DHS OIG, OIG-10-62, Management Letter for U.S. Citizenship and Immigration Services' FY 2009 Consolidated Balance Sheet (2010)

Department of Homeland Security Office of Inspector General Management Letter for U.S. Citizenship and Immigration Services' FY 2009 Consolidated Balance Sheet OIG-10-62 March 2010 Office ofInspector General U.S. Department of Homeland Security Washington, DC 20528 Homeland Security MAR - 4 2010 Preface The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General Act of1978. This is one of a series of audit, inspection, and special reports prepared as part of our oversight responsibilities to promote economy, efficiency, and effectiveness within the department. This report presents the managenient letter for U.S. Citizenship and Immigration Services' (USCIS) fiscal year (FY) 2009 consolidated balance sheet audit. It contains observations and recommendations related to internal controls that did not reach the level required to be reported in the balance sheet report.

Other internal control weaknesses which are considered significant deficiencies were reported, as required, in KPMG LLP's (KPMG) Independent Auditors' Report, dated January 15,2010. KPMG performed the audit and is responsible for this management letter and the conclusions expressed in it. We do not express opinions on USCIS' consolidated balance sheet or provide conclusions on compliance with laws and regulations. The recommendations herein have been discussed in draft with those responsible for implementation.

We trust this report will result in more effective, efficient, and economical operations. We express our appreciation to all of those who contributed to the preparation of this report. ~~~.~ Richard L. Skinner Inspector General KPMG LLP 2001 M Street, NW Washington, DC 20036 January 15, 2010 Office of Inspector General and Chief Financial Officer, U.S. Citizenship and Immigration Services U.S. Department of Homeland Security Ladies and Gentlemen: We have audited the balance sheet of the U.S. Department of Homeland Security, U.S. Citizenship and Immigration Services (USCIS) as of September 30, 2009, and have issued our report thereon dated January 15, 2010. In planning and performing our audit of the balance sheet of USCIS, in accordance with auditing standards generally accepted in the United States of America, we considered USCIS’ internal control over financial reporting (internal control) as a basis for designing our auditing procedures for the purpose of expressing our opinion on the balance sheet but not for the purpose of expressing an opinion on the effectiveness of USCIS’ internal control. Accordingly, we do not express an opinion on the effectiveness of USCIS’ internal control.

During our audit we noted certain matters involving internal control and other operational matters summarized in the Table of Financial Management Comments and presented herein for your consideration. These comments and recommendations, all of which have been discussed with the appropriate members of management, are intended to improve internal control or result in other operating efficiencies. These comments are in addition to the significant deficiencies presented in our Independent Auditors’ Report, dated January 15, 2010, included in the FY 2009 USCIS Annual Financial Report. A description of each internal control finding and its disposition as either a significant deficiency or a financial management comment is provided in Appendix A. The status of our prior year findings and recommendations are provided in Appendix B. Our findings related to information technology functionality and systems security have been presented in a separate letter to the Office of Inspector General and the USCIS Chief Information Officer.

USCIS’ response to the findings identified is presented in Appendix C, and we have taken consideration of their three noted exceptions. We did not audit USCIS’ response, and accordingly, we express no opinion on it. Our audit procedures are designed primarily to enable us to form an opinion on the balance sheet, and therefore may not bring to light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge of USCIS’ organization gained during our work to make comments and suggestions that we hope will be useful to you.

We would be pleased to discuss these comments and recommendations with you at any time. This report is intended for the information and use of USCIS management, the Office of Inspector General, the U.S. Office of Management and Budget, the U.S. Congress, and the Government Accountability Office, and is not intended to be and should not be used by anyone other than these specified parties. Very truly yours, KPMG LLP, a U.S. limited liability partnership, is the U.S. member firm of KPMG International, a Swiss cooperative. U.S. Citizenship and Immigration Services Table of Financial Management Comments September 30, 2009 TABLE OF FINANCIAL MANAGEMENT COMMENTS (FMC) U.S. Citizenship and Immigration Services (USCIS) Page USCIS 09-01 Accrued Leave Discrepancies USCIS 09-02 Inadequate and/or Inconsistent Supervisor Review of Payroll Transactions USCIS 09-03 Noncompliance with OMB Guidance Regarding TSP Deduction Forms USCIS 09-04 Inadequate and/or Inconsistent Supervisory Review of Personnel Actions USCIS 09-05 Undelivered Orders USCIS 09-06 Insufficient Support for the Determination of Parking Withholdings APPENDIX Appendix Subject A B C Crosswalk – Financial Management Comments to Active Notice of Findings and Recommendations (NFRs) Status of Prior Year NFRs Management Response 3 3 4 4 5 5 Page 7 9 10 2 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2009 USCIS FMC-09-01 (NFR No. USCIS 09-07) – Accrued Leave Discrepancies USCIS has improved its payroll process in FY 2009.

