Gandhi has left some unfinished business for his successor. (Marvin Joseph/The Washington Post)

At Tuesday night’s State of the District address, outgoing Chief Financial Officer Natwar M. Gandhi won two rounds of applause as Mayor Vincent C. Gray hailed Gandhi’s fiscal stewardship over 13 years.

Gandhi’s achievements are well documented — balanced budgets, swelling reserves, high bond ratings, and so forth. But whoever replaces him will have some unfinished business to attend to. Those matters are laid out, in part, in the “Yellow Book” — the annual report from the city’s independent auditors attesting to the government’s internal financial controls.

Long story short, old problems persist and some new issues have been identified.

This year’s Yellow Book, issued by KPMG with the annual Comprehensive Annual Financial Report, identified continuing issues with computer systems in the CFO’s office that could allow a malevolent employee to access and change financial records — an old concern examined last year by my colleague Nikita Stewart. The report also identified ongoing issues with procurement practices, pertaining particularly to purchase card usage and contracts let through the mammoth Department of General Services, including missing documents and unsupported sole-source awards.

Gandhi can rightly and proudly claim that auditors this year identified no “material weaknesses,” the most serious class of oversight lapse. But KPMG identified an additional two “significant deficiencies” beyond the two identified last year and mentioned above. The new deficiencies concern accounting practices in the Office of Tax and Revenue and various issues with financial reporting related to capital projects.

In each case, managers in the CFO’s office said they were addressing the issues. With respect to the IT controls — the longest-standing issue, one implicated in the $50 million Harriette Walters theft — KPMG acknowledged some progress has been made in recent years but said “additional improvements in formalizing key [information technology control] processes and creating an effective monitoring function are needed.”

Said the CFO’s office: “Over the last several years, the District has engaged in
an extensive remediation process to address and resolve the reported findings and to strengthen internal controls related to information technology. While much improvement has been made as a result of that effort, we recognize that there are areas in which improvement is still needed.”

Perhaps the next CFO will be finally able to allay auditors’ long-documented concerns.

Here is the report in full: