DHS OIG, OIG-10-61, Management Letter for U.S. Customs and Border Protection's FY 2009 Consolidated Financial Statements (2010)

Department of Homeland Security Office of Inspector General Management Letter for U.S. Customs and Border Protection's FY 2009 Consolidated Financial Statements OIG-10-61 March 2010 Office ofInspector General u.s. Department of Homeland Security Washington, DC 20528 Homeland Security MAR - 4 2010 Preface The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our oversight responsibilities to promote economy, efficiency, and effectiveness within the department. This report presents the management letter for u.S. Customs and Border Protection's (CBP) fiscal year (FY) 2009 consolidated financial statements audit. It contains observations and recommendations related to internal controls that did not reach the level required to be reported in the financial statement report.

Other internal control weaknesses which are considered significant deficiencies were reported, as required, in KPMG LLP's (KPMG) Independent Auditors' Report, dated January 6, 2010. KPMG performed the audit and prepared this management letter and is responsible for the conclusions expressed in it. We do not express opinions on CBP's consolidated financial statements or internal controls, or conclusions on compliance with laws and regulations. The recommendations herein have been discussed in draft with those responsible for implementation.

We trust this report will result in more effective, efficient, and economical operations. We express our appreciation to all of those who contributed to the preparation of this report. ~~o(,~ Richard L. Skinner Inspector General KPMG LLP 2001 M Street, NW Washington, DC 20036 January 6, 2010 Office of Inspector General and Chief Financial Officer, U.S. Department of Homeland Security, Washington, DC Chief Financial Officer, U.S. Customs and Border Protection Ladies and Gentlemen: We have audited the consolidated balance sheet of the U.S. Customs and Border Protection (CBP), a Component of the U.S. Department of Homeland Security, as of September 30, 2009, and the related consolidated statement of net cost, changes in net position, custodial activity, and the combined statement of budgetary resources (hereinafter, referred to as “consolidated financial statements”) for the year then ended. In planning and performing our audit of CBP’s consolidated financial statements, we considered CBP’s internal control over financial reporting in order to determine our auditing procedures for the purpose of expressing our opinion on the consolidated financial statements. In connection with our fiscal year (FY) 2009 engagement, we considered CBP’s internal control over financial reporting by obtaining an understanding of CBP’s internal controls, determining whether internal controls had been placed in operation, assessing control risk, and performing tests of controls in order to determine our procedures.

We limited our internal control testing to those controls necessary to achieve the objectives described in Government Auditing Standards and OMB Bulletin No. 07-04, Audit Requirements for Federal Financial Statements. We did not test all internal controls relevant to operating objectives as broadly defined by the Federal Managers’ Financial Integrity Act of 1982 (FMFIA). The objective of our engagement was not to provide an opinion on the effectiveness of CBP’s internal control over financial reporting. Accordingly, we do not express an opinion on the effectiveness of CBP’s internal control over financial reporting.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal control that is less severe that a material weakness, yet important enough to merit attention by those charged with governance. A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis. KPMG LLP, a U.S. limited liability partnership, is the U.S. member firm of KPMG International, a Swiss cooperative.

We noted certain matters involving internal control and other operational matters that are listed on page 1 in the Table of Financial Management Comments, and presented for your consideration. These comments and recommendations, all of which have been discussed with the appropriate members of management, are intended to improve internal control or result in other operating efficiencies. These comments are in addition to the significant deficiencies and material weakness presented in our Independent Auditors’ Report, dated January 6, 2010, included in the FY 2009 CBP Performance and Accountability Report. A description of each internal control finding, and its disposition, as either a material weakness, significant deficiency, or a financial management comment, is provided in Appendix A. Our findings related to information technology systems security have been presented in a separate letter to the Office of Inspector General and the DHS Chief Information Officer dated January 6, 2010.

