INDEPENDENT AUDITORS' REPORTS
REPORT ON THE PRINCIPAL FINANCIAL STATEMENTS
REPORT ON INTERNAL CONTROL
Exhibit I
MATERIAL WEAKNESSES
SEIZED ASSETS
As noted in the Independent Auditors' Report on Financial Statements, the FBI does not have an adequate system in place to accurately and completely account for its seized assets. As such, we were unable to perform sufficient audit procedures to determine the propriety and fairness of presentation of the amount of the FBI's seized assets, as of September 30, 1996, resulting in a qualification to the audit report. The amount of seized assets reported on hand at September 30, 1996 is inaccurate due to incomplete and late reporting of field office seizure activities.
Based on our seized asset testwork, we determined that:
· The FBI's seized assets are not consistently being approved for processing and recorded at the field offices, nor are the field offices notifying headquarters of seized asset activity, within the required time limit. Of the 24 case files we reviewed, 23 indicated that the Forfeiture and Seized Property Unit (FSPU) received notice of the seizure more than 25 days after the seizure action. The FBI Forfeiture and Abandoned Property Manual, Step 2-55, states that all seizures are to be reported to FSPU within 25 calendar days of seizure.
Often, the FSPU at the field office is not involved in cases until weeks after the seizure action. Also, authorization on the seizure form is often given many days after the seizure form is prepared. This late notification and filing of seizure forms caused the seized asset account balance to be understated at year end.
· The FBI field offices do not update in a timely manner the seized asset property records as a result of their year-end inventories of seized assets. In addition, the Property Forfeiture Application (PFA) system custody reports do not completely track historical data on seized assets.
Presently, the PFA system does not have the capability to retain transactions according to historical dates. Consequently, the FBI's seized assets detailed report provided during the audit did not include all assets that were on hand as of September 30, 1996, because certain assets were forfeited between year-end and the audit fieldwork report run date. For financial statement reporting purposes, the PFA reports should include all assets on hand as of the September 30 year-end date (regardless of when the reports are run).
While existence and valuation were supported for the assets we tested, the FBI's recordkeeping and inventory procedures were not adequate to ensure the accuracy and completeness of seized assets on hand as of September 30, 1996.
Recommendation No. 1
We recommend that the Director, FBI: (a) reinforce its policy to require agents involved in asset seizures to promptly inform, and obtain the requisite authorization from, the seized asset units so that timely notice of seizures can be given to FSPU; (b) adopt procedures to ensure that field offices update their year-end seized asset inventory reports in a timely manner; and (c) make the system modifications needed to ensure the completeness of the PFA custody reports at fiscal year-end.
Management's Response
Concur. Through enhanced management oversight and training for field personnel, the salient aspects of Recommendation Number 1 with respect to notification/reporting delays will be addressed. The issue of entering data into the Property Forfeiture Application (PFA) in a timely manner was also a topic of discussion at the annual Paralegal Specialist conference.
With respect to the fiscal year-end PFA reports, the Forfeiture and Seized Property Unit is researching the possibility of enhancing the PFA to capture historical data. It may also be possible in the future to utilize the DOJ Consolidated Asset Tracking System (CATS). However, this will not be an option until the record conversion process has been completed.
It should be noted that any problems relating to CATS must be addressed by the DOJ staff which oversees that system.
CAPITAL LEASES
As noted in the Independent Auditors' Report on Financial Statements, we noted deficiencies in the implementation of the FBI's accounting policy, including instances of inadequate recordkeeping. As a result, we were unable to determine if capital leases were properly recorded and reported.
The FBI defines capital leases according to the criteria presented in the Federal Accounting Standards Advisory Board's (FASAB) Statement of Financial Accounting Standards (SFFAS) No. 6, Accounting for Property, Plant, and Equipment, with the additional criterion that the asset value meets or exceeds the capitalization threshold of $25,000 set by the U.S. Department of Justice. We noted that, in some instances, leases were categorized as capital or operating based solely on the purchase price of the asset. We also noted that the FBI uses forms that provide all capital lease criteria to be considered; however, the analysis to determine if the lease meets the capitalization criteria is not consistently being performed.
