Operations Management Council Internal Control Quarterly Status

1
Operations Management Council Internal Control
Quarterly Status

• Thursday, February 15, 2007
• NASA Headquarters
• Room 7C61

2
Internal Control Quarterly Status AgendaFebruary
15, 2007

• Opening Remarks Action Status Ms. Dominguez
  5 min.
• HQ Management Systems Status Ms. Cline 10 min.
• Status of Current Internal Control Deficiencies
  40 min.
• Owner Recommendation
• Asset Management (MW) OCFO no change
• Financial Management System (MW) OCFO no
  change
• Financial Management Data Integrity (MC) OCFO no
  change
• Financial Mgmt. Policy Procedures (MC) OCFO no
  change
• Financial Management Staffing (MC) OCFO no
  change
• Full Cost Integration (MC) OCFO no change
• Information Technology Security (MW) OCIO no
  change
• NASA Declassification Program (MC) OSPP close
• Mission Management Aircraft (MC) OIM no change
• Acquisition Management (OW) OPII no change
• Undefinitized Contract Actions (MC) OIM close

Key Material Weakness (MW) Other Weakness
(OW) Management Challenge (MC)
3
Action from 7/28/06 Internal Control Meeting

• The Office of Infrastructure and Administration
  (IA) will analyze the process for updating key
  Agency documents, determine the cause of delays,
  and make recommendations to the Deputy
  Administrator on ways to improve accountability
  for completion of required actions. Due October
  6, 2006.
• Status Closed per presentation to the Deputy
  Administrator on February 9, 2007

4
Classification of Internal Control Deficiencies

• Material Weakness (MW) a deficiency in
  internal controls that is significant enough to
  be reported outside the Agency.
• May jeopardize the Agencys mission
• Violates statutory or regulatory requirements
• Significantly weakens safeguards against waste,
  loss, unauthorized use, mismanagement of funds,
  property, other assets
• Other Weakness (OW) a deficiency in internal
  controls that should be reported and monitored
  internally.
• Management Challenge (MC) a concern about a
  challenge to management. There is insufficient
  information to confirm a serious systemic
  internal control weakness in this area. It may
  pertain to issues that are outside managements
  control or factors that may create an adverse
  condition. Close monitoring is required.

5
Summary
6
NASA Headquarters Audit StatusPresentation to
theOperations Management Council
Management Systems Division Office of
Infrastructure and Administration

• Lynn F. H. Cline
• Deputy Associate Administrator, Space Operations
• Mission Directorate
• Headquarters Executive Management Representative
  (EMR)
• February 15, 2007

7
Activity since last status

• Internal Audit conducted September 18-22, 2006
• External Surveillance audit conducted by National
  Quality Assurance, Inc. November 8-10, 2006

8
Results

• There is one major finding of nonconformance as a
  result of surveillance audits
• The Quality Systems Manual is still not updated
  (Carry-over for past three assessments)
• This has been in work for some time, and is now
  at the step where comments received in NODIS have
  been dispositioned and official signature package
  in process. Document must be signed out by
  Deputy Administrator. If not approved by next
  surveillance audit, it will be a significant
  issue.
• The Quality Systems Manual was signed on November
  26, 2006 and verification will be confirmed
  during the May 2007 External Surveillance Audit.
• There is one minor nonconformance finding
• Management Review input shall include information
  on, results of audits, customer feedback, process
  performance and product conformity, status of
  preventive and corrective actions, follow up from
  previous reviews, changes affecting the QMS and
  recommendations for improvement.
• There is currently no document that clearly
  describes how this management review activity is
  conducted. It is presented as a complex, multi
  layered approach to reporting, with information
  reported in various venues, but there is no clear
  document specifying how this is to occur. (This
  should be considered a significant issue.)
• Updating NPD 1000.0 and NPD 1000.3 should resolve
  this issue.

9
Focus Area

• Look at causes of hindrances to timely review and
  approval of Quality Manual and other documents.
• Previous action discussed by Olga Dominguez
  should be adequate, if properly implemented, to
  address this on-going HQ Management System
  concern
• Next surveillance audit will review the status
  and concurrency of Agency top level policy and
  requirements documents
• NPD 1000.0, Strategic Management and Governance
  Handbook
• NPD 1001.0, NASA Strategic Plan
• NPD 1000.3, NASA Organization

10
Future Activities

• Internal Audit March 12-16, 2007
• Surveillance Audit May 2-3, 2007
• Core Requirements (Management Review, Internal
  Audit, Corrective Action, Preventive Action,
  Customer Satisfaction, Continual Improvement)
• Resource Management (6.1, 6.2, 6.3, 6.4)
• Verification of Major Nonconformance corrective
  action

