Final 33961WDC_NRCS_Annual Report.pdf

United States Department of Agriculture

Office of Inspector General

United States Department of Agriculture

Natural Resources Conservation Service

Audit Report

For the Year Ended September 30, 2011

Table of Contents

Report Area Page

Independent Auditors’ Report .......................................................................................................... A-1

Exhibit I – Material Weaknesses ............................................................................................ B-1

Exhibit II – Significant Deficiencies ....................................................................................... C-1

Exhibit III – Compliance with Laws and Regulations ............................................................ D-1

Exhibit IV – Status of Prior Year Material Weaknesses and Significant Deficiencies ............E-1

Exhibit V – Status of Prior Year’s Non-Compliance Findings ................................................ F-1

Exhibit VI – Management’s Response.................................................................................... G-1

Financial Statements (Unaudited)

Table of Contents

Management’s Discussion and Analysis

Financial Statements

Notes to the Financial Statements

Required Supplementary Stewardship Information (Unaudited)

Human Capital

Research and Development

Required Supplementary Information (Unaudited)

Deferred Maintenance

Statement of Budgetary Resources by Major Budget Account

A-1

Independent Auditors’ Report

Chief, Natural Resources Conservation Service and Inspector General, United States Department of Agriculture

We were engaged to audit the accompanying balance sheet of the United States Department of Agriculture (USDA) Natural Resources Conservation Service (NRCS) as of September 30, 2011, and the related statement of net cost, changes in net position, and budgetary resources (hereinafter referred to as “financial statements”) for the year then ended. The objective of our engagement was to express an opinion on the fair presentation of these financial statements. We were also engaged to consider the NRCS’s internal control over financial reporting and tested the NRCS’s compliance with certain provisions of applicable laws, regulations, and contracts that could have a direct and material effect on these financial statements.

Summary

As stated in our opinion on the financial statements, the scope of our work was not sufficient to enable us to express, and we do not express, an opinion on the financial statements as of and for the year ended September 30, 2011.

Our consideration of internal control over financial reporting resulted in identifying certain deficiencies that we consider to be material weaknesses and other deficiencies that we consider to be significant deficiencies, as defined in the Internal Control Over Financial Reporting section of this report, as follows:

Material Weaknesses

1 Improved Accounting and Controls Are Needed Over Undelivered Orders

2 Improved Accounting and Controls Are Needed Over Accrued Expenses

3 Improved Controls Are Needed Over Financial Reporting

4 Improved Accounting and Controls Are Needed for Property, Plant and Equipment

5 Improved General and Application Access Controls Are Needed

Significant Deficiencies

6 Continued Improvement in Accounting and Controls Are Needed Over the Revenue and Unfilled Customer Orders

7 Continued Improvement in Controls Are Needed Over Purchase and Fleet Card Transactions

KPMG LLP

2001 M Street, NW Washington, DC 20036-3389

KPMG LLP is a Delaware limited liability partnership, the U.S. member firm of KPMG International Cooperative (“KPMG International”), a Swiss entity.

USDA Natural Resources Conservation Service November 4, 2011

A-2

The results of our tests of compliance with certain provisions of laws, regulations, and contracts disclosed the following instances of noncompliance or other matters that are required to be reported under Government Auditing Standards, issued by the Comptroller General of the United States, and Office of Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements for Federal Financial Statements, as amended.

Noncompliance

8 NRCS Did Not Substantially Comply with the Federal Financial Management Improvement Act of

1996 (FFMIA)

Other Matter

We identified a matter that may be reported as a violation of the Merit System principles of 5 U.S.C., Section 2301 that has been referred to NRCS and OIG. The outcome of this matter, and any resulting ramifications, is not presently known.

Had we been able to perform all of the procedures necessary to express an opinion on NRCS’s fiscal year 2011 financial statements, other internal control matters and other instances of noncompliance may have been identified and reported.

The following sections discuss the reasons why we are unable to express an opinion on NRCS’s financial statements; our consideration of the NRCS’s internal control over financial reporting; our tests of NRCS’s compliance with certain provisions of applicable laws, regulations, and contracts; and management’s and our responsibilities.

Opinion on the Financial Statements

We were engaged to audit the accompanying balance sheet of NRCS as of September 30, 2011, and the related statement of net cost, changes in net position, and budgetary resources for the year then ended.

NRCS was unable to provide sufficient evidential matter in support of certain transactions and account balances, as presented in the NRCS financial statements as of and for the year ended September 30, 2011, particularly with respect to beginning net position balances and current year activity; obligations incurred, including accrued expenses and undelivered orders; leases; real and personal property; recoveries of prior year unpaid obligations; advances to others; and stewardship land. NRCS was unable to complete corrective actions and make adjustments, as necessary, to these and other financial statement amounts prior to the contractually required completion date of the engagement.

It was impracticable to extend our audit procedures sufficiently to determine the extent to which NRCS’s financial statements as of and for the year ended September 30, 2011 may have been affected by the matters discussed in the preceding paragraph; accordingly, the scope of our work was not sufficient to enable us to express, and we do not express, an opinion on the accompanying financial statements as of and for the year ended September 30, 2011.

