CDRL A028 Attachment 2 - Assertion Control Information (Amendment 0001).docx

DLA Distribution HQs Control Objectives and Risks

FY21 Control Objectives and Risks (Distribution COs 9-17). These are the Control Objectives for which Distribution Centers hold responsibility for ensuring the processes are being performed accurately in accordance with standard operating procedures. COs 1-8 are systemic controls for which the Distribution Center Commanders/Directors do not hold responsibility.

Control Objective 9 – Receipt Recordation and Acceptance – Controls provide reasonable assurance that assets received at DLA for stock are receipted and recorded to DSS completely, accurately, and timely. Further, discrepancies at time of receipt are reported using Supply Discrepancy Reports to the applicable owner/manager.

Risks:

· Items that are offloaded may not be recorded completely, accurately, timely or at all into DSS

· Material not destined for DLA Distribution could be receipted and inducted

· The same material receipt may be inducted into DSS twice.

· Receipts may be incorrectly cancelled

· Receipted assets must be accepted

Control Objective 10 – Completeness of Assets in Storage Locations - Controls provide reasonable assurance that assets in all storage locations are completely and accurately recorded in DSS.

Risks:

· Storage locations may contain an asset that is not recorded in DSS or is recorded inaccurately

· Risk of understatement or inaccurate balance

Control Objective 11 - Existence - Controls provide reasonable assurance that assets recorded in DSS physically exist.

Risks:

· Risk of material on record not existing (overstatement of account balance)

Control Objective 12 – Rights – Controls provide reasonable assurance that assets are completely and accurately recorded to an owner’s balance based upon owner RIC and changes to ownership are appropriately processed timely and authorized when applicable.

Risks:

· Ownership of an asset is incorrectly recorded

· Ownership changes, to include disposals, may not be processed accurately, timely or authorized

Control Objective 13 – Stock Readiness/Asset Condition – Controls provide reasonable assurance that assets in storage remain in a ready-for-issue condition, and any changes to the condition code of an asset is recorded timely, accurately, and authorized appropriately.

Risks:

· Condition of items on record could deteriorate without being assessed resulting in valuation overstatement

· Condition of item could be modified without authorization

· Questions or Responses to SQCR may not occur timely and may result in over or understatement of balance until CC inquiry is rectified

Control Objective 14 - Adjustments to DSS Account Balances - Controls provide reasonable assurance that quantity adjustments posted to DSS account balances are (1) authorized by appropriate personnel and approved by management in accordance with policy, (2) processed accurately, and (3) reported to user entities in a timely manner. Adjustments are considered transactions resulting in a gain or loss and transmitted via EDI 947i.

Risks:

· Adjustment could be made without proper authorization

· Inaccurate or incomplete adjustments could occur

Control Objective 15–Timeliness of Fulfilling Orders - Controls provide reasonable assurance orders are fulfilled (order processed, asset picked, asset packed, and shipped) in a timely manner.

Risks:

· Risk of material release not transferred to User Entity timely

Control Objective 16 – Shipping - Controls provide reasonable assurance that orders filled (Materiel Release Order, Disposal Release Order, or Redistribution Order) are recorded in DSS accurately, in a timely manner and that shipment of materiel is executed per request; (item may ship small parcel, freight or local delivery/customer pick-up (based on item attributes/requisition priority/customer request) and via expedited or standard transportation mode, or custom agreement (dedicated truck).

Risks:

· Shipments may not occur timely

· Shipment and associated dates may not be recorded to DSS accurately

· Shipments could occur in a different method than requested

Control Objective 17 – Safeguarding of Assets - Controls provide reasonable assurance that items in DLA custody are safeguarded and accessible only to authorized personnel.

