DHS OIG, OIG-16-79, United States Citizenship and Immigration Services' Management Letter for DHS' FY 2015 Financial Statements Audit (2016)

United States Citizenship and Immigration Services' Management Letter for DHS' FY 2015 Financial Statements Audit May 3, 2016 OIG-16-79 DHS OIG HIGHLIGHTS United States Citizenship and Immigration Services’ Management Letter for DHS’ FY 2015 Financial Statements Audit  What We Found  KPMG LLP, under contract with the DHS Office of Inspector General, audited the United States Citizenship and Immigration Services’ financial statements and internal control over financial reporting for fiscal year (FY) 2015. The resulting management letter contains four observations related to internal controls and other operational matters for management’s consideration. KPMG LLP noted internal control deficiencies and the need for improvement in several processes including annual ethics and integrity training; compliance with the Prompt Payment Act; inaccurate and unsupported data in some financial systems; and recording of internal use software. These deficiencies are not considered significant and were not required to be reported in the Independent Auditors’ Report on DHS’ FY 2015 Financial Statements and Internal Control over Financial Reporting, dated November 13, 2015, included in the DHS FY 2015 Agency Financial Report.

These observations are intended to improve internal control or result in other operating efficiencies.     May 3, 2016  Why We Did This Audit The Chief Financial Officers Act of 1990 (Public Law 101- 576) and the Department Of Homeland Security Financial Accountability Act (Public Law 108-330) require us to conduct an annual audit of the Department of Homeland Security’s (DHS) consolidated financial statements and internal control over financial reporting.        For Further Information: Contact our Office of Public Affairs at (202) 254-4100, or email us at [email protected]  www.oig.dhs.gov OIG-16-79 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov MAY 3 2016 MEMORANDUM FOR: Joseph Moore FROM: SUBJECT: Chief Financial Officer United States Citizenship and Immigration Services Mark Bell J-1 J ~ Assistant Inspector General for Audits United States Citizenship and Immigration Services' Management Letter for DHS' FY 2015 Financial Statements Audit Attached for your action is our final report, United States Citizenship and Immigration Services' Management Letter for DHS' FY 2015 Financial Statements Audit. This report contains four observations related to internal control deficiencies that were not required to be reported in our Independent Auditors' Report on DHS' FY 2015 Financial Statements and Internal Control over Financial Reporting, dated November 13, 2015, which was included in the Department of Homeland Security's (DHS) fiscal year (FY) 2015 Agency Financial Report. We do not require management's response to the recommendations . The independent public accounting firm KPMG LLP conducted the audit of DHS' FY 2015 financial statements and is responsible for the attached management letter and the conclusions expressed in it.

Consistent with our responsibility under the Inspector General Act, we will provide copies of our report to congressional committees with oversight and appropriation responsibility over the Department of Homeland Security. We will post the report on our website for public dissemination. Please call me with any questions, or your staff may contact Maureen Duddy, Deputy Assistant Inspector General for Audits, at (617) 565-8723. Attachment KPMG LLP Suite 12000 1801 K Street, NW Washington, DC 20006 December 18, 2015 Office of Inspector General, U.S. Department of Homeland Security, and Chief Financial Officer U.S. Department of Homeland Security, United States Citizenship and Immigration Services Washington, DC Ladies and Gentlemen: In planning and performing our audit of the consolidated financial statements of the U.S. Department of Homeland Security (DHS or Department), as of and for the year ended September 30, 2015, in accordance with auditing standards generally accepted in the United States of America and Government Auditing Standards issued by the Comptroller General of the United States; and Office of Management and Budget (OMB) Bulletin No. 15-02, Audit Requirements for Federal Financial Statements, we considered the Department’s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the financial statements.

In conjunction with our audit of the general purpose financial statements, we also performed an audit of internal control over financial reporting in accordance with attestation standards established by the American Institute of Certified Public Accountants. The United States Citizenship and Immigration Services (USCIS) is a component of DHS. During our audit we noted certain matters involving internal control and other operational matters, related to USCIS, that are presented for your consideration. These comments and recommendations, all of which have been discussed with the appropriate members of management, are intended to improve internal control or result in other operating efficiencies.