The information in the Management’s Discussion and Analysis, Required Supplementary Information, and Required Supplementary Stewardship Information sections is not a required part of the financial statements, but is supplementary information required by U.S. generally accepted accounting principles.

A-3

We have applied certain limited procedures, which consisted principally of inquiries of management regarding the methods of measurement and presentation of this information. However, we did not audit this information and, accordingly, we express no opinion on it.

Internal Control Over Financial Reporting

Our consideration of internal control over financial reporting was for the limited purpose described in the Responsibilities section of this report and was not designed to identify all deficiencies in internal control over financial reporting that might be significant deficiencies or material weaknesses and therefore, there can be no assurance that all deficiencies, significant deficiencies, or material weaknesses have been identified. However, in our fiscal year 2011 engagement to audit, we identified certain deficiencies in internal control over financial reporting that we consider to be material weaknesses and other deficiencies that we consider to be significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis. We consider the deficiencies described in Exhibit I to be material weaknesses.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. We consider the deficiencies described in Exhibit II to be significant deficiencies.

We noted certain additional matters that will be reported to management of NRCS in a separate letter dated November 4, 2011.

Exhibit IV presents the status of prior year significant deficiencies and material weaknesses.

Compliance and Other Matters

The results of certain of our tests of compliance as described in the Responsibilities section of this report, exclusive of those referred to in FFMIA, disclosed one instances of noncompliance or other matters that are required to be reported herein under Government Auditing Standards or OMB Bulletin No. 07-04, as amended and is described below.

We identified a matter that may be reported as a violation of the Merit System principles of 5 U.S.C., Section 2301 that has been referred to NRCS and Office of Inspector General (OIG). The outcome of this matter, and any resulting ramifications, is not presently known.

The results of our other tests of compliance as described in the Responsibilities section of this report, exclusive of those referred to in FFMIA, disclosed no instances of noncompliance or other matters that are

A-4 required to be reported herein under Government Auditing Standards or OMB Bulletin No. 07-04, as amended.

The results of our tests of FFMIA disclosed instances in which the NRCS’s financial management systems did not substantially comply with the (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, and (3) the United States Government Standard General Ledger at the transaction level.

Responsibilities

Management’s Responsibilities. Management is responsible for the financial statements; establishing and maintaining effective internal control; and complying with laws, regulations, and contracts applicable to

NRCS.

Auditors’ Responsibilities. As discussed in the report on the financial statements section, the scope of our work was not sufficient to enable us to express, and we do not express, an opinion on the accompanying financial statements of NRCS as of and for the year ended September 30, 2011. We conducted our engagement in accordance with auditing standards generally accepted in the United States of America; the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States; and OMB Bulletin No. 07-04, as amended. Those standards and OMB Bulletin No. 07-04, as amended, require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes consideration of internal control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of NRCS’s internal control over financial reporting. Accordingly, we express no such opinion.

An audit is planned to include:

• Examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements;

• Assessing the accounting principles used and significant estimates made by management; and

• Evaluating the overall financial statement presentation.

In connection with our fiscal year 2011 engagement, we considered the NRCS’s internal control over financial reporting by obtaining an understanding of the NRCS’s internal control, determining whether internal controls had been placed in operation, assessing control risk, and performing tests of controls as a basis for designing our auditing procedures, but not for the purpose of expressing an opinion on the effectiveness of the NRCS’s internal control over financial reporting. Accordingly, we do not express an opinion on the effectiveness of the NRCS’s internal control over financial reporting. Furthermore, had we been able to perform all of the procedures necessary to express an opinion on the financial statements of NRCS as of and for the year ended September 30, 2011, other matters involving internal control over

A-5 financial reporting may have been identified and reported. We did not test all controls relevant to operating objectives as broadly defined by the Federal Managers’ Financial Integrity Act of 1982.

In connection with our engagement, we performed tests of the NRCS’s compliance with certain provisions of laws, regulations, and contracts, noncompliance with which could have a direct and material effect on the determination of the financial statement amounts, and certain provisions of other laws and regulations specified in OMB Bulletin No. 07-04, as amended, including the provisions referred to in Section 803(a) of FFMIA. We limited our tests of compliance to the provisions described in the preceding sentence, and we did not test compliance with all laws, regulations, and contracts applicable to NRCS. Had we been able to perform all of the procedures necessary to express an opinion on the financial statements of NRCS as of and for the year ended September 30, 2011, other matters involving compliance with laws, regulations, and contracts may have been identified and reported. Providing an opinion on compliance with laws, regulations, and contracts was not an objective of our audit and, accordingly, we do not express such an opinion.

The NRCS’s response to the findings identified in our audit is presented in Exhibit VI. We did not audit the NRCS’s response and, accordingly, we express no opinion on it.

This report is intended solely for the information and use of the NRCS’s management, the USDA’s Office of Inspector General, OMB, the U.S. Government Accountability Office, and the U.S. Congress and is not intended to be and should not be used by anyone other than these specified parties.