However, we identified discrepancies in accrued leave / sick leave balances between National Finance Center (NFC) records and USCIS’ System Time and Attendance Reporting system, or ‘STAR WEB.’ Specifically, we observed 5 instances of 45 tested where the annual leave hours reported by NFC did not agree to the annual leave hours recorded in STAR WEB; and 1 instance of 45 tested where the sick leave hours reported by NFC did not agree to the sick leave hours recorded in STAR WEB. These errors remained outstanding for greater than five pay periods indicating that the differences do not appear to have been researched and resolved in a timely manner. The untimely and/or lack of effective leave audits has the potential to result in a misstatement of an employee’s leave balance. A misstatement of an employee’s leave balance at the end of the fiscal year could result in the misstatement of the liability recorded by USCIS for accrued annual leave.

This also has an effect of misstating the accrued payroll and benefits balance that appears on the USCIS balance sheet. Recommendations: We recommend that the timekeepers: 1. Adhere to existing policy and procedures by performing leave audits when discrepancies are reported by NFC and research and resolve the differences in a timely manner. We recommend that the Office of Human Resources: 2.

Reiterate to all timekeepers the existence of the procedures outlined in the Leave Audit Procedures and re-emphasize the importance of properly adhering to policies and procedures; and 3. Develop and implement controls to monitor the execution of its policies and procedures, particularly related to leave audits, to ensure that they are being carried out appropriately. USCIS FMC-09-02 (NFR No. USCIS 09-14) – Inadequate and/or inconsistent supervisor review of payroll transactions We determined that there was inadequate and/or inconsistent supervisor review of payroll transactions during the fiscal year under audit. Specifically, we observed: 1.

5 instances of 45 tested in which overtime hours were recorded on the timesheet; however, no overtime authorization forms were evident; 2. 1 instance of 45 tested where a timesheet was submitted; however, no supervisor approval was evident; and 3. 1 instance of 45 tested with a significant delay in supervisor approval. The employee timesheet was for pay period 23-2008 (the period ending November 24, 2008); however, the supervisor approval was made on June 30, 2009.

This supervisor approval appears to coincide with the time KPMG made the request for this item. The inadequate / ineffective review over the time and attendance process can result in the transmittal of incorrect payroll information. It also may enable an employee to intentionally or inadvertently falsify timesheet information. Further, this also has an effect of potentially misstating the accrued payroll and benefits balance that appears on the balance sheet.

Recommendation: We recommend that the timekeepers and supervisors validate the data reported in the time and attendance system by ensuring that the hours reported by the employee are accurate. The FY 2010 deployment of the 3 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2009 WebTA system as an electronic means of monitoring this process may serve to enhance the internal control environment. USCIS FMC-09-03 (NFR No. USCIS 09-18) – Noncompliance with OMB Guidance regarding TSP Deduction Forms During our testwork over Human Resources processes, we haphazardly selected a sample of 45 employees receiving payroll checks in pay periods from October 1, 2008 – May 31, 2009. For each employee / pay period selected, we obtained the Thrift Savings Plan (TSP) election form (TSP-1) and documented the contribution elected by the employee.

We compared the contribution election with the PQ-56 screen in the National Finance Center (NFC) database. We identified two instances where employee TSP elections were made, but adequate supporting documentation of the election was not maintained in the employees’ personnel folder. The inability to update and maintain personnel records properly could lead to non-compliance of applicable guidance provided by OPM over the maintenance of payroll records. Recommendation: We recommend that USCIS adequately review manually-entered TSP forms to ensure data accuracy and adhere to the requirements of the Code of Federal Regulations, Title 5, Parts 293.103 and 293.306.

