[Independent Auditors' Report on the National Park Service's Financial Statements for Fiscal Years 2001 and 2000 ]
[From the U.S. Government Printing Office, www.gpo.gov]

Report No. 2002-I-0019

Title: Independent Auditors' Report on the National Park Service's
       Financial Statements for Fiscal Years 2001 and 2000 

 
Date:  March 15, 2002

**********DISCLAIMER**********
This file contains an ASCII representation of an OIG report. No attempt has been made to display graphic images or illustrations. Some tables may be included, but may not resemble those in the printed version. A printed copy of this report may be obtained by referring to the PDF file or by calling the Office of Inspector General, Division of Acquisition and Management Operations at (202) 219-3841.
******************************

Memorandum

To:       Director, National Park Service

From:     Roger La Rouche /Signed/
          Assistant Inspector General for Audits

Subject:  Independent Auditors' Report on the National Park Service's Financial
          Statements for Fiscal Years 2001 and 2000  (No. 2002-I-0019)

We contracted with KPMG LLP, an independent certified public accounting firm, to audit the National Park Service's (NPS) financial statements as of September 30, 2001 and for the year then ended. The contract required that KPMG conduct its audit in accordance with the Government Auditing Standards issued by the Comptroller General of the United States of America, Office of Management and Budget Bulletin 01-02, Audit Requirements for Federal Financial Statements, and the General Accounting Office/President's Council on Integrity and Efficiency Financial Audit Manual.

In connection with the contract, we monitored the progress of the audit at key points and reviewed KPMG's report and related working papers and inquired of their representatives.  Our review, as differentiated from an audit in accordance with Government Auditing Standards, was not intended to enable us to express, and we do not express, opinions on the NPS's financial statements or on conclusions about the effectiveness of internal controls or on conclusions about compliance with laws and regulations.  KPMG is responsible for the auditors' report (Attachment 1) and for the conclusions expressed in the report.  However, our review disclosed no instances where KPMG did not comply in all material respects with Government Auditing Standards.  

In its audit report dated January 18, 2002, KPMG stated that in its opinion the NPS's financial statements for fiscal years 2001 and 2000 presents fairly, in all material respects, the financial position of the NPS as of September 30, 2001 and 2000 and the net cost of operations for the years then ended, and its changes in net position, budgetary resources, and reconciliation of net cost of operations to budgetary obligations for the year ended September 30, 2001 in conformity with accounting principles generally accepted in the United States of America.

KPMG found seven reportable conditions related to internal controls and financial operations three of which are considered to be material weaknesses.  With regard to compliance with laws and regulations, KPMG found NPS to be noncompliant with a portion of the Federal Financial Management Improvement Act.   Specifically, NPS's financial management systems did not meet Federal financial management systems requirements.  

In the February 14, 2002 response (Attachment 2) to the draft report, NPS generally concurred with the 29 recommendations and indicated corrective action would be taken. However, NPS did not agree that the internal control weakness involving information systems security and the weakness over the preparation, analysis, and monitoring of financial information were material weaknesses.  Based on additional information provided by NPS, KPMG has reclassified the weakness for information systems security from a material weakness to a reportable condition. KPMG still considers the weakness over the preparation, analysis, and monitoring of financial information as a material weakness.  The planned improvements by NPS should correct this weakness.  Based on NPS's response we consider all 29 recommendations resolved but not implemented.  The recommendations will be referred to the Assistant Secretary for Policy, Management and Budget for resolution and tracking of implementation.

Section 5(a) of the Inspector General Act (5 U.S.C. App. 3) requires the OIG to list this report in its semiannual report to the Congress.  In addition, the OIG provides this audit report to the United States Congress.  

The Independent Auditors' Report is intended for the information of the management of NPS, the Office of Management and Budget, and the United States Congress.  The report, however, is a matter of public record and its distribution is not limited.

Attachments (2)

ATTACHMENT 1 

Independent Auditors' Report

Director National Park Service:

We have audited the accompanying consolidated balance sheets of the National Park Service (NPS) as of September 30, 2001 and 2000, and the related consolidated statements of net cost for the years then ended, and the related consolidated statement of changes in net position and combined statements of budgetary resources and financing for the year ended September 30, 2001.  The objective of our audits was to express an opinion on the fair presentation of these financial statements.  In connection with our audits, we also considered NPS's internal control over financial reporting and tested NPS's compliance with certain provisions of applicable laws and regulations that could have a direct and material effect on its financial statements.

SUMMARY

As stated in our opinion on the consolidated financial statements, we concluded that NPS's financial statements as of and for the year ended September 30, 2001 and NPS's consolidated balance sheet and consolidated statement of net cost as of and for the year ended September 30, 2000, are presented fairly, in all material respects, in conformity with accounting principles generally accepted in the United States of America.

Our consideration of internal control over financial reporting resulted in the following conditions being identified as reportable conditions:

A.  Controls over Accounting for Personal Property Should be Improved

B.   Year-End Undelivered Order Deobligation and Accounts Payable Accrual Recognition  Procedures Should be Strengthened

C.  The Preparation, Analysis, and Monitoring of Financial Information Should be Improved

D.  Information Systems Security and Controls over Financial Systems and Data Should be Improved 

E.  Procedures over Revenue Recognition, Billings, and Collections Need to be Improved

F.  Controls over Recognizing Expenses in the Proper Period Should be Strengthened

G.  Disclosure of Required Supplementary Information Should be Enhanced

We consider reportable conditions A, B, and C, above, to be material weaknesses. 