Exhibit I

Material Weaknesses

B-1

Number 1: Improved Accounting and Controls Are Needed Over Undelivered Orders (Repeat Condition)

During our internal control testing of undelivered orders (UDOs) in fiscal year (FY) 2011, we noted that:

• Field personnel did not consistently and/or accurately review UDO balances;

• Obligations were not approved by the budget officer before the obligation document was signed and obligated in the accounting system;

• Easement disbursements were made against expired obligations; and

• Advances were not recorded to the correct general ledger account.

In addition to our controls testwork, we identified the following substantive exceptions that are indicative of control deficiencies that have an impact on UDOs:

• From a population of 197 recoveries of prior year unpaid obligations during the period 10/1/10 to

9/30/11, we identified 46 that were invalid and 17 that should have been recorded in a prior fiscal year;

• From a population of 99 open obligations as of September 30, 2011, we identified 12 that were invalid including accruals made at year-end that impacted the open obligation balance; and

• From a population of 31 open advances to others as of August 31, 2011, we identified eight invalid open balances. Additionally, our disbursement testwork identified instances where advances were not complete during FY 2011.

We were unable to conclude on the results of our testwork over undelivered orders, advances to others or recoveries of prior year unpaid obligations due to the materiality of identified differences. The control errors noted in our testwork increase the risk of an Anti-Deficiency Act violation.

The Federal Financial Management Improvement Act (FFMIA) requires each agency to implement and maintain systems that comply substantially with Federal Financial Management systems requirements, applicable Federal accounting standards, and the standard general ledger (SGL) at the transaction level.

The Anti-Deficiency Act states that “an officer or employee of the United States Government or of the District of Columbia government may not make or authorize an expenditure or obligation exceeding an amount available in an appropriation or fund for the expenditure or obligation.”

Office of Management and Budget (OMB) Circular A-123, Management’s Responsibility for Control states that transactions should be promptly recorded, properly classified and accounted for in order to prepare timely accounts and reliable financial and other reports.”

Recommendation 1:

In addition to recommendation 1 from our FY 2009 and FY 2010 audit report, we recommend that NRCS management:

• Provide additional training to field personnel related to the identification and recording of advances and disbursements; and

• Provide guidance and policy to field personnel relating to the monitoring and validation of the obligation’s period of performance prior to payment.

B-2

Number 2: Improved Accounting and Controls Are Needed Over Accrued Expenses (Repeat Condition)

During our walkthrough of internal controls for accrued expenses during FY 2011, we noted that:

• State offices lacked internal controls over the completeness of accrued expenses;

• Expense accruals were recorded incorrectly or were inappropriate;

• Valid support for expense accruals from third parties was not obtained or available.

In addition to our controls testwork, we identified the following substantive exceptions that are indicative of control deficiencies that have an impact on accrued expenses:

• From a population of 190 detail accrued expense balances as of September 30, 2011, we identified 61 that were unsupported; adjustments that should have been recorded as obligations; or the related goods or services were already disbursed;

• From a population of 169 easement disbursements during the period 10/1/10 to 9/30/11, we identified five that included disbursements made against expired Agreements to Purchase or an advance that was improperly recorded as a delivered order;

• From a population of 164 other procurement disbursements during the period 10/1/10 to 9/30/11, we identified ten exceptions that were not adequately supported or related to an invalid adjustment which misstated the general ledger account;

• From a population of 90 non-routine procurement disbursements during the period 10/1/10 to 9/30/11, we identified 12 that were not adequately supported; and

• Our testwork of expenses and disbursements during FY 2011 identified expenses recorded to the wrong FY due to incomplete accruals as of September 30, 2010.

Additional testwork determined that the accrued expense balance as of September 30, 2011 was incomplete.

From a population of 64 disbursements during the period 10/1/10 to 9/30/11, we identified 22 that did not include, or had entered, an incorrect acceptance date into the Foundation Financial Information System (FFIS), misstated interest for late payments, or lacked supporting documentation for an actual disbursement.

We were unable to conclude on the results of our testwork over accrued expenses due to the materiality of identified differences. The control errors noted in our testwork increase the risk of non-compliance with the Prompt Payment Act.

In accordance with Statement of Federal Financial Accounting Standards (SFFAS) Number (No.) 1 paragraphs 74 and 77, “Accounts payable are amounts owed by a federal entity for goods and services received from, progress in contract performance made by, and rents due to other entities…When an entity accepts title to goods, whether the goods are delivered or in transit, the entity should recognize a liability for the unpaid amount of the goods. If invoices for those goods are not available when financial statements are prepared, the amounts owed should be estimated.”

Per SFFAS No. 5, Accounting for Liabilities of the Federal Government, paragraphs 19 and 25, “A liability for federal accounting purposes is a probable future outflow or other sacrifice of resources as a result of past transactions or events. General purpose federal financial reports should recognize probable and measurable future outflows or other sacrifices of resources arising from (1) past exchange transactions, (2) government-related events, (3) government-acknowledged events, or (4) non-exchange

B-3 transactions that, according to current law and applicable policy, are unpaid amounts due as of the reporting date.”

