1010 CA Industry Day 2025.pptx

DLA Distribution Financial Audit and Compliance Update - Industry Day May 2025 Updated as of Feb 19, 2025

AGENDA

Our Financial Audit Journey Audit Categories/Cycle Types of Audits/Opinions Audit Elements Scope of DLA Inventory Existence Measures Risk Management/Internal Controls Business Process Excellence Supplier Responsibilities Questions

Repeatable Processes and E2E Documentation Risk Identification and Mitigation Effective Internal Controls (systemic preventative) Continuous Improvement & Learning (turnover) Formal Online E2E Course + OJT (all business cycles)

FY16

FY17

FY18

FY19

FY20

FY15

Clean Opinion=Reliance on DLA Distribution Records (Right Item, Right Condition, Right Quantity) Audit: SSAE-16 IPA: Team Kearney Opinion: Modified Audit: DLA FFSA IPA: Ernst & Young (EY) Opinion: Disclaimer Audit: DLA FFSA (EY)

IPA: EY

Opinion: Disclaimer Audit: SOIDC (RMA) Opinion: UnModified Audit: DLA FFSA (EY) Opinion: Disclaimer Audit: SOIDC & AUP (EY) SOIDC Opinion: Adverse AUP Result: Errors noted Audit Opinions:

Un-Modified Modified Disclaimer Adverse Audit: Inventory QTY only IPA: DoD IG Opinion: Modified/Qualified

FY21

Audit: DLA FFSA (EY) Opinion: Disclaimer Audit: SOIDC & AUP Not performed Audit: DLA FFSA (EY) Opinion: Disclaimer Audit: SOIDC (EY) Opinion: TBD

FY22

FY23

Audit: DLA FFSA Opinion: TBD Audit: SOIDC Opinion: TBD Audit: AuP Result:

FY24

Audit: DLA FFSA Opinion: TBD Audit: SOIDC Opinion: Disclaimer

Result: Errors notde

FY25

Opinion: TBD Audit: SOIDC Opinion: TBD

Knowledge Transfer Key Onboarding New Hires Impacted by Dual Systems (DSS + WMS) environment Testing + Risk Assessment required as WMS is deployed for mitigation during design.. Not afterward Audit History and Future Years:

Financial Statement Audit Results

FY22

FY27

Audit: DLA FFSA Opinion: TBD Audit: SOIDC Opinion: TBD

FY26

Opinion: TBD Audit: SOIDC Opinion: TBD Audit: AuP Result:

FY22

FY28

Audit: DLA FFSA (EY) Opinion: Disclaimer Audit: SOIDC & AUP Not performed Audit: DLA FFSA (EY) Opinion: Disclaimer Audit: SOIDC & AUP Not performed

FY25 Approach DLA Distribution Audit Roadmap 4 of xx

DEC

JAN

FEB

MAR

APR

MAY

JUN

JUL

AUG - SEP

Finalize Program Approach

- Getting to "Yes"

- Business Process Health

- SOIDC Audit Validation

- NFR Remediation

- Assertion Program

- Compliance Program

- Physical Inventory Health

- MPHR Progress Site Validation Visits

- 11 WMS Sites in Scope

- SOIDC Documentation

- Risk Identification

- Controls Evaluation

- Process Narratives/Maps

- Audit Compliance Handbook Update

- Expand QAE role in Audit

Finalize FY26 SOIDC Documentation

- MDS

- Control Activities

- Risk Control Matrix

- Process Maps

Year-end Wrap

- PBC Wrap

- Observation Review

- PICP Completion

- CAP Development

Communication/Training

- FY24 CAP SOIDC Adverse

- Stakeholders

- AU/SAUM

- Risk Mgmt. Board

- SOIDC PMO

- Distribution Centers

- MPHR

Lead, leverage, and support HQ J3’s Plan to Stock (P2S) and Order to Cash (O2C) cycles and SOIDC PMO audit efforts Drive actions and decisions through SAUM meetings and monthly DIST Risk Working Group and Risk Management Boards Leverage Multi-Purpose Holistic Review Program (MPHR) to prioritize and close shared Enterprise deficiencies Answer Auditor requests (Provide By Clients - PBCs) and facilitate audit site visits for FY25 Audit Opinion Report on Annual Assessments Certify SOIDC Documentation Communicate and Train Finalize Program Approach

Validate Process Documentation Plan Risk Assessment Q2 – Risk Assessment Quantitative Factors Qualitative Factors Define measures of success Q3 – Controls Testing Test of Design (TOD) Test of Effectiveness (TOE) Q4 – Report Deficiencies (what is broken?)