11
Back Up Charts
12
HQ Quality Management System

• The Headquarters (HQ) Quality Management System
  (QMS) is a process-based management system that
  controls the quality of HQ customer products and
  mission requirements
• Implements the HQ quality policy (which is also
  NASAs policy) as stated in the 2006 NASA
  Strategic Plan
• HQs customer products are
• NASA Strategic Plan,
• Annual Budget and the Annual Performance Plan (as
  represented in the Integrated Budget and
  Performance Document), and
• Annual Performance and Accountability Report
• The scope of the HQ QMS is mission and mission
  support management of the Vision for Space
  Exploration, aeronautics and science.
• The Deputy Administrator, as the
  official-in-charge of the HQ QMS, provides the
  resources to implement, maintain, and improve the
  QMS
• The scope of the Operations Management Council
  encompasses all activities conducted by NASA,
  including the review of the HQ QMS
• The Executive Management Representative has
  day-to-day responsibility for the HQ QMS
• Supported by the Office of Infrastructure and
  Administration

13
Asset Management

• Office of the Chief Financial Officer
• Terry Bowie
• February 15, 2006

14
BackgroundAsset Management

• The OMC and NASAs independent financial auditors
  designated asset management (Property, Plant, and
  Equipment) as a Material Weakness. Asset
  Management includes Contractor-held and
  NASA-held property.
• Currently, the OCFO is sharing responsibility for
  this Material Weakness with the Programmatic
  Internal Control Team (PICT) and the
  Institutional Internal Control Team (IICT).
• Corrective Action Plans have been developed to
  address auditor recommendations from both the FY
  2005 and FY 2006 financial statement audits.
  These plans define the goal, objectives,
  strategies, and actions for improving NASAs
  internal controls over Property, Plant, and
  Equipment.

15
IssueAsset Management

• NASA needs to improve its management controls for
  the financial reporting of Property, Plant and
  Equipment, and materials including Theme Assets
  (formerly Assets-in-Space), Contractor-held
  property, spare parts and assets under
  construction. Lack of proper management controls
  can result in inconsistent financial recording
  practices that can misstate asset values and
  period expenses.
• Root cause
• NASAs policies and procedures are not fully in
  conformance with federal requirements.
• NASAs obligation documents and disbursements are
  not coded to identify whether they relate to
  acquisition of property.
• Updates Since Last Quarter
• Provided revisions to Agency-wide policy/process
  documents
• 7120.5D Establishes the requirement for Project
  Managers to determine Alternative Future Use for
  projects and identify capital acquisitions from
  project inception
• 7120.7 Establishes WBS Level 2 requirements for
  Internal Use Software projects
• Financial Management Requirements (FMR), Volume
  6, Chapter 4, Plant, Property and Equipment
• 7120.X (Research and Technology) - Establishes
  the requirement for Project Managers to determine
  Alternative Future Use for projects and identify
  capital acquisitions from project inception
• Provided Business Process Requirements for the
  IEMP Integrated Asset Management PPE Module
• Met with OPII, OCE, PAE, Policy, Procurement,
  and Mission Directorates to discuss proposed
  changes to the Contractor Cost Reports (NF533)
  and WBS changes
• Created a system change request to have a capital
  asset indicator added to both SAP and MdM, which
  will allow for flagging of costs from inception
• Met with Procurement and Logistics
  representatives to integrate property management
  practices.

16
Critical Milestone StatusAsset Management
17
Planned Actions for Next QuarterAsset Management

• Continue working with the AAPC and FASAB to
  finalize guidance on the accounting treatment of
  our Agencys space exploration projects
  (mission-related projects)
• Continue work on PPE Implementation plan tasks
  to include revising and documenting business
  process, policy and procedural changes
• Meet with the Mission Directorate Business
  Analysts community to communicate their roles and
  responsibilities in the management of PPE
• Prototype financial property solution with
  existing project
• Continue working with the Offices of Program and
  Institutional Integration, Policy, Procurement,
  Chief Engineer and Mission Directorates, to
  ensure revisions to the contractor cost reporting
  process are developed by all stakeholders.
• Continue working with the Procurement and
  Logistics communities to integrate property
  management practices.
• Continue working with the IEMP IAM Project Team
  members on the blueprinting of the PPE Module to
  ensure revised business processes are
  implemented.
• Continue to work with MdM and Competency Center
  staff to ensure requested system changes are
  configured
• Work with OCE to ensure asset related changes are
  incorporated into final issuance of 7120.5D,
  7120.7 and 7120.X
• Through the Senior Assessment Team (SAT),
  continue to work with the Institutional Internal
  Control Team (IICT), the Programmatic Internal
  Control Team (PICT), and the Financial Management
  Internal Control Team (FMICT) to integrate
  policy, procedures, and internal controls