Code of Federal Regulations Title 5, Part 1315: Prompt Payment requires “Executive departments and agencies to pay commercial obligations within certain time periods and to pay interest penalties when payments are late. Interest is computed from the day after the due date through the payment date, at the rate in effect on the day payment becomes overdue. Interest remaining unpaid for any 30-day period will be added to the principal, and interest thereafter will accrue monthly on the total of principal and previously accrued interest. Section 1315.4(b) of the rule provides that an invoice is deemed to be received on the later of 1) the date a proper invoice is received by an agency if the agency annotates the invoice with the date of receipt, or 2) the seventh day after the date in which goods are delivered or services completed, unless acceptance occurs earlier or if a longer acceptance period is specified in the contract. If the agency fails to annotate an invoice with the date of receipt of the invoice, the date placed on the invoice by the contractor is used to determine the start date for the payment period.”

Recommendation 2:

In addition to recommendation 3 from our FY 2009 and FY 2010 audit report, we recommend that NRCS management:

• Reduce the number of standard voucher and year end accruals required by configuring systems to record accruals when goods/services are receipted in the application, where there is a cost benefit;

• Enhance monitoring internal controls over obligations and payment approvals to determine whether appropriate documentation is provided to support the obligation and disbursement;

• Utilize transaction codes in FFIS to record accruals that do not reverse for direct entry obligations;

and

• Provide guidance on the Prompt Payment Act related to the entry of acceptance dates and determine if additional interest is due to vendors or whether the vendor was overpaid as a result of any errors.

Number 3: Improved Controls Are Needed Over Financial Reporting (Repeat Condition)

During our FY 2011 engagement, we identified the following financial reporting weaknesses:

• Stewardship land information, comprised of conservation easements, is incomplete and inaccurate;

• NRCS did not have consistent monitoring controls to determine the condition of stewardship land;

• NRCS was unable to determine deferred maintenance costs as of September 30, 2011;

• The annual performance measures reported in the Management Discussion and Analysis (MD&A) were not clearly aligned with the current strategic plan that includes long term performance measures as of June 30, 2011. This was subsequently corrected by management within the MD&A as of September 30, 2011;

• NRCS did not have adequate internal controls over the Fund Balance with Treasury reconciliation;

• An apportionment was not approved by the OMB before being apportioned in FFIS;

• NRCS recorded anticipated resources into FFIS without an OMB approved Standard Form (SF)-132;

• NRCS recognized disbursing authority for a particular Treasury Appropriation Fund Symbol (TAFS) which has an open obligation past five years as no-year funds, and manually reclassifies amounts that post to the unapportioned authority and apportioned authority accounts to expired authority; and

• From a population of 524 standard voucher manual journal entries during the period 10/1/11 to 10/14/11, we identified 41 that were either processed without adequate supporting documentation or improperly recorded into the accounting system.

B-4

SFFAS No. 29, Heritage Assets and Stewardship Land, paragraph 41 states that “entities should report the condition of stewardship land as required supplementary information” (RSI) to the financial statements. In addition, it states that entities should report “the number of physical units by major category of stewardship land use for which the entity is the steward at the end of the reporting period” as well as “the number of physical units by major category of stewardship land use that were acquired and the number of physical units by major category of stewardship land use that were withdrawn during the reporting period.”

SFFAS No. 6, Accounting for Property, Plant and Equipment, paragraph 83 lists the information that is required for disclosure relating to deferred maintenance.

Treasury Financial Manual (TFM), Part 2, Chapter 4200 directs agencies on how to report their year end closing data into the FACTS II system. Section 4225.35a, Receivables, states that agencies should “exclude any receivable from the public, except when a provision of law specifies that such orders may be used as budget authority. Unfilled customer orders do not exist for orders placed by the public, since agencies must receive advances with the orders for goods or services from the public.” The United States SGL (USSGL) provides additional posting model and general ledger guidance for all financial transactions.

Recommendation 3:

In addition to recommendation 4 from our FY 2009 and FY 2010 audit report, we recommend that NRCS management:

• Enforce NRCS’s Circular 21 to ensure condition assessment policies and procedures are compliant with SFFAS No. 29;

• Incorporate agency accountability measures at the state office level to track adherence to monitoring policy in determining the condition of stewardship land;

• Continue development of a methodology to collect data and properly report deferred maintenance information in future years in accordance with U.S. generally accepted accounting principles (US

GAAP);

• Implement a second level review and approval for apportionments entered into FFIS prior to posting that includes the agreement of the entry to a OMB approved SF-132;

• Apportion anticipated resources with OMB that NRCS plans to record in FFIS;

• Continue to timely correct expired transactions that post to current authority general ledger accounts in FFIS;

• Implement procedures to eliminate the need to record a large amount of adjustments at the end of the year;

• Establish policies/guidelines that assist accounting personnel in properly determining what constitutes necessary and sufficient supporting documentation for recorded manual adjustments; and

• Enhance the design of management review of standard voucher entries to include obtaining and inspecting supporting documentation.