Develop CAPs Statement of Assurance

CUI

CUI

Warfighter Always

PEOPLE PRECISION POSTURE PARTNERSHIPS

End-to-End Audit Process and Organizational Building Blocks DLA Distribution Annual Audit Cycle

Scoping / Site Selection Rules of Engagement PBCs Auditor Requests DLA Responses

SITE VISITS

Walkthrough Test of Design (TOD)

TESTING

PBCs Document Review Review of Site Visit Results OBSERVATIONS Preliminary Audit Results PBCs Clarify Discrepancies NFRs / REPORT Understand and agree to NFR contents Final report issued

PROCESS

Document business processes Flow of inputs and outputs to achieve objectives

RISK

Identify, assess, prioritize measurable events that may impede achieving objectives Responses (accept risk or mitigate with controls) CONTROL Document functions to mitigate risk with reasonable assurance for objectives Appropriate design and operating effectiveness

Validate Process Documentation Plan Risk Assessment Q2 – Risk Assessment Quantitative Factors Qualitative Factors Define measures of success Q3 – Controls Testing Test of Design (TOD) Test of Effectiveness (TOE) Q4 – Report Deficiencies (what is broken?)

Develop CAPs Statement of Assurance

DLA Full Financial Statement Audit (FFSA) Audit performed on all of DLA’s business cycles (financials and operations) Auditor starts at Financial Statements compared to the floor and the reverse; looks at the floor and tests against the financial statements (i.e. completeness and existence) Cyclic:

Oct-Dec: Audit Planning Jan-Mar: In depth auditor business process walkthroughs Jan-Oct: PBC submissions and responses Jun-Sep: Year-end inventory count observations and roll forward transaction tracing Service Owned Inventory in DLA Custody (SOIDC) Controls-based audit (“open book” audit) Auditor tests based on Risk Control Matrix (RCM), and Management Descriptions of Systems (MDS) written by DLA Each control objective and activity submitted is tested for design and effectiveness Requires detailed process mapping, risk evaluation, controls, and a written Management Description of System/Services Agreed Upon Procedures (AuP) Performed for MILSVC Owner Materiel at the request of MILSVC’s IPA.

Services’ IPA to select samples for “book to floor” counts likely with observation by their IPA Floor to book samples completed and observed by MILSVC IPA Substantive testing audit, physical inventories are performed, and accuracy is documented and projected over the holdings for that owner Rights testing is conducted to prove DLA’s right to hold materiel for given owner using receipt data and evidential matter Military Services FFSA

DLA Distribution as the custodian for Mil Services’ materiel Distribution assist, as needed, to Mil Service Audit requests via Evidential Matter, data pulls, and meetings or On site audit work with the DLA Distribution Centers

Understanding Audit Types of Audits Linkage to Owners’ Assertions

Un-modified (Clean) Opinion (formerly referred to as Unqualified Opinion) Highest level of auditor confidence IPA able to access to all information in a timely manner Organization’s information conforms with Generally Accepted Accounting Principles (GAAP) Modified Opinion (formerly referred to as Qualified Opinion) Auditors were not able to fully satisfy themselves on all aspects of the financial statement presentation The “Except for…” opinion: Everything in this financial statement is good, except for… Adverse Opinion A negative response that occurs only when the auditor finds the organization’s records as a whole are uninformative Not in line with GAAP, or if the financial records have been falsified or are in other ways erroneous Disclaimer of Opinion Reflects the auditors are unable to completely perform their work and the organization has difficulty providing specific information in a timely manner

Understanding Audit Opinions

How do we get Distribution from a ‘Disclaimer’ and ‘Adverse’ Opinion to a ‘Modified’ or Clean Opinion ?