We would be pleased to discuss these comments and recommendations with you at any time. This report is intended for the information and use of DHS and CBP management, the Office of Inspector General, the U.S. Office of Management and Budget, the U.S. Congress, and the Government Accountability Office, and is not intended to be and should not be used by anyone other than these specified parties. Very truly yours, Department of Homeland Security U.S. Customs and Border Protection Table of Financial Management Comments September 30, 2009 TABLE OF FINANCIAL MANAGEMENT COMMENTS (FMC) Comment Reference FMC 09-01 Verification of Check Proof Listing (CPL) and weaknesses in the certification of Subject Page(s) 2 payments FMC 09-02 Automated Commercial System (ACS) deficiency over the accumulation of claims 2 against a drawback bond FMC 09-03 Failure to complete supervisory review FMC 09-04 Weaknesses in the monitoring, review, and oversight process over the completion of Fines, Penalties, and Forfeitures (FP&F) cases FMC 09-05 Weaknesses in the review of weekly/monthly entry edit reports FMC 09-06 Miscellaneous seized inventory findings FMC 09-07 Lack of formal policies over review of importer self-assessment annual notification letters FMC 09-08 Lack of controls over capital leases FMC 09-09 Lack of controls over the timely processing of goods and services received FMC 09-10 Weakness in CBP’s management review of contracts FMC 09-11 Deficiencies in CBP’s controls over calculating the validity and collectability of non-entity taxes, duties, and trade receivables, net 2–3 3 3–4 4–5 5–6 6 6–7 7–8 8 FMC 09-12 Deficiencies in CBP’s controls over the application of benefits to C-TPAT Partners FMC 09-13 Weaknesses in accounting for Imputed Financing 9 9–10 APPENDICES Appendix A B C Subject Crosswalk – Financial Management Comments to Active NFRs Status of Prior Year Findings Management Response Page(s) 11–12 13 14 1 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 FMC 09-01 – Verification of Check Proof Listing (CPL) and weaknesses in the certification of payments (NFR No. CBP 09-01) Condition: In the event that the chief/supervisor does not certify a payment, the Automated Commercial System (ACS) is defaulted to automatically indicate that the Port Director certified a given payment, without the Port Director’s actual certification. Based on our review of the corrective action plan and inquiry with the client, we noted this issue has not been corrected for FY 2009.

Recommendation: We recommend that CBP develop and implement an automated system that ensures all necessary verifications are completed prior to issuance of payment. While the system is in development, continue using their manual control to verify payments in the system to avoid the ACS default being activated. FMC 09-02 – Automated Commercial System (ACS) deficiency over the accumulation of claims against a drawback bond (NFR No. CBP 09-04) Condition: ACS does not properly account for bond sufficiency of claims that involve a continuous bond. The automated control that prevents a claimant from exceeding the bond amount on file is not operating effectively.

As a result, CBP may not have sufficient surety against a drawback over claiming. Specifically, we noted eight drawback claims from our first half testwork and three from our third quarter testwork that did not have the correct bond liability accumulated amount. In one instance, we examined accelerated drawback claim number JF901076931 in the amount of $119,310; however, the ACS screen print function code (BNLI), which displays the estimated accumulated entry amounts by bond, showed $6,531. However, the accumulated entry amount in ACS should have been at least $119,310.

In addition, we noted that the “TIP” guidelines were written in 1998 and are not being communicated effectively to the Drawback ports for implementation. Recommendation: We recommend that CBP develop and implement an automated system to ensure that the drawback module properly accounts for bond sufficiency. While the system is in development, implement a manual check by the drawback specialist and technicians to query the bond on file related to the claim, and verify that there is a sufficient amount on the bond for the claimant to be paid. FMC 09-03 – Failure to complete supervisory review (NFR No. CBP 09-12) Condition: We performed testwork over the first three quarters of the current fiscal year related to drawback claims.

We noted that three out of 56 selected drawback claims were subject to a supervisory review; however, the supervisor did not initial and date the claim indicating his or her review/approval. Upon inquiry at the ports, the full desk review/supervisory review checklist was completed; however, the reviewer did not initial and date the claim. 2 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 Recommendation: We recommend that CBP reinforce its drawback guidelines at all levels to ensure that drawback claims are properly reviewed and there is evidence indicating the review. FMC 09-04 – Weaknesses in the monitoring, review, and oversight process over the completion of Fines, Penalties, and Forfeitures (FP&F) cases (NFR No. CBP 09-16) Condition: We noted during our initial walk-through and process meetings over FP&F that Headquarters is not fully conducting oversight over FP&F as indicated in the Seized Asset Management and Enforcement Procedures Handbook (SAMEPH).