B-5

Number 4: Improved Accounting and Controls Are Needed for Property, Plant, and Equipment (Repeat Condition)

During our FY 2011 internal control and substantive testwork over general property, plant and equipment (PP&E), we noted the following:

Real and Personal Property

• Duties were not appropriately segregated allowing one individual to acquire, inventory, and certify to the completeness of personal property inventory;

• The property inventory process failed to identify real and personal property items that existed, but were not included in the inventory listing;

• The inventory process failed to recognize items on the Personal Property Report (PROP) that no longer existed;

• A lack of accounting guidelines surrounding leasehold improvements;

• Information Technology (IT) property does not have an adequate tracking system to ensure items are properly omitted from PROP;

• NRCS was unable to provide supporting documentation for real and personal property balances and/or the date placed in service;

• Capitalized assets included items below the agency’s capitalization threshold as a result of an incorrect budget object code (BOC) causing inaccurate accumulated depreciation and net book value;

and

• Amounts were included in acquisition costs that should have been expensed and not capitalized.

Capital Leases

In testing internal controls over leases, we determined that NRCS lacks consistent application of its reconciliation control between the lease database and the records at the state office level and the review of the lease reconciliation reports are not evidenced. Additionally, testwork during field site visits identified 21 exceptions in 85 sampled items where leases recorded in FFIS were not included, over-obligated, or under-obligated, and lease amounts and/or start/end dates were not accurate in the lease database.

Our testwork over capital and operating leases as of July 31, 2011 identified 22 exceptions in 61 sampled items where the lease was either improperly classified, not adequately supported, or the capital lease asset and liability balance was incorrect.

NRCS has not implemented a procedure that determines the budgetary impact of leases that may be classified differently under OMB Circular A-11, Preparation, Submission and Execution of the Budget and SFFAS No. 6, Accounting for Property, Plant and Equipment criteria.

We were unable to conclude on the results of our testwork over real and personal property and leases due to the combination of the range of errors in the populations and incomplete databases.

OMB Circular A-123, Management’s Responsibility for Internal Control states that management has a fundamental responsibility to develop and maintain effective internal control.

SFFAS No. 6, Accounting for Property, Plant, and Equipment, states that “general PP&E shall be recorded at cost. Cost shall include all costs incurred to bring the PP&E to a form and location suitable for its intended use. PP&E shall be recognized when title passes to the acquiring entity or when the PP&E is delivered to the entity or to an agent of the entity. In the case of constructed PP&E, the PP&E

B-6 shall be recorded as construction in progress until it is placed in service, at which time the balance shall be transferred to general PP&E.”

SFFAS No. 6, paragraph 20, identifies the 4 criteria for classification of capital and operating leases.

Additionally, SFFAS No. 6 it states that “the present value of rental and other minimum lease payments (should exclude) that portion of the payments representing executory cost.”

SFFAS No. 5, paragraphs 45 and 46 identifies the “discount rate to be used in determining the present value of the minimum lease payments ordinarily would be the lessee's incremental borrowing rate unless

(1) it is practicable for the lessee to learn the implicit rate computed by the lessor and (2) the implicit rate computed by the lessor is less than the lessee's incremental borrowing rate. If both these conditions are met, the lessee shall use the implicit rate.”

OMB A-11 identifies six criteria that a lease must meet in order to be considered an operating lease rather than a capital lease.

Recommendation 4:

In addition to recommendation 5 from our FY 2009 and 2010 audit report, we recommend that NRCS management:

• Develop in coordination with the Department Chief Information Officer (CIO) a reconciliation process for State offices to utilize to reconcile between the International Technology Services (ITS) property report and State inventory reports;

• Develop a policy and procedure to identify and account for leasehold improvements;

• Continue to train budget, program, and field office personnel to properly establish obligations depending upon the lease type;

• Develop and implement a system or tracking tool to timely identify upcoming lease end dates to determine whether amendments/renewals are needed and update the Corporate Property Automated Information System (CPAIS)/FFIS accordingly in a timely manner;

• Provide training to personnel in the state offices responsible for the accounting of real and personal property including an in depth training on the functionality of the PROP system. This training should include, but not be limited to, application procedures to ensure personnel are entering the correct BOC into PROP, guidance on how to individually enter items into PROP that are bundled together under one invoice or purchase order, and how to recognize what costs should be capitalized or expensed;

• Develop a procedure to obtain reasonable estimates in data where the lessor has not provided adequate documentation; and

• Determine if any lease classifications will change for budgetary purposes based on capital lease criteria differences between OMB A-11 and SFFAS No. 6.

Number 5: Improved General and Application Access Controls Are Needed (Repeat Condition)

USDA International Technology Services IT General Controls

At the Department level, the USDA OIG identified IT general control deficiencies at ITS, a service organization within USDA as part of their FY 2010 review. ITS manages the network/server infrastructure that supports major applications at NRCS. KPMG performed testing in FY 2011 and identified similar control weaknesses identified by the USDA OIG in FY 2010, including weaknesses in logical access.

