Migrating a Federal Financial System Without Audit Readiness Is Going in Blind

I have worked on audit readiness for a few federal system migrations, and the same pattern repeats: the system goes live on schedule, and OMB A-123 internal control assessments or audits find what the schedule skipped.

If you are the prime supporting a system owner, that finding is yours. Your team will inherit not only the shiny new system but also all the unthought-of, unforeseen control issues. Those gaps surface at the first audit or assessment and follow you into CPARS and future recompetes.

System Integrators (SI) are not the problem. Scope and speed are. They build the system with the time and resources they have. Audit readiness by design slows you down because the same people who create workflows shouldn't design business process controls. Audit readiness covers control design, documenting deadline-driven decisions, and audit evidence. Those require different skill sets and bring different perspectives. Staff it as its own role to de-risk the project before go-live. You’re not only addressing issues early, but these fixes will cost less in the long run.

The SI reports to the schedule

Most people will assume the SI team covers internal controls. It fails because that SI team builds and tests the system to hit the go-live date.

The assumption is fair. The contract says they will deliver the system and design controls around it; they could even have staffed a controls workstream. But that workstream answers to the go-live date.

Your agency's control environment extends beyond the new financial system. Business processes, manual controls, feeder systems, and documentation sit outside it. The reality is the auditor will not sort findings by whose scope they fall in. Findings will belong to your agency and you. 

Design: a posting can pass testing and still be wrong

A posting can pass every User Acceptance Test (UAT) and still break federal accounting rules.

I have seen system integrators accidentally skip required accounting entries because the business forgot to explain them. This easily happens when you have rare accounting issues that might not even happen annually, like impairment. The business might not even think of it as a required entry because they haven’t done it in a while, but Federal GAAP requires the ability to do impairment. So the business might say your accounting and entry listing is good, but in reality it’s incomplete.

The result is a configuration that passes system testing but posts to the wrong accounts. Or it needs a manual workaround every month.

FFMIA requires the agency's system to apply federal accounting standards and the USSGL at the transaction level. For the agency, each workaround is a manual control to design, run, and monitor.

Decisions: the accounting calls get made late

The design decisions that cause audit problems get made by developers; in meetings, nobody labels them as accounting.

I have seen a team modify USSGL transaction code postings to work around a system limitation. No one in the room asked what the change did to the SF 133, or worse, they thought they understood how the crosswalk worked and misapplied it.

Put an audit readiness team member in those meetings. That person spots the accounting events and reviews postings before they are pocketed in. Your developers stay on delivery. In audit readiness, the person can quickly identify the issue and work with the developers to adjust it as it’s being built, rather than doing cleanup work later. 

Evidence: design for the sample request

You do not build a system for the auditor. But the auditor will test it harder than any user.

Commercial financial systems used for federal accounting sometimes need extra netting entries to complete a USSGL posting. That is fine. But are those netting or “False” entries easy to identify and exclude?  

If the auditor pulls a population for sampling, and it includes entries that are not true transactions. Agency staff explains each one. The auditor starts to question the rest of the population.

The fix is cheap at design time: a document type or field that flags facilitating entries, so the agency can pull them out and reconcile them.

The agency's first audit after go-live tests your system. A population that is complete and ties to the trial balance is the result you want.

Start with your staffing plan

If you are bidding on or starting to support a federal financial system migration, message me at info@personsconsulting.com. We can talk about where audit readiness fits on your team.

Your SI will reach go-live. You will be audited. Don’t wait until then to ask whether the new system and processes are actually auditable.

This week, check your staffing plan. Who owns USSGL posting review, control documentation, and audit populations? If the answer is a developer or no one, that is the gap.

Persons Consulting LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) and a licensed CPA firm in Virginia.