A memorandum to the field was issued in February 2009 indicating that the F05 Report should be retained. However, we noted through our interviews at various ports that these ports are not aware of such guidance. We noted that during our initial walk-through as well as during our review of the Fourth Quarter Mission Action Plan (MAP) that the SAMEPH is in the process of being revised; however, such revisions have not been approved or issued, nor are the ports aware of the new guidance regarding the review, annotation, and retention of the F05 report. We completed testwork at ten ports with FP&F offices and noted numerous inconsistencies in both the types of reports used to monitor outstanding FP&F cases as well as the retention period of the reports used.

Recommendations: We recommend that CBP: 1. Immediately ensure that Field Offices and Ports are aware of the memorandum issued in February 2009 that requires the retention of the F05 Report. 2. Update the SAMEPH in a timely manner to include a single, standardized methodology for ascertaining the status of pending cases, including those cases for which immediate action is due.

CBP should consider the need for evidence of such review as well as retention of this documentation to prove adequate monitoring of the FP&F process. 3. Update the procedures at Headquarters in a timely manner to ensure the monitoring of FP&F cases to create accountability for FP&F Officers’ monitoring of outstanding FP&F cases. 4.

Update the procedures at Headquarters in a timely manner to ensure the monitoring of FP&F cases and to create accountability for FP&F Officer’s review of the F05 report. These procedures should include a standardized reporting mechanism for ports to follow to allow monitoring of FP&F cases at all levels (local ports, Field Offices, and Headquarters). FMC 09-05 – Weaknesses in the review of weekly/monthly entry exception/edit reports (NFR No. CBP 09-18) Condition: We statistically selected 11 ports at which to perform control testwork over the entry process. Based on the results of testwork performed at the ports, we noted the following instances of noncompliance with CBP Directive 5610-004A and Directive 5610-006: � At one port, we noted that the S21 report is run on a monthly basis rather than a weekly basis.

3 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 � � � At one Area Service Port responsible for ensuring that sub-ports complete a timely review of the S21 report, there was no such oversight or monitoring that the S21 was run or reviewed. We found a lack of segregation of duties at one port; the supervisory review of the S21 report could be conducted by the same person that performed the deletions. We found no evidence that the following reports were resolved according to the Directives: a. B06 Rejected/Canceled Entries report at four ports, including supervisory review b. B84 Budget Clearing Account report at two ports c. S21 Weekly Deletions report at one port. Recommendations: We recommend that CBP: 1.

Reinforce the importance of the requirements of CBP Directive 5610-004A through updated directives or other written communications and, if necessary, provide adequate training to ensure that the reports required are in fact being reviewed. Those reports consist of the B06, S21, and B84. 2. Reinforce the importance and the requirements of CBP Directive 5610-004A through updated directives or other written communications and, if necessary, provide adequate training to ensure that the reports requiring supervisory review (with evidence of signature or initial) are in fact being reviewed by a supervisor.

Those reports consist of the B06 and S21. 3. Consider expanding upon the current directives to require evidence (via signature or initial) of periodic supervisor review of the other reports that are required to be processed/reviewed. (Note: these are reports that are required to be reviewed by the CBP Directives noted in recommendation numbers 1 and 2; however, the current directives are silent as to the requirement of a supervisory review.) Those reports consist of B07 and B84 as well as the B08, “Late Report.” 4.

Implement new, or emphasize existing, policies and procedures through training or other written communications to ensure that the ports have proper segregation of duties over the cancellation and deletion of entries. 5. Develop and implement policies that stipulate the requirement of back-up personnel to process/review reports required by the directives noted in recommendation number 1. FMC 09-06 – Miscellaneous seized inventory findings (NFR No. CBP 09-28) Condition: We statistically selected nine seized property locations in which to observe the annual inventory and noted the following issues: � At one Office of Border Patrol (OBP) temporary storage facility, we inspected a page of the storage facility log and noted three instances between June 24, 2009 and July 3, 2009 where personnel accessed the storage facility without being accompanied by another CBP official.

