DHS OIG, OIG-14-71, U.S. Citizenship and Immigration Services’ Management Letter for FY 2013 DHS Financial Statements Audit (2014)

Department of Homeland Security �������������������������� U.S. Citizenship and Immigration Services’ Management Letter for FY 2013 DHS Financial Statements Audit OIG-14-71 April 2014 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov APR 21 2014 Joseph Moore Chief Financial Officer U.S. Citizenship and Immigration Services Anne L. Richards Assistant Inspector General for Audits U.S. Citizenship and Immigration Services’ Management Letter for FY 2013 DHS Financial Statements Audit MEMORANDUM FOR: FROM: SUBJECT: Attached for your information is our final report, U.S. Citizenship and Immigration Services’ Management Letter for FY 2013 DHS Financial Statements Audit. This report contains four comments and six recommendations related to internal control deficiencies that were not required to be reported in the Independent Auditors’ Report on DHS’ FY 2013 Financial Statements and Internal Control over Financial Reporting. Internal control deficiencies which are considered significant deficiencies were reported, as required, in the Independent Auditors’ Report, dated December 11, 2013, which was included in the Department of Homeland Security’s (DHS) fiscal year (FY) 2013 Agency Financial Report. We do not require management’s response to the recommendations.

We contracted with the independent public accounting firm KPMG LLP (KPMG) to conduct the audit of the DHS’ FY 2013 financial statements and internal control over financial reporting. The contract required that KPMG perform its audit according to generally accepted government auditing standards and guidance from the Office of Management and Budget and the Government Accountability Office. KPMG is responsible for the attached management letter dated January 15, 2014, and the conclusions expressed in it. Please call me with any questions, or your staff may contact Mark Bell, Deputy Assistant Inspector General for Audits, at (202) 254-4100.

Attachment KPMG LLP Suite 12000 1801 K Street, NW Washington, DC 20006 January 15, 2014 Office of Inspector General U.S. Department of Homeland Security, and Chief Financial Officer U.S. Department of Homeland Security, U.S. Citizenship and Immigration Services Washington, DC Ladies and Gentlemen: We have audited the financial statements of the U.S. Department of Homeland Security (DHS or Department) for the year ended September 30, 2013 (referred to herein as the “fiscal year (FY) 2013 financial statements”), and have issued our report thereon dated December 11, 2013. In planning and performing our audit of the financial statements of DHS, in accordance with auditing standards generally accepted in the United States of America and Government Auditing Standards, we considered internal control over financial reporting (internal control) as a basis for designing our auditing procedures for the purpose of expressing our opinion on the financial statements. In conjunction with our audit of the financial statements, we also performed an audit of internal control over financial reporting in accordance with attestation standards established by the American Institute of Certified Public Accountants. The U.S. Citizenship and Immigration Services (USCIS) is a component of DHS.

During our audit, we noted certain matters involving internal control and other operational matters, related to USCIS, that are presented for your consideration. These comments and recommendations, all of which have been discussed with the appropriate members of management, are intended to improve internal control or result in other operating efficiencies. These matters are summarized in the Table of Financial Management Comments on the following pages. The disposition of each internal control deficiency identified during our FY 2013 audit – as either reported in our Independent Auditors’ Report, or herein – is presented in Appendix A. Our findings related to information technology systems have been presented in a separate letter to the DHS Office of Inspector General, the USCIS Chief Information Officer, and Chief Financial Officer.

Our audit procedures are designed primarily to enable us to form an opinion on the financial statements and on the effectiveness of internal control over financial reporting, and therefore may not bring to light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge of USCIS’s organization gained during our work to make comments and suggestions that we hope will be useful to you. We would be pleased to discuss these comments and recommendations with you at any time. The purpose of this letter is solely to describe comments and recommendations intended to improve internal control or result in other operating efficiencies.

Accordingly, this letter is not suitable for any other purpose. Very truly yours, KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative (“KPMG International”), a Swiss entity. U.S. Citizenship and Immigration Services Table of Financial Management Comments September 30, 2013 TABLE OF FINANCIAL MANAGEMENT COMMENTS (FMC) Comment Reference Subject Page FMC 13-01 FMC 13-02 FMC 13-03 FMC 13-04 Deficiencies in the Public and Confidential Financial Disclosure Reporting Process Deficiencies in the Recording, Classification, and Useful Life of Internal Use Software Inadequate Preparation and Review of the Transaction by Elimination Pairs Report Insufficient Review of Journal Entries 2 2 3 3 APPENDIX Appendix Subject A Crosswalk – Financial Management Comments to Active Notices of Finding and Recommendation (NFRs) Page 4 1 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2013 FMC 13-01 – Deficiencies in the Public and Confidential Financial Disclosure Reporting Process (Notice of Finding and Recommendation (NFR) No. U.S. Citizenship and Immigration Services (USCIS) 13-01) During testwork over Office of Government Ethics (OGE) Form 450, we noted that USCIS did not obtain and review 247 of the 791 required OGE reports by the February 15, 2013 deadline. During testwork over OGE Form 278, we noted that one report was not reviewed and certified by the Ethics Officer within 60 days of filing.

Recommendation: We recommend that USCIS make any necessary enhancements to systems and processes to ensure timely notification to and submission by employees of OGE Forms 450 and 278, and submitted forms are reviewed by the Ethics Office in a timely manner. FMC 13-02 – Deficiencies in the Recording, Classification, and Useful Life of Internal Use Software (NFR No. USCIS 13-02) USCIS was unable to provide a complete general ledger detail for internal use software (IUS) costs as of June 30, 2013, for substantive testing. We noted that the Financial Management Division (FMD) performed an analysis of the IUS balance as of July 31, 2013, and posted adjustments related to prior year activity, resulting in a net upward adjustment of $6.4 million and a net downward adjustment of $0.3 million. We performed testwork over additions to the IUS balance as of June 30, 2013 and noted the following errors: • USCIS did not reclassify $14.1 million from Software in Development (United States Standard General Ledger (USSGL) account 1832) to Internal Use Software (USSGL account 1830) timely for one project.