Risks:

· Unauthorized access to assets increases risk of theft

· Lack of appropriate safeguarding increases risk that losses will not be detected

Attachment (1) - DLA Distribution’s Control Objectives for FY21 SOIDC Audit

· See CO 9 through 17 for direct application to Distribution Operations. These will be tested by the Independent Public Accountant, Auditor (Ernst & Young)

· Note COs 1 through 8; are directly applicable to Information Systems (J6 activities also under audit) image1.emf

FY2021 SOIDC Draft Control Objectives Response updates v4 08132020 updatesv3.docx FY2021 Service Owned Items in DLA Custody (SOIDC) Draft Control Objectives

Control Objective 1: Security Management - Controls provide reasonable assurance that Management has established, implemented, and monitors the DLA Information Operations Security Management program.

· Management has not established a security program that is reflective and is responsive to DSS' weaknesses and/or environmental threats

· Due to changes introduced to DSS and/or the supporting environment, the established security program no longer reflects and/or is responsive to DSS' weaknesses and/or environmental threats

· DLA employees are unaware of and/or do not comply with relevant security policies and procedures associated with the DSS security program

· Subservice providers are not adequately monitored to ensure coverage over SOIDC relevant security controls that are not performed by DLA

Control Objective 2: Access Controls - Controls provide reasonable assurance that logical access is restricted to authorized users.

· Unauthorized users obtain logical access to DSS programs and data

· Users with authorization to access certain aspects of DSS programs and data obtain unauthorized access to other aspects of DSS programs and data

· Identification and authentication settings are not configured to restrict unauthorized access to DSS programs and data

· Users retain previously authorized access to DSS programs and data when they no longer require such access due to changes in responsibility or employment status with DLA

Control Objective 3: Configuration Management - Controls provide reasonable assurance that request for changes to DSS systems, and underlying application and database software are authorized, tested, implemented and documented.

· Unauthorized changes to DSS application program and/or database structures installed into the production environment have adverse effects on the complete, accurate, and timely processing and reporting of transactions and balances

· Authorized changes to DSS application program and/or database structures installed into the production environment have adverse effects on the complete, accurate, and timely processing and reporting of transactions and balances

· DSS program documentation, including that related to changes to application programs and/or database structures is incomplete or non-existent

Control Objective 4: Segregation of Duties - Controls provide reasonable assurance that the DLA identifies, authorizes, and monitors risks of incompatible duties related to the maintenance, usage, and operation of DSS by DLA Information Operations personnel.

· Conflicting duties are combined with existing processes associated with the maintenance and operation of DSS

· As time passes, the implementation of new processes and/or modification of existing processes results in the combination of conflicting duties within processes associated with the maintenance and operation of DSS

· Controls placed into operation to address segregation of duties concerns within processes associated with the maintenance, usage and operation of DSS are not designed or operating effectively

Control Objective 5: Computer Operations – Controls provide reasonable assurance that DSS application processing is authorized and executed in a complete, accurate, and timely manner. Further, problems and errors are identified, tracked, recorded, and resolved in a complete, accurate, and timely manner.

· Without a formalized and approved process, the risk increases that unauthorized data transmissions to and from DAAS and DSS will occur in the production environment

· Without a current and complete SLA with DISA, there is a potential risk related to the lack of understanding and accountability of policies and procedures related to the scheduling, monitoring, and maintenance of production jobs

· Incidents and Job Failures that are not reviewed and/or remediated timely could affect production data and integrity

Control Objective 6: Input – Controls provide reasonable assurance that data is received from authorized sources, and is input into DSS completely, accurately, and timely.

· Without formally approving interface agreements for service customers, the security requirements are unknown to management, thereby increasing the risk of vulnerabilities within the boundary of the system

· Without considering interface-related security risks, unauthorized data input or access and changes to DSS data could occur

· Without validating compliance with established business rules and functional requirements, data input via DSS screens may be processed inaccurately or not at all

· Data transmissions are received from unauthorized parties

Control Objective 7: Output - Controls provide reasonable assurance that transactions, files, and reports generated out of DSS are produced completely, accurately, and timely.