4 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 � � � � At one Seized Inventory Vault, we noted that a Crystal Meth seizure was outside of the two percent weight deviation, but was not reported to the joint intake center per the inventory instructions. The vault reported the deviation subsequent to our inquiry. Upon receipt of the Certification memo from OBP over one sector, we noted that OBP reported multiple instances for which various OBP temporary storage facilities within the sector could not locate the seized property or a disposition of the property that was listed on the count sheet during the seized property inventory. Upon our inquiry, CBP stated that there were delays in updating SEACATS with the proper locations once items were transferred.

At one OBP temporary storage facility, three separate marijuana seizures were reweighed. These seizures were made subsequent to running the inventory count sheet, and were therefore required to be listed on the add-on sheet. Although the change in weight was noted on the CF-6051S form, it was not noted on the add-on sheet. Therefore, SEACATS was not correctly input with the new weight.

At one OBP temporary storage facility, there is no alarm system installed. Recommendations: We recommend that CBP OBP and OFO: 1. Ensure that OBP facilities follow the requirement that no fewer than two employees may enter the temporary storage facility at any time, and update the SAMEPH to reflect this requirement. 2.

Emphasize the importance of reporting tolerable weight differences identified during the inventory to all responsible parties, per the inventory instructions. 3. Ensure proper recordkeeping of seized property at all seized vaults, including OBP, to include timely updating of transfers in SEACATS. 4.

Emphasize the importance of completing the add-on sheet properly, with any changes in weight from the previous weight to the time of inventory properly reflected. 5. Ensure that alarm systems are properly installed at all temporary storage facilities to ensure safekeeping of seized and forfeited property. FMC 09-07 – Lack of formal policies over review of importer self-assessment (ISA) annual notification letters (NFR No. CBP 09-29) Condition: CBP has not formalized the requirements related to the review of the Annual Notification Letters.

We noted that checklists were completed for CBP’s review of Annual Notification Letters selected in our sample; however, there is no requirement or directive implementing the completion of this checklist as a formal procedure. We noted that, based on our inquiry and review of CBP’s MAP CBP-MAP-08-29, CBP is in the process of incorporating the review of an ISA annual notification review checklist into a Standard Operating Procedure or a desk review checklist, as appropriate. This checklist will be used to conclude on whether a company is eligible for continued participation in the ISA program. We noted that the elements described in CBP-MAP-08-29 were not implemented as of September 30, 2009.

5 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 Recommendations: We recommend that CBP issue internal guidance to formalize requirements for: 1. Completion of the Annual Notification Internal Review Checklist, to include review of the Annual Notification Letter and review of the participant’s risk to CBP based on information received from other CBP resources 2. Issuance of either a Continuation Letter or Removal Letter based on this review. FMC 09-08 – Lack of controls over capital leases (NFR No. CBP 09-35) Condition: During our walk-throughs over capital leases, we noted that there is no clear auditable documentation trail, such as a checklist, evidencing how CBP determines if a lease should be classified as capital or operating, considering the four capital lease criteria provided by SFFAS No. 6, Accounting for Property, Plant, and Equipment, and the six capital lease criteria provided by OMB Circular No. A-11, Preparation, Submission, and Execution of the Budget.

Recommendations: We recommend that CBP: 1. Develop policies and procedures for determining the proper classification of all leases as operating or capital at the inception of the lease. These procedures should include documentation evidencing that CBP considered the four criteria for capital leases as defined by SFFAS No. 6 and the six criteria for capital lease criteria provided by Circular No. A-11 such as a standardized checklist. Ensure that the documentation (i.e., standardized checklist) is completed by the appropriate office and reviewed by the appropriate personnel.

The documentation should also clearly identify which criteria the lease met (or failed to meet) that caused the lease to be classified as operating or capital. These procedures should also include periodic review of the lease classification when there are changes in the lease agreement or circumstances that warrant a reevaluation of the lease classification. 2. Conduct the necessary trainings for designated offices to ensure there is a clear understanding of how to accurately complete the checklist.

