Army Modernization: Army Should Take Steps to Reduce Risk

The Army is investing in near- and long-term modernization efforts to maintain its technological edge over potential adversaries. It is doing this by upgrading and updating current weapon systems, developing new capabilities, and reshaping its doctrine, force structure, training, and leader development.

This testimony is based on prior GAO work conducted 2016 through 2019 and addresses the Army's progress in: (1) establishing Army Futures Command, and (2) developing its near-term and long-term modernization strategies. It also highlights several actions recommended in prior reports related to Army modernization.

To conduct this work, GAO assessed the Army's near- and long-term modernization efforts, application of leading practices to those efforts, budget documents, and the effectiveness of the process for developing requirements for major weapon systems. This statement includes updates to this information, as of April 2019.

In January 2019, GAO reported on initial steps the Army has taken to consolidate its modernization efforts under one authority—Army Futures Command. Army officials call it their most significant institutional change since 1973, when the Army was reorganized after the Vietnam War. As a precursor to this new command, the Army established eight cross-functional teams as a pilot program to increase the efficiency of requirements and technology development in six key modernization areas. These areas are described in the table below.

Since announcing the modernization efforts in 2017, the Army has directed more funding toward closing near-term capability gaps. For example, as part of the planning for the fiscal year 2019 budget process, the Army identified 67 high-priority programs that require a $16 billion investment between now and fiscal year 2023. In addition to the near-term capabilities the Army is pursuing, it has identified a number of long-term needs—those focused after fiscal year 2024—and taken steps to realign research and development efforts and funding with those needs.

Over the past 2 years, GAO highlighted several steps Army should take to improve its modernization efforts, including:

Apply leading practices to Army Futures Command's cross-functional teams, and capture their lessons learned.

Assess the resources, particularly personnel, necessary to support its requirements development process.

Increase the transparency of its efforts by clarifying how it evaluates whether its modernization efforts are achieving the Army's goals and clearly stating the full costs of pursuing those goals.

Reduce risk by ensuring technologies are fully mature—such as demonstrating technologies in an operational environment before starting a formal acquisition program.

By implementing these recommendations, Army Futures Command could better ensure its ability to deliver enhanced capabilities to the warfighter and decrease the risk of cost and schedule growth.

Over the past 2 years, GAO has made recommendations related to this body of work. Department of Defense and Army concurred with all the recommendations and are working to implement them.

Thank you for the opportunity to be here today to discuss our recent work  on the Army’s efforts to upgrade or replace its capabilities—a process  generally referred to as modernization. The Army has determined that it  must undertake this modernization in order to maintain its edge over  potential adversaries, or risk falling behind. Over the past 2 years, our  reports have highlighted some aspects of modernization including where  the Army has taken some positive steps and where we have identified  opportunities for improvement.

According the Army Strategy of 2018, the Army’s modernization efforts  fall within broader efforts to maintain the ability to deter or defeat potential  adversaries. Simultaneous with modernization of its weapon systems, the  Army has begun an effort to reshape its warfighting concepts for  engaging with potential adversaries across all domains; including land,  air, sea, space, and cyberspace. These new operational concepts will  shape not only the Army’s equipment modernization priorities, but also its  doctrine, force structure, training, and leader development.

This statement will address the Army’s progress in: (1) establishing Army  Futures Command, and (2) developing its near-term and long-term  modernization strategies. In addition, it will highlight several key actions  that we recommended in our prior reports related to Army modernization.

This statement is based on prior work in three GAO reports. The prior  work that we drew from, among other things, assessed the Army’s near-  and long-term modernization efforts, application of leading practices to  those efforts, budget documents, and the effectiveness of process for  developing requirements for the major weapon systems. The statement  also includes updates to information as of April 2019 as appropriate,  based on Army documentation. The reports cited throughout this  statement contain more details on the scope of the work and the  methodology used to carry it out.

We conducted the body of work on which this testimony is based from  March 2016 to January 2019 in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.

The Army Can Take Steps to Improve the Way Army Futures Command Operates

Army Futures Command Established to Lead Modernization Efforts

In January 2019, we reported on the initial steps the Army has taken to  consolidate all its modernization efforts under one authority. Establishing  Army Futures Command is reported to be the most significant institutional  change to the Army since it reorganized in 1973 after the Vietnam War.  According to Army documentation, the intent of the new command is to  provide unity of command, accountability, and modernization at the speed  and scale required to prevail in future conflicts. The organization is led by  a four-star general like its organizational peers: Army Materiel Command,  Training and Doctrine Command, and Forces Command. The Army  declared the commencement of operations for the command in July 2018,  and has begun to define its organizational structures. Army Futures  Command is expected to be fully operational by July 2019, meaning it will  have sufficient staff with operational facilities, secure funding, and the  ability to execute its assigned mission, roles, and responsibilities.

Army Futures Command is headquartered in Austin, Texas. According to  Army officials and documentation, the Army chose Austin because of its  proximity to science, technology, engineering, and mathematics talent, as  well as private sector innovators that officials believe will assist the  command in achieving its modernization goals. According to senior Army  leadership, the new command headquarters will have around 300 staff in  place by July 2019, a workforce that may grow to as many as 500 employees—100 military and 400 civilians. Our analysis of Army’s plans  for initial staffing at the Army Futures Command headquarters, based on  data from July 1, 2018, found that about one-third of headquarters staff  would be involved directly in modernization efforts, such as engineers and  operations specialists, and the remaining two-thirds would consist of  support staff, including legal counsel and contracting professionals.

According to Army Futures Command officials and documentation, the  new organization will be organized around three major components:

Futures and Concepts Center is responsible for identifying and  prioritizing capability and development needs and opportunities. This  organization subsumed the Army Capabilities Integration Center on  December 7, 2018. The center was formerly part of Army Training and  Doctrine Command and is located at Fort Eustis, Virginia.

Combat Capabilities Development Command is responsible for  conceptualizing and developing solutions for identified needs and  opportunities. This organization subsumed the Research,  Development and Engineering Command on February 3, 2019 and is  located at Aberdeen Proving Ground, Maryland.

Combat Systems Directorate is responsible for refining,  engineering, and producing new capabilities. This directorate will  communicate with the program executive offices and program  management offices reporting to the Assistant Secretary of the Army  for Acquisition, Logistics and Technology. Combat Systems  Directorate is in the process of being established and is located in  Austin, Texas.

Among other things, the reorganization is intended to establish Army  Futures Command to oversee development of Army’s six modernization  priorities. The Army’s then-Acting Secretary and the Chief of Staff in an  October 3, 2017 memorandum identified these priorities to guide Army  modernization: next generation combat vehicle, air and missile defense, and  soldier lethality.

Army Established Cross- Functional Teams to Improve How it Develops Capabilities

As we reported in January 2019, to pursue the six priority areas, the Army  established eight cross-functional teams. These teams were initially  created as a pilot effort to increase the efficiency of requirements and  technology development for modernization before the announcement of  the new command. They were subsequently moved into Army Futures  Command in 2018. These cross-functional teams are located throughout  the country in areas of relevance to their mission. The eight cross- functional teams and the priority areas they address are outlined in table  1.

These cross-functional teams are intended to:  take steps toward achieving the six modernization priorities;  leverage expertise from industry and academia;  identify ways to use experimentation, prototyping, and  demonstrations; and  identify opportunities to improve the efficiency of requirements  development and the overall defense systems acquisition process.