· Without formally approving interface agreements for service customers, the security requirements are unknown to management, thereby increasing the risk of vulnerabilities within the boundary of the system

· Without effective validation of DSS output, incorrect transactions and files may be passed for processing

· Without verifying that system generated reports outputted from DSS represent a complete and accurate population of data within DSS, the risk increases of user-entities relying on incomplete or inaccurate data to support their financial statements

· Data transmissions are sent to unauthorized parties

Control Objective 8: Data Processing - Controls provide reasonable assurance that transactions are processed by DSS completely, accurately, and timely.

· Without validating compliance with business rules and functional requirements, transactions may be processed inaccurately or not at all

· Without reviewing, responding to, and correcting data validation errors in a timely manner, transactions will remain stalled and unable to be processed

Control Objective 9 – Receipt Recordation and Acceptance – Controls provide reasonable assurance that assets received at DLA for stock are receipted and recorded to DSS completely, accurately, and timely. Further, discrepancies at time of receipt are reported using Supply Discrepancy Reports to the applicable owner/manager.

· Items that are offloaded may not be recorded completely, accurately, timely or at all into DSS

· Material not destined for DLA Distribution could be receipted and inducted

· The same material receipt may be inducted into DSS twice.

· Receipts may be incorrectly cancelled

· Receipted assets must be accepted

Control Objective 10 – Completeness of Assets in Storage Locations - Controls provide reasonable assurance that assets in all storage locations are completely and accurately recorded in DSS.

· Storage locations may contain an asset that is not recorded in DSS or is recorded inaccurately

· Risk of understatement or inaccurate balance

Control Objective 11 - Existence - Controls provide reasonable assurance that assets recorded in DSS physically exist.

· Risk of material on record not existing (overstatement of account balance)

Control Objective 12 – Rights – Controls provide reasonable assurance that assets are completely and accurately recorded to an owner’s balance based upon owner RIC and changes to ownership are appropriately processed timely and authorized when applicable.

· Ownership of an asset is incorrectly recorded

· Ownership changes, to include disposals, may not be processed accurately, timely or authorized

Control Objective 13 – Stock Readiness/Asset Condition – Controls provide reasonable assurance that assets in storage remain in a ready-for-issue condition, and any changes to the condition code of an asset is recorded timely, accurately, and authorized appropriately.

· Condition of items on record could deteriorate without being assessed resulting in valuation overstatement

· Condition of item could be modified without authorization

· Questions or Responses to SQCR may not occur timely and may result in over or understatement of balance until CC inquiry is rectified

Control Objective 14 - Adjustments to DSS Account Balances - Controls provide reasonable assurance that quantity adjustments posted to DSS account balances are (1) authorized by appropriate personnel and approved by management in accordance with policy, (2) processed accurately, and (3) reported to user entities in a timely manner. Adjustments are considered transactions resulting in a gain or loss and transmitted via EDI 947i.

· Adjustment could be made without proper authorization

· Inaccurate or incomplete adjustments could occur

Control Objective 15–Timeliness of Fulfilling Orders - Controls provide reasonable assurance orders are fulfilled (order processed, asset picked, asset packed, and shipped) in a timely manner.

· Risk of material release not transferred to User Entity timely

Control Objective 16 – Shipping - Controls provide reasonable assurance that orders filled (Materiel Release Order, Disposal Release Order, or Redistribution Order) are recorded in DSS accurately, in a timely manner and that shipment of materiel is executed per request; (item may ship small parcel, freight or local delivery/customer pick-up (based on item attributes/requisition priority/customer request) and via expedited or standard transportation mode, or custom agreement (dedicated truck).

· Shipments may not occur timely

· Shipment and associated dates may not be recorded to DSS accurately

· Shipments could occur in a different method than requested

Control Objective 17 – Safeguarding of Assets - Controls provide reasonable assurance that items in DLA custody are safeguarded and accessible only to authorized personnel.

· Unauthorized access to assets increases risk of theft

· Lack of appropriate safeguarding increases risk that losses will not be detected image2.png