DHS OIG, OIG-17-90, Management Letter for U.S Customs and Border Protection's Fiscal Year 2016 Consolidated Financial Statements Audit (2017)

Management Letter for U.S. Customs and Border Protection's Fiscal Year 2016 Consolidated Financial Statements Audit June 30, 2017 OIG-17-90 DHS OIG HIGHLIGHTS Management Letter for U.S. Customs and Border Protection’s Fiscal Year 2016 Consolidated Financial Statements Audit  What We Found  KPMG LLP (KPMG) expressed an unmodified (Clean) opinion on CBP’s consolidated financial statements. The management letter contains 12 observations related to internal controls and other operational matters for management’s consideration. KPMG noted internal control deficiencies in certain processes, including deobligation of undelivered orders; review of Federal Employee Compensation Act claims; and the seized and forfeited property inventory. These deficiencies did not meet the criteria to be reported in the Independent Auditors' Report on U.S. Customs and Border Protection’s FY 2016 Consolidated Financial Statements, dated January 18, 2017 included in the CBP FY 2016 Performance and Accountability Report.   June 30, 2017  Why We Did This Report U.S. Customs and Border Protection (CBP) prepares annual financial statements to demonstrate accountability to Congress and the public.

We contracted with an independent public accounting firm, KPMG LLP to audit CBP’s fiscal year (FY) 2016 financial statements to express an opinion over the fairness of presentation of those statements. During the audit KPMG LLP noted certain matters involving the CBP’s internal control and other operational matters. For Further Information: Contact our Office of Public Affairs at (202) 254-4100, or email us at [email protected]     www.oig.dhs.gov OIG-17-90 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov June 30, 2017 MEMORANDUM FOR: Sean Mildrew FROM: SUBJECT: Acting Chief Financial Officer United States Customs and Border Protection John V. Kelly -~ Deputy Inspector General ~?~ Management Letter for U. S Customs and Border Protection's Fiscal Year 2016 Consolidated Financial Statements Audit Attached for your action is our final report, Management Letter for U.S. Customs and Border Protection's Fiscal Year 2016 Consolidated Financial Statements Audit. This report contains observations related to internal control deficiencies that were not required to be reported in the Independent Auditors' Report on U.S. Customs and Border Protection's FY 2016 Consolidated Financial Statements, dated January 18, 2017 included in the CBP's FY 2016 Performance and Accountability Report.

We do not require management's response to the recommendations. The independent public accounting firm KPMG LLP conducted the audit of CBP's FY 2016 financial statements and is responsible for the attached management letter dated January 18, 2017 and the conclusions expressed in it. Please call me with any questions, or your staff may contact Maureen Duddy, Deputy Assistant Inspector General for Audits, at (617) 565-8723. Attachment January 18, 2017 Office of Inspector General U.S. Department of Homeland Security Washington, DC Chief Financial Officer U.S. Customs and Border Protection Washington, DC Ladies and Gentlemen: In planning and performing our audit of the consolidated financial statements of the U.S. Customs and Border Protection (CBP), as of and for the year ended September 30, 2016, in accordance with auditing standards generally accepted in the United States of America and Government Auditing Standards issued by the Comptroller General of the United States; and Office of Management and Budget (OMB) Bulletin No. 15-02, Audit Requirements for Federal Financial Statements, we considered CBP’s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of CBP’s internal control.

Accordingly, we do not express an opinion on the effectiveness of CBP’s internal control. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. During our audit, we noted certain matters involving deficiencies in internal control and other operational matters that are presented for your consideration. These comments and recommendations, all of which have been discussed with the appropriate members of management, are intended to improve internal control or result in other operational efficiencies.

This letter provides our observations, which have been indexed in the Table of Financial Management Comments. The disposition of each internal control deficiency identified during our audit of the consolidated financial statements as of, and for the year ended September 30, 2016 – as either reported in our Independent Auditors’ Report, or herein as a financial management letter comment – is presented in Appendix A. Our findings over information technology systems have been presented in a separate letter to the Department of Homeland Security Office of Inspector General, CBP Chief Information Officer, and CBP Chief Financial Officer. Our audit procedures are designed primarily to enable us to form an opinion on the consolidated financial statements, and therefore may not bring to light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge of CBP’s organization gained during our work to make comments and suggestions that we hope will be useful to you.