The cross-functional team pilots were structured to help achieve these  goals. Each cross-functional team consists of core staff and subject  matter experts from across the Army. To facilitate the rapid approval of  requirements, each cross-functional team is led by a general officer or a  senior civilian official who could communicate directly with the highest  levels of the Army. The goal of staffing these teams is to ensure that each  team had individuals who specialized in acquisition, requirements,  science and technology, test and evaluation, resourcing, contracting, cost  analysis, sustainment, and military operations. The goal of bringing  different experts together is to facilitate collaboration and immediate  opportunities for stakeholders to provide input as opposed to the more  traditional requirements development process, in which input has typically  been provided separately. Officials told us that, while all of these subject  matter experts may have provided input on the requirements  development process in the past, placing them on a single team offers the  promise of streamlining those efforts and could eliminate the need for  multiple reviews. Figure 1 below compares the requirements development  process under cross-functional teams to how the Army has traditionally  developed requirements.

Further Implementation of Leading Practices Could Reduce Risk for Army Futures Command

In January 2019, we recommended that Army Futures Command  incorporate leading practices for effective cross-functional teams. We  determined that the documentation that established the cross-functional  team pilots fully addressed four of our eight leading practices for effective  teams, and at least partially addressed another four. The leading  practices and their implementation by the cross-function teams are  described in table 2 below.

In addition to the practices listed above, the cross-functional team pilots  generally applied leading practices for requirements development. One  leading practice the teams generally applied was promoting  communication between requirements developers, warfighters, and  industry representatives. This enables the cross-functional teams to  better match developer resources with end-user needs.

While applying this practice, the cross-functional team pilots had initial  progress in writing requirements documents more efficiently. According to  cross-functional team officials, they were able to shorten the requirements  development process for several capabilities.

However, we found that Army Futures Command does not have a formal  plan to identify and share lessons learned from cross-functional team  pilots to incorporate or expand application of these leading practices.  Doing so would allow Army Futures Command the opportunity to  accelerate the progress these teams made and spread the benefits  across all of the teams and a wider range of specific military capabilities  they are pursuing. We recommended that the Army (1) incorporate cross- functional teams’ experiences in applying leading practices and (2)  execute a process for identifying and incorporating lessons learned. The  Department of Defense concurred with these recommendations, and  stated that Army Futures Command expects to apply leading practices  and capture lessons learned by the end of 2019.

Our January 2019 report also identified leading practices for mergers and  organizational transformations. These leading practices are listed in table  3 below.

We found that the Army Futures Command had implemented some of  these practices, particularly leadership’s dedication to the new command  and the clear statement of its mission. However, we have previously  reported that, according to federal internal controls standards, it is  important to implement all of these practices in order to establish the  organizational structure necessary to enable an entity to plan, execute,  control, and assess the organization in achieving its objectives.  Establishment of this structure is particularly important for the Army where  leadership and its priorities can change frequently. Therefore, we  recommended in January 2019 that Army Futures Command fully apply  these leading practices. The Department of Defense concurred with the  recommendation, and stated that it would start pilot processes in fiscal  years 2019 and 2020.

Army Futures Command Should Assess Availability of Key Acquisition Personnel Needed for Requirements Development

In addition to further implementing leading practices, Army Futures  Command can reduce risk to meeting its goals by fully assessing the  workforce necessary to develop requirements—the testable and  measurable characteristics necessary for the design of a proposed  system. Historically, the Army has been unable to ensure that  requirements for new capabilities are feasible due, in part, to a declining  workforce for requirements development. In June 2017, we reported that  the Army had prioritized combat readiness over resourcing its  requirements development process to meet future readiness needs. We  recommended that the Army assess the resources, particularly personnel,  necessary for requirements development. The Army concurred with the  recommendation, and has stated it would implement this recommendation  once Army Futures Command is fully operational. As Army Futures  Command centralizes and takes responsibility for requirements  development, this recommendation is even more pertinent. Therefore, we  recently elevated the status of the recommendation to a priority  recommendation for the Secretary of the Army, as we believe it warrants  greater attention from the Department of the Army.

Army Futures Command Has Not Developed Formal Policies and Procedures for Coordination with Other Army Acquisition Entities

As Army Futures Command approaches full operating status, it is  important to define not only how the command functions, but how it works  with other organizations. In our January 2019 report, we found that Army  Futures Command had not yet established policies and procedures  detailing how it will execute its responsibilities in coordination with other  Army organizations that do not directly report to it. One such organization  is the Office of the Assistant Secretary of the Army for Acquisition,  Logistics, and Technology—the civilian authority responsible for the  overall supervision of Army acquisition matters—and the acquisition  offices it oversees. To mitigate concerns about coordination, the Army  issued a directive in August 2018, signed by the Secretary of the Army,  designating the military deputy to the Assistant Secretary as an advisor to  Army Futures Command, and Army Futures Command officials have  stated that the Assistant Secretary will retain full acquisition authorities as  required by law. The command expects to continue to refine its  coordination with the Office of the Assistant Secretary of the Army for  Acquisition, Logistics, and Technology.

The Army Is Funding Modernization Priorities, but Further Steps Can be Taken to Manage Risk

Army Modernization Has Prioritized Near-Term Capability Gaps while Identifying and Beginning to Fund Long-Term Needs

Since announcing the modernization efforts in 2017, the Army has  directed more funding toward closing near-term capability gaps, focused  on fiscal years 2019 through 2023. For example, as part of the planning  for the fiscal year 2019 budget process, the Army identified 67 high- priority programs, such as the M-1 Abrams tank and the AH-64 Apache  helicopter, which require further investment. To support these priorities,  the Army identified a need for $16 billion in increased funding in fiscal  years 2019 through 2023. The 2018 Army Modernization Strategy report  identified the need for additional resources for near-term efforts, including  plans to spend billions of dollars for acquisition of maneuverable short  range air defense capabilities in fiscal years 2020 through 2024.

In addition to the near-term capabilities the Army is pursuing, it has  identified a number of long-term needs—those focused after fiscal year  2024—and begun to align research and development efforts with these  needs. The Army identified long-term capabilities for all of the  modernization priorities, as well as dates that science and technology  efforts should transition to programs of record. As part of this overall  effort, the Army has evaluated its science and technology portfolio to  realign funding toward its six modernization priorities.

In an October 2017 Army review, the eight cross-functional teams  examined science and technology investments to identify which efforts  contributed to the priorities and which did not. The review was performed  for the Office of the Deputy Under Secretary of the Army. Based on that  work, as of our January 2019 report, the Army had taken steps to realign  over $1 billion from previous priorities and toward the new priorities for  fiscal years 2019 through 2023. Army officials stated that they expect to  undertake similar reviews annually.

Tracking Near-Term Modernization Efforts and Costs Could Address Management Challenges

The Army is executing near-term modernization programs, but could  better manage how it evaluates them and estimate their costs. In  September 2018, we reported that the Army used its six priority  capabilities to identify key mission areas—such as long-range artillery, air  and missile defense, brigade combat teams, and cyber and electronic  warfare—that require near-term modernization investments. Based on its  assessments, the Army prioritized and proposed several near-term  solutions to address its critical capability gaps. These solutions included  adding personnel—and different types of personnel—to combat forces,  updating existing weapon systems, and investments in research and  development. However, the Army had not established processes for  evaluating whether its modernization efforts allow it to deter or defeat  potential adversaries during a major conflict.

