assets, or about the need to request more resources.

Our 12 recommendations could help the Air Force strengthen its policies and procedures for overseeing and reporting on its mission-critical assets.