DHS OIG, OIG-17-84, United States Citizenship and Immigration Services' Management Letter for DHS' Fiscal Year 2016 Financial Statements Audit (2017)

United States Citizenship and Immigration Services' Management Letter for DHS' Fiscal Year 2016 Financial Statements Audit June 27, 2017 OIG-17-84 DHS OIG HIGHLIGHTS United States Citizenship and Immigration Services’ Management Letter for DHS’ Fiscal Year 2016 Financial Statements Audit What We Found KPMG LLP, under contract with the DHS Office of Inspector General, audited the United States Citizenship and Immigration Services’ (USCIS) financial statements and internal control over financial reporting for FY 2016. The resulting management letter contains four observations related to internal controls and other operational matters which are presented in this report for management’s consideration. KPMG LLP noted internal control deficiencies in several processes including monitoring and recording employee completion of the annual ethics and integrity training; review and approval of H1-B and L fraud fee journal entries; recording of property, plant, and equipment; and inaccurate and unsupported data in some systems. These deficiencies are not considered significant and were not required to be reported in the Independent Auditors’ Report on DHS’ FY 2016 Financial Statements and Internal Control over Financial Reporting, dated November 14, 2016, included in the DHS FY 2016 Agency Financial Report.

June 27, 2017 Why We Did This Report The Chief Financial Officers Act of 1990 (Public Law 101- 576) and the Department Of Homeland Security Financial Accountability Act (Public Law 108-330) require us to conduct an annual audit of the Department of Homeland Security’s (DHS) consolidated financial statements and internal control over financial reporting. During the fiscal year (FY) 2016 audit of DHS’ consolidated financial statements and internal control over financial reporting, KPMG LLP noted certain matters involving the United States Citizenship and Immigration Service’s internal control and other operational matters. For Further Information: Contact our Office of Public Affairs at (202) 254-4100, or email us at [email protected] www.oig.dhs.gov OIG-17-84 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov June 27, 2017 MEMORANDUM FOR: Joseph Moore Chief Financial Officer United States Citizenship and Immigration Services FROM: SUBJECT: John V. Kelly '0==?~ · · Deputy Inspector General United States Citizenship and Immigration Services' Management Letter for DHS' Fiscal Year 2016 Financial Statements Audit Attached for your information is our final report, United States Citizenship and Immigration Services' Management Letter for DHS' Fiscal Year 2016 Financial Statements Audit. This report contains four observations related to internal control deficiencies that were not required to be reported in our Independent Auditors' Report on DHS' FY 2016 Financial Statements and Internal Control over Financial Reporting, dated November 14, 2016, which was included in the Department of Homeland Security's (DHS) fiscal year (FY) 2016 Agency Financial Report.

We do not require management's response to the recommendations. The independent public accounting firm KPMG LLP conducted the audit of DHS' FY 2016 financial statements and is responsible for the attached management letter and the conclusions expressed in it. Consistent with our responsibility under the Inspector General Act, we will provide copies of our report to congressional committees with oversight and appropriation responsibility over the Department of Homeland Security. We will post the report on our website for public dissemination.

Please call me with any questions, or your staff may contact Maureen Duddy, Deputy Assistant Inspector General for Audits, at (617) 565-8723. Attachment KPMG LLP Suite 12000 1801 K Street, NW Washington, DC 20006 December 8, 2016 Office of Inspector General U.S. Department of Homeland Security, and Chief Financial Officer U.S. Department of Homeland Security, U.S. Citizenship and Immigration Services Washington, DC Ladies and Gentlemen: We planned and performed our audit of the consolidated financial statements (hereinafter referred to as the “financial statements”) of the U.S. Department of Homeland Security (DHS or Department), as of and for the year ended September 30, 2016, in accordance with auditing standards generally accepted in the United States of America; the standards applicable to financial audits contained in Government Auditing Standards issued by the Comptroller General of the United States; and Office of Management and Budget (OMB) Bulletin No. 15-02, Audit Requirements for Federal Financial Statements. We considered the Department’s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the consolidated financial statements. In conjunction with our audit of the consolidated financial statements, we also performed an audit of internal control over financial reporting in accordance with attestation standards established by the American Institute of Certified Public Accountants; the standards applicable to attestation engagements contained in Government Auditing Standards issued by the Comptroller General of the United States; and the internal control requirements included in OMB Bulletin No. 15-02.