USCIS FMC-09-04 (NFR No. USCIS 09-20) – Inadequate and/or Inconsistent Supervisory Review of Personnel Actions During our testwork over Human Resources processes, we obtained a listing of USCIS employees hired between October 1, 2008, and May 31, 2009 and haphazardly selected a sample of 45 employees. In order to test the operating effectiveness of the internal controls over the authorization of the personnel action forms, we obtained the respective SF-52 and SF-50 forms. Specifically, we identified: 1. 27 instances of 45 tested where there was no sign-off on the SF-52 by the authorizing official evidencing that a USCIS employee properly reviewed the SF-52 and checked to see that sufficient funding was available for the position.

2. 2 instances of 45 tested where the SF-52 form was routed to Payroll without final approval from the HR Specialist. There was no approval on the SF-52 by the appropriate HR Specialist authorizing Payroll to commence the hiring process. According to USCIS policy, the SF-52 form should be electronically signed by the HR Assistant (processor) and subsequently signed by the HR Specialist (reviewer) for final approval.

In these instances (sample items #39 and #44) the HR Assistant provided the final approval instead of the HR Specialist, thereby violating proper segregation of duties. 3. 6 instances of 45 tested where the SF-52 was not properly coded. A lack of funding approval could cause USCIS to exceed its budget for new hires and/or Full Time Equivalents (FTEs).

The budgeted amount for hiring is awarded each fiscal year. Inadequate supervisory review over the processing of SF-52s could result in the transmittal of inaccurate payroll information processed by the NFC. This also has an effect of misstating the accrued payroll and benefits balance on USCIS’ balance sheet. 4 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2009 Recommendations: We recommend that the USCIS Human Resources Department: 1.

Consider implementing a management review process to include evidence of signed authorization from authorizing and funding officials on each SF-52; 2. Ensure that there is adequate staff to implement a management review process inclusive of funding approval; 3. Adhere to the current Standard Operating Procedure (SOP) for the processing of SF-52s; and 4. Consider including policy and procedures in the updated SOP for obtaining the necessary OPF/eOPF documentation from a new employee’s previous agency in a timely manner.

USCIS FMC-09-05 (NFR No. USCIS 09-21) – Undelivered Orders During our substantive testing over USCIS aged undelivered order balances as of April 30, 2009, we identified 3 out of 11 UDO samples totalling $4.4 million, with no activity within the previous 12 months, that were not de-obligated as of April 30, 2009 in accordance with established policies and procedures. As such, USCIS personnel are not adequately following the UDO Verification & Validation (V&V) review process for detecting and correcting inactive UDO balances timely. The inability to de-obligate inactive UDO balances timely will overstate UDO balances, and simultaneously make them unavailable for other purposes. Recommendation: We recommend USCIS ensure personnel are adequately following the V&V review process, including procedures to ensure invalid UDOs are de-obligated timely.

USCIS FMC-09-06 (NFR No. USCIS 09-22) – Insufficient Support for the Determination of Parking Withholdings During the FY2009 financial statement audit, we performed testing over sensitive payments/executive perquisites following the guidance of the Government Accountability Office (GAO) Financial Audit Manual, Section 280.05. The scope of our analysis covered the executive perquisites made to the Senior Executive Service (SES) employees of DHS USCIS for the year ended September 30, 2009, specifically parking privileges. We made inquiries of USCIS management, including officials in the Office of the General Counsel, the Office of Administration, and the Office of Asset Management. As a result of our inquiries, we identified the following conditions: 1.

The policy and procedures for controlled parking are only applicable to the 111 Massachusetts Ave NW and 20 Massachusetts Ave NW headquarters parking facilities. There appears to be no formal policy regarding the consideration of parking privileges at the other USCIS locations. 2. The Office of Administration prepared documentation supporting the FY 2009 annual parking costs at six USCIS buildings within the Washington, DC metropolitan area.