18
RecommendationAsset Management

• Asset Management should continue to be carried as
  a Material Weakness

19
Financial Management System

• Office of the Chief Financial Officer
• Terry Bowie
• February 15, 2007

20
BackgroundFinancial Management System

• In 2005, the OMC designated Financial Management
  System as a Material Weakness. Financial
  Management System captures challenges related
  to
• Confirming configuration
• Validating the accounting
• Validating construction of the financial reports
• Currently, the OCFO is sharing responsibility for
  this Material Weakness with the Office of the
  Chief Information Officer and the Integrated
  Enterprise Management Program (IEMP) Office.
• Corrective Action Plans have been developed to
  address auditor recommendations from both the FY
  2005 and FY 2006 financial statement audits.
  These plans address improvements required for
  NASAs financial management system and ensure
  that processes achieve accurate, reliable, and
  timely financial information.

21
Issue Financial Management System

• Since the completion of the rollout of the new
  system, challenges in system processing,
  configuration, and capabilities have surfaced and
  the current version of the SAP system has some
  capability limitations which have required the
  definition and implementation of compensating
  controls.
• Root cause
• Conversion from 10 disparate legacy financial
  systems supported by over 120 subsidiary systems,
  along with over a decade of historical data, to a
  single integrated financial management system
  highlighted long-standing data and process
  issues.
• Updates Since Last Quarter
• Implemented SAP Version Update system
  improvements
• Continued to generate and review monthly
  reconciliations
• Continued to execute compensating procedures to
  analyze Business Warehouse data on a quarterly
  basis to ensure that liabilities are
  appropriately recorded

22
Critical Milestone Status Financial Management
System
23
Planned Actions for Next Quarter Financial
Management System

• Review funds control processes and submit to OMB
  for certification
• Continue to prepare monthly financial statements
  within 30 days of period close
• Continue to generate monthly management reports

24
Recommendation Financial Management System

• Financial Management System should continue to be
  carried as a Material Weakness.

25
Financial Management Data Integrity

• Office of the Chief Financial Officer
• Terry Bowie
• February 15, 2007

26
Background Financial Management Data Integrity

• In 2005, the OMC designated Financial Management
  Data Integrity as a Material Weakness.
  Financial Management Data Integrity captures
  challenges related to
• Environmental Liabilities
• Fund Balance with Treasury (FBWT)
• Currently, the OCFO is sharing responsibility for
  this Material Weakness with the Offices of
  Infrastructure and Administration, Procurement,
  and the Integrated Enterprise Management Program
  (IEMP).
• The FY 2006 financial statement audit removed
  Environmental Liabilities and Fund Balance with
  Treasury (FBWT) as reportable conditions.
• Corrective Action Plans have been developed to
  address auditor recommendations from both the FY
  2005 and FY 2006 financial statement audits.
  These plans address validating the tools and
  methodology used to prepare the unfunded
  environmental liability estimates and ongoing
  monitoring and control of financial accounts,
  including Fund Balance with Treasury.
• In 2006, the OMC lowered the significance level
  of Financial Management Data Integrity to a
  Management Challenge

27
Issue Financial Management Data Integrity

• NASA needs to continue to improve its current
  procedures to ensure that all reconciling items
  are thoroughly researched, resolved timely, and
  reviewed by appropriate center and headquarters
  OCFO personnel. NASA needs to improve existing
  environmental liability procedures and implement
  needed internal controls to assure the improved
  procedures are adhered to and followed.
• Root cause
• Relates to issues from data conversion system
  processing in the early stages of production
  operation.
• Updates Since Last Quarter
• Monitored metrics monthly
• Conducted on-going monitoring to ensure monthly
  reconciliations are performed and appropriate
  corrective actions are taken
• Continued to conduct on-going review and
  monitoring of compliance with Fund Balance with
  Treasury policies, procedures, and practices

28
Critical Milestone Status Financial Management
Data Integrity
29
Planned Actions for Next Quarter Financial
Management Data Integrity

• Review existing guidance for account
  reconciliation and analyses
• Continue to monitor metrics monthly
• Continue to conduct on-going monitoring to ensure
  monthly reconciliations are performed

30
Recommendation

• Financial Management Data Integrity should
  continue to be carried as a Management Challenge.

31
Financial Management Policy and Procedures

• Office of the Chief Financial Officer
• Terry Bowie
• February 15, 2007

32
Background Financial Management Policies and
Procedures

• In 2005, the OMC designated Financial Management
  Policies and Procedures as a Management
  Challenge. This challenge is related to
  completion of the Financial Management
  Requirements (FMR).