Training should insure that all criteria of the SFFAS No. 6 and OMB Circular No. A-11 are understood. Training should also be provided to all areas responsible for generating a lease/purchase request with emphasis placed on the importance of including all relevant information on the lease/purchase request so that the designated offices can easily complete the documentation/standardized checklist. FMC 09-09 – Lack of controls over the timely processing of goods and services received (NFR No. CBP 09-37) Condition: We noted that the Contract Officer’s Technical Representatives (COTR) and goods receivers do not consistently enter goods receipt and service entry sheets into the System Applications and Products in Data Processing (SAP) timely. As a result, at year end, CBP must estimate accounts payable for goods or services received, but not entered into SAP.

Although this estimation process is typically accurate, as evidenced by the search for unrecorded liabilities performed by CBP at the beginning of each fiscal year, we noted that CBP lacks controls over the process of recording the receiving of goods and services timely throughout the year. 6 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 CBP captures goods receipt/service entries not entered timely through the use of workflow messages and an on-demand SAP “parked invoice” report available to all receiving officials. However, these procedures are not performed until after the receipt of an invoice, which is typically after the receipt of goods or services. In addition, CBP does not have controls/review procedures to ensure that COTRs and goods receivers check workflow messages and resolve items on the “parked invoice” report.

Furthermore, we noted instances in which CBP disbursed payments outside of its normal process in SAP through wire transfers because the goods receipt/expense was not processed timely in SAP. These transfers are made outside of SAP as the system will not allow disbursements until it has performed a three-way match between obligation/purchase order, goods receipt, and invoice. We noted that these wire transfers are often not resolved timely (i.e., expense and disbursement formally recorded in SAP) if the input of the goods receipt or service entry sheet are delayed, which in some instances can take up to a year or more to resolve. In addition, we noted the monthly wire transfer accrual to properly record these disbursements made outside of SAP included unresolved wire transfers that were made as far back as FY 2005.

Recommendations: We recommend that CBP: 1. Reinforce the requirements of CBP Directive No. 5320-028C for a COTR or goods receiver to enter receiving information into SAP within five business days. 2. Update policies and procedures to include procedures for supervisors to review the entry of goods receipt and service entry sheets into SAP.

This review should include ensuring that they are entered timely; verifying the acquisition date input into SAP by comparing to the date the goods or services were actually received, as indicated by a signed packing slip, invoice detail, or other sources; and ensuring that goods receivers are checking workflow messages and resolving items on the “parked invoice” report. 3. Establish procedures for the timely expensing of wire transfer payments and document the procedures requiring communication with the relevant contracting officer and COTR, or relevant goods receiver to confirm goods or services have been received prior to initiating a wire transfer. FMC 09-10 – Weakness in CBP’s management review of contracts (NFR No. CBP 09-44) Condition: During our testwork over undelivered orders (UDOs) as of June 30, 2009, we noted that CBP was unable to provide authorized obligating documents for nine of the 239 items requested.

We noted that six of the nine obligating documents were initiated during FY 2009. Recommendation: We recommend that CBP develop a records tracking records-tracking system for files that are relocated or procedures to maintain soft copies of authorized documents to ensure that the files are maintained and readily available for review. 7 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 FMC 09-11 – Deficiencies in CBP’s controls over calculating the validity and collectability of non­ entity taxes, duties, and trade receivables, net (NFR No. CBP 09-45) Condition: While performing dual-purpose testwork over a sample of CBP’s collectability and validity (C&V) process, we noted the following: � The Office of Field Operations (OFO) and the National Finance Center (NFC) did not properly complete or review its procedures related to the C&V process as follows: a. Four fines and penalties (F&P) “Validity and Collectability Analysis Checklists” did not match checklist guidelines and supporting documentation; one of the four incorrectly calculated the gross receivable amount. b. Four F&P cases in CBP’s sample analyzed by the NFC through the “results summary” did not match the “Validity and Collectability Analysis Checklists” and/or supporting documentation. c. Four F&P “Validity and Collectability Analysis Checklists” were completed as of the date of checklist completion rather then as of quarter end. d. Ten F&P cases’ “Results and Analysis Spreadsheets,” which are used to calculate the the cases’ supporting validity and collectability percentages, did not match documentation and thus resulted in an incorrect validity and collectability calculation. For items a-c above, we noted through subsequent inquiry that NFC identified the correct amounts through its review and noted the corrections on the “Results and Analysis Spreadsheets.” � The sampling extrapolation was not correctly calculated for both the F&P and SDB “Results and Analysis Spreadsheets” in the second quarter.