Based on the delinquency in returning the KPMG request for this documentation, we believe this analysis may have been prepared only after our request. 3. Lack of consideration and documentation of which (if any) employee parking provided by USCIS as a fringe benefit is within IRS statutory limitations. The exceptions noted above are most likely caused by USCIS management not performing and documenting a complete and thorough analysis of parking privileges throughout the entity.

As a result of the conditions noted above, USCIS may be failing to notify those employees who receive employer­ 5 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2009 provided parking benefit in excess the IRS thresholds, which may lead to noncompliance with the IRS Code. Recommendations: We recommend that USCIS: 1. Analyze the lease agreements and occupancy agreements for all USCIS facilities/locations to determine which USCIS offices have parking privileges provided as a fringe benefit that could potentially be taxable to those receiving the benefit. 2.

Determine which offices have parking that is in excess of the IRS thresholds, and where necessary, notify the affected employees. 6 U.S. Citizenship and Immigration Services Crosswalk – Financial Management Comments to Active Notice of Findings and Recommendations (NFRs) September 30, 2009 Appendix A Component NFR No. Description USCIS 09-01 Number not used USCIS 09-02 Number not used USCIS 09-03 Number not used Disposition1 IAR FMC MW SD NC No. Not applicable Not applicable Not applicable USCIS 09-04 Untimely update of adjudication status within CLAIMS 3 and CLAIMS 4 USCIS 09-05 Applications included in deferred revenue at incorrect fee amounts USCIS 09-06 Obligations are not being recorded in FFMS in a timely manner C C D USCIS 09-07 Discrepancies with the leave balance between the NFC records and STAR reports are not being researched and resolved timely 09-01 USCIS 09-08 Number not used USCIS 09-09 Number not used USCIS 09-10 Number not used USCIS 09-11 Number not used Not applicable Not applicable Not applicable Not applicable USCIS 09-12 Inadequate internal controls over the reporting of fixed assets B USCIS 09-13 Deficiencies in the Deferred Revenue Quality Assurance Process and the internal control environment C USCIS 09-14 Inadequate and/or inconsistent supervisor review of payroll transactions 09-02 USCIS 09-15 Number not used Not applicable 7 U.S. Citizenship and Immigration Services Crosswalk – Financial Management Comments to Active Notice of Findings and Recommendations (NFRs) September 30, 2009 Appendix A Component NFR No. Description Disposition1 IAR FMC MW SD NC No. USCIS 09-16 Issues involving the completeness and existence of equipment, and inconsistent asset tagging (based on initial site visits) B USCIS 09-17 USCIS is improperly including EOIR / ‘Relief from Deportation’ Applications in the Deferred Revenue query results. USCIS 09-18 Compliance with OMB Guidance regarding TSP deduction forms USCIS 09-19 Accounts Payable Transactions are not Being Recorded in FFMS USCIS 09-20 Inadequate and/or inconsistent supervisory review of personnel actions USCIS 09-21 Aged Obligations are not timely reviewed to ensure the validity and accuracy of the UDO balance. USCIS 09-22 Insufficient support for the determination of parking withholdings (compliance) C D 09-03 09-04 09-05 09-06 USCIS 09-23 Disbursements are being charged to an improper sub-object code D 1Disposition Legend: IAR Independent Auditors’ Report FMC Financial Management Comment MW Material Weakness as reported in the IAR SD Significant Deficiency as reported in the IAR NC Noncompliance with laws, regulations, contracts, and grant agreements as reported in the IAR Information Technology General and Application Controls The following links to the applicable sections of the IAR: A B General Property, Plant, and Equipment C Deferred Revenue D Accounts Payable 8 U.S. Citizenship and Immigration Services Status of Prior Year NFRs September 30, 2009 Appendix B Component NFR No. Description Disposition Closed Repeat (FY 09 NFR No.) � � USCIS 08-02 Fee receipts are not being deposited in a timely manner per Treasury Guidance at USCIS Service Centers USCIS 08-03 RNACS improperly reflects completed naturalization applications as pending USCIS 08-04 Untimely update of adjudication status within CLAIMS 3 and CLAIMS 4 USCIS 08-05 Applications included in deferred revenue at incorrect fee amounts USCIS 08-06 Obligations are not being recorded in FFMS in a timely manner USCIS 08-07 Discrepancies with the leave balances between the NFC records and STAR reports are not being researched and resolved timely USCIS 08-11 Ineffective deferred revenue quality assurance procedures at the NYC District Office � USCIS 08-12 Inadequate internal controls over the reporting of fixed assets USCIS 08-13 Deficiencies in the Deferred Revenue Quality Assurance Process and the Internal Control Environment USCIS 08-14 Inadequate and/or inconsistent supervisor review of payroll transactions USCIS 08-15 Insufficient documented evidence of Senior Executive Service (SES) employees’ compliance with the Code of Federal Regulations � 09-04 09-05 09-06 09-07 09-12 09-13 09-14 9 U.S. Citizenship and Immigration Services Management Response September 30, 2009 Appendix C U.S. Dcp~rtmcnl ortlomclll.nd Security U.S. Citizenship and ImmigratiOll Services OjJict· /lilhe ellief Fiurillciul OjJkrr Washington.