The results of our tests of compliance with laws and regulations, exclusive of the Federal Financial Management Improvement Act (FFMIA) of 1996, disclosed no instances of noncompliance that are required to be reported herein under Government Auditing Standards or Office of Management and Budget (OMB) Bulletin No. 01-02, Audit Requirements for Federal Financial Statements.

The results of our tests of FFMIA, described in the Compliance with Laws and Regulations section below, disclosed that NPS's financial management systems did not substantially comply with Federal financial management systems requirements, due to the information systems security control issues that we have identified as a reportable condition in internal controls.  Further, NPS has three material weaknesses in internal controls that represent noncompliance with the accounting standards aspect of FFMIA. 

The following sections discuss our opinion on NPS's financial statements, our consideration of NPS's internal control over financial reporting, our tests of NPS's compliance with certain provisions of applicable laws and regulations, and management's and our responsibilities.

OPINION ON THE CONSOLIDATED FINANCIAL STATEMENTS

We have audited the accompanying consolidated balance sheets of NPS as of September 30, 2001 and 2000, and the related consolidated statements of net cost for the years then ended, and the related consolidated statement of changes in net position and combined statements of budgetary resources and financing for the year ended September 30, 2001.  

In our opinion, the financial statements referred to above present fairly, in all material respects, the financial position of the NPS as of September 30, 2001 and 2000, and its net costs for the years then ended, and its changes in net position, budgetary resources, and reconciliation of net costs to budgetary obligations for the year ended September 30, 2001, in conformity with accounting principles generally accepted in the United States of America.

NPS's fiscal year 2001 statement of net cost presents more details of gross costs and earned revenues than the fiscal year 2000 statement of net cost.  While the fiscal year 2001 statement of net cost represents improved financial reporting, it is inconsistent with the fiscal year 2000 presentation.

The information in the Management Discussion and Analysis, Required Supplementary Stewardship Information, and Required Supplementary Information sections is not a required part of the financial statements, but is supplementary information required by the Federal Accounting Standards Advisory Board or OMB Bulletin No. 97-01, Form and Content of Agency Financial Statements, as amended.  We have applied certain limited procedures, which consisted principally of inquiries of management, regarding the methods of measurement and presentation of this information.  However, we did not audit this information and, accordingly, we express no opinion on it.

INTERNAL CONTROL OVER FINANCIAL REPORTING

Our consideration of internal control over financial reporting would not necessarily disclose all matters in the internal control over financial reporting that might be reportable conditions.  Under standards issued by the American Institute of Certified Public Accountants, reportable conditions are matters coming to our attention relating to significant deficiencies in the design or operation of the internal control over financial reporting that, in our judgment, could adversely affect NPS's ability to record, process, summarize, and report financial data consistent with the assertions by management in the financial statements. 

Material weaknesses are reportable conditions in which the design or operation of one or more of the internal control components does not reduce to a relatively low level the risk that misstatements, in amounts that would be material in relation to the financial statements being audited, may occur and not be detected within a timely period by employees in the normal course of performing their assigned functions.  Because of inherent limitations in internal control, misstatements due to error or fraud may nevertheless occur and not be detected. 

We noted certain matters involving internal control over financial reporting and its operation that we consider to be reportable conditions.  We believe that the first three reportable conditions, labeled 01.A, 01.B, and 01.C, are material weaknesses: 

01.A.	Controls over Accounting for Personal Property Should be Improved

As a result of the fiscal year 2000 audit of NPS, certification requests and instructions were sent to all parks in an attempt to ensure all personal property items were properly accounted for in NPS's accounting records.  The personal property certification form was designed and collection of the certification was coordinated by the Washington Area Service Office (WASO).  

During our fiscal year 2001 audit, we visited three parks and found exceptions relating to both existence and completeness of recorded personal property at one park.  Due to the above exceptions we visited six additional national parks during the final audit phase to verify the propriety of the certifications.  We randomly selected personal property items from the parks visited to test the completeness of the certifications.  As a result of this testwork, we found three items that were excluded from the certified inventory listings.  These were subsequently corrected.

The certification instructions required the parks to verify the information (fixed asset listing) sent to them from WASO.  If the information on the fixed asset listing was correct, the parks were to certify the listing by signing, dating, and faxing it back to WASO.  Through discussions with park personnel, we found that the directions were vague and insufficient in the following respects:

  -  The instructions could have been clearer by requiring the parks to conduct a physical inventory of property and providing detailed instructions on how to conduct such a physical inventory.

  -  The instructions required the parks to perform and complete the certification by the close of business on the same day the instructions were received.  This was clearly impossible at all but the smallest parks, and likely resulted in inadequate attention to verifying the accuracy of the listing.

As a result, fixed assets and accumulated depreciation were understated at September 30, 2001.  Further, internal control over possession of these assets was compromised.  Consequently, NPS re-performed a physical inventory of its personal property at all park locations and determined the necessary adjustments.

NPS has a systemic problem that affects the transaction recorded in FFS when transferring a property item between two parks.  When property is transferred, two separate transactions occur in FFS, one to transfer the item out and one to transfer it in.  The transaction to remove the property item from the park is recorded in FFS correctly.  However, the second transaction to re-enter the transferred property into FFS is not recorded properly.  FFS is incorrectly configured to recognize the accumulated depreciation of the transferred-out asset as the acquisition cost of the asset transferred-in.  FFS also does not recognize any amounts for previously recorded accumulated depreciation.  As part of completing the re-certifications, the amounts recorded in FFS were adjusted to reflect the proper balances.

Recommendations

We recommend that for future property certifications, WASO give the parks sufficient notice of required physical inventories and provide clearer directions on how such inventories must be conducted.  We also recommend that WASO attach a form to the certification requiring the parks to provide details of and authorize any changes to correct errors identified on the fixed asset listing (i.e., additions or deletions).  Upon the parks' completion of the certifications and WASO's posting of corrections, parks should receive from WASO a corrected version of the fixed asset listing to ensure that the proper adjustments were made.  

