Page 1 GAO-25-107731 DOD Service Organization Reports
The Department of Defense (DOD) has the largest discretionary budget authority
of any agency in the federal government—$920 billion in fiscal year 2024.Yet it is
the only major federal agency to have never achieved an unmodified (or clean)
audit opinion on its agencywide financial statements. The National Defense
Authorization Act for Fiscal Year 2024 mandated that the Secretary of Defense
ensure that DOD receives an unmodified audit opinion on its financial statements
by December 31, 2028. For fiscal year 2024, DOD’s agencywide financial
statement auditor reported 28 material weaknesses in internal control over
financial reporting. One of the material weaknesses, first identified in fiscal year
2019, related to DOD’s use of service organizations.
Service organizations provide their customers with centralized services, such as
accounting and payroll, that are important for managing DOD’s financial
operations. Customers retain responsibility for the processes involved in these
services. Therefore, customers and their financial statement auditors need to
understand the design and operating effectiveness of service organizations’
controls over such processes. System and Organization Controls 1 (SOC 1)
reports, which are prepared by service organization auditors (service auditors),
can help them do so.
We developed this report in connection with fulfilling our mandate to audit the
U.S. government's consolidated financial statements, as outlined in section 331
of title 31, United States Code. This report discusses the service auditors’
opinions in DOD service organizations’ fiscal years 2020 through 2024 SOC 1
reports and the actions DOD service organizations took to address any
deficiencies identified in those reports. We are also providing information on
DOD’s efforts to address its Service Organizations material weakness.
• A SOC 1 report is an efficient way to provide multiple financial statement
auditors and customers with an independent opinion on the controls and
systems at a service organization that are relevant to its customers’ internal
controls over financial reporting. By identifying deficiencies, SOC 1 reports
also give service organizations a basis for improving their operating
processes and controls.
• The number of DOD service organization SOC 1 reports issued, and the audit
opinions included in these reports, varied for fiscal years 2020 through 2024.
In its ongoing effort to adapt to changing customer needs, DOD plans to add
six SOC 1 reports in the next 2 to 3 years.
• Most of the service organizations whose SOC 1 reports we selected for
further review had performed root cause analyses to address deficiencies
U.S. Government Accountability Office
Management: Role of Service
Reports in Assessing the
ness of Internal Controls
-25-107731
Report to Congressional Committees