DC 20529-2130 u.s. Citizenship and Irnmigrauon Services Febnlary 24. 20 I0 Memorandum TO: FROM: Anne L. Richard Assistant Inspector General for Audits U.S. Department of Homeland Security TimothyA. Rosado~/ ~ U.S. Citizenship ~rZ;Services Acting Chief Financial Officer SUBJECT: Management Response to Management Letter for U.S. Citizenship and Immigration Services' Fiscal Year 2009 Consolidated Balance Sheet. We would like to thank you for the opportunity to review and comment on the Management Letter report on U.S. Citizenship and Immigration Service' Fiscal Year 2009 Consolidated Balance Sheet.

USC IS requests that your Office make the following changes to the Indepcndcnt Auditor's Managemcnt Letter report. Except for the items noted below, USCIS agrees and accepts all the findings, comments and conclusions the independent auditors expressed in the Management Letter report. I. Page 3 - delete the reference to USCIS FMC-09-01 (NFR No. USCIS 09-02 - Cash Management); there is no such NFR issued. 2.

Page 5 - change tille orUSCIS FMC-09-07 (NFR No. USCIS 09-22) - "Execlitive Perquisites" to correctly reflect that the finding applies to all USCIS employee that receive a parking bencfit and not just cxecutives. The current NFR title "'nsufficient Support for the Determination of Parking WithhoJdings" accurately describes the condition. www.llscis.goY 10 U.S. Citizenship and Immigration Services Management Response September 30, 2009 Appendix C Management Response to Management Letter Report for USCIS's FY 2009 Consolidated Balance Sheet Page 2 3. Page 11 • Corrections to Report Distribution: Change Title - Assistant Secretary to Director; Change Title - Chicf Financial Officer to Acting Chief Financial Officer; Delete Title - Chieflnfonnation Officer; and Add Title - Associate Director, Management Directorate. USCIS is committed to resolving all control deficiencies and weaknesses identified in the audit and have prepared Mission Action Plans to resolve and improve our internal controls for the reporting of USCIS financial information.

USCIS appreciates the cooperation and respect that your staff provided during the course of the audit and looks forward to continuing our slrong working relationship with your office. If you have any questions regarding our comments, please contact Charles "Bucky" Tretler, Chief, Financial Management Division at (202)272-1960. 11 Appendix A Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff for Operations Chief of Staff for Policy Deputy Chiefs of Staff General Counsel Executive Secretariat Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Chief Financial Officer Chief Information Officer U.S. Citizenship and Immigration Services Director Associate Director, Management Directorate Acting Chief Financial Officer Chief Information Officer Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees, as appropriate ADDITIONAL INFORMATION AND COPIES To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig.

OIG HOTLINE

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal misconduct relative to department programs or operations: • Call our Hotline at 1-800-323-8603; • Fax the complaint directly to us at (202) 254-4292; • Email us at [email protected]; or • Write to us at: DHS Office of Inspector General/MAIL STOP 2600, Attention: Office of Investigations - Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528. The OIG seeks to protect the identity of each writer and caller.