We would be pleased to discuss these comments and recommendations with you at any time. The purpose of this letter is solely to describe comments and recommendations intended to improve internal control or result in other operating efficiencies. Accordingly, this letter is not suitable for any other purpose. Very truly yours, U.S. Customs and Border Protection Table of Financial Management Comments September 30, 2016 TABLE OF FINANCIAL MANAGEMENT COMMENTS (FMC) FMC Reference Subject FMC 16-01 Inadequate Implementation of Quarterly Analysis of Open Obligations FMC 16-02 Ineffective Review and Deobligation of Undelivered Orders FMC 16-03 Lack of Heritage Asset Collections Monitoring Controls FMC 16-04 Inadequate Controls over Settlement of Assets FMC 16-05 Management Oversight of Property, Plant, and Equipment FMC 16-06 FMC 16-07 FMC 16-08 FMC 16-09 FMC 16-10 FMC 16-11 FMC 16-12 APPENDICES Appendix A Ineffective Controls over the Review of Federal Employees’ Compensation Act Quarterly Chargeback Reports Deficiencies in the Public and Confidential Financial Disclosure Reporting Process Deficiencies in the Public and Confidential Financial Disclosure Reporting Process Lack of Controls over Payroll Service Provider’s Implementation of the Border Patrol Agent Pay Reform Act Ineffective Controls in the Seized and Forfeited Property Inventory Process Ineffective Controls over the Taxes, Duties and Trade Receivables Allowance Lack of Supporting Documentation for Excise Tax Collections Subject Crosswalk – Financial Management Comments to Active Notices of Finding and Recommendation (NFRs) Page 1 1 1 2 2 3 3 3 4 4 5 5 U.S. Customs and Border Protection Financial Management Comments September 30, 2016 CBP – Financial Management Comment (FMC) 16-01 – Inadequate Implementation of Quarterly Analysis of Open Obligations (Notice of Finding and Recommendation (NFR) No. CBP 16-01) CBP was not in full compliance with the Quarterly Analysis of Open Obligations required procedures.

Specifically, in the second quarter analysis, 4,285 out of the 16,458 obligation line items that were given a valid status (Status 1) and either had not had activity in the last 12 months or had an expired period of performance did not contain an explanation of validity as required by the designed control procedures. Recommendation: CBP should develop a risk-based approach for identifying obligations that are no longer valid. CBP – FMC 16-02 – Ineffective Review and Deobligation of Undelivered Orders (NFR No. CBP 16-01a) Controls to ensure that all open obligations were properly identified as valid or invalid were not operating effectively in fiscal year 2016. Specifically, during testwork over a statistical sample of 39 inactive open obligations (i.e. those with no activity in the current fiscal year) performed as of June 30, 2016, we identified one sample item in which the obligation was invalid (status 3 or 4) as of June 30, 2016.

However, the obligation was incorrectly marked as valid (status 1) on the June 30, 2016 Quarterly Obligation Analysis. Recommendation: CBP should develop a risk-based approach for identifying obligations that are no longer valid. CBP – FMC 16-03 – Lack of Heritage Asset Collections Monitoring Controls (NFR No. CBP 16-04) CBP lacked formally documented policies and procedures to ensure all assets comprising the collections of documents and artifacts were appropriately reviewed, classified, recorded, and safeguarded in accordance with Statements of Federal Financial Accounting Standards No. 29, Heritage Assets and Stewardship Land. Additionally, CBP did not have controls in place to ensure all new and/or potential heritage assets were identified at ports of entry, Customs Houses and field units, and reported to the Historical Program Office.

We noted the U.S. Customs and Border Protection Public Affairs Policy Handbook was developed in fiscal year 2015, which assigned responsibility for the management and reporting of heritage assets as follows: x Historical Program Office is responsible for management of heritage assets in the Ronald Reagan Building. x The national and international field offices are responsible for management of heritage assets located in respective ports of entry, border patrol sectors and stations, and air and marine installations. x The Office of Finance is responsible for the reporting of heritage assets. However, CBP management has not approved the policy and formally issued it across the organization. Recommendation: CBP should allocate resources to develop and implement detailed standard operating procedures for the Historical Program Office and national and international field offices to ensure complete and accurate reporting and safeguarding of heritage assets. 1 U.S. Customs and Border Protection Financial Management Comments September 30, 2016 CBP – FMC 16-04 – Inadequate Controls over Settlement of Assets (NFR No. CBP 16-05) We selected a statistical sample of 15 general property, plant, and equipment asset settlement transactions recorded from October 1, 2015 through May 31, 2016 and identified the following: x Two instances in which the placed-in-service date per the financial system of record did not agree to the date that custodianship transferred to CBP reflected on the Joint Acceptance Inspection Report (JAIR).