In addition, we recommend that NPS resolve the systemic error in FFS to properly record transfers-in of capitalized assets.

01.B.	Year-End Undelivered Order Deobligation and Accounts Payable Accrual Recognition Procedures Should be Strengthened

NPS implemented corrective action in fiscal year 2001 to address the material weakness identified during the fiscal year 2000 audit related to deobligating undelivered orders (UDOs) and recognizing accounts payable or accruals at year-end.  As a result, many UDOs with no activity were deobligated and NPS personnel were instructed on how to properly recognize accruals at year-end.  However, similar to fiscal year 2000, we continued to identify exceptions in relation to the deobligation of UDOs and recognition of accruals during the fiscal year 2001 audit.  

Our testing of UDO balances as of September 30, 2001, identified UDOs that had not been deobligated, even though the related services were received before year-end.  Certain UDO balances tested had invoices that were received prior to year-end for work performed before year-end, but NPS neither deobligated the UDO balances nor recognized liabilities as of September 30, 2001.  Based on invoices that were received subsequent to year-end, certain UDOs had work performed before year-end.  Therefore, NPS should have reviewed the related contract and estimated an accrual for the services received.  However, NPS neither deobligated the UDO balances nor accrued for services performed up to year-end.  We also identified a situation where the contract/agreement had expired, but the UDO balance was not properly deobligated.  Another UDO balance had funds that were obligated to a cooperative agreement when the same amount and the same account number had already been obligated for an interagency agreement.  

Based on the above exceptions, we determined that NPS's review of UDOs to determine accruals needed was inadequate.  NPS also did not have adequate procedures to ensure that invoices received prior to year-end but paid after year-end for services received prior to year-end were recorded as payables.  

NPS was not able to provide the support for a number of accounts payable balances that we selected for review that were older than a year, as of September 30, 2001.  NPS subsequently determined that these payables were invalid.  NPS had not performed a thorough review of recorded payables to determine their validity.  We also found accounts payable in the population that had offsetting payment transactions, which were also included in the payable population.  As the payment, when entered into the system, did not properly reference the payable, the balance was not properly reduced to zero.  Thus, NPS has not properly referenced payments made in FFS to eliminate open payables.

Our tests of recorded accounts payable balances also disclosed other transactions that were incorrectly recorded as payables in the general ledger at September 30, 2001.  For example, in one instance an NPS contracting officer did not understand the requirements for making accruals, and accrued the total balance of the contract, instead of estimating the work that was completed.

As a result of the exceptions noted, NPS recorded an adjusting entry to remove fiscal year 1999 and prior UDO's with no activity.  NPS also reviewed invoices received throughout the year for federal contracts and estimated an accrual for services received through year-end.  In addition, NPS reviewed subsequent disbursements made in October and November to determine accruals needed for non-federal vendor contracts.  However, our review of NPS's subsequent disbursement review indicated that this exercise was not thorough as we continued to identify exceptions.  NPS re-reviewed subsequent disbursements twice to determine necessary accruals at fiscal year 2001 year-end.  Consequently, several significant correcting adjusting entries were made to the general ledger as of September 30, 2001.  Several of these adjustments were entered into the general ledger as late as January 2002.

Recommendations

We recommend that NPS develop an accounts payable estimation process such that the estimate will be available for inclusion in interim and year-end financial statements within the Department's timeline requirements.

The NPS should develop written policies and procedures to document its accounts payable accrual methodology, which should include (1) consideration of systems-generated data, as available, to aid in developing historical trends of expenses paid subsequent to fiscal year-end for goods and services received prior to year-end, (2) a limited review of disbursements subsequent to year-end, and (3) written or verbal contacts by the contracting officers with vendors and contractors (including federal agencies), as needed, to estimate amounts owed for goods and services received prior to year-end but paid after fiscal year-end (or remaining unpaid when the financial statements are prepared).  Regarding the first step (consideration of systems-generated data), NPS should determine if the available field for "service date" in its accounting system could be used now or in the future as a means to develop a historical data base of disbursements after year-end for goods and services received prior to year-end.

NPS should use (and test) the revised accounts payable estimation methodology when preparing the interim unaudited financial statements required as of March 31, 2002 that are due to OMB within 60 days from the end of the reporting period, in accordance with OMB Bulletin No. 01-09, Form and Content of Agency Financial Statements.

We also recommend that NPS continue to review all UDOs and determine the validity of the recorded balances.  Modifications should be obtained for expired contracts/agreements, if necessary, and all invalid UDO balances should be deobligated.  All records of obligating documents such as contracts, grants, and interagency agreements, modifications to the initial obligations, and the support for the work that has been received such as receiving reports and vendor invoices should be maintained in support of recorded balances.  NPS should perform this review continually.

NPS should also ensure that payments entered into the general ledger reference the related payable to properly reflect the balance of individual accounts payable. 

01.C.	The Preparation, Analysis, and Monitoring of Financial Information Should be Improved

During the fiscal year 2001 audit, we continued to identify numerous findings relating to NPS's preparation, analysis, and monitoring of its financial information.
 
NPS is required to prepare and submit the Report on Budget Execution and Budgetary Resources (SF 133) to the OMB quarterly.  The fiscal year 2001 second quarter SF-133 for the Land Acquisition and State Assistance appropriation was submitted to OMB with inaccurate data.  