33
IssueFinancial Management Policies and Procedures

• NASA needs to continue to improve its current
  policy to ensure improvement of existing
  procedures and implement needed internal controls
  to assure the improved procedures are adhered to
  and followed.
• Root cause
• NASAs policies and procedures are not fully in
  conformance with federal requirements
• Implementation of the Integrated Enterprise
  Management Program required revision of policies
  and procedures
• Updates Since Last Quarter
• Implemented monthly financial reporting,
  including Center compliance with monitoring and
  controls requirements
• Performed/performing A-123 and monitoring reviews
  at Centers

34
Critical Milestone Status Financial Management
Policies and Procedures
35
Recommendation Financial Management Policies and
Procedures

• Financial Management Policies and Procedures
  should continue to be carried as a Management
  Challenge.

36
Financial Management Staffing

• Office of the Chief Financial Officer
• Terry Bowie
• February 15, 2007

37
BackgroundFinancial Management Staffing

• In 2005, the OMC designated Financial Management
  Staffing as a Management Challenge. Financial
  Management Staffing captures challenges related
  to
• Staffing Levels
• Personnel Skill Mix
• Workforce Development
• Currently, the OCFO is sharing responsibility for
  this Management Challenge with the Office of
  Institutions and Management.
• Corrective Action Plans have been developed to
  address auditor recommendations from both the FY
  2005 and FY 2006 financial statement audits. The
  plans include actions to address workforce
  development.

38
Issue Financial Management Staffing

• NASA needs to ensure adequate staffing for
  financial management functions across
  Headquarters and the Centers and to continually
  provide additional handson training for
  financial personnel to ensure that they
  understand their roles in financial reporting.
• Root cause
• With the implementation of the Integrated
  Enterprise Management Program (IEMP), additional
  training was required due to new processes.
• The implementation of the IEMP Core Financial
  module represented a major transformation of
  NASA's financial management systems and
  processes.
• Updates Since Last Quarter
• Made minimal progress in hiring this quarter
• Vacancy announcements were posted for GS9-14
  Accountants, Budget Analysts and GS-15
  Accountants
• Fourth quarter of 2006 5 candidates accepted
  offers 7 staff members resigned
• Currently 24 vacancies (8 managerial positions)
• 3 Budget Analyst and 1 Administrative Officer
  positions announced and candidates selected
  offer pending outcome of external assessment
• 2 Supervisory Budget Analyst positions pending
  outcome of external assessment
• Submitted an OCFO Reorganization Proposal on
  September 1, 2006
• Developed a Workforce Assessment (Sep 06) and a
  Workforce Plan (Oct 06)
• Workforce Plan includes career development,
  forecasting, performance measurement, and
  recruiting/retention
• Training Provided to OCFO Staff
• Appropriation Law
• Budget Analysts Essential Guide to Formulation,
  Justification and Execution
• U.S. Standard General Ledger

39
Critical Milestone Status Financial Management
Staffing
40
Planned Actions for Next Quarter Financial
Management Staffing

• Gain approval for proposed reorganization
• Finalize FTE ceilings and establish hiring
  targets for needed skills, consistent with
  workforce analysis
• Continue hiring to approved ceiling
• Design training program to address the needs of
  the organization, consistent with workforce
  analysis

41
Recommendation Financial Management Staffing

• Financial Management Staffing should continue to
  be carried as a Management Challenge.

42
Full Cost Integration

• Office of the Chief Financial Officer
• Terry Bowie
• February 15, 2007

43
BackgroundFull Cost Integration

• In 2005, the OMC designated Full Cost
  Integration as an Other Weakness. Full Cost
  Integration addresses challenges related to a
  lack of understanding of full cost policies and
  procedures.
• In the past, the emphasis of full cost activity
  was focused on full cost accounting. Today,
  emphasis is needed on cost information tailored
  to science/engineering and institutional program
  decision making.
• In 2006, the OMC reduced the significance level
  of Full Cost Integration to a Management
  Challenge.

44
IssueFull Cost Integration

• Full Cost concepts need to be better integrated
  into NASA operations. Despite implementing a Full
  Cost accounting system and many Full Cost
  processes, NASA still lacks the level of cultural
  change needed to fully transition to Full Cost
  management.
• Root cause
• Insufficient stakeholder training
• Unintended consequences and behaviors realized
  from initial full cost approaches
• Some policies and planned processes were based on
  insufficient experience and need to be refined to
  reflect lessons learned
• Updates Since Last Quarter
• Cost Objectives Study completed by independent
  cost experts
• Cost Objectives Working Group assessing those
  study findings
• Clarify objectives for full cost management
• Develop/prioritize specific cost information
  improvement actions
• Develop plan of action and milestones
• Support Agency requirement for simplified cost
  management
• Center Management and Operations (CMO) in place
  for FY07

45
Critical Milestone Status Full Cost Integration
46
Planned Actions for Next QuarterFull Cost
Integration

• Complete Cost Objectives Working Group report
• Plan for implementation of near-term
  recommendations in 4th quarter

47
RecommendationFull Cost Integration

• Full Cost Integration should continue to be
  carried as a Management Challenge.

