Notices of findings, and the risk object behind them

What the public record actually contains

This matters before any figure below is read, because the unit everyone talks about is not the unit anyone outside the audit can obtain.

A Notice of Findings and Recommendations is what an auditor issues when testing finds a control deficiency. It names the condition, the criterion, the cause, the effect and a recommendation, and it is addressed to the entity that has to fix it. The notices themselves are not published. What the DoD OIG publishes each year is the count of notices issued, reissued and closed, a table of those counts by reporting entity, and a roster of the Agency-Wide material weaknesses. Nothing on this page is an extracted notice. The material weakness is the finest grain the public record supports, and the ten-element object below is built at that grain and says so element by element.

Eight years of notices

Issued is the whole population an auditor worked on in that year, and most of it is prior-year notices reissued because the condition had not been corrected. New is the part that was found that year. Reading issued alone reads the backlog as fresh findings.

The issued count falls from 3,559 in FY2020 to 2,473 in FY2025, and that is not by itself evidence of improvement. A notice leaves the population when it is closed, when it is merged into another, when the entity it was issued to stops being separately audited, or when the audit approach changes what is tested. Two of those happened inside this window: the FY2024 entity table has no U.S. Special Operations Command row, and the Department moved in 2026 from control remediation toward substantive testing of balances. Whether a control was fixed is a different question from whether its notice is still open, and the public record answers only the second.

Where the notices sit — FY2024

The per-entity table each report prints. It is published here only for the years whose rows sum exactly to the total the same report states, which is the one check the source itself supplies against a transcription.

FY2018, FY2025 are not published at entity grain. The FY2018 table sums to 2,243 against a published 2,410 — the difference is a merged General Fund and Working Capital Fund presentation and a Defense Information Systems Agency row the report marks “Delayed” — and FY2025’s auditor report prints no entity table at all. A table that does not foot is a transcription, so it is withheld rather than shown with a caveat.

What stayed on the roster

Each column is a year in which a roster was published; each mark is that weakness appearing on it. Pairing a weakness across years is this site's judgement, not the Department's: the systems weakness was printed as Financial Management Systems and Information Technology, then Legacy Systems, then Financial Management Systems Modernization, and a roster keyed on the printed title would read those renames as closures.

FY2023 has no column. DODIG-2024-114 states 28 Agency-Wide material weaknesses for FY2023 and refers the roster to an appendix that is not in the released text; drawing that year with every weakness absent would turn a gap in the record into a year of closures. Financial Management Systems Modernization has been on every one of the 7 rosters published. Rows in grey have left the FY2025 roster, which is not the same as having been fixed — the FY2022 report folded Financial Statement Compilation and Suspense Accounts into weaknesses that remain.

The ten-element audit-risk object

A finding read as a document tells you what went wrong once. The same finding read as a structured object tells you what to build: which relationship in the data was supposed to hold, which data would evidence it, and whether anyone can measure it. Ten elements per weakness, each recording whether the cited document states it or this site read it out of the narrative.

1. 1Financial statement / account — which balance is affected
2. 2Assertion — existence, completeness, cutoff, valuation, rights
3. 3Audit risk — what could cause a material misstatement
4. 4Control — what was supposed to prevent or detect it
5. 5Control failure — what actually went wrong
6. 6Root cause — why the control failed — not the symptom
7. 7Population / exposure — how much was in scope
8. 8Historical audit evidence — what the auditors tested and found
9. 9Remediation — what management did, and whether it held
10. 10Outcome — open, recurring, downgraded or closed

Element 6 is the one that decides whether any of this is useful. “The interface failed” is a symptom; “no key identifies a record on both sides of the interface, so the reconciliation that exists compares two numbers derived from the same side” is a cause, and only the second tells anyone what to build. Element 10 is never written by the extract: it is computed from the rosters above, because an outcome asserted beside the evidence it summarises is a restatement with a verdict printed on it. Control NFR-05 re-derives it on every load.

What the sources on this site could actually test

Scored one weakness at a time against File A, File B, File C, the contract files and the budget exhibits. This is the step that turns a reading list into a build queue, and most of the queue is empty for a reason worth stating plainly.

18 of 26 are out of reach here, and that is the finding rather than a shortcoming of this site. The weaknesses that dominate the roster concern proprietary balances, journal entries, trading partners, user access and interface reconciliations — none of which appear in any published execution file, because the published files exist to report budgetary execution to the public and were never built to evidence a control. A remediation system has to be built where the transactions are. What this page can do is name, for each weakness, the relationship that has to hold and the data that would evidence it, which is the specification that work would start from.