In addition, NPS's SF-133s do not accurately reflect NPS's Obligations Incurred or Recoveries of Prior Year Obligations for annual and multi-year appropriations.  NPS's FFS records all adjustments to obligations as Recoveries of Prior Year Obligations.  This is improper because many adjustments to obligations are not true recoveries.  This is a systemic problem within FFS.  Since NPS's FFS balance of Recoveries of Prior Year Obligations is incorrect, NPS nets Recoveries of Prior Year Obligations with Obligations Incurred when preparing NPS's SF-133 and its Statement of Budgetary Resources.  The netted amount is then reported as Obligations Incurred.  NPS should instead reflect true recoveries as Recoveries of Prior Year Obligations in the SF-133 and as Adjustments in the Statement of Budgetary Resources.  NPS's treatment results in true recoveries of prior year obligations not being identified and obligations incurred being incorrectly reduced by recoveries.  As a result of our finding, NPS performed an analysis over its annual and multi-year appropriations and determined an adjustment to properly recognize recoveries of prior year obligations.  

We perform a crosswalk of budgetary account balances reported on the quarterly SF 133 to their corresponding proprietary accounts to ensure the appropriateness of budgetary transactions.  The analysis for two of three Treasury symbols we reviewed as of the second quarter had significant differences between the budgetary and corresponding proprietary accounts.  These differences were a result of incorrect entries that were entered into FFS in fiscal year 2001 as beginning balance adjustments to reflect the ending balances in Hyperion in fiscal year 2000.  The entries that were made in FFS did not include all the necessary budgetary accounts or proprietary accounts, which caused the differences reflected in our crosswalk.  NPS indicated that by fiscal year 2001 year end, all beginning balance differences would be adjusted in the general ledger accounts affected.  However, our review of the budgetary to proprietary account crosswalk at year end for one Treasury Symbol indicated a $6,127,432 difference resulting from beginning balance adjustments.  NPS recorded a post-closing adjustment to the fiscal year 2001 financial statements to correct the difference.   

Treasury's Federal Management Service (FMS) notifies agencies of their deposit and disbursements differences on FMS 6652, Statement of Differences with Treasury.  Treasury Financial Manual 2-5100 Supplement to Volume 1, states, "Federal agencies must research and resolve differences reported on the monthly FMS 6652."  NPS's payroll agency location code FMS 6652 has a reconciling item of $991,893.  Treasury disbursed the above amount in fiscal year 1999 on the NPS's behalf.  In 1999, when NPS switched to FPPS as its payroll processing system, the system was producing incorrect data, which made reconciliation with Treasury figures difficult.  As NPS did not know where to allocate the transaction, no entry was made to the NPS general ledger to recognize the transaction.  The likelihood that differences can be resolved decreases as time elapses and NPS has recognized fewer disbursements than Treasury has actually made on NPS's behalf.  Based on our recommendation, NPS recorded an adjustment to the fiscal year 2001 financial statements to recognize this transaction.

Our park visits indicated that there were a number of vehicles and other equipment items that are no longer in use and need to be tagged as excess property items.  NPS's Personal Property Management Handbook does not discuss accounting transactions required for property that is identified as no longer in use or those that have been identified as excess.  As a result of our findings, NPS and the Department's financial management office (PFM) issued guidance on accounting for excess property throughout the Department.

NPS provides or receives services to and from other Department agencies.  These transactions should be identified and reconciled to ensure that both parties affected have the appropriate balances reflected on their respective financial statements as of year-end.  At the Department level, the identified transactions will be eliminated from the consolidated statements.  As of January 4, 2002, NPS had not completed its reconciliations of eliminating transactions with other Department bureaus.  The transactions that should be eliminated are currently identified through a process which includes reconciling transactions and balances with other Department bureaus.  Although the reconcilations are performed quarterly, these intra-Departmental transactions are not adequately reconciled and resolved timely throughout the year.  Therefore, most of the reconciliation process occurs at year-end, requiring a significant amount of time and resources on the part of the accounting staff.  If the differences with trading partners are not resolved, NPS's financial statements may be misstated by the amount of the unreconciled and unposted elimination entries.  In addition, the lack of adequate timely reconciliation and resolution of intra-Department's transactions would impact the DOI's ability to prepare consolidated financial statements in a timely manner.

Similar to the prior year, NPS's AOC recorded over 150 post-closing adjustments to its October 26, 2001 trial balance.  Given the accelerated financial reporting deadlines required by OMB Bulletin No. 01-09, Form and Content of Agency Financial Statements for fiscal year 2002, NPS needs to streamline development and production of the subsidiary information needed for the audit, or accelerate its production schedule, to ensure timely completion of the fiscal year 2002 audit.


Recommendations

We recommend that NPS perform the following procedures:

1.   Improve communication between the NPS budget office and the AOC and perform adequate reviews over external reports that are prepared for submission.  The budget office should forward documentation supporting information they input to FFS to AOC on a timely basis.  AOC should obtain supporting documentation for adjustments made to amounts recorded in the general ledger.

2.   Continue working with American Management Systems (AMS) to correct the systemic error related to recoveries.  Manually track actual recoveries for annual and multi-year appropriations until the system is fixed in order to properly reflect the recoveries on the SF-133 and the Statement of Budgetary Resources.

3.   Ensure that all adjustments are reviewed and signed by the reviewer before being entered into FFS.  The review should ensure that the correct budgetary and proprietary accounts are affected in relation to the adjustment.

4.   Make a concerted effort to timely research and resolve all differences identified through the Fund Balance with Treasury reconciliation procedures.

5.   In conjunction with the Department and other bureaus, implement a formal set of policies and procedures for the proper reconciliation and elimination of intra-Departmental transactions.  The process should be designed to eliminate the significant effort that NPS expends to reconcile out of balance conditions after year-end.  In addition, NPS should establish a monitoring process to ensure all differences identified in the reconciliation process are resolved in a timely manner.