48
Information Technology Security

• Office of the Chief Information Officer
• Scott Santiago
• February 15, 2007

49
Background

• The current audits of NASAs IT Security Program
  by the NASA OIG are identifying similar
  deficiencies that had been identified and
  addressed in previous OIG audits and through NASA
  corrective actions.
• Impacts
• Effect on mission accomplishment puts the
  integrity, availability and confidentiality of
  all NASAs critical data at risk.
• Cost impact potential loss of ITAR and SBU
  information that costs NASA billions to develop
  or acquire.
• Compliance impact noncompliant with the Federal
  Information Security and Management Act.
• Budgets and schedule Corrective Action Plan
  requires reallocation of mission resources to
  bring Agency IT systems into compliance,
  potentially impacting mission budgets and
  schedules,
• Operating efficiency collaboration across
  Centers is seriously hampered due to
  inconsistencies in the way security solutions
  have been implemented at Centers.
• All NASA organizations are at risk.

50
Issue

• Description of deficiency In order to properly
  protect NASAs information and Information
  Technology (IT), the NASA IT Security Program
  needs more effective implementation, monitoring,
  verification and validation and enforcement.
• Root cause Current ITS Review established to
  determine root cause. On schedule to be completed
  February 2007.
• Updates since last quarter
• New IT Security clause - Completed Feb. 2007
• Completed NASA IT Security review, finalizing
  report and corrective action plan. Scheduled for
  completion end of February 2007.
• Established interim FISMA corrective action plan
  in December 2006

51
Deficiency Milestone Status
52
Planned Actions for Next Quarter

• Review completed January 2007, the final report
  with recommendations and corrective action plan
  due February 2007.

53
Recommendation

• Continue as a Material Weakness until corrective
  actions are implemented and they begin to
  demonstrate to NASA management the required
  results to assure that risk is being managed at
  an acceptable level
• All Centers have demonstrated that all updated or
  new ITS Plans comply with existing NASA Policy.
• NASA computers and devices have mitigated known
  vulnerabilities based on accepted risk levels.
• NASA intrusion response
• Intrusion detection covers all network
  demarcation points between NASA networks and
  external networks.
• NASA is capable of investigating all potential
  compromised devices immediately following
  detection.

54
NASA Declassification ProgramManagement
Challenge (MC)

• Office of Security and Program Protection
• Steve Peyton
• February 15, 2007

55
Background

• NASA had a significant backlog of permanent
  records containing classified national security
  information (CNSI) that needed to be reviewed for
  continued classification pursuant to EO 12958
  amended.

56
Issue

• Deficiency Description
• NASA faced a December 2006 deadline to insure
  that all permanent records containing CNSI that
  are 25-years old or older are subjected to
  classification review. Poor past records
  management practices prevented the identification
  of records subject to Section 3.3 of EO 12958
  amended, resulting in NASAs inability to
  identify its total universe to be considered for
  declassification. The identified root causes
  significantly impeded the classification review
  programs efforts. EO 12958 as amended contains
  a sliding-window requirement for NASA to conduct
  yearly classification reviews of permanent
  records containing CNSI.
• Root Causes
• Insufficient staffing
• Historically poor records management
• Insufficient funding
• Lack of Declassification Guides
• Insufficient resident expertise to perform
  classification reviews for older programs
• Insufficient support from senior management
  (commitment of resources)
• Corrective Action Plan (CAP)
• A comprehensive CAP was developed and distributed
  to the OMC, OIG, all Mission Directorates, and
  Center Security Offices on August 1, 2005.
• Update Since Last Quarter
• 661,000 pages reviewed (goal was 500,000)

57
Deficiency Milestone Status
58
Planned Actions for Next Quarter

• Begin to review documents to meet December 31,
  2007 deadline.
• Review the number of Referrals received from
  Other Government Agencies to meet December 31,
  2009 deadline.
• Review Special Media requirements that are
  required to be reviewed by December 31, 2011.

59
Recommendation

• This deficiency should be removed as a Management
  Challenge (MC).
• The lessons learned and the established teams
  will enable us to keep the Declassification
  process moving forward.
• Request the Mission Directorates and Center
  Directors continue to provide their support to
  this continued declassification effort.

60
Mission Management Aircraft

• Infrastructure and Administration
• Joe Walker
• February 15, 2007

61
Background

• GAO audit of Agencys FY03 and FY04 Mission
  Management Aircraft (MMA) operations highlighted
  control deficiencies with respect to management
  of NASAs MMA.
• MMA operations were also questioned in several
  prior GAO and NASA IG audit reports.

62
Issue

• Inadequate documentation and periodic review of
  MMA mission requirements Resolved
• A-76 cost comparisons of all alternatives to
  government ownership of MMA have been completed
• Insufficient HQ oversight - Resolved
• Lack of integrated IT system to capture and
  report aircraft cost utilization Resolved
• MMA downgraded from an Other Weakness to a
  Management Challenge at the October 2006 OMC
  Meeting.

