DHS OIG, OIG-15-72, U.S. Citizenship and Immigration Services' Management Letter for DHS' FY 2014 Financial Statements Audit (2015)

U.S. Citizenship and Immigration Services' Management Letter for DHS' FY 2014 Financial Statements Audit April 21, 2015 OIG-15-72 HIGHLIGHTS U.S. Citizenship and Immigration Services’ Management Letter for DHS’ FY 2014 Financial Statements Audit April 21, 2015 What We Found KPMG LLP reviewed the U.S. Citizenship and Immigration Services (USCIS) internal control over financial reporting. The management letter contains five observations related to internal control and other operational matters for management’s considerations. KPMG LLP noted deficiencies and the need for improvement in certain USCIS processes. These deficiencies did not meet the criteria to be reported in the Independent Auditors’ Report on DHS’ FY 2014 Financial Statements and Internal Control over Financial Reporting, dated November 14, 2014, included in DHS’ fiscal year 2014 Agency Financial Report.

These observations are intended to improve internal control or result in other operating efficiencies. Why We Did This The Federal Government has a fundamental responsibility to be an effective steward of taxpayers’ dollars. Sound financial practices and related management operations, reliable financial systems, and effective internal control are essential for reliable, timely financial information that supports management decision making needed to achieve the Department of Homeland Security’s (DHS) mission. For Further Information: Contact our Office of Public Affairs at (202) 254-4100, or email us at [email protected] www.oig.dhs.gov OIG-15-72 ~~ ~' ~.,Nng~t~` OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov APR 21 2015 MEMORANDUM FOR: Joseph Moore FROM: SUBJECT: Chief Financial Officer U.S. Citizenship and Immigration Services Mark Bell Assistant Inspector General for Audits U. S. Citizenship and Immigration Services' Management Letter for DHS' FY 2014 Financial Statements Audit Attached for your information is our final report, U.S. Citizenship and Immigration Services' Management Letter for DHS' FY 2014 Financial Statements Audit.

This report contains observations related to internal control deficiencies that were not required to be reported in the Independent Auditors' Report on DHS' FY 2014 Financial Statements and Internal Control over Financial Reporting. Internal control deficiencies which are considered significant deficiencies were reported, as required, in the Independent Auditors' Report, dated November 14, 2014, which was included in the Department of Homeland Security (DHS) fiscal year (FY) 2014 Agency Financial Report. We do not require management's response to the recommendations. The independent public accounting firm KPMG LLP conducted the audit of DHS' FY 2014 financial statements and is responsible for the attached management letter and the conclusions expressed in it.

Consistent with our responsibility under the Inspector General Act, we will provide copies of our report to appropriate congressional committees with oversight and appropriation responsibility over the Department of Homeland Security. We will post the report on our website for public dissemination. Please call me with any questions, or your staff may contact Paul Wood, Acting Deputy Assistant Inspector General for Audits, at (202) 254-4100. Attachment December 8, 2014 Office of Inspector General U.S. Department of Homeland Security, and Chief Financial Officer U.S. Department of Homeland Security, U.S. Citizenship and Immigration Services Washington, DC Ladies and Gentlemen: In planning and performing our audit of the consolidated financial statements of the U.S. Department of Homeland Security (DHS or Department), as of and for the year ended September 30, 2014, in accordance with auditing standards generally accepted in the United States of America; the standards applicable to financial audits contained in Government Auditing Standards issued by the Comptroller General of the United States; and Office of Management and Budget (OMB) Bulletin No. 14-02, Audit Requirements for Federal Financial Statements, we considered the Department’s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the consolidated financial statements.

In conjunction with our audit of the consolidated financial statements, we also performed an audit of internal control over financial reporting in accordance with attestation standards established by the American Institute of Certified Public Accountants. The U.S. Citizenship and Immigration Services (USCIS) is a component of DHS. During our audit we noted certain matters involving internal control and other operational matters, related to USCIS, that are presented for your consideration. These comments and recommendations, all of which have been discussed with the appropriate members of management, are intended to improve internal control or result in other operating efficiencies.