Further, as of September 30, 1996, the FBI had not maintained adequate records to support the amount, location, and valuation of its assets under capital leases. As such, we were unable to determine if all leases meeting the capitalization criteria were properly identified. Accordingly, we could not determine if the related financial statement balances and footnote disclosures were fairly presented.
Recommendation No. 2
We recommend that the Director, FBI: strengthen recordkeeping and reporting procedures to ensure that capital leases are identified, documented, and properly reported in the financial statements.
Management's Response
Concur. The Finance Division will augment and enhance procedures to ensure that capital leases are identified and reported properly in the financial statements.
Exhibit II
REPORTABLE CONDITIONS
ACCOUNTS RECEIVABLE
As a result of our accounts receivable testwork, we determined that the FBI incorrectly calculated amounts due under interagency agreements. The FBI's calculation of accounts receivable related to work under interagency agreements included obligated but unfilled customer orders. As a result, accounts receivable as of September 30, 1996 were overstated by the amount of obligations that were included in accounts receivable for which the related expenses had yet to be incurred.
SFFAS No. 1, Accounting for Selected Assets and Liabilities, states that a receivable should be recognized when a federal entity establishes a claim to cash or other assets against other entities. As such, accounts receivable should not include balances for undelivered services.
Although the FBI posted a $37 million adjustment to fairly state accounts receivable in its statement of financial position as of September 30, 1996, it needs to revise its accounting policy with respect to unbilled accounts receivable.
Recommendation No. 3
We recommend that the Director, FBI: revise accounting procedures for interagency accounts receivable so that amounts are recognized based on actual expenses incurred for assets and services delivered under the related obligations.
Management's Response
Concur. The Finance Division has implemented procedures to ensure that receivables are recognized pursuant to the provisions of SFFAS No. 1, Accounting for Selected Assets and Liabilities.
PROPERTY AND EQUIPMENT
As a result of our property and equipment testwork, we identified the following conditions which resulted in misstatements (that were ultimately corrected) in the statement of financial position:
· The acquisition cost of a construction-in-progress (CIP) project was understated by $6.5 million in the general ledger and financial statements, as well as in the Fixed Asset System (FAS) system. The FAS system was understated because certain fixed asset purchase orders were not updated in the FAS. This occurred because the related purchase orders were not properly bar coded as fixed assets. Consequently, future expenses were not recognized as capitalizable. As a result, the property and equipment balance on the statement of financial position was understated. This error was subsequently adjusted in the general ledger and the financial statements.
· The acquisition cost of one CIP project was understated by $2.2 million in the general ledger and financial statements, as well as the FAS. The amount was originally correctly recorded in the general ledger; however, the general ledger was subsequently adjusted to agree with the FAS, which contained the incorrect amount. Again, the purchase orders were not properly bar coded as fixed assets in the FAS. Correcting entries were made in the accounting records and financial statements.
Recommendation No. 4
We recommend that the Director, FBI: revise fixed asset accounting policies and procedures to include periodic reconciliations to ensure that the proper capitalized costs have been entered into FAS, and that this subsidiary system's balances agree with the general ledger.
Management's Response
Concur. The Finance Division is evaluating current procedures relative to capturing Construction-in-Progress (CIP) costs to ensure that such amounts will be fairly stated at year-end.
ACCOUNTS PAYABLE
As a result of our search for unrecorded liabilities testwork, we noted that the FBI has no procedure for accruing contractor services accounts payable. Eight out of eight sample items, totalling $4.4 million, were not accrued as required.
According to SFFAS No. 1, Accounting for Selected Assets and Liabilities, payables should be accrued for goods and services received from, progress in contract performance by, and rents due to other entities. If invoices for such goods and services are not available when the financial statements are prepared, the amounts owed should be estimated. Such estimates should be based on the federal entity's engineering and management evaluation of actual performance progress and incurred costs.