63
Deficiency Milestone Status
64
Planned Actions for Next Quarter

• Respond to recommendations from OIG audit of A-76
  Cost Comparison studies

65
Recommendation

• Mission Management Aircraft should remain a
  Management Challenge until completion of the OIG
  audit of the A-76 Cost Comparison studies

66
Acquisition Management

• Office of Program and Institutional Integration
  (OPII)
• Rita Svarcas
• February 15, 2007

67
Background

• The Inspector General (IG) and the GAO (via its
  High Risk List) assert that NASA is not providing
  proper acquisition oversight. This is a
  long-standing deficiency. OCE, OP, OGC, OCFO,
  IEMP, and OPII are working together, and with the
  OIG and the GAO, to address the concerns and
  correct the deficiency.
• Major activities include
• 16 May 06 SMC approved Agency Strategic
  Acquisition Approach that enables informed
  decisions earlier in the acquisition process.
• 18 July 06 OCE briefed Deputy Administrator on
  recommended approach that addresses IGs concerns
  and GAOs High Risk rating.
• 28 July 06 Based on OCE briefing, Acquisition
  Management deficiency designated as an Other
  Weakness, with OPII as the POC.
• 15 September 06 OCE presented draft
  implementation documents to OPII for review and
  finalization.
• 21 November 06 Team of HQ representatives
  presented status of related activities to GAO
  team, with OIG in attendance.
• 31 January 07 GAO issued High-Risk Update,
  re-stating concerns and necessary improvements.

68
Issue Description of Deficiency

• Weak link between financial management and
  program management decisionmaking
• hinders Agencys ability to effectively
• Estimate costs
• Perform contract oversight
• Analyze contractor performance, including EVM
• Establish strong integrated business processes
  and associated tools

69
Issue Root Cause

• GAO High-Risk (May 19, 2004)
• Weak link between financial management and
  program management decision-making
• Financial management culture that has not fully
  acknowledged nature and extent of financial
  management difficulties
• GAO High-Risk (January, 2005)
• Lack of modern, fully implemented integrated
  financial management system
• Undisciplined cost estimating processes in
  project development
• Inability to obtain information needed to assess
  contract progress
• GAO High-Risk (Jan 31, 2007)
• Calls for re-engineering of cost reporting
  process
• Lack of cost and performance data
• To develop credible estimates
• To compare BCWP to ACWP
• Lack of analytical tools
• Lack of trained staff for cost analysis and EVM

70
Updates Since Last Quarter

• Planned Actions were
• Finalize list of policies requiring modification.
• Accomplished.
• Establish case study criteria, review current
  candidates, and obtain approval of senior
  management.
• Revised approach contemplates joint case studies
  addressing both this Weakness and the IEMP
  program/project management study (regarding
  requirements and data gaps).
• Research relevant Agency analyses and
  initiatives, including IEMP and other tools.
• Accomplished. Reviewed related studies and
  identified new Management/Business Systems
  Integration Group (M/BSIG) as a key venue for
  addressing business process issues in a
  cross-functional manner.

71
Deficiency Milestone Status
72
Planned Actions for Next Quarter

• Prepare Corrective Action Plan to resolve High
  Risk area
• Involving multiple organizations OCFO, OP,
  PAE, OCE, IEMP (M/BSIG), OPII
• Plan will ultimately involve
• GAO agreement
• Deputy Administrator correspondence
• Tracking progress to completion (GAO
  concurrence)
• Continue modifying policies to incorporate
  ASP/ASM/PSM
• Establish case study plan in conjunction with
  IEMP and the M/BSIG

73
Recommendation

• This deficiency should continue to be carried as
  an Other Weakness.

74
Undefinitized Contract Actions (UCAs)

• Office of Procurement
• Deborah ONeill
• February 15, 2007

75
Background

• UCAs are used when there is an urgent need to
• - initiate work by contractors to meet
  schedules or
• - turn off contractor performance in order to
  stop their incurrence of costs before a final
  price or estimated cost and fee have been
  negotiated and mutually agreed upon by NASA and
  the contractor.
• When used appropriately, UCAs are a legitimate
• procurement tool.

76
Issue

• Description of Deficiency
• - GAO audits identified in early 1990s large
  dollar amount of UCAs (6.6 billion) which
  resulted in their appearing as part of GAO
  Contract Management High Risk. This remained the
  case until the GAO 2007 update when UCAs were no
  longer identified as part of the Contact
  Management High Risk.
• Root cause
• - Use of UCAs has fluctuated over time due to
  the temporary need to expedite certain
  activities. Problems may occur if they are
  inappropriately used, there are no dollar
  limitations on the amount of a UCA, and UCAs are
  not definitized in a reasonable period of time.