B-7

Actions to resolve the conditions in the ITS IT general controls environment are critical to ensuring the protection of critical NRCS applications, resources and data.

NRCS IT General Controls

In testing general and application access controls at NRCS during FY 2011, we noted the following deficiencies:

Remote Access

NRCS has not implemented multi-factor authentication when signing or logging in for remote access.

Application-Level Access

• NRCS does not have a formal process to request access to zRoles (a user account/role management application used for ProTracts and Fund Manager);

• NRCS does not have a formal process to periodically review access to zRoles accounts;

• From a population of NRCS Easement Staging Tool (NEST) accounts, five NRCS separated employees retained access to their NEST accounts after the date of their termination;

• From a population of Active Directory users, 17 either lacked a System Authorization Access Request (SAAR) ticket or supervisor approval on their Access Request forms;

• No formal periodic review of users with Manager/Human Resource (HR) roles in EmpowHR; and

• A formal procedure is not in place with regard to access management for the HR system.

Configuration Management Support System Access

• NRCS does not have a formal process to periodically review users with access to the Administrator within CoLab; and

• The Administrator account within CoLab is a shared account and the password is not changed on a periodic basis.

User Access Management

From a population of Active Directory accounts, ten NRCS separated employees retained access to their Active Directory accounts after the date of their termination.

In addition to our access control testwork, we identified the following control deficiencies that have an impact on general and application access controls:

• No anti-virus software installed on Linux servers (which host the WebTCAS front-end);

• Vulnerability scanning was not performed over the Web Farm for at least 2 months during FY 2011;

• No Linux patches were implemented for at least 3 months during FY 2011;

• Vulnerabilities classified as “High” were not addressed in a timely manner; and

• A Service Level Agreement (SLA), which includes a financial management system, does not include explicit oversight of audit access/audit reporting and separation of employee procedures.

NRCS continues to have weak manual and entity-level controls, which further elevates the severity of the IT application and general control weaknesses. Additionally, access control findings at NRCS and ITS from FY 2008, 2009, and 2010 have not substantially been addressed and corrected.

The following lists criteria associated with the above conditions:

OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources;

B-8

OMB M-07-16, Safeguarding Against and Responding to the Break of Personally Identifiable Information;

National Institute of Standards and Technology (NIST) SP 800-63, Electronic Authentication Guideline;

NIST SP 800-30, Risk Management Guide for Information Technology Systems;

NIST SP 800-40 v.2, Creating a Patch and Vulnerability Management Program;

NIST SP 800-35, Guide to Information Technology Security Services – Developing Service Agreements; and

NIST SP 800-53, Recommended Security Controls for Federal Information Systems.

Recommendation 5:

We recommend that NRCS management:

• Establish controls to monitor the control environment at ITS and mitigate the identified weaknesses;

• Work with ITS to implement two-factor authentication for remote users of NRCS specific applications;

• Monitor and respond promptly to any detected vulnerabilities and determine the impact of these invasions on financially significant systems and information;

• Continue to follow its established process for granting access to ensure that accounts are only granted to appropriate personnel and evidence of such approval is retained;

• Establish formal procedures for requesting and granting access to zRoles;

• Establish formal procedures for reviewing users with zRoles and their roles, HR and manager roles in

EmpowHR, and Administrator accounts within CoLab;

• Install anti-virus software or implement and document compensating controls on Linux servers;

• Develop and implement a process that will timely identify that sufficient amount of licenses are available to perform vulnerability scanning each month. Renew or revise any contracts, etc. as necessary;

• Remediate, appropriately assign, or appropriately document via Exemption Form in a timely manner and according to policy critical vulnerabilities;

• Update SLAs, where applicable, to include provisions around access auditing and separation of employee procedures; and

• Identify any information systems with financial significance which has no formal policies and procedures with regard to access management and establish such formal policies and procedures, including guidelines for account creation, modification, removal, review, monitoring, and any other NIST specified criteria.

Exhibit II

Significant Deficiencies

C-1

Number 6: Continued Improvement in Accounting and Controls Are Needed Over the Revenue and Unfilled Customer Orders (Repeat Condition)

During our test of design over reimbursable agreement controls, we noted that NRCS lacked internal controls over unfilled customer orders, accounts receivable, and revenue during the first two quarters of FY 2011. Specifically,

• Reimbursable agreements were not recorded timely;

• Recorded amounts were inaccurate;

• The funding source was not validated by the budget officer prior to approval and entry to the FFIS;

and

• NRCS did not accrue for revenue earned during the first quarter.

Additionally, we identified two instances where unfilled customer orders were not recorded to FFIS.

During our substantive testing for the period October 1, 2010 to March 31, 2011, we identified 20 instances where the recognition of revenue was incorrect or inadequately supported.

