In brief: Pentagon audit flags vulnerable, redundant IT systems. ERP and financial software failings in part to blame for audit failures. Fix date pushed back from 2028 to 2030 after financial IT issues first identified in 2001.
The US Department of Defense (DoD) is riddled with “vulnerable systems” as well as “redundant and antiquated” financial management software.
That's according to auditors as the Pentagon failed its seventh consecutive audit, despite spending over $903 billion in 2024, including billions on IT.
The audit highlighted widespread ongoing issues with ERP systems – even as DoD insisted that it had now deployed over 800 automations across its back-office; 50% of them supporting financial management functions.
Join peers following The Stack on LinkedIn
"The DoD IT systems environment includes numerous vulnerable systems and core enterprise systems that support the major end to-end processes and ERP systems" said auditors [pdf], urging the "retirement of vulnerable systems to allow for large-scale audit improvements..."
DoD had identified major financial management IT systems issues as far back as 2001 and initially set a “correction target date” of 2028. Sadly, 27 years were not long enough: This month, it pushed the target date back to 2031, blaming a “delay in the implementation of corrective actions.”
Inspectors urged DoD to “eliminate redundant and antiquated financial management IT systems to improve auditability, security, and productivity.”
The sheer “number of applications, hosting locations, interfaces, and other variations… create a complex environment where it is difficult to maintain effective IT general and application controls (including information security)"
A presentation by the then-CIO in 2021 showed that the Army (just one of the myriad DOD departments) alone had 2,370 systems and apps running on-premises; 40,000+ different analytics products; 1.4 million users; 150 system interfaces for the Army’s 72,000-strong digital workforce and $1.5 billion in annual hardware costs, with nearly double that for software.
See also: Pentagon admits hackers “roam freely” in its IT systems
The DoD IT systems environment includes numerous vulnerable systems and core enterprise systems that support the major end to-end processes and ERP systems… Many of these systems do not comply with Federal Information System Controls Audit Manual (FISCAM) requirements with regards to entity-level technology controls, application-level general controls, and automated application controls (including security management access, segregation of duties, configuration management, system interfaces, master data, and audit trails – DoD’s 2024 audit.
The Pentagon insisted that it was making progress on financial IT systems.
It had rolled out a further 68 back-office automations for the Army, where wins are prosaic but important; e.g. its its “Real Property Inventory Automation” has updated real property records for 50,000 installations and 199,000 transactions, saving a claimed 33,000 working hours.
A new Army machine learning model to “facilitate root cause analysis and failure trends across fiscal years and improved dashboard capabilities for tracking and monitoring audit progress and remediation” may also help.
Across the Pentagon a further 21% of the automations “assist with compliance or audit activities, such as pulling documentation to support audit responses” a fact sheet (pdf) from the department suggested.
2028? We’ll get there…
Michael McCord, the DoD comptroller and CFO, said progress toward a goal of passing the much-failed audit by 2028 goal was continuing.
“This result was not a surprise, and I know that on the surface it doesn’t sound like we’re making progress. However, that is not the case,” he said.
“I believe the department has turned a corner in its understanding of the challenges and more importantly, in addressing those challenges, momentum is on our side” McCord said. (Of 28 reporting DoD entities, nine landed an “unmodified” or clean audit, 15 failed, three are pending.)
To give a sense of its scale, for 2023’s audit 1,600 auditors conducted 700 site visits and assessed $3.8 trillion in assets and $4 trillion in liabilities.
The Defense department meanwhile touted a range of IT transformation wins as signs of progress, including a new “Integrated Personnel and Pay System for the Army that “consolidates information from over 50 legacy systems and promotes secure and consistent processes and data.”
(Users appear to hate it…)
The Department of the Navy meanwhile has now decommissioned 11 systems and rolled more capabilities into its Navy ERP, DoD emphasised.
That piece of software cost the Navy $1.4 billion between 2022-2024 just to maintain, the Government Accountability Office (GAO) said in June.