01.D.  Information Systems Security and Controls over Financial Systems and Data Should be Improved 

NPS has not implemented comprehensive information systems security policies or procedures to effectively control and protect information supporting NPS's operations and assets.  While NPS has established initiatives in the security and controls over its information systems, the U.S. Department of the Interior (Department) has not met the requirements of OMB Circular A-130, Security of Federal Automated Information Resources.  OMB Circular A-130 provides requirements to ensure adequate security for information relating to general support systems and major application systems.  Specifically, we noted weaknesses in the following areas:

Entity-wide Security Program and Planning:  NPS did not have an entity-wide security plan and did not focus appropriate resources on security of information.  Specifically, NPS has not:

  -  Performed routine entity-wide risk assessments of systems.
  -  Finalized and approved comprehensive security policies to include the establishment of a security management structure and clearly assigned security responsibilities.
  -  Established security-related personnel policies and procedures.
  -  Performed risk assessments or initiated a formal program for management review and accreditation of its security program and major applications.
  -  Developed resource classification categories.

Access Controls:  NPS did not have adequate controls to limit or detect access to certain information systems to protect against unauthorized modification, loss or disclosure of data. We noted that NPS had weaknesses with:

  -  Identification of authorized users.
  -  Implementation of policies and procedures to define minimum standards for user account passwords.
  -  Monitoring of security violation logs.
  -  Continuing the network operating system conversion and utilizing existing monitoring and configuration management features.
  -  Strengthening Federal Financial System (FFS) security policies and procedures surrounding the timely notification of termination and adhering to current policies and procedures for establishment of user accounts.

Software Development and Change Controls:  NPS did not have adequate application software development and change controls. In particular, NPS did not have documented policies and procedures over certain systems to make program changes and to prevent unauthorized programs or modifications.  We specifically noted that documented WAN/LAN change control policies and procedures needs to be established.

System Software Controls:  NPS did not establish controls to limit and monitor access to powerful programs and sensitive files that control computer hardware and secure applications supported by the system.  We specifically noted that centralized standards for operating system configurations should be implemented.

Segregation of Duties:  NPS did not ensure proper segregation of duties for its information systems.  The division of roles and responsibilities and steps in critical functions were not designed for certain information systems so that no one individual could undermine the process.  We noted that review of infrastructure, jobs, functions, etc., should be routinely performed to determine if changes are warranted.

Service Continuity:  NPS did not have adequate controls to minimize the risk of unplanned interruptions and to recover critical operations and protect data should interruptions occur.  Specifically, NPS had not:

  -  Identified critical operations and resources that prioritized data and operations.
  -  Documented emergency processing priorities.
  -  Rotated backup tapes at a secure off-site facility.
  -  Established a comprehensive Continuity of Operations Plan for the Accounting Operations Center (AOC).
  -  Developed Continuity of Operations Plans for the Administrative Program Center in support of the Interior Department Electronic Acquisitions System (IDEAS) application and the Network Management Office.

Application Controls:  NPS did not establish adequate controls for application systems.  Application controls are the structure, policies, and procedures that apply to separate, individual application systems.  Further, application controls encompass both the routines contained within the computer program code, and the policies and procedures associated with user activities, such as manual measures performed by the user to determine that data were processed accurately by the computer.  Specifically, we noted weaknesses in:

  -  Developing and revising procedures for reconciliations, data input procedures, operating procedures, and output processes for FFS subsystems.
  -  Strengthening IDEAS security controls, input processing documentation, and change controls.
  -  Identifying critical operations and resources that prioritize data and operations.
  -  Documenting emergency processing priorities.

National Business Center:  The Interior National Business Center (NBC) administers several of NPS's financial management systems, including: the Federal Personnel and Payroll System (FPPS), Federal Financial System (FFS), Hyperion, and IDEAS. Although NBC has recently improved the security and controls over these information systems, NBC needs to continue improvements in the areas of: entity-wide security planning, configuration of operating systems, system software controls, software development and change controls, and service continuity. Weaknesses in these control areas could affect NPS's ability to prevent and detect unauthorized changes to its financial information and increases NPS's need for less efficient manual controls to monitor and reconcile financial information.

Recommendations

NPS should improve controls over information technology systems to ensure adequate security and protection of information resources.  NPS should also ensure that adequate resources are dedicated to information technology security and system controls.  

We recommend that NPS annually obtain assurance (similar to a SAS 70 Type II report) from NBC that adequate security and controls are in place over the financial management systems.

01.E.  Procedures over Revenue Recognition, Billings, and Collections Need to be Improved

Our detailed testwork over NPS's billings and collection process indicated that the Accounting Services Team (AST) needs to improve its controls over reviewing receivables, advances from others, and the recording of revenue transactions.

We segregated all unbilled accounts receivable balances that were older than a year from the unbilled accounts receivable detail file.  NPS could not provide supporting documentation for all the unbilled account receivable balances we selected for review.  Therefore, we concluded that these items were invalid and the unbilled accounts receivable balance at September 30, 2001 was overstated.  NPS reviewed the unbilled accounts receivable population as a result of this finding and recorded a post closing adjustment to remove invalid unbilled receivables.

NPS could not provide supporting documentation for several advances from others balances we selected for review as of September 20, 2001, that had no activity for over a year.  We therefore were unable to determine the validity of these items.  Consequently, NPS reviewed the advances from others population and recorded a post closing adjustment to remove invalid advances from others transactions.