NRCS consolidated the accounting for revenue and reimbursable agreements to three locations during the 3rd quarter of FY 2011. The consolidation to three locations provides an additional control to detect and correct material misstatements. Our testwork during FY 2011 supports the operating effectiveness of the controls performed at the consolidated locations. To further support the improvement in the control environment, our testwork of balances and transactions after consolidation did not identify material misstatements to the revenue, accounts receivable, or unfilled customer order balances.

SFFAS No.7, Accounting for Revenue and Other Financing Sources and Concepts for Reconciling Budgetary and Financial Accounting, states that agencies should “recognize exchange revenue at the time that a Government entity provides goods or services to the public or to another Government entity.”

OMB Circular No. A-123, Management’s Responsibility for Internal Control, states that “management has a fundamental responsibility to develop and maintain effective internal control”.

Recommendation 6:

We recommend that NRCS management:

• Reduce the amount of time needed for National Headquarter approval of delegation of authority for signing that has to be delegated for reimbursable agreements; and

• Implement formal, sustainable reimbursable agreements monitoring controls that operate for the entire

FY.

Number 7: Continued Improvement in Controls Are Needed Over Purchase and Fleet Card Transactions (Repeat Condition)

During our test of design of internal controls over purchase and fleet cards, we noted that:

• Quarterly supervisory review of purchase card transactions was not conducted during the 1st quarter of FY 2011;

• Purchase cardholder transactions were not reconciled within 30 days of the transaction date;

C-2

• Purchase cardholder accounts were not deactivated when there were unreconcilied transactions greater than 60 days;

• Unreconciled transactions cannot be reviewed and approved by the cardholder’s supervisor;

• Two cardholders were issued purchase cards, but had not registered the cards or taken the necessary training;

• One cardholder was a valid cardholder, but did not appear on the purchase card hierarchy listing as of

April 2011;

• One cardholder had registered the purchase card, but NRCS was unable to provide proof of training completion for this individual; and

• Fleet card internal controls had not been implemented at the time of our testwork.

Additionally, our testwork of credit card disbursement for the period April 1, 2011 to July 31, 2011 identified nine instances where NRCS could not provide support that the Approving Official had reviewed and approved the sampled purchase card transactions.

Through our walkthrough of controls, we noted that NRCS implemented properly designed controls which validated purchase card holders in the 3rd quarter of FY 2011. To further support the improvement of internal controls, our testwork over transactions of credit card transactions did not identify material misstatements of credit card disbursements.

OMB Circular No. A-123 states that “management is responsible for developing and maintaining effective internal control.”

USDA Departmental Regulation 5013-6, Office of Procurement and Property Management, paragraph 13, states that “cardholder supervisors will monitor purchasing activity of cardholders in their units.

Supervisors shall review cardholder transaction reports at least quarterly or more often if agency procedures require. On reviewing a cardholder report, the supervisor shall initial it and retain it on file.”

Department Regulation (DR) 5400-006 states that “users of the fleet charge cards or alternative payment methods must submit receipts for purchases. The local fleet program coordinator, an accountable property official, or other management official responsible for the fleet and non-fleet vehicles and motorized equipment must keep all receipts for a minimum of one calendar year in order to maintain an adequate audit trail.”

USDA General Manual Title 120, Part 406.21, Use of Government Purchase Cards, states that “cardholders shall approve their transactions no later than 30 days after a transaction appears. The account of any cardholder who fails to approve transactions within 60 days after each transaction appears in AXOL will be deactivated.”

USDA’s Approving Official Purchase Card Program Guide, section 4.9.B states that “AOs are to ‘final approve’ cardholder transactions within 30 days from when they appear in their ‘Manager’s Approval Queue’.”

Recommendation 7:

We recommend that NRCS management:

• Establish a sustainable control environment for fleet card purchases;

• Ensure compliance with the policy requiring supervisors to perform quarterly reviews;

• Require all cardholders to register cards in the US Bank system; and

C-3

• Ensure compliance with the policy requiring Approving Officials to perform timely reviews of purchase card transactions.

Exhibit III

Compliance with Laws and Regulations

D-1

Number 8: NRCS Did Not Substantially Comply with the Federal Financial Management Improvement Act of 1996 (Repeat Comment)

Compliance with Federal Financial Management System Requirements

During our engagement, we determined that NRCS’s systems are unable to:

• Provide extracts of certain balances at a period of time which resulted in the sampling of transactions;

• Allow for authority beyond ten years of availability; and

• Prevent the recording of invalid upward and downward adjustment to prior year obligations.

These issues were addressed through our recommendations in Exhibit I.

Compliance with Applicable Federal Accounting Standards

During our engagement, we determined that beginning net position balances and current year activity;

obligations incurred, including accrued expenses and undelivered orders; leases; real and personal property; recoveries of prior year unpaid obligations; and advances to others were not properly recorded in accordance with Federal accounting standards. Stewardship information was incomplete and inaccurate, and is not in accordance with SFFAS No. 29. Additionally, NRCS was unable to present deferred maintenance information for real, personal, or stewardship property.

These issues were addressed through our recommendations in Exhibit I.