Consequently, more than 30 days elapsed between the time when a completed asset had been accepted by CBP (placed-into-service) and the time in which CBP recorded the applicable transaction to move the asset from construction-in-progress to in-use. One instance in which the final asset value was not adjusted to the final invoiced amount within 30 days of receiving the final invoice. We selected a statistical sample of 17 general property, plant, and equipment asset settlement transactions recorded from June 1, 2016 through September 30, 2016 and identified the following: x Two instances in which more than 30 days elapsed between the time in which a completed asset had been placed-into-service and the time in which CBP recorded the applicable transaction to move the asset from construction-in-progress to in-use. As a result of the late settlements, depreciation for the asset was understated.

CBP adjusted depreciation at the time the asset was placed-into-service. x Three instances in which CBP’s date of acceptance did not agree to the capitalized date per the financial system of record. The difference between the acceptance date and capitalization date did not exceed one month and thus did not have an impact on depreciation expense. We selected a sample of six construction-in-progress assets with no activity between October 1, 2015 and July 31, 2016 and identified the following: x Three instances in which more than 30 days elapsed between when a completed asset had been placed-into-service and when CBP recorded the applicable transaction to move the asset from construction-in-progress to in-use. One of the three late settlements crossed reporting periods.

As a result of the late settlements, depreciation for the asset was understated from the time between when the asset was placed-into-service to when the asset was settled. CBP adjusted depreciation to the correct amount at the time the asset was placed into service. Recommendations: CBP should: x Draft a management action plan to update existing policies to include a requirement to provide a Certificate of Occupancy or other supporting documentation that would validate the placed into service date. x Develop a final settlement standard operating procedure and worksheet to assist with the oversight of projects and to ensure timely recording of assets. CBP – FMC 16-05 – Management Oversight of Property, Plant, and Equipment (NFR No. CBP 16-08) Controls over CBP’s annual personal property and equipment inventory were not operating effectively in fiscal year 2016.

During site visits to various ports of entry in July and August, we traced a sample of 91 assets from floor to book and identified the following: x One instance in which the financial system of record had barcode and identification information that x was not consistent with the information on the physical asset. Inconsistent tracking and recording of Radiation Portal Monitors by all locations in the financial system of record. 2 U.S. Customs and Border Protection Financial Management Comments September 30, 2016 Recommendations: CBP should: x Continue to stress the importance of following existing inventory policies that require validation of information on physical assets during physical inventories. x Remind personal property inventory participants of their responsibility to validate that proper procedures are followed and inventories are conducted with due diligence. Improve and enhance inventory verification and validation efforts. x x Continue to monitor asset modifications through existing internal controls. x Continue to track Radiation Portal Monitor asset modification while assisting with asset value transfers to each lane.

CBP – FMC 16-06 – Ineffective Controls over the Review of Federal Employees’ Compensation Act Quarterly Chargeback Reports (NFR No. CBP 16-15) CBP did not perform a timely review of the FY 2016 third and fourth quarter chargeback detail to ensure that the totals per quarter agreed to the chargeback summary report submitted by the Department of Labor. Recommendation: CBP should work with the Department of Labor to ensure amounts on the quarterly chargeback details are correct and that they receive the reports timely. CBP – FMC 16-07 – Ineffective Controls over the Review of Federal Employees’ Compensation Act Claim Forms (NFR No. CBP 16-16) During our testwork over 45 claims filed in fiscal year 2016, we identified the following: x One instance in which the Notice of Occupational Disease and Claim for Compensation (CA-2) form was not reviewed timely in accordance with CBP’s policy. Specifically, seven months elapsed between the date the employee submitted the form and the date of the supervisor review. x Four instances in which the claimant’s pay grade and step per the Federal Notice of Traumatic Injury and Claim for Continuation of Pay/Compensation (CA-1) form did not agree with the grade and step stated on the claimant’s Leave and Earnings Statement at the time of injury.

Recommendation: CBP employees should perform reviews of claims in accordance with established policies and procedures. CBP – FMC 16-08 – Deficiencies in the Public and Confidential Financial Disclosure Reporting Process (NFR No. CBP 16-18) During our testwork over public and confidential financial disclosure reporting, we identified the following: x CBP did not have formalized policies and procedures in place during fiscal year 2016 to govern tracking of Office of Government Ethics (OGE)-278, Public Financial Disclosure Report, filers in the new reporting system. x The new entrant OGE-450, Confidential Financial Disclosure Report, population included individuals who were not required to complete new entrant filings in the current year. 3 U.S. Customs and Border Protection Financial Management Comments September 30, 2016 We selected a sample of 25 OGE-278 forms and 45 OGE-450 forms and determined that controls to ensure proper completion and review of forms were not operating effectively in fiscal year 2016. Specifically, we identified the following: x One instance in which the termination OGE-278 filing was not completed within the 30-day requirement. x One instance in which the annual filer completed the OGE-278 filing by the June 20, 2016 filing deadline, but final review and certification was not completed until after the 60-day review period. x One instance in which the initial review of the OGE-450 was completed within the 60-day requirement, but the final review and certification was not completed until after the 60-day review period.