77
Deficiency Milestone Status
78
Planned Actions for Next Quarter

• Continue to require prior approval
• - Head of Contracting Activity for UCAs gt 100K
• - Center Procurement Officer for UCAs lt 100K
• - AA for Procurement for Letter Contracts gt
  Center
• Master Buy Plan threshold or 10M (ESMD
  and
• SOMD)
• - Center Procurement Officer for all other
  Letter
• Contracts
• Continue to monitor and follow up with Centers on
  UCA activity on a monthly basis
• Dollars
• Number of actions
• Time it takes to definitize (within 180 days)

79
Planned Actions for Next Quarter(Continued)

• Continue to review as part of each Center
  Procurement Management Survey, self-assessments,
  and Center Procurement Officer one-on-one
  meetings with Assistant Administrator for
  Procurement

80
Recommendation

• This deficiency should be closed because UCAs are
  actively being managed and reported resulting in
  the dollar amount having declined from 6.6
  billion in the early 1990s to less than 500
  million. This has been recognized by GAO with
  the deletion of UCAs from its January 2007
  updated High Risk Series report.

81
Backup
82
Total NASA UCAs Actions by Age January 31, 2007
83
(No Transcript)
84
(No Transcript)
85
Summary
86
Governance of Internal Controls at
NASAChristyl JohnsonTerry BowieCharles
ScalesFebruary 15, 2007
87
Background

• Agency must comply with updated OMB Circular
  A-123, Managements Responsibility for Internal
  Control, Dec. 2004
• Provide assurances of internal controls
• Separate assurance on internal controls over
  financial reporting
• Report on identified material weaknesses and
  corrective actions
• Assessment of internal controls must include
  programmatic, financial, and institutional
  management, and must be conducted as effectively
  and efficiently as possible

88
Need for Modification to Current Approach

• In 2006, it became obvious that supporting
  documentation and evidence for the annual
  statement of assurance was severely lacking.
  Financial evidence was documented, but the
  programmatic and institutional components were
  not.
• NASA relied upon external audit bodies to
  identify weaknesses, instead of actively
  identifying, managing and correcting weaknesses
  internally.
• Perception existed that internal controls is
  strictly financial

89
Need for Modification to Current Approach

• OMC was tasked with the responsibility of
  reviewing and monitoring all reported internal
  control deficiencies. This proved to be an
  arduous task, and not an efficient role for the
  OMC. The Senior Assessment Team (SAT) was not
  functioning as reviewing body.
• An Internal Controls workshop with representation
  from programmatic, financial, and institutional
  components revealed a stovepiped approach to
  managing internal controls. The SAT was not
  effectively integrating internal controls as a
  consequence, risk to NASA increased both for
  internal management effectiveness and external
  audits.

90
Previous Responsibilities of the Senior
Assessment Team

• Promote effective Agency-wide internal controls
• Identify who will perform assessments
• Document performance requirements and guidance
• Approve assessment objectives, scope, and other
  relevant requirements and communicate these to
  assessable units
• Monitor the progress of internal control
  assessments

91
New Responsibilities of the Senior Assessment Team

• Ensures adequate resources are devoted to the
  internal control evaluation process and NASAs
  compliance with the requirements of OMB Circular
  A-123 (identifying key controls, developing a
  testing plan, documenting test results, and
  reporting on the effectiveness of the controls)
• Ensures Senior Assessment Team decisions are
  documented
• Advises the Operations Management Council on the
  content of the Administrators Annual Statement
  of Assurance, and submits to the Administrator a
  statement on whether there is reasonable
  assurance that NASAs internal controls over
  programs, institutions, and financial reporting
  are achieving their intended objectives.

92
Proposed Responsibilities of the Senior
Assessment Team

• Integrates and coordinates internal controls and
  policies across programmatic, financial, and
  institutional management for improved efficiency
  and effectiveness of Agency internal management
  controls
• Provides oversight of the design and
  implementation of an effective and comprehensive
  Agency-wide internal control program
• Leads Agency prioritization of internal control
  requirements for the current year and develops
  plans for prioritization in the out-years
  consistent with Agency vision and mission
• Monitors and assesses Agency material weaknesses
  for the OMC recommends action as appropriate

93
Proposed Responsibilities of the Senior
Assessment Team

• Reports material weaknesses to OMC for further
  action
• Tracks progress of Agency-wide corrective action
  resolution
• Supports OMC and the establishment of an
  integrated set of metrics to measure the Agencys
  progress towards its goals
• Compiles supporting documentation for the
  Administrators Statement of Assurance from HQ
  Offices and Centers
• Promotes continuous internal controls evaluation
  and monitors the progress of assessments
  throughout the Agency