Existence: What we say is on our books is actually in location… Must Reduce Variance and Improve Accuracy (Receipt, Storage, and Shipment) Completeness: What we see on the floor in recorded in our books Must have items recorded accurately and timely into our system Rights: We must have posted the item to the correct Owner record Receive materiel and place into custody to correct Owner & perform all changes in ownership fully and accurately with Evidential Matter (EM) “Timeliness” Elements of Audit (always checked by the IPA):

Recordation of inventory (accurate books, recorded timely) Proof of shipment/delivery (to close out the sale, inbound or outbound) Cut-off procedures (clean books – in process work is closed out timely) Inventory Adjustments reviewed prior to acceptance/changes No Proration logic applied Understanding Audit Elements Existence, Completeness, Rights

DLA’s Fraud Risk Management (FRM) Strategy and Compliance Roadmap

Assess Organizations complete an annual assessment of fraud risk, included in the Agency Fraud Risk Profile, and completed an annual assessment of fraud controls The ERM PMO / RICAs work through governance structure to identify and prioritize the risk and control remediation ERM PMO monitors audits, guidance, and GAO’s high risk list for potential high priority fraud activities.

Design and Implement The FRM Strategy summarizes DLA's plan & integration with existing fraud reduction efforts Integration with OUSD(C)'s fraud analytics program (Advana) and other automated tools ERM PMO informs DLA staff of strategy and planning through DOD's SOA Handbook and Workshops and communication products Evaluate and Adapt DOD and DLA report the effectiveness of organizational and Agency FRM activities through the Fraud Control Assessment results Continuous improvement of FRM program, tools, and technologies to combat fraud Commit Chief Risk Officer is responsible for managing DLA fraud risks, serving as the repository of knowledge of fraud risk, and controls and manages the fraud risk assessment process DLA Governance Boards (ERWG, SRMT, and SMC) form the DLA FRM Program Agency and organizational tone at the top sends the message that there is zero tolerance for fraud Implementing DOD’s FRM Strategy at the Agency level

Internal Control (IC) Standard Metrics FY24 Getting to "Yes" Health 10 of xx

Measuring, Tracking, and Reporting Process Success

Business Process Excellence Scorecard 11 of xx Sub-Process: COSIS Visual Inspections SAUM: Mandy Brechbill JQ-S SME: Mike Gratkowski Process Health % of Healthy Components Divided By Total Components Business Objective:

COSIS Visual Inspections serve as a function to validate the current condition of stored materiel relative to the condition recorded in the system of record.

They are a financially relevant sub-process for both SOIDC and FFSA audits Process/Risk/Control Activities:

Conducted a table-top process walkthrough to understand process, risks, and controls.

Identified a potential key risk for human capital due to the reliance on manual actions to achieve the business objective.

Design Documentation Monitoring

Notional Rating

SOIDCMDS

SOIDC

RCM

SOIDC Process Maps Process Risk Control Business Process Narratives (BPNs) SOPs, FRAGOs, Process Documents Communication and Training QAEs Audit/OIG NFRs

SID/CIP

Findings Site Visits Data Analysis Metrics DC Assertions

CPI

Assistance is needed from DLA suppliers to ensure that material sent to our Distribution Centers complies with contract terms and conditions.

Material is shipped in the appropriate quantity Material is marked and packaged correctly Material is sent to the correct address/customer.

Supplier/Vendor compliance in keeping with DLA’s standards for KCC (Kind/Condition/Count), packaging and labeling are imperative for minimizing rework and helping DLA achieve an Unmodified (Clean) Opinion.

DLA Supplier Responsibilities

Q & A

End Slide 1 image10.png image11.png image12.png image3.png image8.png image1.jpg image2.png image4.png image5.jpeg image6.png image7.png image9.png