These matters are summarized in the Table of Financial Management Comments on the following pages. The disposition of each internal control deficiency identified during our FY 2014 audit – as either reported in our Independent Auditors’ Report, or herein as a financial management letter comment – is presented in Appendix A. Our findings related to information technology systems have been presented in a separate letter to the DHS Office of Inspector General, the USCIS Chief Information Officer and Chief Financial Officer. Our audit procedures are designed primarily t o enable us to form an opinion on the financial statements and on the effectiveness of internal control over financial reporting, and therefore may not bring to light all weaknesses in policies or procedures that may exist. We aim, however, to use our knowledge of USCIS’s organization gained during our work to make comments and suggestions that we hope will be useful to you.

We would be pleased to discuss these comments and recommendations with you at any time. The purpose of this letter is solely to describe comments and recommendations intended to improve internal control or result in other operating efficiencies. Accordingly, this letter is not suitable for any other purpose. Very truly yours, KPMG LLP Suite 12000 1801 K Street, NW Washington, DC 20006 KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative (“KPMG International”), a Swiss entity.

U.S. Citizenship and Immigration Services Table of Financial Management Comments September 30, 2014 TABLE OF FINANCIAL MANAGEMENT COMMENTS (FMC) Comment Reference FMC 14-01 FMC 14-02 FMC 14-03 FMC 14-04 FMC 14-05 Subject Deficiencies in the Recording of Property, Plant, and Equipment Deficiencies in the Timely Recording of Obligations Deficiencies in the Approval of Apportionment Entries to Federal Financial Management System (FFMS) Inaccurate and Unsupported Data in the CLAIMS 3 CLAIMS 4 and MFAS Systems Deficiencies in the Public and Confidential Financial Disclosure Financial Reporting Process Appendix Subject APPENDIX A Crosswalk – Financial Management Comments to Active Notices of Finding and Recommendation (NFRs) Page 2 2 3 3 5 Page 6 1 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2014 FMC 14-01 – Deficiencies in the Recording of Property, Plant, and Equipment (Notice of Finding and Recommendation (NFR) No. U.S. Citizenship and Immigration Services (USCIS) 14-01) During the review of prior period adjustments, we identified the following: • The development of National Appointment Scheduling System Release 1.0.0.0 was not recorded timely and costs were not properly capitalized. • The disposal of Requirements Improvement Program Release 1.0 was not recorded timely and internal use software was overstated. • The acquisition and depreciation of equipment was not recorded timely. We performed testwork over internal use software additions as of June 30, 2014 and noted the following: • The deployment of Enterprise Service Bus – Lockbox Intake Service Release 2.0 was not recorded timely. • The deployment of Freedom of Information Processing System Release 7.1 was not recorded timely. Recommendations: We recommend that USCIS: • Continue with its newly established Release Planning Review approval process, as documented in the revised Office of Information Technology internal use software Standard Operating Procedure dated April 1, 2014. The newly established Release Planning Review approval process requires that internal use software reportable releases are identified prior to the onset of any software development efforts and therefore mitigates the re-occurrence of this condition. • Ensure personnel are aware of policies and procedures related to the receipt of assets, and change in the status of assets.

This includes the deployment of software or the impairment or disposal of an asset, which must be reported, recorded, and documented at the time the asset was received or the status changed. Those personnel identified as having responsibility for this reporting must complete available property management training. FMC 14-02 – Deficiencies in the Timely Recording of Obligations (NFR No. USCIS 14-02) During testwork over 21 undelivered orders selected as of June 30, 2014, we noted that the obligation was signed on September 30, 2013, however the funds were not obligated within the general ledger until November 27, 2013. Additionally, the period of performance began and services were rendered prior to obligation in the general ledger on October 1, 2013.