94
Previous Governance Structure
Operations Management Council (OMC)
95
New Governance Structure
Operations Management Council (OMC)
96
Justification for Change to Chair of the SAT

• Under the new governance structure, the Office of
  Program and Institutional Integration (OPII) is
  the manager of Agency-level integration of
  programmatic and institutional functions and
  activities, and is best positioned to recognize
  internal management control deficiencies across
  programmatic, institutional, and financial
  entities
• The SAT will enhance the OPII role as focal point
  for programmatic requirements and as the
  integrator of functional policy requirements by
  providing current information on the state of
  internal management controls to meet those
  requirements across the Agency

97
Justification for Change to Chair of the SAT

• The OPII, as SAT Chair, is best positioned to
  coordinate the development of an Integrated
  Internal Control Plan and determine appropriate
  assessable units for review and analysis
• The OPII as SAT Chair, is best positioned to
  identify internal control deficiencies within the
  Agency management systems and recommend
  appropriate action
• The OPII, as SAT Chair, is best positioned to
  render decisions in the overall best interests of
  the Agency, with no dominant programmatic,
  institutional or financial filter

98
Previous Execution of Internal Controls Functions
OFFICE OF
INSTITUTIONS AND MANAGEMENT
OFFICE OF THE ASSOCIATE ADMINISTRATOR FOR
INSTITUTIONS AND MANAGEMENT
OFFICE OF DIVERSITY AND EQUAL OPPORTUNITY
OFFICE OF
OFFICE OF HUMAN CAPITAL MANAGEMENT
INFRASTRUCTURE
AND
ADMINISTRATION
OFFICE OF SMALL BUSINESS PROGRAMS
OFFICE OF SECURITY AND PROGRAM PROTECTION
NASA SHARED
OFFICE OF PROCUREMENT
SERVICES CENTER
In accordance with law, the offices of
Diversity and Equal Opportunity and Small
Business Programs maintain reporting
relationships to the Administrator and Deputy
Administrator.
99
New Execution of Internal Controls Functions
OFFICE OF
INSTITUTIONS AND MANAGEMENT
OFFICE OF THE ASSOCIATE ADMINISTRATOR FOR
INSTITUTIONS AND MANAGEMENT
OFFICE OF INTERNAL CONTROLS AND
MANAGEMENT SYSTEMS
OFFICE OF INFRASTRUCTURE AND ADMINISTRATION
OFFICE OF DIVERSITY AND EQUAL OPPORTUNITY
OFFICE OF HUMAN CAPITAL MANAGEMENT
OFFICE OF SMALL BUSINESS PROGRAMS
OFFICE OF SECURITY AND PROGRAM PROTECTION
NASA SHARED SERVICES CENTER
OFFICE OF PROCUREMENT
In accordance with law, the offices of
Diversity and Equal Opportunity and Small
Business Programs maintain reporting
relationships to the Administrator and Deputy
Administration.
100
Justification for New Office Reporting to AA, IM

• The new Office will
• Help ensure compliance with Federal objectives
  and requirements for internal management controls
  
• Provide focused leadership to assess and
  integrate a comprehensive internal management
  control program consistent with the Agency
  governance structure
• Acquire and administer the resources necessary to
  identify key management controls, develop a
  testing plan, document testing results, and
  report on the effectiveness of the Agencys
  internal controls
• Provide the daily oversight of the Agency
  internal control program including establishing
  controls, performing assessments, identifying and
  reporting deficiencies, and monitoring corrective
  actions

101
Justification for New Office Reporting to AA, IM
(cont.)

• Creation of this new Office demonstrates
  NASAs commitment to a comprehensive and
  integrated internal management control program
  and emphasizes the importance of internal
  management controls and risk assessment to the
  NASA community in support of the Agencys mission

102
Office of Internal Controls and Management
Systems Responsibilities

• Executive Leadership for Internal Controls
• Support for the Senior Assessment Team (SAT)
• Operational leadership of the Institutional
  responsibilities of the SAT
• Support for correction of internal control
  deficiencies
• Mission Support Plan (MSP) Maintenance and
  Oversight
• Progress reporting against MSP objectives and
  goals
• Updates of MSP and process enhancements
• Audit Liaison
• Primary point-of-contact for GAO/OIG audit
  activities
• Reporting on audit recommendations and corrective
  actions
• Management Systems
• Support for internal and external assessments
• Directives Management and NASA Online Directives
  Information System (NODIS)

103
Next Steps

• Move current management systems function from IA
  to a new office for Internal Management Controls,
  which reports directly to the AA for Institutions
  and Management
• Update Charter with approved roles and
  responsibilities
• Finalize an Organizational Implementation Plan
• Finalize an Integrated Internal Controls Plan
• Update Internal Control policy documents
• Implement Plan in FY07 (2nd Quarter)