We also found that the Army had not fully estimated the costs or sources  of funding for its near-term modernization efforts. In particular, we found  that the Army did not report in its modernization strategy the extent to  which it relied on Overseas Contingency Operations appropriations. We  recommended that the Army (1) develop a plan to finalize the processes  for evaluating how its near-term investments contribute to the Army’s  ability to decisively defeat a major adversary, and (2) finalize its cost  analysis of near-term investments and report those costs to Congress in  its fiscal year 2020 budget request. Army officials told us in April 2019  that the Army has taken steps to implement these recommendations.

Addressing Past Challenges with Technology Development Could Help Address Long- Term Modernization Risks

The most recent efforts to modernize follow several past efforts.  Unfortunately, the Army has a history of failed, costly weapon system  procurements to replace older weapons systems. These failures are due,  in part, to requirements that could not be met and the immaturity of key  technologies. Many of these programs failed to provide any capability to  the warfighter despite the considerable time and funding expended. Some  examples of these cancelled programs are listed in table 4 below.

While the Army has dedicated significant funding towards its long-term  modernization priorities, other changes may also be needed. Among  them, we recommended in our January 2019 report, that Army Futures  Command take steps to follow our leading practices to mature technology  to a sufficiently high level prior to system development, which can reduce  risk.

There are indications that, in some cases, the Army plans to mature  technology to a sufficiently high level prior to system development. For  example, officials from the Future Vertical Lift cross-functional team told  us they will complete technology demonstrations on two competitive  prototypes before choosing to develop a design for the Future Attack  Reconnaissance Aircraft. However, we found that the Army may continue  its past practice of proceeding into system development with less mature  technologies. In particular, we identified some plans to mature  technologies in a relevant environment prior to authorizing the start of a  new acquisition program, rather than the higher level of demonstrating  them in an operational environment as recommended by our leading  practices. This increases risk that new capabilities will require further  maturation in system development, which could raise costs and extend  timelines for delivery of equipment to the warfighter.

We recommended in our January 2019 report that the Army should  demonstrate technologies in an operational environment before starting a  formal acquisition program. The Department of Defense concurred with  the recommendation and stated that the Army Futures Command will  execute a new development process that will include operational  technology demonstrations. Pilot processes for this are expected to begin  in 2019.

In summary, we recognize that the Army is early in its modernization  efforts but could make changes now that would be helpful. Army Futures  Command should implement not only the leading practices we describe  as well as the lessons learned by its own cross-functional teams. The  Army should also increase the transparency of its efforts by clarifying how  it evaluates its progress towards modernization goals and clearly stating  the full costs of pursuing those goals. Finally, the Army can reduce the  risk to the long-term modernization of its capabilities by ensuring that the  technologies it uses in future weapon systems are fully mature.

Chairman Norcross, Ranking Member Hartzler, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to answer any questions that you may have at this time.

If you or your staff have any questions about this testimony, please  contact Jon Ludwigson, Acting Director, Contracting and National  Security Acquisitions at (202) 512-4841, or ludwigsonj@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. GAO staff who made key  contributions to this testimony are J. Kristopher Keener (Assistant  Director), Joe E. Hunter (Analyst-in-Charge), Emily Bond, Matthew T.  Crosby, Cale Jones, Kevin O’Neill, John Pendleton, and Roxanna Sun.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Army modernization includes updating existing weapons and acquiring new weapons to give the Army an edge over its adversaries.

This testimony discusses 3 prior reports assessing the Army's near- and long-term modernization efforts, related budget documents, and acquisition processes for major weapon systems.

Those reports had 7 recommendations that may help the Army avoid costly failures, including:

Ensuring that technologies planned for use in new weapon systems programs are mature

Ensuring transparency in evaluation of and costs for near-term efforts

Analyzing the workforce needed to develop weapon system requirements


Business Systems Modernization: DOD Has Made Progress in Addressing Recommendations to Improve IT Management, but More Action Is Needed

DOD spends billions of dollars each year on systems to support its key business areas, such as personnel and logistics. For fiscal year 2020, DOD reported that its business system investments are expected to cost about $8.9 billion. GAO has made many recommendations to DOD aimed at strengthening defense business systems management. Further, U.S. Code Title 10, Section 2222 requires DOD to perform activities aimed at ensuring that these investments are managed efficiently and effectively.

The National Defense Authorization Act for Fiscal Year 2016 included a provision for GAO to report on the extent to which DOD is complying with the code's requirements. Accordingly, the objective of this review was to assess the extent to which DOD has taken actions that comply with the code's requirements for ensuring that business system investments are managed efficiently and effectively.

To do so, GAO selected 12 recommendations that DOD had not implemented as of June 2019, and assessed the department's subsequent actions on the recommendations (through November 2019) against the requirements in the code. GAO also analyzed DOD's business systems guidance and business enterprise architecture documentation, and interviewed relevant DOD officials.

As of November 2019, the Department of Defense (DOD) had taken actions that addressed some, but not all, of the 12 prior GAO recommendations for strengthening defense business systems management. In doing so, the department made progress in complying with related business system investment management requirements contained in U.S. Code Title 10 Section 2222 (the code or U.S. Code).

Specifically, as of November 2019, DOD had implemented four of the 12 recommendations (see table). For example, with respect to the requirement associated with investment management guidance, DOD had implemented the recommendation to issue policy requiring full consideration of sustainability and technological refreshment requirements for its business system investments.

However, DOD had not yet implemented eight other recommendations relating to the code's requirements. The recommendations that had not been implemented relate to the department's actions to:

integrate its business and information technology (IT) architectures,

ensure that portfolio assessments are conducted in key areas identified in the GAO Information Technology Investment Management framework.

develop a skills inventory, needs assessment, gap analysis, and plan to address identified gaps as part of a strategic approach to human capital planning, among other things.

Taking further actions to implement all of the recommendations is essential to helping the department achieve compliance with all of the requirements—and, ultimately, further strengthen the management of its defense business system investments as well as its efforts to effectively transform its business operations.

GAO is not making any new recommendations in this report. As of November 2019, DOD had not yet implemented eight of the 12 prior recommendations. GAO will continue to monitor DOD's actions to address the remaining recommendations.

The Department of Defense (DOD) spends billions of dollars each year  on systems that are fundamental to achieving its business transformation  goals. These include systems that address key areas such as personnel,  financial management, health care, and logistics. According to DOD’s  information technology (IT) investment data, as of April 2019, the  department had 1,958 business system investments and planned to  spend approximately $8.9 billion on developing, modernizing, operating,  and maintaining its business systems in fiscal year 2020.

Since 1995, we have designated DOD’s business systems modernization  efforts as high risk due, in part, to the large amount of money spent each  year on these systems. We have reported that significant potential exists  for identifying and avoiding costs associated with duplicative functionality  across the department’s portfolio of defense business systems. In  addition, the department has continued to face critical challenges in  improving its business system acquisition management and investment  management, and in leveraging its federated business enterprise  architecture.

Since 1995, we have made a series of recommendations aimed at  strengthening the department’s institutional approach to its business  systems modernization and reducing the risks associated with its key  investments. Congress subsequently included provisions consistent with  our recommendations in certain years of the department’s annual  authorizing legislation.

Specifically, the department’s authorizing legislation for fiscal year 2005  amended U.S. Code Title 10 to add Section 2222 (the code or U.S.  Code) and included provisions related to DOD’s business system  investments that were consistent with our recommendations. In addition,  more recently, the National Defense Authorization Act for Fiscal Year  2016 (NDAA), which was enacted in November 2015, amended the code  to include provisions that required DOD to perform certain activities aimed  at ensuring that its business system investments are managed efficiently  and effectively.