Recommendations: We recommend that CBP management provide training and/or additional guidance through policies and procedures in order to: 1. Ensure OFO personnel are fully aware of the purpose and their responsibilities related to the C&V process for F&P. 2. Ensure the NFC performs and clearly documents its detailed review of the “C&V Analysis Checklists” and “Results and Analysis Spreadsheets”. 3.

Ensure the sampling extrapolation is properly calculated each quarter. 8 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 FMC 09-12 – Deficiencies in CBP’s controls over the application of benefits to C-TPAT partners (NFR No. CBP 09-46) Condition: While performing walk-throughs and testwork related to the Customs-Trade Partnership Against Terrorism (C-TPAT) program, we noted the following: � � When testing controls surrounding the application of C-TPAT benefits to importer partners in ACS at the National Targeting and Control Branch (NTCB), we noted that the reconciliation of changes in the C-TPAT importer partner benefits application only occurs on a quarterly basis. As a result of this time lag, a C-TPAT partner who has a downgrade in status immediately after the quarter-end could improperly receive security screening benefits for almost three months. However, we did note that in some situations (e.g., a partner with a major violation), headquarters informs NTCB immediately to remove or suspend benefits.

This mitigates some, but not all, of the risk. When testing controls surrounding the application of C-TPAT benefits to importer partners in Automated Targeting System (ATS), we noted that one C-TPAT partner, who should have received a higher level of benefits, based on the results of the in-person validation, did not receive such benefits, as the status in the Web portal was not properly updated. When we brought this to the attention of CBP, this error was immediately fixed. Recommendations: We recommend that: 1.

The C-TPAT program and the NTCB perform a reconciliation of C-TPAT benefits on at least a monthly basis to ensure that all removal or suspension of benefits are updated timely 2. The C-TPAT program continue to perform a regular review of C-TPAT partners’ status in the C-TPAT program, as reflected in the latest validation report against the benefits granted in ATS in order to identify and correct any errors in the application of benefits. FMC 09-13 – Weaknesses in accounting for imputed financing (NFR No. CBP 09-47) Condition: We noted the following errors in CBP’s calculation of imputed financing sources and imputed cost: � When calculating the Office of Personnel Management (OPM) imputed pension and other retirement benefits cost based on contribution and cost factors established by OPM, we noted that CBP only recognized 25 percent of the total imputed costs for several employee classes within the calculation. This occurred as CBP accounted for the imputed cost as total OPM service cost less employee and agency contribution for which CBP then multiplied the sum by 25 percent.

CBP should have calculated the imputed costs by taking the total OPM service cost less employee and agency contribution only. As a result, CBP understated Imputed Financing (5780) and Imputed Costs (6730). 9 Department of Homeland Security U.S. Customs and Border Protection Financial Management Comments September 30, 2009 � We noted two calculation errors in which CBP did not appropriately account for a repeating imputed financing source. Specifically, CBP only accounted for one month of activity for an activity occurring throughout the year and only accounting for one of five salaries that were imputed financing sources to CBP.