USCIS also did not update the useful life for that project in a timely manner. We noted that although management identified that the project’s useful life was changed, the useful life in the accounting records was not updated to reflect this change timely. • USCIS incorrectly reclassified capital costs of $722,000 from USSGL account 1830 to USSGL account 1832 for another project, resulting in a $182,000 understatement of amortization expense. We performed testwork over additions to the IUS balance as of September 30, 2013, and noted the following: • USCIS did not reclassify $352,000 from USSGL account 1832 to USSGL account 1830 timely for one project. • USCIS did not reclassify $1.9 million from USSGL account 1832 to USSGL account 1830 timely for another project, resulting in a $53,000 understatement of amortization expense. 2 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2013 We performed a reconciliation to determine completeness and noted the following: Eight system releases were in-development that were not accounted for by FMD.

The budgeted amounts for these projects totaled $3 million. Recommendation: We recommend that USCIS develop and implement, within each office responsible for the management of software development projects operating procedures for: • Identifying and reporting of capitalizable software development projects prior to the initiation of software development. • Collecting costs for capitalizable software development projects and timely reporting that information. • Periodic reviews of the status of capitalizable software both in development and in operation, and the reporting of changes in status. FMC 13-03 – Inadequate Preparation and Review of the Transaction by Elimination Pairs Report (NFR No. USCIS 13-06) We noted that review of the September 2013 DHS Bureau Intra-Agency Transactions by Elimination Pairs Report was prepared using the August 2013 DHS Bureau Intra-Agency Transactions by Elimination Pairs Report. Recommendation: We recommend that USCIS ensure use of the most current information available when reviewing monthly and quarterly checklists.

FMC 13-04 – Insufficient Review of Journal Entries (NFR No. USCIS 13-07) A manual journal entry for Imputed Costs related to the Office of Personnel Management Post- Employment Benefits was understated by $1,893,179. The understatement was caused by a miscalculation due to the omission of the Federal Employees Retirement System - Revised Annuity Employee normal cost from the pension expense calculation. USCIS proposed an on-top correcting entry for the amount of the error. Recommendation: We recommend that USCIS review and update procedures for verifying that calculations for manual journal entries are complete and accurate.

3 U.S. Citizenship and Immigration Services Crosswalk – Financial Management Comments to Active NFRs September 30, 2013 Appendix A Description MW SD NC No. Disposition1 IAR FMC the Public and Confidential Financial Deficiencies in Disclosure Reporting Process Deficiencies in the Recording, Classification, and Useful Life of Internal Use Software Inaccurate Data in the CLAIMS 3, CLAIMS 4, and MFAS Systems Non-Compliance with the Federal Financial Management Improvement Act of 1996 Inadequate Monitoring of Software Licenses Inadequate Preparation and Review of the Transaction by Elimination Pairs Report Insufficient Review of Journal Entries J J 13-01 13-02 Note 1 13-03 13-04 Component USCIS NFR No. 13-01 USCIS 13-02 USCIS 13-03 USCIS USCIS USCIS USCIS 13-04 13-05 13-06 13-07 1Disposition Legend: IAR FMC MW SD Independent Auditors’ Report dated December 11, 2013 Financial Management Comment Contributed to a Material Weakness at the Department level when combined with the results of all other components Contributed to a Significant Deficiency at the Department level when combined with the results of all other components Contributed to Non-Compliance with laws, regulations, contracts, and grant agreements at the Department level when combined with the results of all other components Notice of Finding and Recommendation NC NFR Cross-reference to the applicable sections of the IAR: A B C D E F G H I J K L Financial Reporting Information Technology Controls and Financial Systems Functionality Property, Plant, and Equipment Budgetary Accounting Entity-Level Controls Liabilities Grants Management Custodial Revenue and Drawback Federal Managers’ Financial Integrity Act of 1982 (FMFIA) Federal Financial Management Improvement Act of 1996 (FFMIA) Single Audit Act Amendments of 1996 Antideficiency Act, as amended (ADA) Note 1: This finding was identified by USCIS management and therefore not included in the management letter. 4 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix A Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff Deputy Chief of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Chief Privacy Officer U.S. Citizenship and Immigration Services Director Chief Financial Officer Audit Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees, as appropriate � www.oig.dhs.gov OIG-14-71 ADDITIONAL INFORMATION To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General (OIG) Office of Public Affairs at: [email protected], or follow us on Twitter at: @dhsoig.

OIG HOTLINE

To expedite the reporting of alleged fraud, waste, abuse or mismanagement, or any other kinds of criminal or noncriminal misconduct relative to Department of Homeland Security (DHS) programs and operations, please visit our website at www.oig.dhs.gov and click on the red tab titled "Hotline" to report. You will be directed to complete and submit an automated DHS OIG Investigative Referral Submission Form. Submission through our website ensures that your complaint will be promptly received and reviewed by DHS OIG. Should you be unable to access our website, you may submit your complaint in writing to: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Office of Investigations Hotline 245 Murray Drive, SW Washington, DC 20528-0305 You may also call 1(800) 323-8603 or fax the complaint directly to us at (202) 254-4297.

The OIG seeks to protect the identity of each writer and caller.