During our audits we noted certain matters involving the U.S. Citizenship and Immigration Services’ (USCIS) internal control and other operational matters that are presented for your consideration. These comments and recommendations, all of which have been discussed with the appropriate members of management, are intended to improve internal control or result in other operating efficiencies. These observations and recommendations are summarized in Exhibit I of this letter and are not considered significant deficiencies or material weaknesses in internal control over financial reporting. Significant deficiencies and material weaknesses in internal control over financial reporting have been previously communicated to the DHS Office of Inspector General (OIG) and management in our Independent Auditors’ Report, dated November 14, 2016, included in the fiscal year 2016 DHS Agency Financial Report.

Deficiencies related to USCIS information technology (IT) controls will be presented in a separate letter to the DHS Office of Inspector General, USCIS Chief Information Officer, and USCIS Chief Financial Officer. Our audit procedures are designed primarily to enable us to form an opinion on the financial statements and on the effectiveness of internal control over financial reporting, and therefore may not bring to light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge of USCIS’s organization gained during our work to make comments and suggestions that should be useful to you. We would be pleased to discuss these comments and recommendations with you at any time.

KPMG LLP is a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. The purpose of this letter is solely to describe comments and recommendations intended to improve internal control or result in other operating efficiencies. Accordingly, this letter is not suitable for any other purpose. Very truly yours, U.S. Citizenship and Immigration Services Table of Financial Management Comments September 30, 2016 TABLE OF FINANCIAL MANAGEMENT COMMENTS (FMC) Comment Reference Subject FMC 16-01 Deficiencies in Monitoring and Recording Employee Completion of FMC 16-02 the Annual Ethics and Integrity Training Insufficiently Precise Review and Approval of H1-B and L Fraud Fee Journal Entries FMC 16-03 Deficiencies in the Recording of Property, Plant, and Equipment FMC 16-04 Inaccurate and Unsupported Data in the Adjudication Information Management Systems (CLAIMS 3 and CLAIMS 4) and the Marriage Fraud Amendment System Appendix Subject APPENDIX A Crosswalk – Financial Management Comments to Active NFRs Page 2 2 2 3 Page 4 1 U.S. Citizenship and Immigration Services Financial Management Comments and Recommendations September 30, 2016 FMC 16-01 – Deficiencies in Monitoring and Recording Employee Completion of the Annual Ethics and Integrity Training (NFR No. USCIS 16-01) Controls were not operating effectively to ensure that all employees completed the required annual ethics training.

In our sample of 45, USCIS employees required to complete the annual ethics and integrity training course, due on December 31, 2015, we found that USCIS was unable to provide documentation to support that two of the employees had completed the required annual training for calendar year 2015. Additionally, for one of those two employees, USCIS was unable to provide support that the employee completed the training due in the prior year as well. Recommendation: USCIS should: x Enhance its communications and compliance processes to ensure employees understand and comply with agency ethics and integrity training policies. x Engage Program Offices and Directorates to add necessary emphasis of timely completion of annual ethics and integrity training. FMC 16-02 – Insufficiently Precise Review and Approval of H1-B and L Fraud Fee Journal Entries (NFR No. USCIS 16-02) Controls were not operating effectively to ensure that journal entries recorded were accurate.

In one of six monthly journal entries related to the transfer of H-1B and L Fraud fees selected for testwork, we identified a variance of $120 between what was recorded in the journal entry and the amount that was requested per the letter to Treasury. Recommendation: USCIS should emphasize policies and procedures relating to the review of journal entries in order to correct any identified errors prior to year-end reporting. FMC 16-03 – Deficiencies in the Recording of Property, Plant, and Equipment (NFR No. USCIS 16-03) Controls were not operating effectively to ensure that the monthly recorded costs were complete and accurate. Specifically, during our review of the property roll forward we identified the following: x One disposal which was not recorded timely.