The NDAA for fiscal year 2016 included a provision for GAO to assess,  biennially, the department’s compliance with the requirements in the code  related to managing defense business systems. Accordingly, our specific  objective for this review was to assess the extent to which DOD has taken  actions that comply with the U.S. Code Title 10, Section 2222  requirements for ensuring that business system investments are  managed efficiently and effectively.

To address the objective, we first identified and reviewed the  requirements in U.S. Code Title 10, Section 2222 that related to DOD’s  management of its business system investments. We also identified in  prior GAO reports, the recommendations that we had made to the  department related to managing its defense business systems. We  selected for review, the 12 recommendations that DOD had not  implemented at the start of our audit in June 2019.

We then obtained and analyzed available documentation pertaining to the  department’s actions to address each of the 12 recommendations. This  included analyzing DOD investment decision memorandums and  guidance on certifying and approving defense business systems. We  compared information on the actions that the department took to address  the recommendations to the business system investment management  requirements specified in the code. We assessed whether the  department’s actions on the recommendations fulfilled the requirements  in the code.

In addition, we supplemented our analysis with interviews of relevant  DOD officials regarding the status of the department’s actions to  implement the recommendations and comply with the related  requirements in the code. These included officials in the Office of the  Chief Management Officer (CMO), the Office of the Chief Information  Officer (CIO), and the Offices of the CMOs in the Departments of the Air  Force and Army. We also observed a demonstration of the Office of the  CMO’s business enterprise architecture to better understand the actions  taken to address our related recommendations.

We conducted this performance audit from June 2019 to December 2019,  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objective. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective.

DOD is the largest U.S. government department and one of the most  complex organizations in the world. In support of its military operations,  the department manages many interdependent business functions,  including logistics management, procurement, health care management,  and financial management. DOD relies extensively on IT to support its  business functions.

The department’s IT budget organizes investments in four categories,  called mission areas—enterprise information environment, business,  warfighting, and intelligence. Figure 1 shows the amount of DOD’s total  requested fiscal year 2020 IT budget (of $36.1 billion) that the department  plans to spend on each of its mission areas (including the approximately  $8.9 billion it plans to spend on developing, modernizing, operating, and  maintaining its business systems).

The department further organizes its IT budget by segments. In this  regard, the business mission area segments are logistics/supply chain  management, human resource management, health, financial  management, acquisition, real property management, training and  readiness, other business services, and defense security enterprise.  Figure 2 shows the department’s projected fiscal year 2020 spending (of  $8.9 billion) for each segment in the business mission area.

U.S. Code Establishes Requirements for Managing Defense Business Systems

As amended in 2016, the U.S. Code requires DOD to perform certain  activities aimed at ensuring that its business system investments are  managed efficiently and effectively. Specifically, the amendments  established four sets of requirements for the department related to (1)  issuing policy and guidance for managing defense business systems; (2)  developing and maintaining a defense business enterprise architecture;  (3) establishing a Defense Business Council to provide advice to the  Secretary on managing defense business systems; and (4) obtaining  approvals before systems proceed into development (or if no  development is required, into production or fielding).

Further, the amendments to the code established specific designations  and thresholds that, among other things, provided additional details about  the department’s requirements:

Covered defense business systems. The code defines a covered  defense business system as a system that is expected to have a total  amount of budget authority of over $50 million over a period of 5 years  or more.

Priority defense business systems. The code establishes a  category of system, called a priority defense business system. This  refers to a system that is (1) expected to have a total amount of  budget authority of over $250 million over the period of the current  future-years defense program, or (2) designated by the DOD chief  management officer (CMO) as a priority defense business system  based on specific program analyses of factors including complexity,  scope, and technical risk, and after notification to Congress of such  designation.

Thresholds and officials responsible for review and certification  of defense business systems. The code states that, unless  otherwise assigned by the Secretary of Defense, military department  CMOs are to have approval authority for their covered defense  business system investments of below $250 million over the future- years defense program. The CMO is to have approval authority for  defense business systems owned by DOD components other than the  military departments, systems that will support the business process  of more than one military department or other component, and priority  defense business systems.

Certification requirements. The code requires that a defense  business system program be reviewed and certified at least annually,  on the basis of its compliance with the business enterprise  architecture and appropriate business process reengineering. In  addition, the code requires that the business system program be  reviewed and certified on the basis of having valid, achievable  requirements and a viable plan for implementing the requirements;  having an acquisition strategy designed to eliminate or reduce the  need to tailor commercial off-the-shelf systems; and being in  compliance with the department’s auditability requirements.

DOD Has Assigned Roles and Responsibilities for Managing Defense Business Systems

DOD Instruction 5000.75: Business System Requirements and  Acquisitions assigns roles and responsibilities for managing defense  business system investments. Table 1 identifies the key entities and  their responsibilities for managing defense business system investments.

GAO Previously Has Reported on DOD Business Systems Modernization Efforts

GAO designated the department’s business systems modernization  efforts as high risk in 1995 and has continued to do so in the years since.  In addition, since 2005, we have issued 12 reports in which we assessed  DOD’s actions to respond to the business system investment  management requirements contained in U.S. Code Title 10, Section  2222. These 12 reports, which are listed in appendix I, collectively  contained 29 recommendations to help strengthen the department’s  management of its business systems. For example,  In 2014, we reported that DOD had taken steps to comply with key  provisions in the NDAA for Fiscal Year 2005; however, the  department continued to face challenges in fully complying with the  provisions and modernizing its business systems environment. As a  result, we recommended that the department improve its business  system certification and approval process. DOD agreed with, and  implemented this recommendation.

In 2015, we reported that DOD had implemented 5 of the 16  recommendations made by GAO since June 2011 to address each of  the overarching provisions for improving business systems  management described in the NDAA for Fiscal Year 2005. The  department had partially implemented the other 11 recommendations.  We also reported that DOD’s business enterprise architecture and  process reengineering efforts were not fully achieving the intended  outcomes described in statute. Thus, we made a recommendation  aimed at ensuring that the department better achieve business  process reengineering and enterprise architecture outcomes and  benefits. DOD agreed with this recommendation and took steps  toward implementing it.

In 2018, we reported that DOD had made progress in complying  with most legislative provisions for managing its defense business  systems, but that additional actions were needed. For example, the  NDAA for Fiscal Year 2016 required DOD and the military  departments to issue guidance to address five requirements for  reviewing and certifying the department’s business systems. We  reported that, while DOD had issued guidance addressing all of the  requirements, the military departments had shown mixed progress.  Accordingly, we recommended that the military departments issue  guidance to address certifiying their business systems on the basis of  the five requirements. While DOD partially agreed with these  recommendations, the military departments implemented them.

As of June 2019, the department had implemented 15 of the 29  recommendations contained in the 12 reports. In addition, we closed two  of the recommendations as “not implemented” because the actions taken  by the department did not sufficiently address the recommendations. The  department had not yet taken actions to address the other 12  recommendations.

Table 2 identifies the four sets of requirements for strengthening DOD’s  management of defense business systems identified in the U.S. Code. In  addition, the table identifies a fifth category associated with human  capital, which supports the department’s execution of the other four sets  of requirements. The table also identifies the 12 GAO recommendations  that remained to be implemented as of June 2019.