In the FBI's case, invoices from contractors are typically received two to four months after year-end. The FBI has no procedures, however, to estimate unbilled costs as of fiscal year-end for financial statement reporting purposes. As a result, property, plant, and equipment; expenses; and accounts payable were understated as of and for the year ended September 30, 1996. The amount of the understatement was calculated and adjusted in the general ledger and financial statements. Without procedures to correctly account for these accounts payable, however, the FBI's financial statements will continue to be misstated prior to audit adjustments.
Recommendation No. 5
We recommend that the Director, FBI: establish procedures to estimate contractor-related accounts payable for invoices not yet received at year-end for financial statement accrual purposes. The largest contractors should be contacted for estimates of costs incurred as of September 30.
Management's Response
Concur. The Finance Division will establish procedures to estimate contractor-related accounts payable at year-end so as to enhance the quality of data presented in the financial statements.
ELECTRONIC DATA PROCESSING (EDP) - SERVICE INTERRUPTION
As a result of our EDP general controls review, we noted the following conditions related to EDP service interruption:
· The FBI has a disaster recovery plan (DRP) related to its headquarters data center, however, the DRP has not been fully tested. As such, the FBI cannot demonstrate that, should a disaster occur making the headquarters data center inoperable for an extended period, the agency could successfully recover and resume computer operations and related processing at an alternate site within a time frame that meets the agency's needs.
· In the event of a disaster affecting the data center, the potential for lost data is not consistent with current expectations. The FBI DRP indicates that expectations are that all FBI applications will be functional at the alternate processing site within two days. The current recovery procedures, however, would only limit down-time to five business days.
Presently, journal files are created throughout the processing cycles and would be available, barring a disaster to the data center, to restore lost files within a few hours. In addition, back-up files, including the operating system and on-line documentation, are backed up weekly. Should a disaster occur, however, the maximum exposure would be five business days, because the prior week back-up tapes would have to be used in lieu of the journal file tapes.
· The FBI has no documented comprehensive and coordinated Continuity of Business (COB) Plan for the operational and administrative divisions and units located at its headquarters. Should a disaster occur to an individual division or unit or to a portion of the building, the agency lacks a plan for the affected areas to resume their normal functions.
The unavailability of mission critical systems could have serious adverse effects on the FBI's ability to effectively apply resources during the early critical hours of a disaster, and thus on national security. Similarly, unacceptable service delivery interruptions in administrative or other support functions could occur. OMB Circular No. A-130, Management of Federal Information Resources, requires that agencies' DRP's ensure the ability to recover and provide services sufficiently to meet the minimal needs of system users in the event of a disaster.
Recommendation No. 6
We recommend that the Director, FBI:
(a) Design and implement disaster recovery plan tests to ensure workable restoration of services within a time frame that is consistent with management's expectations. Testing should be done no less than annually and should include:
· supervision by a disaster recovery coordinator
· variations in disaster scenarios (Headquarters and West Virginia data centers)
· utilization of multiple teams
· stated objectives
· debriefing sessions
· documentation retention
(b) Reevaluate mission critical systems for maximum exposure to data loss and adjust the off-site back-up rotation procedures to ensure that the maximum time exposure is not exceeded (until such time as the tape silos and corresponding "hot" back-ups of data files are implemented and fully operational.)
(c) Design, develop, implement, and biannually test an organization wide COB Plan, under a disaster recovery coordinator, that includes:
· operating procedures prioritized by category
· time lines indicating when operational activities will be resumed
· human and material inventory needs (including people, information technology, and operational supplies)
· locations of needed supplies
· phone trees of key points of contact
Management's Response
Concur. The Information Resources Division will institute and/or revise policies and
perform corresponding procedures so as to comply with the provisions enumerated within
Recommendation Number 6.
REPORT ON COMPLIANCE
#####