As a result, CBP understated Imputed Financing (SGL 5780) and Imputed Costs (SGL 6730). Recommendation: We recommend that CBP develop policies and procedures to ensure that the imputed financing sources calculation and related journal entry are thoroughly reviewed for accuracy prior to being recorded in the financial statements. 10 U.S. Customs and Border Protection Crosswalk – Financial Management Comments to Active NFRs September 30, 2009 Appendix A Disposition* Independent Auditors’ Report Non- Significant Compliance Deficiency Material Weakness FMC Page No. Component CBP CBP CBP NFR No. 09-01 Description Verification of CPL and weaknesses in the certification of payments 09-02 Detection of excessive drawback claims 09-03 Insufficient retention period for documents that support drawback claims Automated Commercial System deficiency over the accumulation of claims against a drawback bond CBP 09-04 C C CBP 09-05 Deficiencies in the in-bond process E CBP 09-06 System integration and compliance with the USSGL at the transaction level CBP 09-07 ACS deficiencies over non-entity accounts receivable and CBP’s ability to effectively monitor collection actions CBP 09-08 ACS Limitations – Review of prior related drawback claims and selectivity for underlying consumption entries C CBP CBP CBP CBP CBP CBP 09-09 Number not used 09-10 Number not used 09-11 Number not used 09-12 Failure to complete supervisory review 09-13 Number not used 09-14 Number not used Not applicable Not applicable Not applicable Not applicable Not applicable Compliance determined at Department level Compliance determined at Department level CBP 09-15 CBP 09-16 CBP 09-17 09-18 Weaknesses identified in the bonded warehouse and foreign trade zone processes and procedures Weaknesses in the monitoring, review, and oversight process over the completion of Fines Penalties, and Forfeitures cases Inadequate oversight of Entry Summary Compliance Measurement Weaknesses in the review of weekly/monthly entry edit reports CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP 09-19 Number not used 09-20 Number not used 09-21 Number not used 09-22 Number not used 09-23 09-24 Untimely deobligation of inactive obligations Improper Settlement of Assets, including untimely capitalization of assets from CIP 09-25 Number not used 09-26 Number not used 09-27 Number not used Not applicable Not applicable Not applicable Not applicable B Not applicable Not applicable Not applicable 11 E E D 2 09-01 2 09-02 2-3 09-03 3 09-04 3-4 09-05 Appendix A FMC Page No. 4-5 09-06 5-6 09-07 6 09-08 6-7 09-09 8 09-10 8-9 09-11 9 09-12 9-10 09-13 U.S. Customs and Border Protection Crosswalk – Financial Management Comments to Active NFRs September 30, 2009 Component CBP NFR No. 09-28 Miscellaneous seized inventory findings Description Disposition* Independent Auditors’ Report Non- Significant Compliance Deficiency Material Weakness CBP CBP CBP CBP CBP CBP CBP CBP 09-29 Lack of formal policies over review of importer self-assessment annual notification letters Weaknesses in CBP’s processes related to asset additions 09-30 09-31 Number not used 09-32 Number not used 09-33 Weaknesses in recording FM&E TI CIP 09-34 Misstatement of the 3/31/09 SBI CIP 09-35 Controls over capital leases 09-36 CBP 09-37 CBP 09-38 CBP 09-39 CBP 09-40 CBP 09-41 CBP 09-42 CBP 09-43 CBP 09-44 CBP 09-45 CBP 09-46 CBP 09-47 Misstatement of the 3/31/09 inventory and related property, net Lack of controls over the timely processing of goods and services received Weakness in CBP’s management review of the financial statements Weaknesses in CBP’s assessment and identification of new/relevant financial reporting issues Management oversight of property, plant, and equipment Findings related to accounting for the SBInet program Weaknesses in CBP’s process related to asset disposals Weaknesses is CBP’s classification of PP&E related transactions Weakness in CBP’s management review of contracts Deficiencies in CBP's controls over calculating the validity and collectability of non-entity taxes, duties, and trade receivables, net Deficiencies in CBP’s controls over the application of benefits to C-TPAT partners Weaknesses in accounting for imputed financing B Not applicable Not applicable B B B A A,B B B B B *Disposition Legend: FMC Financial Management Comment The following links to the applicable sections of the Independent Auditors’ Report: A B C D E F Financial Reporting Property, Plant, and Equipment Drawback of Duties, Taxes, and Fees Inactive Obligations Entry Process Information Technology 12 U.S. Customs and Border Protection Status of Prior Year Findings September 30, 2009 Appendix B Description Closed Repeat (09 NFR No.) Disposition NFR No. 08-01 Component CBP CBP CBP CBP CBP CBP CBP 08-07 