DOD Made Progress in Strengthening Its Management of Business Systems, but Had Not Addressed All Recommendations Relating to the Statutory Requirements

DOD took actions toward addressing GAO’s recommendations related to  business system requirements contained in the U.S. Code. In doing so,  the department made progress in strengthening the management of its  defense business system investments. Specifically, between June 2019  and November 2019, the department demonstrated that it had  implemented four of the 12 remaining recommendations aimed at  strengthening business systems management.

As of November 2019, for example, the department had taken actions to  implement a recommendation that helped the department comply with the  code’s requirement to establish guidance for effectively managing its  defense business system investments. In this regard, the Office of the  CMO demonstrated that DOD had implemented our recommendation to  improve the department’s policy to require full consideration of  sustainability and technological refreshment requirements for its defense  business systems investments. Specifically, the department  demonstrated that its Instruction 5000.75, DOD Directive 5000.01, and  DOD Financial Management Regulation Volume 2B guidance includes  policy requiring consideration of sustainability and technological  refreshment. The department also demonstrated that its DOD Directive  5000.01 guidance includes policy to ensure that best systems  engineering practices are used in the procurement and deployment of  commercial systems, modified commercial systems, and defense-unique  systems.

In addition, with regard to the requirement that DOD ensure that business  systems are reviewed and certified in accordance with U.S. Code Title 10,  Section 2222, the Army demonstrated that it had implemented our  recommendation that the department improve its guidance for certifying  defense business systems. Specifically, the Army issued guidance to  require that the systems be certified on the basis of (1) having valid,  achievable requirements and a viable plan to implement the  requirements; (2) having an acquisition strategy designed to eliminate or  reduce the need to tailor commercial off-the-shelf systems to meet unique  requirements, incorporate unique requirements, or incorporate unique  interfaces to the maximum extent practicable; and (3) being in compliance  with DOD’s auditability requirements.

The Air Force also demonstrated that it had implemented our  recommendation that the department improve its guidance for certifying  defense business systems. Specifically, the Air Force issued guidance  to require that systems be certified on the basis of (1) having an  acquisition strategy designed to eliminate or reduce the need to tailor  commercial off-the-shelf systems to meet unique requirements,  incorporate unique requirements, or incorporate unique interfaces to the  maximum extent practicable; and (2) being in compliance with DOD’s  auditability requirements.

Further, with regard to this requirement, the Office of the CMO  demonstrated that it had addressed the recommendation to implement  and use business enterprise architecture and business process  reengineering compliance assessments more effectively. Specifically, in  September 2019, the Office of the CMO demonstrated that it had  reviewed business enterprise architecture and business process  reengineering compliance assessments and identified in investment  decision memorandums which systems had assessments that required  action.

Even with the actions taken, however, more remained to be done to  implement eight other recommendations relating to the code’s  requirements that could help strengthen the department’s management of  its business systems. Specifically, with regard to the requirement to  ensure that business systems are reviewed and certified in accordance  with the code, the department had not implemented two of our related  recommendations. For example, it had not implemented our  recommendation to ensure that portfolio assessments are conducted in  key areas identified in GAO’s IT investment management framework,  such as current schedule, project reporting, and risks.

In addition, with regard to the requirement to develop and maintain a  defense business enterprise architecture and IT enterprise architecture, in  accordance with relevant laws and Office of Management and Budget  policies and guidance, the department had developed a business  enterprise architecture. However, it had not implemented our five related  recommendations. For example, it had not implemented our  recommendation to integrate its business and IT architectures. According  to officials in the Office of the CIO, the office plans to finalize the first  increment of version 3 of its DOD Information Enterprise Architecture (i.e.,  IT enterprise architecture) by the end of December 2019, and intends to  integrate the business enterprise architecture into the Information  Enterprise Architecture as a part of that effort.

Further, with regard to human capital, which supports the other  requirements, the department had not implemented our related  recommendation to develop a skills inventory, needs assessment, gap  analysis, and plan to address identified gaps as part of a strategic  approach to human capital planning. In commenting on its status in  addressing the recommendation in September 2019, the Office of the  CMO stated that it intends to publish a Defense Business Operations  Management Workforce Plan by December 31, 2019. According to office  officials, the plan is to include skills requirements for both Office of the  CMO permanent employees and DOD employees detailed to the Office of  the CMO in support of the management and reform of defense business  operations management.

Table 3 summarizes the status of the 12 recommendations, as of  November 2019, relative to the requirements established in the code.

Further, appendix II provides additional information about the status of the  recommendations, as of November 2019.

By taking actions to implement four of the 12 remaining  recommendations, DOD made important progress in its efforts to comply  with the requirements established in the U.S. Code. Nevertheless, taking  further actions to implement all of the recommendations is essential to  helping the department comply with all of the requirements—and  ultimately, to strengthen the management of its defense business system  investments and efforts to effectively transform its business operations.

DOD provided written comments on a draft of this report, which are  reprinted in appendix III. In its comments, the department stated that it  appreciated GAO’s recognition of the progress that DOD has made to  strengthen business systems management. The department agreed that  more needs to be done to strengthen the management of investments in  DOD business operations and stated that, in the coming months, it plans  to execute a reform agenda intended to strengthen oversight and improve  business performance.

Further, while this report made no new recommendations, the department  concurred with our assessment of the status of seven of the eight open  recommendations that DOD has not yet implemented. In addition, the  department suggested that we close one recommendation that it perform  specific activities as part of a strategic approach to human capital  planning for the Office of the CMO, based on the CMO’s submission of a  human capital analysis report to Congress in early January 2020.

The department subsequently provided us a copy of the CMO’s human  capital analysis report on February 7, 2020. We plan to assess the report  to determine if it meets the intent of our recommendation.

We are sending copies of this report to the appropriate congressional  committees, the Director of the Office of Management and Budget, the  Secretary of Defense, and other interested parties. This report also is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions on matters discussed in  this report, please contact me at (202) 512-4456 or harriscc@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  major contributions to this report are listed in appendix IV.

Appendix I: Prior GAO Reports on Department of Defense Business System Modernization

Since 2005, GAO has issued 12 reports in which we assessed DOD’s  actions to respond to business systems modernization requirements  contained in U.S. Code, Title 10, Section 2222. These requirements  specify how DOD is to manage its business system investments. The  reports are listed below:  Defense Business Systems: DOD Needs to Continue Improving  Guidance and Plans for Effectively Managing Investments, GAO-18-130  (Washington, D.C.: April 16, 2018).

DOD Business Systems Modernization: Additional Action Needed to  Achieve Intended Outcomes, GAO-15-627 (Washington, D.C.: July 16,  2015).

Defense Business Systems: Further Refinements Needed to Guide the  Investment Management Process, GAO-14-486 (Washington, D.C. May  12, 2014).

DOD Business Systems Modernization: Further Actions Needed to  Address Challenges and Improve Accountability, GAO-13-557  (Washington, D.C.: May 17, 2013).

DOD Business Systems Modernization: Governance Mechanisms for  Implementing Management Controls Need to Be Improved, GAO-12-685  (Washington, D.C.: June 1, 2012).

Department of Defense: Further Actions Needed to Institutionalize Key  Business System Modernization Management Controls, GAO-11-684  (Washington, D.C.: June 29, 2011).

Business Systems Modernization: Scope and Content of DOD’s  Congressional Report and Executive Oversight of Investments Need to  Improve, GAO-10-663 (Washington, D.C.: May 24, 2010).

