internal controls

We identified deficiencies in E-Verify’s processes for confirming identity during employment verification.  E-Verify’s photo matching process is not fully automated, but rather, relies on employers to confirm individuals’ identities by manually reviewing photos.  We attribute these deficiencies to USCIS not developing or evaluating the plans and internal controls needed to improve its processes and detect, track, and investigate system errors.  Until USCIS addresses E-Verify’s deficiencies, it cannot ensure the system provides accurate employment eligibility results.  We made 10 recommendations to improve E-Verify’s accuracy, internal controls, and workload capabilities.  USCIS concurred with all 10 recommendations.

KPMG LLP (KPMG), under contract with DHS OIG, conducted an integrated audit of DHS’ FY 2019 consolidated financial statements and internal control over financial reporting.  KPMG issued an unmodified (clean) opinion over the Department’s financial statements, reporting that they present fairly, in all material respects, DHS’ financial position as of September 30, 2019.  However, KPMG identified material weaknesses in internal control in two areas and other significant deficiencies in three areas.  Consequently, KPMG issued an adverse opinion on DHS’ internal control over financial reporting.  KPMG also reported two instances of noncompliance with laws and regulations.  DHS concurred with all of the recommendations.

Department leadership must commit itself to ensuring DHS operates more as a single entity. rather than a collection of components. The lack of progress in reinforcing a unity of effort translates to a missed opportunity for greater effectiveness. Second, Department leadership must establish and enforce a strong internal control environment typical of a more mature organization. The current environment of relatively weak internal controls affects all aspects of the Department’s mission, from border protection to immigration enforcement and from protection against terrorist attacks and natural disasters to cybersecurity. We have seen little evidence of proactive effort by leadership to view the organization holistically, to forcefully communicate the need for cooperation among components, and to establish programs or policies that ensure unity, even though such effort is a necessary precondition to unified action.