These matters are summarized in the Table of Financial Management Comments. The disposition of each internal control deficiency identified during our FY 2015 audits – as either reported in our Independent Auditors’ Report, or herein as a financial management letter comment – is presented in Appendix A. Our findings related to information technology systems have been presented in a separate letter to the DHS Office of Inspector General, USCIS Chief Information Officer and USCIS Chief Financial Officer. Our audit procedures are designed primarily to enable us to form an opinion on the financial statements and on the effectiveness of internal control over financial reporting, and therefore may not bring to light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge of USCIS’s organization gained during our work to make comments and suggestions that we hope will be useful to you.

We would be pleased to discuss these comments and recommendations with you at any time. The purpose of this letter is solely to describe comments and recommendations intended to improve internal control or result in other operating efficiencies. Accordingly, this letter is not suitable for any other purpose. Very truly yours, KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative (“KPMG International”), a Swiss entity.

United States Citizenship and Immigration Services Table of Financial Management Comments September 30, 2015 TABLE OF FINANCIAL MANAGEMENT COMMENTS (FMC) Comment Reference Subject FMC 15-01 Deficiencies in Monitoring and Recording Employee Completion of the Annual Ethics and Integrity Training FMC 15-02 Non-Compliance with the Prompt Payment Act FMC 15-03 Inaccurate and Unsupported Data in the CLAIMS 3 CLAIMS 4 and MFAS Systems FMC 15-04 Deficiencies in the Recording of Internal Use Software Appendix Subject APPENDIX A Crosswalk – Financial Management Comments to Active Notices of Findings and Recommendations (NFRs) Page 2 2 3 4 Page 6 1 United States Citizenship and Immigration Services Financial Management Comments September 30, 2015 FMC 15-01 – Deficiencies in Monitoring and Recording Employee Completion of the Annual Ethics and Integrity Training (NFR No. USCIS 15-01) We selected a random sample of 45 USCIS employees required to complete the annual ethics and integrity training course, due on December 31, 2014, and found that USCIS was unable to provide documentation to support, either through LearningEDGE (USCIS’s online training portal), transcripts or other relevant evidence (e.g. training sign-in sheets), that nine of the employees had completed the required annual training in a timely manner. Additionally, for one of those nine employees, USCIS was unable to provide support that the employee completed the training due in the prior year as well. Recommendations: We recommend that USCIS: x Implement proper policies and procedures to ensure required trainings, including those delivered outside LearningEdge, are documented and tracked appropriately for all USCIS employees. x Conduct a regular review of LearningEdge records and follow-up with employees who have not yet completed the training prior to the year-end due date. FMC 15-02 – Non-Compliance with the Prompt Payment Act (NFR No. USCIS 15-02) Based on our testwork performed over a sample of 58 vendor payments made during FY 2015, we noted one instance of non-compliance with the Prompt Payment Act in which the interest payment was calculated using an incorrect acceptance date of May 31, 2015, resulting in a due date of June 30, 2015.

We determined the services were rendered on April 30, 2015 and the invoice was accepted on May 18, 2015. We determined, based on the supporting documentation, the prompt pay interest should have been calculated based on an accepted date of May 18, 2015 and due date of June 17, 2015. As a result, USCIS understated the amount of interest paid to the vendor by $596.35. Recommendations: We recommend that USCIS: x Develop a post payment review process to identify acceptance date errors and develop a method to determine if interest penalties are calculated correctly.