We noted that the asset was approved for disposal on June 30, 2015 per the decommissioning memo; however, the Accounting and Reporting Branch was not notified of the disposal until the first quarter of FY 2016. x The development for one project was not recorded timely and costs were not properly capitalized. Cost estimates were not provided for September 2015 even though costs were incurred. During FY 2016, USCIS recorded a prior period adjustment to properly record the capitalization of costs related to the project in September 2015. Recommendation: We noted that USCIS implemented corrective actions during FY 2016 to mitigate the reoccurrence of the cited conditions.

Therefore, no further action is needed. 2 U.S. Citizenship and Immigration Services Financial Management Comments and Recommendations September 30, 2016 FMC 16-04 – Inaccurate and Unsupported Data in the Adjudication Information Management Systems (CLAIMS 3 and CLAIMS 4) and the Marriage Fraud Amendment System (NFR No. USCIS 16-05) We conducted testwork over the FY 2016 third quarter list to floor audit and identified the following: x For 100 of the 795 samples, USCIS was unable to provide a physical application to support the applications’ status. We note it is USCIS’s policy to treat all unsupported samples as “not pending.” As these applications were unsupported, we were unable to conclude whether the status determined by USCIS is appropriate. x For one of the 795 samples, the fee per the sample did not agree to the fee per the fee schedule, based on the form type and receipt date. USCIS was unable to provide support for the fee per the sample. x Forty two of the 795 samples were listed as pending in the application tracking system, however, we determined that these samples were not pending based on review of the physical application.

Of these samples, USCIS also identified the 42 samples to be not pending. This indicates that the information in the application tracking systems [CLAIMS 3, CLAIMS 4, and the Marriage Fraud Amendment System] was not reliable for financial reporting purposes and that there were deficiencies in the internal controls that govern the information in these systems, resulting in the need for the deferred revenue estimation methodology. Recommendation: USCIS should: x Continue to ensure appropriate staff members are trained regarding the requirements of the quarterly review to ensure that the estimation process is complete and accurate. x Continue to increase the number and type of applications required to be processed through the Electronic Immigration System and ensure the application allows for the direct reporting of deferred revenue. The controls over the application status should eventually allow USCIS to retire their legacy tracking systems and replace their current estimation process. x Consider performing alternative procedures on the missing applications in order to reduce the number of unsupported samples.

3 U.S. Citizenship and Immigration Services Crosswalk – Financial Management Comments to Active NFRs September 30, 2016 Appendix A NFR No. Description Disposition1 IAR FMC MW SD NC No. 16-01 16-02 16-03 16-04 16-05 Deficiencies in Monitoring and Recording Employee Completion of the Annual Ethics and Integrity Training Insufficiently Precise Review and Approval of H1-B and L Fraud Fee Journal Entries Deficiencies in the Recording of Property, Plant, and Equipment Ineffective Monitoring of Aged Obligations Inaccurate and Unsupported Data in the Adjudication Information Management Systems (CLAIMS 3 and CLAIMS 4) and the Marriage Fraud Amendment System B 16-01 16-02 16-03 16-04 1Disposition Legend: IAR FMC Financial Management Comment MW Independent Auditors’ Report dated November 14, 2016 SD NC Contributed to a Material Weakness at the Department-level when combined with the results of all other components Contributed to a Significant Deficiency at the Department-level when combined with the results of all other components Contributed to Non-Compliance with laws, regulations, contracts, and grant agreements at the Department-level when combined with the results of all other components NFR Notice of Finding and Recommendation Cross-reference to the applicable sections of the IAR: A B C D E F G H I J Information Technology Controls and Financial System Functionality Financial Reporting Property, Plant, and Equipment Entity-Level Controls Grants Management Custodial Revenue and Refunds and Drawback Federal Managers’ Financial Integrity Act of 1982 Single Audit Act Amendments of 1996 Antideficiency Act, as amended Federal Financial Management Improvement Act of 1996 4 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix B Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Chief Financial Officer United States Citizenship and Immigration Services Director Audit Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees www.oig.dhs.gov OIG-17-84 ADDITIONAL INFORMATION AND COPIES To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected]. Follow us on Twitter at: @dhsoig.

OIG HOTLINE

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305