Recommendations: CBP should: x Amend its draft directive on Implementation of the Public Financial Disclosure Report (OGE Form 278) Requirements to include the new financial disclosure system. x Request that the Indianapolis Hiring Center provide refresher training for personnel responsible for processing realignments and organization code changes. x Follow up with Human Resource Management on a prior request that the human resource system regularly send out automatic electronic reminders to filers and reviewers whose filings and/or reviews are overdue. x Request that the DHS Headquarters Ethics Office contact the Office of Government Ethics to request that the filing system issue regular automatic electronic reminders to reviewers whose reviews of OGE-278s are coming due and to reviewers whose reviews are overdue. CBP – FMC 16-09 – Lack of Controls over Payroll Service Provider’s Implementation of the Border Patrol Agent Pay Reform Act (NFR No. CBP 16-20) Controls were not properly designed and implemented to ensure the accuracy of all manual adjustments to payroll Leave and Earnings Statements. Specifically, during our testwork over a statistical sample of 149 employee payroll disbursements in fiscal year 2016, we identified two instances in which an employee was paid the Border Patrol Agent Pay Reform Act supplemental overtime payment twice on their lump sum annual leave payment upon separation from CBP. This included the associated Social Security and Medicare expense on the overpayment.

CBP has not collected the overpaid amounts from the employees that were overpaid upon separation. Recommendation: CBP should establish controls to ensure sufficient communication with the United States Department of Agriculture, especially during the implementation of new laws and regulations that impact payroll processing. CBP – FMC 16-10 – Ineffective Controls in the Seized and Forfeited Property Inventory Process (NFR No. CBP 16-25) Controls over seized and forfeited property were not operating effectively during fiscal year 2016. Specifically, we identified the following: x During testwork at six seized property vaults, we identified one instance in which a 100% vault inventory was not completed within 30 days of a Seized Property Specialist permanently leaving their position and the port did not obtain a waiver confirming this deviation was approved.

The port completed an inventory during the annual inventory. No missing vault items were identified during this process. 4 U.S. Customs and Border Protection Financial Management Comments September 30, 2016 x During testwork over tracing the fiscal year 2016 inventory items into the ending seized property system fiscal year 2016 activity population, we identified one instance in which the weight identified during our inventory was not updated in the seized property system. x During testwork over the seized and forfeited property supporting the fiscal year 2016 seized and forfeited property footnote, we identified five instances in which case information was either not accurately updated in the seized property system or not documented appropriately on the supporting documentation. Recommendation: CBP should redistribute memoranda to the respective Directors, Field Operations offices, and Ports of Entry to reemphasize current policies and procedures regarding the highly sensitive activities involving the custody, management, and accountability of seized property and its proper processing.

Special emphasis should be placed on the policy of performing an outgoing inventory after a Seized Property Specialist separates from their area of responsibility within the appropriate time limits and the submission of a waiver if there is an anticipated delay. Other special emphasis should be placed on the importance of updating the seized property system and putting in place internal controls to ensure that the system has been updated with correct information. CBP – FMC 16-11 – Ineffective Controls over the Taxes, Duties and Trade Receivables Allowance (NFR No. CBP 16-29) CBP did not design and implement sufficient controls to evaluate the appropriateness of the allowance methodology related to current Taxes, Duties and Trade Receivables. Specifically, we identified nine items included in the Taxes, Duties and Trade Receivables entry accrual related to Anti-Dumping and Countervailing Duties that were aged over 90 days and were not allowed for, but did have valid bonds at entry.

Recommendation: CBP should establish controls to review the collectability of the Taxes, Duties and Trade Receivables accrual related to Anti-Dumping and Countervailing Duties. CBP – FMC 16-12 – Lack of Supporting Documentation for Excise Tax Collections (NFR No. CBP 16- 32) CBP did not develop policies and procedures to retain supporting documentation for the excise tax calculation. Specifically, for three of the items selected in our statistical sample of 107 excise tax collections, CBP was unable to explain the difference between the amount of excise taxes collected and the amount we recalculated using the Tax and Trade Bureau rates. Recommendation: CBP should develop policies and procedures for retention of supporting documentation for the excise tax calculation.