The NPS AST reviews the FFS Monthly Accounts Receivable Report and determines the collectibility of billed accounts receivable balances.  This team also reviews Project Cost Allocation System (PCAS) reports, which provide information regarding unbilled accounts receivable.  During fiscal year 2001, due to Financial Reporting Reconciliation System (FRRS) problems (FRRS is the subsidiary ledger to FFS), the FFS Monthly Accounts Receivable Report was not available to AST until March 2001.  The PCAS reports did not contain accurate and reliable information until July 2001, due to problems in the PCAS system.  Therefore, the established control of reviewing these reports monthly was not performed for a majority of fiscal year 2001.  As established management review controls were not performed, the opportunity to detect errors in a timely manner diminished.  As a result, unbilled receivables and billed receivables may have been misstated throughout the year and may not have been detected timely.

The NPS technicians that enter bills into the FFS system do not have adequate knowledge on when to recognize revenue for services performed versus recording an expenditure refund.  We identified a transaction for which incurred expenditures were incorrectly reversed when a bill was sent out for reimbursable services performed.  Similarly, when a NPS employee provided technical assistance for the Ohio and Erie Canal Association, NPS properly recognized the employee expense and subsequently billed the Association for it.  However, when NPS collected the amount billed to the Association, instead of recognizing revenue for services performed, the original expense recognized was reversed.  For both of the above transactions, as expenses incurred were negated and revenue was not recognized, revenue and expenses are understated for fiscal year 2001.  Inversely, the NPS also erroneously recorded a revenue receipt when a refund was received from a grantee.  This transaction should have been recorded as an expense refund.

A posting model problem in the FFS creates invalid account receivables that are flagged as "E" document types and should be written off.  During the fiscal year 2000 audit, we reported this as a condition that needed NPS's review and corrective action.  However, during the fiscal year 2001 audit, we identified that the accounts receivable population continued to include "E" document types and the AST team had not identified these receivables as an adjusting entry to the year end receivables balance as of December 18, 2001.

Bills are manually prepared for employee quarter rental collections and other collections from reimbursable agreements at the Cape Cod National Seashore.  Because the bills are not generated by the FFS system, the necessary accounting entries are not automatically entered in FFS.  However, Cape Cod employees do not enter these invoices into the NPS FFS system.  The invoices are tracked and if the invoices become delinquent, two dunning letters are sent.  If the bill remains uncollected, the supporting documentation is then forwarded to the AOC in Herndon for further follow up activity.  In response to the above identified condition, the NPS AOC indicated that year-end closing instructions for the parks emphasizes the need to enter all receivables into FFS as of September 30, 2001.


Recommendations

We recommend that AOC implement the following procedures:

1.  Establish procedures to review the validity of recorded receivables monthly or quarterly, so that balances that are not valid can be identified and removed timely.

2.  Review all the aged advances from others balances over one year old and determine the validity of the advance or related contract.  In addition, perform a review of all advances from others balances and ensure that valid contracts, agreements, and other supporting documentation (such as invoices that reduce the balance) are maintained.

3.  Generate PCAS reports and prepare bills timely.  If errors due to systemic problems are identified through analysis, ensure that the necessary parties are informed and corrective action is taken promptly.  AST should also investigate alternative means to obtain necessary data to perform necessary analysis when a particular method is not functioning as intended.

4.  Provide training to accounting technicians on when to recognize revenue versus expenditure refunds.  Technicians that enter transactions should also perform self-reviews to ensure that the transaction they entered into the system is proper. 

5.  Provide adequate training to park employees to assist them in identifying transactions that should be established as reimbursable agreements and properly recording reimbursable agreements.

6.  Ensure that the posting models which produce "E" documents are investigated and corrected, so the problem does not continue in future years.

7.  Ensure that all bills, whether generated at the park or AOC level, are either generated through the FFS system or entered into the system at the time the bill is initiated.  Thus, receivables will be recorded in the general ledger throughout the year when bills are generated.  Otherwise, the opportunity for fraud exists.

01.F.  Controls Over Recognizing Expenses in the Proper Period Should be Strengthened

In fiscal year 2000, NPS issued a significant number of on-site Treasury checks related to fire-fighting activities.  We reviewed a sample of these transactions, that are recorded in FFS as "no check" transactions.  Our review indicated that the NPS personnel did not enter fire payments into FFS until Treasury acknowledged receipt of paperwork related to the payment.  Therefore, NPS recorded the transactions two to three months after actual disbursement of funds and fiscal year 2000 transactions that should have been recorded in fiscal year 2000 were incorrectly recorded as fiscal year 2001 transactions.  Based on our finding, NPS performed a review of fire payment transactions made in fiscal year 2000 and identified an adjustment of $30 million.  As a result, the fiscal year 2000 financial statements were re-stated.

NPS's control over credit card transactions should also be strengthened.  During our park visits, our inquiries indicated that many of the purchases at Cape Cod National Seashore are made using a credit card.  However, there was no formal policy to require a supervisor, or a person other than the credit card holder, to review and sign-off on the credit card statement that reflects the purchases made on behalf of the park.  At Mt. Rainier National Park, the procurement officer reviews the credit card statements of all personnel that purchase goods on behalf of the park.  However, there was no supervisory review of the procurement officer's credit card purchases.

Recommendations

We recommend that the AOC ensure that transactions are recorded in the general ledger in a timely manner, with special emphasis on transactions that occur at year-end. 

A formal policy should be established at the individual parks, to require someone other than the credit card holder to review monthly credit card statements and document that review.  

01.G.  Disclosure of Required Supplementary Information Should be Enhanced

Statement of Federal Financial Accounting Standard (SFFAS) 14, Amendments to Deferred Maintenance Reporting Amending SFFAS No. 6 & SFFAS No. 8, states that the supplementary information for deferred maintenance should include the identification of each major class of asset for which maintenance has been deferred, and if the condition assessment survey method of measuring deferred maintenance is used (which is the case at NPS), the following should be disclosed for each major class of asset for which maintenance has been deferred:

  -  Description of requirements or standards for acceptable operating condition.
  -  Asset condition.