2 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2014 Recommendation: We noted that policies and procedures were established April 30, 2014, which address the condition of this finding. However, we recommend that the Financial Compliance and Systems Branch evaluate the design and effectiveness of the established procedures through the mission action plan process. FMC 14-03 – Deficiencies i n the Approval of Apportionment Entries to Federal Financial Management System (NFR No. USCIS 14-04) Two apportionment transactions out of a sample of 43 were not reviewed and approved by a supervisor prior to recording the transaction in the Federal Financial Management System (FFMS). The transactions were posted to the general ledger on May 27, 2014; however, the physical print out of the Apportionment Transaction Screen was never reviewed and approved by a supervisor.

As a result, $304.9 million was apportioned in the incorrect quarter, prior to being detected and corrected on the same day. Recommendations: We recommend that USCIS: • Ensure all employees with responsibility for entering apportionment transactions in the general ledger are aware of and implement the procedures outlined in the Budget Manual. • Supervisory Budget Analysts continue to monitor apportionments to ensure compensating controls are functioning effectively. FMC 14-04 – Inaccurate and Unsupported Data in the CLAIMS 3 CLAIMS 4 and MFAS Systems (NFR No. USCIS 14-04) We conducted testwork over the FY 2014 third quarter floor-to-list audit and noted the following: • One sample item was not included within the Citizenship and Immigration Services Centralized Oracle Repository deferred revenue universe, the system used to generate the deferred revenue population from the CLAIMS 3 system. The file was present in the CLAIMS 3 system mainframe, but was not properly extracted by Citizenship and Immigration Services Centralized Oracle Repository because it had a status of “0” or “unknown.” We conducted testwork over the FY 2014 third quarter list-to-floor audit and noted the following: • For two of the 680 samples, we reviewed the physical application and determined one application was adjudicated and another application was not adjudicated as of May 20, 2014.

However, USCIS's sampling results included a different status as of May 20, 2014. 3 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2014 • For 139 of the 680 samples, USCIS was unable to provide a physical application to support the applications’ status. We noted that it was USCIS’s policy to treat all unsupported samples as “not pending.” • For five of the 680 samples, the fee per the sam ple did not agree to the fee per the historic fee table, based on the form type and receipt date. USCIS was unable to provide support for these as the fee per the sample related to older applications. • For 94 of the 680 samples, the samples were listed as pending i n the application tracking system but we determined that these samples were not pending based on review of the physical application.

Of these samples, USCIS identified 94 of them to be not pending. This indicated that the information in the application tracking systems, CLAIMS 3, CLAIMS 4 and MFAS, was not reliable for financial reporting purposes and that there are deficiencies in the internal controls that govern the information in these systems, resulting in the need for the deferred revenue estimation methodology. • The deferred revenue quarterly sampling and verification process identified discrepancies in the status of applications where errors between the system query results and the hard copy application exist; however, all identified errors were not corrected within the systems. Although consideration of the faulty data was included in the monthly estimation of deferred revenue, the inclusion of faulty data presented an environment where the conditions in the NFR will be present in subsequent quarterly sampling and verification. We conducted test work over the FY 2014 4th quarter list-to-floor audit and noted the following: • For one of the 45 samples, the fee per the sample did not agree to the fee per the historic fee table.

USCIS was unable to provide an explanation or support for the difference related to an older application. Recommendations: We recommend that USCIS: Related to sampling methodology: • Consult statisticians to verify the adequacy of the existing sample design and implement recommended changes for FY 2015, improving efficiency in both the sample selection and field verification process. Consider the following: o Analyzing year over year changes to assess if changes to sample design need to be made. Additionally, quarter over quarter assessments should be made to adjust sample sizes within the year if needed. o Demonstrating, on a quarterly basis, that the proposed sample design meets the Standard Operating Procedure (SOP) requirements of sub-sections 4.4.1.2a – c. 4 U.S. Citizenship and Immigration Services Financial Management Comments September 30, 2014 o USCIS should document the precision it is targeting and factor in an expected error rate during their sample design to show that the sample design meets its precision targets at the associated confidence level.