5 U.S. Customs and Border Protection Crosswalk-Financial Management Comments to Active Notices of Findings and Recommendations (NFRs) September 30, 2016 NFR No. Description MW SD NC Disposition* IAR E D E CBP 16-01 CBP 16-01a CBP 16-02 CBP 16-03 Inadequate Implementation of Quarterly Analysis of Open Obligations Ineffective Review and Deobligation of Undelivered Orders Ineffective Controls over Review of ACS Exception and Error Reports Insufficient Retention Period for Documents that Support Drawback Claims CBP 16-04 Lack of Heritage Asset Collections Monitoring Controls CBP 16-05 CBP 16-06 CBP 16-07 CBP 16-08 CBP 16-09 CBP 16-10 CBP 16-11 CBP 16-12 CBP 16-13 CBP 16-13a CBP 16-14 CBP 16-15 CBP 16-16 Ineffective Controls over Settlement of Assets, as of September 30, 2016 Ineffective Controls over the SF- 132/133 Reconciliation Control Deficiencies over Entity Level Controls Management Oversight of Property, Plant, and Equipment Inadequate Controls over Subsequent Disbursements Invoice Classification Lack of Controls to Detect Excessive Drawback Claims Lack of Controls to Determine Sufficiency of Drawback Continuous Bonds for Claimants Qualified for Accelerated Payments Ineffective Controls over the Review of Single Transaction Bonds Lack of Controls over Complementary User Entity Controls Lack of Controls over Service Provider Assurance Lack of Documentation to Support Accelerated Filer Status Ineffective Controls over the Review of Federal Employees’ Compensation Act Quarterly Chargeback Reports Ineffective Controls over the Review of 6 C C B B C C B B C FMC No. 16-01 16-02 16-03 16-04 16-05 16-06 16-07 U.S. Customs and Border Protection Crosswalk-Financial Management Comments to Active Notices of Findings and Recommendations (NFRs) September 30, 2016 NFR No. Description MW SD NC Disposition* IAR Note 1 E E E CBP 16-17 CBP 16-18 CBP 16-19 CBP 16-20 CBP 16-21 Federal Employees’ Compensation Act Claim Forms Failure to Establish and Communicate the Control Environment During the ACS to ACE Transition Deficiencies in the Public and Confidential Financial Disclosure Reporting Process Non-Compliance with Federal Financial Management Improvement Act Lack of Controls over Payroll Service Provider’s Implementation of the Border Patrol Agent Pay Reform Act Ineffective Controls over the Legal Contingent Liability Management Schedule CBP 16-22 Identification of Non-GAAP Policies CBP 16-23 CBP 16-24 CBP 16-25 CBP 16-26 CBP 16-27 CBP 16-28 CBP 16-29 CBP 16-30 CBP 16-31 CBP 16-32 Ineffective Controls over the Preparation and Review of Adjusting Journal Entries Improper Recording of the Fines, Penalties, and Forfeitures Receivable Ineffective Controls in the Seized and Forfeited Property Process Ineffective Controls over the Timely Review of Liabilities for Deposit Accounts Ineffective or Improper Application of Controls over the Statement of Budgetary Resources Ineffective Design of Controls in the Year-end Financial Reporting Process Ineffective Controls over the Taxes Duties and Trade Receivable Allowance Ineffective Controls over the Seized and Forfeited Property Footnote Ineffective Controls over the Reporting of Prior Period Adjustments Lack of Supporting Documentation for Excise Tax Collections 7 B B B B B B B FMC No. 16-08 16-09 16-10 16-11 16-12 U.S. Customs and Border Protection Crosswalk-Financial Management Comments to Active Notices of Findings and Recommendations (NFRs) September 30, 2016 NFR No. Description MW SD NC Disposition* IAR FMC No. CBP 16-33 CBP 16-34 Ineffective Controls over the Timely Update of Harmonized Tariff Schedule Codes Lack of Sufficient Review over the Performance and Accountability Report B E *Disposition Legend: IAR FMC MW SD NC NFR Independent Auditors’ Report dated January 18, 2017 Financial Management Comment Contributed to a Material Weakness Contributed to a Significant Deficiency Contributed to Non-Compliance with Laws and Regulations Notice of Finding and Recommendation Cross-reference to the applicable sections of the Independent Auditors' Report: A B C D E Note 1 Information Technology Controls and Financial Systems Functionality Financial Reporting Refunds and Drawbacks of Duties, Taxes, and Fees Entity-Level Controls Custodial Revenue – Entry Process Non-compliance determined at the Department-level 8 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix B Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Chief Financial Officer United States Customs and Border Protection Commissioner Audit Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees   www.oig.dhs.gov OIG-17-90 ADDITIONAL INFORMATION AND COPIES To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected]. Follow us on Twitter at: @dhsoig.

OIG HOTLINE

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305