Compliance with the United States Standard General Ledger (USSGL)

During our engagement, we noted that NRCS did not use USSGL appropriate posting models for recoveries of prior year obligations paid and unpaid.

These issues were addressed through our recommendations in Exhibit I.

Exhibit IV

Status of Prior Year’s Material Weaknesses and Significant Deficiencies

E-1

As required by Government Auditing Standards and OMB Bulletin No. 07-04, Audit Requirements for Federal Financial Statements, as amended, we have reviewed the status of prior year’s significant deficiencies and material weaknesses. The following table summarizes these issues and provides our assessment of the progress NRCS has made in correcting these findings.

Reported Condition Year Identified Fiscal Year 2011 Status Improved Accounting and Controls Are Needed Over Undelivered Orders

2008, 2009, 2010 Material Weakness

Open (FY 2011 MW No.1)

Continued Improvement in Accounting and Controls Are Needed for Unfilled Customer Orders

2008, 2009, 2010 Material Weakness

Open (FY 2011 SD No. 6)

Improved Accounting and Controls Are Needed for Accrued Expenses

2008, 2009, 2010 Material Weakness

Open (FY 2011 MW No. 2)

Improved Accounting and Controls Are Needed for Property, Plant, and Equipment

2008, 2009, 2010 Material Weakness

Open (FY 2011 MW No.4)

Improved Controls Are Needed Over Financial Reporting

2008, 2009, 2010 Material Weakness

Open (FY 2011 MW No.3)

Improved General and Application Access Controls Are Needed

2008 and 2009 Significant Deficiency;

2010 Material Weakness

Open (FY 2011 MW No. 5)

Continued Improvement in Controls Are Needed Over Purchase and Fleet Card Transactions

2008 and 2009 Significant Deficiency;

2010 Material Weakness

Open (FY 2011 SD No. 7)

Exhibit V

Status of Prior Year’s Non-Compliance Findings

F-1

As required by Government Auditing Standards and OMB Bulletin No. 07-04, Audit Requirements for Federal Financial Statements, as amended, we have reviewed the status of prior year’s non-compliance findings. The following table summarizes these issues and provides our assessment of the progress NRCS has made in correcting these findings.

Reported Condition Years Reported Fiscal Year 2011 Status

NRCS Does Not Substantially Comply with Federal Financial Management Improvement Act of 1996

2008, 2009 and 2010 Open/Comment Repeated in 2011

Exhibit VI

G-1

Exhibit VI

G-2

Fiscal Year 2011 Financial Statements

Natural Resources Conservation Service

MANAGEMENT’S DISCUSSION AND ANALYSIS

MISSION AND ORGANIZATIONAL STRUCTURE

Mission Statement Organizational Structure Strategic Planning and Accountability Framework

MISSION GOAL: GET MORE CONSERVATION ON THE GROUND

Performance Scorecard for FY 2011

PERFORMANCE GOALS, OBJECTIVES, AND RESULTS

BUSINESS LINES AND RESOURCES

Business Lines

ANALYSIS OF FINANCIAL STATEMENTS AND STEWARDSHIP INFORMATION

Assets Liabilities Net Position Net Cost of Operations Budgetary Resources

ANALYSIS OF SYSTEMS, CONTROLS AND LEGAL COMPLIANCE

FY 2011 Financial Statement Audit Report Results Federal Managers’ Financial Integrity Act (FMFIA) of 1982 Federal Managers’ Financial Integrity Act Action Plans Compliance with Laws and Regulations Internal Controls over Financial Reporting (OMB Circular‐ A‐123, Appendix A) Federal Financial Management Improvement Act (FFMIA) of 1996 Federal Information Security Management Act (FISMA) of 2002 Improper Payments Elimination and Recovery Act (IPERA) of 2010 Anti‐Deficiency Act Inspector General Act Amendments of 1988 GAO/OIG Active Audits Other Management Information and Initiatives Limitations of Financial Statements

FINANCIAL STATEMENTS

BALANCE SHEET

STATEMENT OF NET COST

STATEMENT OF CHANGES IN NET POSITION

STATEMENT OF BUDGETARY RESOURCES

NOTES TO THE FINANCIAL STATEMENTS FOR THE YEAR ENDED SEPTEMBER 30, 2011

Note 1 – Significant Accounting Policies A. Reporting Entity B. Basis of Presentation and Accounting C. Fund Balance with the U.S. Treasury D. Accounts Receivable E. General Property, Plant, and Equipment, Net F. Other Assets G. Liabilities H. Workers Compensation Liability I. Employee Annual, Sick, and Other Leave J. Pension and Other Retirement Benefits K. Revenues and Other Financing Sources L. Imputed Financing M. Use of Estimates

Note 2 ‐ Fund Balance with Treasury Note 3 – Accounts Receivable, Net Note 4 – General Property, Plant, and Equipment, Net Note 5 – Stewardship PP&E

Stewardship Land

Heritage Assets Note 6 ‐ Other Assets Note 7 – Liabilities Not Covered by Budgetary Resources Note 8 ‐ Other Liabilities Note…