10 U.S.C. § 240b — Financial Improvement and Audit Remediation Plan

(a) Financial Improvement and Audit Remediation Plan. (1) In general: The Under Secretary of Defense (Comptroller), working with the Department's Performance Improvement Officer, must keep a plan called the "Financial Improvement and Audit Remediation Plan." (2) Elements: The plan must (A) describe specific actions, interim milestones, and cost estimates for (i) fixing the financial management problems that block timely, reliable, complete financial reports; (ii) getting the Department's financial statements fully audited, aiming for an unmodified ("clean") opinion as soon as possible; (iii) making sure each fiscal year's audit (after fiscal year 2020) finishes by March 31 of the following year; (iv) achieving an unqualified audit opinion for each major part of the Department's statement of budgetary resources; (v) confirming that each major category of Department assets actually exists and is completely accounted for; (vi) meeting resource needs, including staff and IT infrastructure; and (vii) setting long-range goals and measurable targets, including audit timelines, how often controls get tested, and auditor-approved corrective action plans. The plan must also (B) tie those actions to the business-process, control, and systems-modernization efforts described in section 2222 of this title. (b) Report and Briefing Requirements. (1) Annual report: (A) By July 31 each year, the Comptroller must send Congress's defense committees a report on how the Plan is being carried out. (B) Each report must include (i) analysis of the corrective-action-plan summary required by section 240c; (ii) current Department-wide status of corrective action plans tied to critical capabilities, using standard data elements from OMB Circular A-123 guidance, broken down by armed force, military department, and Defense Agency; (iii) a description of work done and planned to test and verify transaction data needed for a clean audit, including from feeder systems; (iv) a current timeline for the full financial-statement audit — submitted annually within six months after the President's budget goes to Congress — including (I) when the Department expects each full audit to begin, (II) when it expects each audit to finish, and (III) when it expects to get a clean opinion, for the Department and each military department, Defense Agency, and other component; (v) a current estimate of the yearly cost of maintaining a clean opinion once first achieved; (vi) certified results of the prior year's audit and a summary of the Department's current financial-statement condition; (vii) a description of audit work on classified programs, including how they prevent exposing classified information; (viii) how each component's corrective action plan, and the Department's overall plan, support the National Defense Strategy; (ix) a detailed funding estimate for the next fiscal year needed to carry out each corrective action plan; and (x) the number and scope of automated processes put in place, such as reconciliation, inventory checks, and internal controls. (2) Semiannual briefings: (A) By January 31 and July 31 each year, the Comptroller and the military departments' comptrollers must brief Congress's defense committees on the corrective action plan's status. (B) The January 31 briefing must rank all military departments and Defense Agencies by how close each is to getting auditable financial statements, as the law requires. (3) Annual report by bottom quartile: By June 30 each year, any military department or Defense Agency ranked in the bottom quarter in that year's January briefing must send Congress's defense committees a report covering (A) its material weaknesses; (B) what's causing them; (C) a plan to fix them; (D) the total number of open audit findings ("NFRs") for the latest and prior two fiscal years; (E) how many NFRs are repeats or reissues from the latest year; (F) how many NFRs expected to close in the latest year are still open; (G) how many NFRs closed in the current and prior years; (H) how many material weaknesses external auditors confirmed as fully fixed or downgraded this year versus prior years; (I) a year-by-year breakdown of which open NFRs are expected to close; and (J) explanations for any bad trends in items (1) through (9) above. (4) Critical capabilities defined: In this subsection, "critical capabilities" means the financial-statement audit priorities the Secretary of Defense sets for that fiscal year. (c) Selecting audit remediation services: Providers who help fix these problems must be chosen based on, among other things, their qualifications, relevant experience, and ability to build and carry out plans that fix internal-control and compliance problems found during an audit.