The standard also says for heritage assets and stewardship land, the condition of the assets or land should be disclosed.

NPS's required supplementary information (RSI) related to deferred maintenance does not include the following disclosures:

  -  NPS identified its major classes of asset categories to be Roads and Bridges, Trails and Walks, Grounds, Buildings, Utilities, Marine and Waterways, and Special features.  However, in the RSI, deferred maintenance is disclosed for Project Management Information System (PMIS) projects, Employee Housing projects, Paved Roads and Bridges projects, and Dams projects.  Thus, except for Paved Roads and Bridges, NPS does not report deferred maintenance for its major classes of asset categories.
  -  NPS has not disclosed the asset condition for PMIS projects, Paved Roads and Bridges, and certain heritage assets.
  -  NPS did not describe the requirements for acceptable operating condition for each major class of assets.

In addition, NPS has not performed standard, comprehensive condition assessments on certain major park assets, and, therefore, cannot give reasonable estimates on the condition of major classes of assets, and the dollar amount of maintenance needed to return major classes of assets to their acceptable operating condition. 

The lack of the deferred maintenance supplementary information as required by SFFAS 14 is the result of insufficient deferred maintenance data coming from the information systems and individual parks, and the lack of a standardized asset condition assessment process throughout the parks.  Because NPS does not have a standardized, comprehensive condition assessment process throughout the parks, NPS cannot identify standards and requirements for measuring deferred maintenance on primary asset types, and cannot readily determine asset condition for major classes of assets and dollar amount needed to return major classes of assets to normal operating condition. 
 
In the required supplementary stewardship information (RSSI), NPS recognized Archeological Sites, Cultural Landscapes, Historic and Prehistoric Structures, Museum Collections, National Historic Landmarks, and Paleontological Sites.

NPS failed to disclose the minimum reporting requirements, per OMB Bulletin No. 
97-01, for the following categories:

  -  For Archeological Sites, NPS did not disclose the methods of acquisition or withdrawal of archeological sites, the beginning balance or the number or archeological sites withdrawn for fiscal year 2001, or information regarding whether any sites are considered multi-use heritage assets.

  -  For Cultural Landscapes, NPS did not disclose methods of acquisition or withdrawal of cultural landscapes, information regarding the beginning balance, additions, or withdrawals, information regarding deferred maintenance or reference information about deferred maintenance elsewhere in the report, or information regarding whether any sites are considered multi-use heritage assets.

  -  For Historic and Prehistoric Structures, NPS did not disclose the withdrawal methods, the beginning balance, ending balance, or the number or historic and prehistoric structures withdrawn for fiscal year 2001, or information regarding whether any sites are considered multi-use heritage assets.

  -  For Museum Collections, NPS did not describe methods of acquisition or withdrawal, information regarding the beginning balance, condition assessments, or information regarding whether any sites are considered multi-use heritage assets.

  -  For National Historic Landmarks, NPS did not disclose information regarding the beginning balance and ending balances, condition assessments or the overall condition of the national historic landmarks, information regarding deferred maintenance or reference information about deferred maintenance elsewhere in the report, or information regarding whether any sites are considered multi-use heritage assets.

  -  For Paleontological Sites, NPS did not describe methods of acquisition or withdrawal, information regarding the beginning or ending balances, overall condition for paleontological sites, information regarding deferred maintenance or reference information about deferred maintenance elsewhere in the report, or information regarding whether any sites are considered multi-use heritage assets.

Recommendations

We recommend that NPS expeditiously continue to implement its new deferred maintenance measurement system that includes:

  -  comprehensive condition assessments of all park assets;
  -  quantification of deferred maintenance by major classes of asset categories identified by NPS, and 
  -  a standardized measurement system for determining deferred maintenance amounts on park assets.  

This will allow NPS to identify its major asset types requiring deferred maintenance, condition of major types of assets, and standards for determining normal operating condition for major classes of assets. 

We also recommend that NPS ensure that all required supplementary stewardship information  for each asset category is disclosed.

*     *     *     *     *     *

A summary of the status of prior year reportable conditions is included as Exhibit I.  We also noted other matters involving internal control over financial reporting and its operation that we have reported to the management of NPS in a separate letter dated January 18, 2002.

COMPLIANCE WITH LAWS AND REGULATIONS  

The results of our tests of compliance with the laws and regulations described in the Responsibilities section of this report, exclusive of FFMIA, disclosed no instances of noncompliance that are required to be reported herein under Government Auditing Standards or OMB Bulletin No. 01-02.

The results of our tests of FFMIA disclosed areas, described below, where NPS's financial management systems did not substantially comply with Federal financial management systems requirements and applicable accounting standards.

Information Systems Security and Controls Over Financial Systems and Data Should be Improved

As discussed in the Internal Control over Financial Reporting section of the report, NPS has several weaknesses in its information technology general control environment that contribute to noncompliance with OMB Circular A-130.  NPS has not managed and coordinated entity-wide security procedures, has not developed a systems development methodology for application software and change controls to prevent unauthorized programs or modifications to an existing program from being implemented, and needs to improve controls to protect information resources, minimize the risk of unplanned interruptions, and recover critical operations. 

Federal Accounting Standards

NPS has three material weaknesses in internal controls as identified in the Internal Control over Financial Reporting section of this report, indicating noncompliance with applicable accounting standards.

*     *     *     *

Recommendations to address these matters are included in the Internal Control over Financial Reporting section of this report.