If errors are detected, develop a process to pay the additional interest penalties to the vendor. x Additionally, USCIS should provide additional training to originating offices on receiving and acceptance and payment processing procedures. 2 United States Citizenship and Immigration Services Financial Management Comments September 30, 2015 FMC 15-03 – Inaccurate and Unsupported Data in the CLAIMS 3, CLAIMS 4 and MFAS Systems (NFR No. USCIS 15-03) We conducted testwork over the FY 2015 third quarter list to floor audit and noted the following: x For two of the 540 samples, we reviewed the physical application and determined two applications were adjudicated as of May 20, 2015, however, USCIS's sampling results included a pending status as of May 20, 2015. x For 48 of the 540 samples, USCIS was unable to provide a physical application to support the applications’ status. We note it is USCIS’s policy to treat all unsupported samples as “not pending.” As these applications were unsupported, we were unable to conclude whether the status determined by USCIS is appropriate. x For two of the 540 samples, the fee per the sample did not agree to the fee per the historic fee table, based on the form type and receipt date. USCIS was unable to provide support for the fee per the sample. x Eighteen of the 540 samples were listed as pending in the application tracking system, however, we determined that these samples were not pending based on review of the physical application.

Of these samples, USCIS identified 16 of them to be not pending. This indicates that the information in the application tracking systems, CLAIMS 3, CLAIMS 4, and MFAS, was not reliable for financial reporting purposes and that there were deficiencies in the internal controls that govern the information in these systems, resulting in the need for the deferred revenue estimation methodology. x The deferred revenue quarterly sampling and verification process identified discrepancies in the status of applications where errors between the system query results and the hard copy application exist; however, all identified errors were corrected within the systems. Although the faulty data was included in the monthly estimation of deferred revenue, the inclusion of faulty data presented an environment where these conditions would be present in subsequent quarterly sampling and verification. x The USCIS designed sampling methodology included a materiality threshold that exceeded what we would expect USCIS to accept. However, we evaluated the results between the USCIS projection and our independent projection and noted a difference less than our audit misstatement posting threshold. x The third quarter estimate and third quarter error rates were processed by USCIS on June 2, 2015, using the Statistical Analysis System.

The universes used for estimation contained slight differences from the universes generated on June 1, 2015 with the same parameters that were provided to us. USCIS was not able to identify the cause of the discrepancy. Recommendations: We recommend that USCIS: x Ensure appropriate staff members are adequately trained regarding the requirements of the quarterly review to ensure: 3 United States Citizenship and Immigration Services Financial Management Comments September 30, 2015 o Criteria established in the deferred revenue standard operating procedures are properly applied in all cases. o Any unusual fee results from the Claims 3 mainframe query are researched to identify non- standard fees before the sampling results are finalized. x Continue to increase the number and type of applications required to be processed through the Electronic Immigration System (ELIS) and ensure the application allows for the direct reporting of deferred revenue. The controls over the application status should eventually allow USCIS to retire their legacy tracking systems and replace their current estimation process. x Document the targeted precision and factor in an expected error rate during sample design to show that the sample design meets precision targets at the associated confidence level.

FMC 15-04 –Deficiencies in the Recording of Internal Use Software (NFR No. USCIS 15-04) Through review of prior period adjustments and journal entries, we identified the following: x The development of ELIS 2 Release 5.0 was not recorded timely and costs were not properly capitalized. In January of 2015, the Accounting and Reporting Branch was informed that costs related to the ELIS 2 Release 5.0 between March 2014 and November 2014 were not properly capitalized. On April 8, 2015, USCIS recorded a prior period adjustment for $2 million to internal use software in development (Standard General Ledger (SGL) 1832) and cost capitalization offset (SGL 6610) to record the capitalization of costs related to the development of the project for the time period of March 2014 to September 2014. x The movement of DAT 1.0 from software in development (SGL 1832) to internal use software (SGL 1830) was not recorded timely; and costs that should have been expensed as operating and maintenance costs were improperly capitalized. DAT 1.0 was deployed in April of 2014; however, the program managers continued to report development costs that should have been reported as operating and maintenance costs related to the project through October 2014.