DOD Business Systems Modernization: Recent Slowdown in  Institutionalizing Key Management Controls Needs to Be Addressed,  GAO-09-586 (Washington, D.C.: May 18, 2009).

DOD Business Systems Modernization: Progress in Establishing  Corporate Management Controls Needs to Be Replicated Within Military  Departments, GAO-08-705 (Washington, D.C.: May 15, 2008).

DOD Business Systems Modernization: Progress Continues to Be Made  in Establishing Corporate Management Controls, but Further Steps Are  Needed, GAO-07-733 (Washington, D.C.: May 14, 2007).

Business Systems Modernization: DOD Continues to Improve Institutional  Approach, but Further Steps Needed, GAO-06-658 (Washington, D.C.:  May 15, 2006).

DOD Business Systems Modernization: Important Progress Made in  Establishing Foundational Architecture Products and Investment  Management Practices, but Much Work Remains, GAO-06-219  (Washington, D.C.: November 23, 2005).

Appendix II: Status of GAO Recommendations Aimed at Strengthening DOD’s Approach to Managing Its Business System Investments, as of November 2019

Table 4 summarizes the status of recommendations made to the  Department of Defense (DOD), based on GAO’s assessments of DOD’s  actions to respond to defense business system investment management  requirements contained in U.S. Code Title 10, Section 2222. The  recommendations, included in GAO reports issued from 2005 through  2018, were aimed at helping the department strengthen its approach to  managing its business system investments. As of June 2019 (when GAO  began its current review of DOD’s actions to address the  recommendations), the department had not yet addressed 12 of 29 total  recommendations. Subsequently, between June 2019 and November  2019, the department implemented four of the recommendations, but did  not implement eight other recommendations.

Appendix III: Comments from the Department of Defense

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the contact above, individuals who made contributions to  this report include Michael Holland (Assistant Director), Tyler Mountjoy  (Analyst in Charge), Camille Chaires, Cheryl Dottermusch, William  Hutchinson, Monica Perez-Nelson, Priscilla Smith, and Adam Vodraska.

DOD spends billions of dollars each year to operate, maintain, and modernize IT systems supporting key business areas like personnel and logistics. DOD’s business systems have been on our High Risk list since 1995 due, in part, to the department’s challenges in managing its considerable investments in them.

We looked at 12 of our recommendations from 2012-2018 on DOD business systems management. As of November 2019, DOD implemented 4 of them. Two of those recommendations were to help ensure that the military services don’t approve investments for needlessly complex systems.

We are monitoring DOD’s progress on the remaining recommendations.


Financial Audit: IRS's FY 2019 and FY 2018 Financial Statements

In accordance with the authority conferred by the Chief Financial Officers Act of 1990, as amended, GAO annually audits IRS's financial statements to determine whether (1) the financial statements are fairly presented and (2) IRS management maintained effective internal control over financial reporting. GAO also tests IRS's compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements.

IRS's tax collection activities are significant to overall federal receipts, and the effectiveness of its financial management is of substantial interest to Congress and the nation's taxpayers.

In GAO's opinion, the Internal Revenue Service's (IRS) fiscal years 2019 and 2018 financial statements are fairly presented in all material respects, and although controls could be improved, IRS maintained, in all material respects, effective internal control over financial reporting as of September 30, 2019. GAO's tests of IRS's compliance with selected provisions of applicable laws, regulations, contracts, and grant agreements detected no reportable instances of noncompliance in fiscal year 2019.

Limitations in the financial systems IRS uses to account for federal taxes receivable and other unpaid assessment balances, as well as other control deficiencies that led to errors in taxpayer accounts, continued to exist during fiscal year 2019.These control deficiencies affect IRS's ability to produce reliable financial statements without using significant compensating procedures. In addition, unresolved information system control deficiencies from prior audits, along with application and general control deficiencies that GAO identified in IRS's information systems in fiscal year 2019, placed IRS systems and financial and taxpayer data at risk of inappropriate and undetected use, modification, or disclosure.

IRS continues to take steps to improve internal controls in these areas. However, the remaining deficiencies are significant enough to merit the attention of those charged with governance of IRS and therefore represent continuing significant deficiencies in internal control over financial reporting related to (1) unpaid assessments and (2) financial reporting systems. Continued management attention is essential to fully addressing these significant deficiencies.

Based on prior financial statement audits, GAO made numerous recommendations to IRS to address internal control deficiencies. GAO will continue to monitor and will report separately on IRS's progress in implementing prior recommendations that remain open. Consistent with past practice, GAO will also be separately reporting on the new internal control deficiencies identified in this year's audit and providing IRS recommendations for corrective actions to address them.

In commenting on a draft of this report, IRS stated that it continues its efforts to improve its financial reporting systems controls and internal controls over unpaid assessments.

The accompanying report presents the results of our audits of the fiscal  years 2019 and 2018 financial statements of the Internal Revenue  Service (IRS). Specifically, we found  IRS’s financial statements as of and for the fiscal years ended  September 30, 2019, and 2018, are presented fairly, in all material  respects, in accordance with U.S. generally accepted accounting  principles; although internal controls could be improved, IRS maintained, in all  material respects, effective internal control over financial reporting as  of September 30, 2019; and no reportable noncompliance for fiscal year 2019 with provisions of  applicable laws, regulations, contracts, and grant agreements we  tested.

This report also provides a discussion of continuing significant  deficiencies in IRS’s internal control over financial reporting related to (1)  unpaid assessments and (2) financial reporting systems that we believe  merit attention by those charged with governance of IRS. Continued  management attention is essential to improving the management and  reporting of unpaid assessments and addressing financial reporting  system deficiencies. IRS also continues to face significant management  challenges that we have reported in previous audits relating to  safeguarding taxpayer receipts and associated information and  preventing and detecting fraudulent refunds based on identify theft. It is  important that IRS continue its efforts to minimize the risks these  challenges pose to taxpayers and any associated losses to the federal  government.

We performed our audit pursuant to authority conferred by the Chief  Financial Officers Act of 1990, as amended by the Government  Management Reform Act of 1994.

We are sending copies of this report to the Chairman and Vice Chairman  of the Joint Committee on Taxation, the Chairmen and Ranking Members  of the Senate Committee on Finance and the House Committee on Ways  and Means, and other interested congressional committees and  subcommittees. We are also sending copies of this report to the  Commissioner of Internal Revenue, the Director of the Office of  Management and Budget, and other interested parties. In addition, the  report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions concerning this report, please  contact me at (202) 512-3406 or clarkce@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report.

To the Commissioner of Internal Revenue  In our audits of the fiscal years 2019 and 2018 financial statements of the  Internal Revenue Service (IRS), we found  IRS’s financial statements as of and for the fiscal years ended  September 30, 2019, and 2018, are presented fairly, in all material  respects, in accordance with U.S. generally accepted accounting  principles; although internal controls could be improved, IRS maintained, in all  material respects, effective internal control over financial reporting as  of September 30, 2019; and no reportable noncompliance for fiscal year 2019 with provisions of  applicable laws, regulations, contracts, and grant agreements we  tested.

The following sections discuss in more detail (1) our report on the  financial statements and on internal control over financial reporting, which  includes required supplementary information (RSI) and other information  included with the financial statements; (2) our report on compliance with  laws, regulations, contracts, and grant agreements; and (3) agency  comments.