If USCIS uses the same sample design and sample sizes year over year, implement a procedure to perform an analytical analysis to prove the assertions in their SOP. o o Demonstrating the adequacy of the sample sizes based on current analysis, including determining whether an adjustment to the distribution of the sample by reallocating the total sample size to provide additional coverage over certain strata, which may help achieve an overall tighter precision estimate. o Reassessing the sample design in FY 2015 to ensure its targeted projections and precisions do not exceed an established internal materiality threshold. o Ensuring the standard deviation used in the projected calculation of precision reflects the entire sample. o Projecting the difference in audit amount (error) rather than the audit amount currently used, as the key test indicator for this area is the potential adjustment.  Continue to increase the number and type of applications required to be processed through Electronic Immigration System (ELIS) and ensure the application will allow for the direct reporting of deferred revenue. The controls over the application status should eventually allow USCIS to retire their legacy tracking systems and replace their current estimation process. FMC 14-05 – Deficiencies in the Public and Confidential Financial Disclosure Financial Reporting Process (NFR No. USCIS 14-05)  During testwork over Office of Government Ethics (OGE) Form 278 financial disclosure reports, we noted one of the 15 samples was not reviewed and certified by the Ethics Officer within 60 days of filing.  During testwork over OGE Form 450 financial disclosure reports, we noted eight of the 25 samples were not reviewed and certified by the Ethics Officer within 60 days of filing. Recommendations: We recommend that USCIS:  Ensure that necessary enhancements are made to their policies and procedures to ensure the timely notification to and submission by employees of OGE Forms 450 and 278.  Ensure all employees with responsibility for completing or reviewing the financial disclosure reports are aware of and implement the policies and procedures.

5 U.S. Citizenship and Immigration Services Crosswalk – Financial Management Comments to Active NFRs September 30, 2014 Appendix A Description MW SD NC No. Disposition1 IAR FMC Component USCIS NFR No. 14-01 Deficiencies in the Recording of Property, Plant, and Equipment USCIS 14-02 Deficiencies in the Timely Recording of Obligations USCIS 14-03 USCIS 14-04 USCIS 14-05 Deficiencies in the Approval of Apportionment Entries to FFMS Inaccurate and Unsupported Data in the CLAIMS 3 CLAIMS 4 and MFAS Systems Deficiencies in the Public and Confidential Financial Disclosure Financial Reporting Process 14-01 14-02 14-03 14-04 14-05 1Disposition Legend: IAR FMC MW components SD Independent Auditors’ Report dated November 13, 2014 Financial Management Comment Contributed to a Material Weakness at the Department level when combined with the results of all other Contributed to a Significant Deficiency at the Department level when combined with the results of all other components Contributed to Non-Compliance with laws, regulations, contracts, and grant agreements at the Department level when combined with the results of all other components Notice of Finding and Recommendation NC NFR Cross-reference to the applicable sections of the IAR: A B C D E F G H I J K Financial Reporting Information Technology Controls and Financial Systems Functionality Property, Plant, and Equipment Budgetary Accounting Entity-Level Controls Grants Management Custodial Revenue and Drawback Federal Managers’ Financial Integrity Act of 1982 (FMFIA) Single Audit Act Amendments of 1996 Antideficiency Act, as amended (ADA) Federal Financial Management Improvement Act of 1996 (FFMIA) 6 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix A Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs U.S. Citizenship and Immigration Services Director Chief Financial Officer Audit Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees www.oig.dhs.gov OIG-15-72 ADDITIONAL INFORMATION AND COPIES To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: [email protected]. Follow us on Twitter at: @dhsoig.

OIG HOTLINE

To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305