On April 8, 2015, USCIS made a prior period adjustment for $600,000 to internal use software in development (SLG 1832) and cost capitalization offset (SGL 6610) to reduce the costs that were improperly recorded as software in development cost. Additionally on April 8, 2015, USCIS made a prior period adjustment for $670,000 to accumulated amortization on internal use software (SGL 1839) and depreciation, amortization and depletion (SGL 6710) to record amortization that should have been recorded on the project between April 2014 and September 2014. x The development of three projects were not recorded timely and costs were not properly capitalized. Costs related to projects CIS 2.3, NFTS 6.3, and eSTAT 1.0 were not reported for capitalized cost estimates for un-received invoices for September 2014. On January 12, 2015, USCIS made a prior period adjustment for $537,000 to internal-use software in development (SGL 1832) and cost capitalization offset (SGL 6610) to properly record the capitalization of costs related to these projects in September 2014.

4 United States Citizenship and Immigration Services Financial Management Comments September 30, 2015 x The development of project CRM 3.1 was not recorded timely and costs were not properly capitalized. The project began incurring development costs in July 2014; however, the Verification Division did not inform the Accounting and Reporting Branch that CRM 3.1 met the internal use software criteria until October 2014. On January 12, 2015, USCIS made a prior period adjustment for $1.6 million to internal use software in development (SGL 1832) and cost capitalization offset (SGL 6610) to record the capitalization of costs related to the development of the project for July 2014 and September 2014. We performed testwork over internal use software disposals as of September 30, 2015, and noted the following: x The disposal of the Secure Information Management System was not recorded timely.

We noted that the asset was approved for disposal on August 13, 2010, according to the disposition Review Approval Certification. However, the Accounting and Reporting Branch was not notified of the disposal until the third quarter of 2015. At the time of disposal, the asset was fully depreciated. On June 30, 2015, USCIS recorded a disposal entry for $5.1 million to internal use software (SGL 1830) and losses on disposition of assets (SGL 7210) to remove the asset from internal use software.

USCIS also made an entry for $5.1 million to accumulated amortization in internal use software (SGL 1839) and SGL 7210 to remove the accumulated amortization related to the asset. Recommendation: We recommend that USCIS continue to adhere to its established process, as documented in the Office of Information Technology Internal Use Software Standard Operating Procedure dated April 1, 2014, to ensure all costs incurred to date, including those costs incurred prior to FY 2015, are properly reported. 5 United States Citizenship and Immigration Services Crosswalk – Financial Management Comments to Active NFRs September 30, 2015 Appendix A Component NFR No. Description USCIS 15-01 Deficiencies in Monitoring and Recording Employee Completion of the Annual Ethics and Integrity Training USCIS USCIS USCIS 15-02 Non-Compliance with the Prompt Payment Act 15-03 15-04 Inaccurate and Unsupported Data in the CLAIMS 3 CLAIMS 4 and MFAS Systems Deficiencies in the Recording of Internal Use Software Disposition IAR FMC MW SD NC No. 15-01 15-02 15-03 15-04 1Disposition Legend: IAR FMC MW SD NC NFR Independent Auditors’ Report dated November 13, 2015 Financial Management Comment Contributed to a Material Weakness at the Department-level when combined with the results of all other components Contributed to a Significant Deficiency at the Department-level when combined with the results of all other components Contributed to Non-Compliance with laws, regulations, contracts, and grant agreements at the Department-level when combined with the results of all other components Notice of Finding and Recommendation Cross-reference to the applicable sections of the IAR: A B C D E F G H I J K Financial Reporting Information Technology Controls and Financial System Functionality Property, Plant, and Equipment Budgetary Accounting Entity-Level Controls Grants Management Custodial Revenue and Refunds and Drawback Federal Managers’ Financial Integrity Act of 1982 (FMFIA) Single Audit Act Amendments of 1996 Antideficiency Act, as amended (ADA) Federal Financial Management Improvement Act of 1996 (FFMIA) 6 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix B Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs Chief Financial Officer United States Citizenship and Immigration Services Director Chief Financial Officer Audit Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees   www.oig.dhs.gov OIG-16-79 ADDITIONAL INFORMATION AND COPIES To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected].

Follow us on Twitter at: @dhsoig.

OIG HOTLINE

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305