Report on the Financial Statements and on Internal Control over Financial Reporting

In accordance with our authority conferred by the Chief Financial Officers  (CFO) Act of 1990, as amended by the Government Management Reform  Act of 1994, we have audited IRS’s financial statements. IRS’s financial  statements comprise the balance sheets as of September 30, 2019, and  2018; the related statements of net cost, changes in net position,  budgetary resources, and custodial activity for the fiscal years then  ended; and the related notes to the financial statements. We also have  audited IRS’s internal control over financial reporting as of September 30,  2019, based on criteria established under 31 U.S.C. § 3512(c), (d),  commonly known as the Federal Managers’ Financial Integrity Act  (FMFIA).

We conducted our audits in accordance with U.S. generally accepted  government auditing standards. We believe that the audit evidence we  obtained is sufficient and appropriate to provide a basis for our audit  opinions.

IRS management is responsible for (1) the preparation and fair  presentation of these financial statements in accordance with U.S.  generally accepted accounting principles; (2) preparing, measuring, and  presenting the RSI in accordance with U.S. generally accepted  accounting principles; (3) preparing and presenting other information  included in documents containing the audited financial statements and  auditor’s report, and ensuring the consistency of that information with the  audited financial statements and the RSI; (4) maintaining effective internal  control over financial reporting, including the design, implementation, and  maintenance of internal control relevant to the preparation and fair  presentation of financial statements that are free from material  misstatement, whether due to fraud or error; (5) evaluating the effectiveness of internal control over financial reporting based on the  criteria established under FMFIA; and (6) its assessment about the  effectiveness of internal control over financial reporting as of September  30, 2019, included in the accompanying Management’s Report on  Internal Control over Financial Reporting in appendix I.

Our responsibility is to express an opinion on these financial statements  and an opinion on IRS’s internal control over financial reporting based on  our audits. U.S. generally accepted government auditing standards  require that we plan and perform the audits to obtain reasonable  assurance about whether the financial statements are free from material  misstatement, and whether effective internal control over financial  reporting was maintained in all material respects. We are also responsible  for applying certain limited procedures to RSI and other information  included with the financial statements.

An audit of financial statements involves performing procedures to obtain  audit evidence about the amounts and disclosures in the financial  statements. The procedures selected depend on the auditor’s judgment,  including the auditor’s assessment of the risks of material misstatement of  the financial statements, whether due to fraud or error. In making those  risk assessments, the auditor considers internal control relevant to the  entity’s preparation and fair presentation of the financial statements in  order to design audit procedures that are appropriate in the  circumstances. An audit of financial statements also involves evaluating  the appropriateness of the accounting policies used and the  reasonableness of significant accounting estimates made by  management, as well as evaluating the overall presentation of the  financial statements.

An audit of internal control over financial reporting involves performing  procedures to obtain evidence about whether a material weakness  exists. The procedures selected depend on the auditor’s judgment,  including the assessment of the risk that a material weakness exists. An  audit of internal control over financial reporting also includes obtaining an  understanding of internal control over financial reporting, and evaluating  and testing the design and operating effectiveness of internal control over  financial reporting based on the assessed risk. Our audit of internal  control also considered IRS’s process for evaluating and reporting on  internal control over financial reporting based on criteria established  under FMFIA. Our audits also included performing such other procedures  as we considered necessary in the circumstances.

We did not evaluate all internal controls relevant to operating objectives  as broadly established under FMFIA, such as those controls relevant to  preparing performance information and ensuring efficient operations. We  limited our internal control testing to testing controls over financial  reporting. Our internal control testing was for the purpose of expressing  an opinion on whether effective internal control over financial reporting  was maintained, in all material respects. Consequently, our audit may not  identify all deficiencies in internal control over financial reporting that are  less severe than a material weakness.

Definition and Inherent Limitations of Internal Control over Financial Reporting

An entity’s internal control over financial reporting is a process effected by  those charged with governance, management, and other personnel, the  objectives of which are to provide reasonable assurance that (1)  transactions are properly recorded, processed, and summarized to permit  the preparation of financial statements in accordance with U.S. generally  accepted accounting principles, and assets are safeguarded against loss  from unauthorized acquisition, use, or disposition, and (2) transactions  are executed in accordance with provisions of applicable laws, including  those governing the use of budget authority, regulations, contracts, and  grant agreements, noncompliance with which could have a material effect  on the financial statements.

Because of its inherent limitations, internal control over financial reporting  may not prevent, or detect and correct, misstatements due to fraud or  error. We also caution that projecting any evaluation of effectiveness to  future periods is subject to the risk that controls may become inadequate  because of changes in conditions, or that the degree of compliance with  the policies or procedures may deteriorate.

In our opinion, IRS’s financial statements present fairly, in all material  respects, IRS’s financial position as of September 30, 2019, and 2018,  and its net cost of operations, changes in net position, budgetary  resources, and custodial activity for the fiscal years then ended in  accordance with U.S. generally accepted accounting principles.

In accordance with federal accounting standards, IRS’s financial  statements do not include an estimate of the dollar amount of taxes that  are owed to the federal government but that taxpayers have not reported  or that IRS has not identified through its enforcement programs, often  referred to as the tax gap, nor do they include information on tax  expenditures. Further detail on the tax gap and tax expenditures, as well  as the associated dollar amounts, is provided in the other information  included with the financial statements.

Opinion on Internal Control over Financial Reporting

In our opinion, although internal controls could be improved, IRS  maintained, in all material respects, effective internal control over financial  reporting as of September 30, 2019, based on criteria established under  FMFIA.

Our fiscal year 2019 audit identified continuing deficiencies concerning  IRS’s internal control over unpaid assessments and continuing and new  deficiencies concerning IRS’s internal control over financial reporting  systems. While not considered material weaknesses, these deficiencies  are collectively important enough to merit attention by those charged with  governance of IRS. Therefore, we considered these issues affecting  IRS’s internal controls over unpaid assessments and financial reporting  systems to be significant deficiencies in internal control as of September  30, 2019. These two significant deficiencies are discussed in more detail  below.

We considered these significant deficiencies in determining the nature,  timing, and extent of our audit procedures on IRS’s fiscal year 2019  financial statements. Although the significant deficiencies in internal  control did not affect our opinion on IRS’s fiscal year 2019 financial  statements, misstatements may occur in unaudited financial information  reported internally and externally by IRS because of these significant  deficiencies.

In addition, because of the significant deficiencies in internal controls over  unpaid assessments and financial reporting systems that existed during  fiscal year 2019, IRS’s financial management systems did not comply  substantially with federal financial management systems requirements as  required by the Federal Financial Management Improvement Act of  1996.

We will be reporting additional details concerning any new issues relating  to these significant deficiencies separately to IRS management, along  with recommendations for corrective actions. We also identified other  deficiencies in IRS’s internal control over financial reporting that we do  not consider to be material weaknesses or significant deficiencies.

Nonetheless, these deficiencies warrant IRS management’s attention. We  have communicated these matters to IRS management and, where  appropriate, will report on them separately along with related  recommendations for corrective actions.

Further, as we have reported in past audits, IRS continues to face  significant ongoing financial management challenges relating to  safeguarding taxpayer receipts and associated information, and  preventing and detecting fraudulent refunds based on identify theft.  Although these challenges do not rise to the level of significant  deficiencies in internal control, we believe they are sensitive matters  requiring IRS management’s attention. We have made several  recommendations to IRS to enhance its internal controls to mitigate these  challenges. It is important that IRS continue its efforts to minimize the  risks these challenges pose to taxpayers and any associated losses to  the federal government.