The results of our tests disclosed no instances where the NPS's financial management systems did not substantially comply with the United States Government Standard General Ledger at the transaction level.

RESPONSIBILITIES

Management's Responsibilities

The Government Management Reform Act (GMRA) of 1994 requires federal agencies to report annually to Congress on their financial status and any other information needed to fairly present their financial position and results of operations.  To meet the GMRA reporting requirements, NPS prepares annual financial statements. 
 
Management is responsible for:
 
  -  Preparing the financial statements in conformity with accounting principles generally accepted in the United States of America;

  -  Establishing and maintaining internal controls over financial reporting; required supplementary stewardship information and performance measures; and

  -  Complying with laws and regulations, including FFMIA.

In fulfilling this responsibility, estimates and judgments by management are required to assess the expected benefits and related costs of internal control policies.  

Auditors' Responsibilities

Our responsibility is to express an opinion on the fiscal year 2001 and 2000 financial statements of NPS based on our audits.  We conducted our audits in accordance with auditing standards generally accepted in the United States of America, the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States, and OMB Bulletin No. 01-02.  Those standards and OMB Bulletin No. 01-02 require that we plan and perform the audits to obtain reasonable assurance about whether the financial statements are free of material misstatement.

An audit includes:

  -  Examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements;
  -  Assessing the accounting principles used and significant estimates made by management; and
  -  Evaluating the overall financial statement presentation.  

We believe that our audits provide a reasonable basis for our opinion.

In planning and performing our fiscal year 2001 audit, we considered NPS's internal control over financial reporting by obtaining an understanding of NPS's internal control, determining whether internal controls had been placed in operation, assessing control risk, and performing tests of controls in order to determine our auditing procedures for the purpose of expressing our opinion on the financial statements. We limited our internal control testing to those controls necessary to achieve the objectives described in OMB Bulletin No. 01-02 and Government Auditing Standards.  We did not test all internal controls relevant to operating objectives as broadly defined by the Federal Managers' Financial Integrity Act of 1982.  The objective of our audit was not to provide assurance on internal controls over financial reporting.  Consequently, we do not provide an opinion on internal control over financial reporting.

As required by OMB Bulletin No. 01-02, we considered NPS's internal control over required supplementary stewardship information by obtaining an understanding of NPS's internal control, determining whether these internal controls had been placed in operation, assessing control risk, and performing tests of controls.  Our procedures were not designed to provide assurance on internal control over required supplementary stewardship information and, accordingly, we do not provide an opinion on such controls.

As further required by OMB Bulletin No. 01-02, with respect to internal control related to performance measures determined by management to be key and reported in the Management Discussion and Analysis, we obtained an understanding of the design of significant internal controls relating to the existence and completeness assertions.  Our procedures were not designed to provide assurance on internal control over performance measures and, accordingly, we do not provide an opinion on such controls.

As part of obtaining reasonable assurance about whether NPS's fiscal year 2001 financial statements are free of material misstatement, we performed tests of NPS's compliance with certain provisions of laws and regulations, noncompliance with which could have a direct and material effect on the determination of financial statement amounts, and certain provisions of other laws and regulations specified in OMB Bulletin No. 01-02, including certain provisions referred to in FFMIA.  We limited our tests of compliance to the provisions described in the preceding sentence, and we did not test compliance with all laws and regulations applicable to NPS.  Providing an opinion on compliance with laws and regulations was not an objective of our audit, and, accordingly, we do not express such an opinion.

Under FFMIA, we are required to report whether NPS's financial management systems substantially comply with (1) Federal financial management systems requirements, (2) applicable Federal accounting standards, and (3) the United States Government Standard General Ledger at the transaction level.  To meet this requirement, we performed tests of compliance with FFMIA section 803(a) requirements. 

DISTRIBUTION

This report is intended for the information and use of NPS's management, the Department of the Interior's Office of the Inspector General, OMB, and the U.S. Congress, and is not intended to be and should not be used by anyone other than these specified parties. 

/signed KPMG LLP/

January 18, 2002

Exhibit I

National Park Service Summary of the Status of Prior Year Reportable Conditions September 30, 2001

The following information was converted from table format and shows the finding reference, the condition and the status.

00.A   Non-compliance with FFMIA with regard to complying with the United States Government Standard General Ledger at the transaction level.
Corrected.  Comment closed.

00.B  Year-End Undelivered Order Deobligation and Accounts Payable Accrual Recognition Procedures Should be Strengthened
Repeated in fiscal year 2001, comment 01.B

00.C  Controls Over Accounting for Personal Property Should be Improved
Repeated in fiscal year 2001, comment 01.A

00.D  Preparation, Analysis, and Monitoring of Financial Information Should be Improved
Repeated in fiscal year 2001, comment 01.C

00.E  Advances to Others Should be Liquidated Timely as Related Expenditures are Reported
Same condition was not identified in fiscal year 2001.  However, NPS continues to have issues related to Advances to others balance, as indicated in fiscal year 2001 comment 01.E

00.F  Internal Controls Over the Electronic Data Processing (EDP) Systems Security Should be Improved.
Repeated in fiscal year 2001, comment 01.D

00.G  Electronic Data Processing Application Software Development and Change Controls Should be Strengthened
Repeated in fiscal year 2001, comment 01.D

00.H  NPS's Accounting Operations Center (AOC) Service Continuity Plan Should be Updated
Repeated in fiscal year 2001, comment 01.D

00.I  Prior Unimplemented Office of Inspector General Findings
Corrected.  Comment closed.

ATTACHMENT 2

TEXT COPY OF NPS RESPONSE NOT AVAILABLE.