Federal Housing Finance Agency: Improvements Needed in Controls over Management Reviews and Information Systems Access
Fast Facts
Each year, we audit the Federal Housing Finance Agency's financial statements.
During our 2023 audit, we found issues with FHFA's internal controls over its review of the draft consolidated financial statements and information systems access. Internal controls are processes to reasonably assure that transactions are properly authorized and recorded.
We considered one of the issues to be a "significant deficiency" when combined with a related FHFA Office of Inspector General control deficiency.
Our 3 recommendations address these issues. We also determined that FHFA is still addressing recommendations from our April 2023 report to management.
Highlights
What GAO Found
During its audits of the Federal Housing Finance Agency’s (FHFA) fiscal year 2023 consolidated financial statements, GAO identified several deficiencies in FHFA’s internal controls. Although these control deficiencies did not negatively affect GAO’s overall audit opinion on FHFA’s consolidated financial statements or internal controls over financial reporting, they nonetheless warrant the attention of FHFA management.
Of the control deficiencies it identified, GAO considered one—which was related to FHFA not performing effective reviews of the draft consolidated financial statements—to be a significant deficiency when combined with a related FHFA Office of Inspector General control deficiency. Other deficiencies GAO identified were important but less critical. For example, FHFA did not properly remove systems access for separated employees in accordance with established procedures. By addressing these deficiencies, FHFA can make it more likely that agency management and employees will prevent, or detect and correct, misstatements in financial reporting.
Why GAO Did This Study
In November 2023, GAO reported on the results of its audits of FHFA’s consolidated financial statements for fiscal years 2023 and 2022. Although GAO found that FHFA had maintained effective internal control over financial reporting as of September 30, 2023, GAO did identify some deficiencies in FHFA’s internal controls. The purpose of this report is to present (1) the internal control deficiencies GAO identified during its fiscal year 2023 audit and (2) the status of FHFA’s corrective actions to address open recommendations related to internal control deficiencies.
To evaluate FHFA’s internal control over financial reporting, GAO reviewed FHFA policies and procedures; interviewed FHFA management and staff; observed controls in operation; and conducted tests of controls to determine whether controls were designed, implemented, and operating effectively. GAO also determined the status of FHFA’s efforts to address recommendations related to internal control deficiencies that GAO identified in its prior report, and that remained open as of September 30, 2023.
Recommendations
GAO is making three recommendations to FHFA to reasonably assure that (1) reviews of draft consolidated financial statements detect and correct misstatements and (2) FHFA grants access to and removes access from information systems in accordance with established procedures. FHFA agreed with GAO’s three recommendations and described actions it plans to take to address each recommendation.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Federal Housing Finance Agency | The Director of FHFA should direct the appropriate management officials to develop sufficiently detailed guidance for how FHFA personnel should review accounting information that FHFA OIG provides for inclusion in FHFA's consolidated financial statements, to detect and timely correct misstatements. (Recommendation 1) |
In its comments on our draft report, FHFA stated that it agreed with our recommendation and described actions it plans to take to address management reviews. FHFA stated that the estimated completion date is June 30, 2024. We will evaluate the effectiveness of FHFA's efforts on this recommendation during our audit of its fiscal year 2024 financial statements.
|
| Federal Housing Finance Agency | The Director of FHFA should direct the appropriate management officials to update existing policy for obtaining FPPS access to clearly describe (1) the process and procedures that staff should follow to request access, (2) the nature and extent of access rights appropriate for each employee's position, and (3) the documentation FHFA should maintain as evidence that the designated approving official granted the access. (Recommendation 2) |
In its comments on our draft report, FHFA stated that it agreed with our recommendation and described actions it plans to take to address information systems access. FHFA stated that the estimated completion date is June 30, 2024. We will evaluate the effectiveness of FHFA's efforts on this recommendation during our audit of its fiscal year 2024 financial statements.
|
| Federal Housing Finance Agency | The Director of FHFA should direct the appropriate management officials to develop monitoring procedures to reasonably assure that FHFA personnel follow existing procedures to timely remove information systems access for separated employees. (Recommendation 3) |
In its comments on our draft report, FHFA stated that it agreed with our recommendation and described actions it plans to take to address information systems access. FHFA stated that the estimated completion date is June 30, 2024. We will evaluate the effectiveness of FHFA's efforts on this recommendation during our audit of its fiscal year 2024 financial statements.
|