Significant Deficiency in Internal Control over Unpaid Assessments

Limitations in the financial systems IRS uses to account for federal taxes  receivable and other unpaid assessment balances, as well as other  control deficiencies that led to errors in taxpayer accounts, continued to  exist during fiscal year 2019. As a result of these deficiencies, IRS’s  systems were unable to provide the timely, reliable, and complete  transaction-level financial information necessary to enable IRS to  appropriately classify and report unpaid assessment balances.

As in prior years, IRS used a complex and labor-intensive statistical  estimation process to compensate for the effects of its system  limitations and other deficiencies on a material portion of its federal taxes  receivable balance to help ensure that this balance was free of material  misstatement. During fiscal year 2019, IRS recorded adjustments  totaling about $17 billion to correct the effects of continued errors in its  underlying data that IRS identified during its manual estimation process.

While using this process to determine a material portion of taxes  receivable has enabled IRS to produce reliable related balances for year- end reporting, it does not provide IRS management with readily available,  reliable unpaid assessment information on a daily basis throughout the  year in order to effectively manage unpaid assessment balances. Further,  errors in taxpayer accounts create a burden for those taxpayers whose  accounts were affected.

While not collectively considered a material weakness, IRS’s ongoing  control deficiencies related to unpaid assessments are important enough  to merit attention by those charged with governance of IRS. Therefore,  these issues represent a significant deficiency in IRS’s internal control  over financial reporting as of September 30, 2019. During fiscal year  2019, IRS documented the key management decisions in the design and  use of the estimation process. This step should reduce the risk that IRS  may perform sampling procedures inconsistent with management intent  or plans. Continued management commitment and sustained efforts are  necessary to build on the progress made to date and to fully address  IRS’s remaining unresolved issues concerning the management and  reporting of unpaid assessments.

Significant Deficiency in Internal Control over Financial Reporting Systems

During our fiscal year 2019 audit, we determined that unresolved  information system control deficiencies from prior audits, along with new  control deficiencies pertaining to business process application controls  and general controls in IRS’s information systems, collectively represent  a significant deficiency in IRS’s internal control over financial reporting  systems. Specifically, IRS did not correct control deficiencies we reported  as of September 30, 2018, concerning (1) unnecessary access rights  granted to accounts, (2) inconsistent monitoring of systems and accounts,  (3) out-of-date and unsupported hardware and software, (4) change  controls over tax and financial management processing on the  mainframe, and (5) developing and implementing effective policies and  procedures as part of IRS’s security management program. In addition,  during this year’s audit, we found new control deficiencies in the following  areas: (1) implementing automated financial controls of interfaces  between key applications, (2) ensuring that authorized personnel  reviewed key documents for external systems, (3) enforcing multifactor  authentication, (4) enforcing adequate encryption to protect systems and  data, or (5) ensuring that patches installed on systems were current to  protect against known vulnerabilities.

The potential effect of these continuing and new deficiencies on IRS’s  financial reporting for fiscal year 2019 was mitigated primarily by IRS’s  compensating management controls designed to detect potential  misstatements on the financial statements. Nevertheless, these  application and general control deficiencies increase the risk of  unauthorized access to, modification of, or disclosure of sensitive  financial and taxpayer data and disruption of critical operations, and are  therefore important enough to merit the attention of those charged with  governance of IRS. According to IRS management, IRS has developed a  plan that focuses on strengthening its information system controls.  Continued and consistent management commitment and attention will be  essential to addressing existing financial reporting system deficiencies.

U.S. generally accepted accounting principles issued by the Federal  Accounting Standards Advisory Board (FASAB) require that the RSI be  presented to supplement the financial statements. Although the RSI is not  a part of the financial statements, FASAB considers this information to be an essential part of financial reporting for placing the financial statements  in appropriate operational, economic, or historical context. We have  applied certain limited procedures to the RSI in accordance with U.S.  generally accepted government auditing standards, which consisted of  inquiries of management about the methods of preparing the RSI and  comparing the information for consistency with management’s responses  to the auditor’s inquiries, the financial statements, and other knowledge  we obtained during the audit of the financial statements, in order to report  omissions or material departures from FASAB guidelines, if any, identified  by these limited procedures. We did not audit and we do not express an  opinion or provide any assurance on the RSI because the limited  procedures we applied do not provide sufficient evidence to express an  opinion or provide any assurance.

IRS’s other information contains a wide range of information, some of  which is not directly related to the financial statements. This information is  presented for purposes of additional analysis and is not a required part of  the financial statements or the RSI. We read the other information  included with the financial statements in order to identify material  inconsistencies, if any, with the audited financial statements. Our audit  was conducted for the purpose of forming an opinion on IRS’s financial  statements. We did not audit and do not express an opinion or provide  any assurance on the other information.

In connection with our audits of IRS’s financial statements, we tested  compliance with selected provisions of applicable laws, regulations,  contracts, and grant agreements consistent with our auditor’s  responsibility discussed below. We caution that noncompliance may  occur and not be detected by these tests. We performed our tests of  compliance in accordance with U.S. generally accepted government  auditing standards.

IRS management is responsible for complying with laws, regulations,  contracts, and grant agreements applicable to IRS.

Our responsibility is to test compliance with selected provisions of laws,  regulations, contracts, and grant agreements applicable to IRS that have  a direct effect on the determination of material amounts and disclosures  in IRS’s financial statements, and perform certain other limited  procedures. Accordingly, we did not test compliance with all laws,  regulations, contracts, and grant agreements applicable to IRS.

Results of Our Tests for Compliance with Laws, Regulations, Contracts, and Grant Agreements

Our tests for compliance with selected provisions of applicable laws,  regulations, contracts, and grant agreements disclosed no instances of  noncompliance for fiscal year 2019 that would be reportable under U.S.  generally accepted government auditing standards. However, the  objective of our tests was not to provide an opinion on compliance with  laws, regulations, contracts, and grant agreements applicable to IRS.  Accordingly, we do not express such an opinion.

Intended Purpose of Report on Compliance with Laws, Regulations, Contracts, and Grant Agreements

The purpose of this report is solely to describe the scope of our testing of  compliance with selected provisions of applicable laws, regulations,  contracts, and grant agreements and the results of that testing, and not to  provide an opinion on compliance. This report is an integral part of an  audit performed in accordance with U.S. generally accepted government  auditing standards in considering compliance. Accordingly, this report on  compliance with laws, regulations, contracts, and grant agreements is not  suitable for any other purpose.

In commenting on a draft of this report, IRS stated that it was pleased to  receive an unmodified opinion on its financial statements. IRS also  commented on its continued efforts to address its financial reporting  systems control deficiencies and improve its internal controls in financial  reporting of unpaid assessments. The complete text of IRS’s response is  reproduced in appendix II.

Appendix I: Management’s Report on Internal Control over Financial Reporting

Appendix II: Comments from the Internal Revenue Service

In 2019, IRS collected over $3 trillion in taxes. This money equates to about 95% of the gross revenue of the United States and helps fund the country. Accordingly, IRS’s financial management is important to Congress and taxpayers.

We audit IRS's financial statements each year and issue an opinion on them, as well as on the effectiveness of the agency's internal controls (e.g., its ability to ensure that transactions are properly authorized and recorded).

We found that IRS’s financial statements were reliable and that its internal controls over financial reporting were effective in 2019.