Verification of CPL and weaknesses in the certification of payments 08-02 Detection of excessive drawback claims 08-03 08-04 Insufficient retention period for documents that support drawback claims ACS deficiency over the accumulation of claims against a drawback bond 08-05 Deficiencies in the in-bond process 08-06 08-08 System integration and compliance with the USSGL at the transaction level ACS deficiencies over non-entity accounts receivable and CBP’s ability to effectively monitor collection actions ACS limitations – review of prior related drawback claims and selectivity for underlying consumption entries CBP CBP CBP CBP CBP CBP CBP CBP 08-09 Number not used 08-10 Weaknesses in the management of environmental liabilities 08-11 Overpayment of drawback claim due to deem liquidation Not applicable X X 08-12 Failure to perform a full desk review/supervisory review CBP-09-12 08-13 Number not used 08-14 Number not used Not applicable Not applicable 08-15 Weaknesses identified in the bonded warehouse and foreign trade zone process and procedures Weaknesses in the requirements related to the monitoring, review, and oversight relating to the efficiency of completion of FP&F cases CBP 08-16 CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP CBP 08-17 Weaknesses in the compliance measurement program 08-18 Weaknesses in the review of weekly/monthly entry edit reports 08-19 Number not used 08-20 Number not used 08-21 Number not used 08-22 Number not used Not applicable Not applicable Not applicable Not applicable 08-23 Untimely deobligation of inactive obligations 08-24 Untimely capitalization of assets from CIP 08-25 Untimely recognition in SAP of assets received for SBI fence construction 08-26 Weaknesses related to the collections and deposits process 08-27 Weaknesses in controls over aircraft parts inventory 08-28 Miscellaneous seized inventory findings 08-29 Lack of review of importer self-assessment annual notification letters 08-30 Weaknesses in CBP’s processes related to asset additions 08-31 Misstatement of actuarial FECA liability 08-32 Misstatement of 9/30/08 leave accrual 08-33 Weaknesses in recording CIP X X X X X 13 CBP-09-01 CBP-09-02 CBP-09-03 CBP-09-04 CBP-09-05 CBP-09-06 CBP-09-07 CBP-09-08 CBP-09-15 CBP-09-16 CBP-09-17 CBP-09-18 CBP-09-23 CBP-09-24 CBP-09-28 CBP-09-29 CBP-09-30 CBP-09-33 U.S. Customs and Border Protection Management Response to the Draft Management Letter September 30, 2009 Appendix C 1300 Penllsylvilli.l. A~IlU" NW Wumllgtoll. DC 20229 u.s. Customs md Border Protection FEB 05 2010 MEMORANDUM FOR: Inspector General Department of Homeland Security FROM: SUBJECT: Eugene H. Schied Chief Financial Officer U.S. Customs and Border Protection Management Response to Management Letter Report on U.s. Customs and Border Protection's Fiscal Year 2009 Consolidated Financial Statements On behalf of U.S. Customs and Border Protection (CBP), I am responding to the draft report entitled, "Management Leiter for us Customs and Border Protection's Fiscal Year 1009 Consolidated Financial Statements." We have reviewed and eoncUJTed with all weaknesses contained in the draft report.

Mission Action Plans (MAPs) outlining CBP's strategy to correct the conditions we concurred with in the draft report will be prepared and provided to KPMG. CBP will continue to work to resolve all auditor identified weaknesses. CBP appreciates the opportunity to review this year's report and looks forward to continuing our professional auditing relationship with your office. If you have any questions or would like additional information, please contact me at (202) 344-2300, or a member of your staff may contact Marl Boyd, Executive Director, Financial Operations, at (202) 344-2364. ~~ Eugene H. Schied Anaclunenls 14 Appendix A Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff for Operations Chief of Staff for Policy Deputy Chiefs of Staff General Counsel Executive Secretariat Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Chief Financial Officer Chief Information Officer Customs and Border Protection Commissioner Chief Financial Officer Chief Information Officer Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees, as appropriate ADDITIONAL INFORMATION AND COPIES To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig.

OIG HOTLINE

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal misconduct relative to department programs or operations: • Call our Hotline at 1-800-323-8603; • Fax the complaint directly to us at (202) 254-4292; • Email us at [email protected]; or • Write to us at: DHS Office of Inspector General/MAIL STOP 2600, Attention: Office of Investigations - Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528. The OIG seeks to protect the identity of each writer and caller.