Eight consecutive disclaimers on the Department of Defense books — the 2028 deadline written into law carries no consequence

What is happening?

The Department of Defense received a disclaimer of opinion on its agency-wide financial statements for the fiscal year ended 2025-09-30, in an auditor report dated 2025-12-18. It was the eighth consecutive disclaimer since full-scope auditing began in FY2018. The reporting entities that were themselves disclaimed account for at least 43 percent of total assets and at least 64 percent of total budgetary resources, as of 2025-09-30.

The same report names 26 material weaknesses, 2 significant deficiencies and 5 instances of noncompliance with laws, regulations, contracts and grant agreements. Eleven reporting entities could not be opined on. One misstatement was sized at USD 18.9 billion, and a second, in the Joint Strike Fighter Global Spares Pool, was reported as material but impossible to quantify.

Total reported assets were USD 4,651.7 billion and total reported liabilities USD 4,729.1 billion as of 2025-09-30. Those are the amounts the Department reports, not amounts found to be missing. The auditor states the unverified portion in a different unit — entities rather than dollars — and that is the 43 and 64 percent pair above.

A deadline exists and is written into statute. Section 1005 of the National Defense Authorization Act for Fiscal Year 2024 directs the Secretary of Defense to ensure the Department has received an unqualified opinion by not later than 2028-12-31. The section is one sentence long. It attaches no penalty, no trigger and no reporting requirement to failure.

Whose problem is this?

The body that publishes the failure and the body that must repair it sit inside the same department, and the body that could make failure cost something has so far written a date instead.

Where does this problem end?

The boundary matters here because the measurement is working and the finding is published on time every year. What is missing is not knowledge of the condition but any cost attached to letting it continue.

What is the state now, and what should it be?

Now

The target state, as the sources give it: an unqualified opinion on the agency-wide financial statements by 2028-12-31 under section 1005. The Department commits in the FY2025 report to an unmodified opinion on a combined Defense Working Capital Fund report covering FY2027 over a two-year period, and then to an agency-wide unmodified opinion on the FY2028 statements. The sources do not agree on what kind of object the 2028 date is. The statute states a calendar date, the congressional research summary describes it as fiscal year 2028, and both the Department and GAO describe it as a goal rather than a requirement.

How big is it?

Exposure. The Defense Health Program General Fund is one of the eleven reporting entities disclaimed for FY2025. The Military Health System served about 9.4 million beneficiaries in FY2024 — servicemembers, retirees and family members. At least that many people receive a benefit administered through an entity whose financial statements could not be opined on.

Scale. At least 43 percent of USD 4,651.7 billion in reported assets and at least 64 percent of USD 1,896.2 billion in budgetary resources sat inside entities that received a disclaimer, as of 2025-09-30. Multiplying the published shares by the published totals gives roughly USD 2.0 trillion of assets and roughly USD 1.21 trillion of budgetary resources. That multiplication is performed here and is published by no source.

Both figures are denominators. Neither of them counts a person who was made worse off.

Needs a new measurementthe affected population: no source opened here counts people harmed by an unverified account. The auditor reports one misstatement as a reporting error rather than a loss and reports the other as unquantifiable. No source links the audit outcome to a measured change in pay, benefits, care or readiness for any identified group. The population file therefore records not-derivable. What can be stated is exposure and scale, and both of those are different from harm.

Under what conditions does it arise?

1. The only money penalty fires on a condition that is already satisfied. Section 1004 of the FY2024 act cancels 1.5 percent of unobligated amounts from a component that fails to be subject to an audit. Every component is subject to an audit. Being audited and then failing meets the condition, so the trigger has never had occasion to operate. Military, reserve and National Guard personnel accounts and the Defense Health Program account are excluded from it in any case.

2. The obligation and the work sit in different places. Section 1005 binds the Secretary of Defense. The 26 agency-wide weaknesses decompose into 151 component-level weaknesses and roughly 2,848 notices of findings and recommendations held by the Army, Navy, Air Force, Defense Logistics Agency, Transportation Command and the intelligence agencies, as of FY2024. The components hold the records and face no statutory consequence of their own.

3. The headline unit can improve without the condition improving. A material weakness can be consolidated into another material weakness, and the count falls with nothing repaired. In FY2025 half of the two-point improvement was exactly that. In the same year the count of control conditions underneath rose from 50 to 69.

4. Extending a participation requirement costs nothing, so it keeps being extended. The FY2025 act moved the audit participation window to FY2034 and the FY2026 act moved it to FY2035. Two extensions in two years. The 2028-12-31 date for a clean opinion has never been extended, because nothing happens on either side of it.

What has been tried?

Everything on this list either measures the failure, extends the window in which it may continue, or pays to reduce it. The two entries that would make failure cost something are bills, and both are sitting in committee.

What was found?

Why is it still unsolved?

Enforcement absent — the condition is measured precisely, published on schedule and stated in numbered findings, and nothing in the system makes the finding cost anything.

The obvious reading of this problem goes the other way, so two claims have to be separated. It is true that the Department cannot substantiate its own records. Over 130 systems are noncompliant with the federal financial management improvement act, one material weakness covers the universe of transactions itself, and the size of one misstatement is stated to be beyond the reach of the people whose job is to know it. But that is the condition being measured, and it is measured well. Every December an auditor names the weaknesses, counts them, lists the entities and quantifies what can be quantified. Nobody is in the dark. What is missing is a cost for remaining in this condition, and that is a different failure.

The cost is missing in three specific places, and each can be read in the text. The statute that sets the date is one sentence with no subsection behind it. The statute that cancels money fires when a component is not audited, and every component is audited, so the trigger has never had occasion to operate. The provision that comes closest to reaching a person is a study of whether audit metrics could be used in the performance evaluation of general officers, flag officers and senior executives, and no source opened here reports whether that briefing happened or what it concluded. A rule whose trigger can never be reached is indistinguishable from no rule at all.

The third movement is what the missing cost does to the measurement itself. A regime that publishes a number and attaches nothing to the outcome creates pressure on the number. Material weaknesses can be consolidated, and consolidation lowers the count without changing anything underneath it. In FY2025 half of the two-point improvement was a merger, while in the same document the count of control conditions beneath the weaknesses rose from 50 to 69. GAO recorded the same pull in the findings channel, noting a stated desire to demonstrate progress by closing findings while the remediation rate fell from 35 percent to 29 percent. The headline moves down, the substrate moves up, and only the headline is ever quoted. The reinforcing detail is that the compliance report itself declines to recommend anything: five statutory noncompliances are named, and the report states that it includes no recommendations to correct them. Even the Antideficiency Act, the one statute in this file that reaches individuals, had four investigations sitting past the 15-month limit in the departmental regulation as of 2025-09-30, with no stated consequence for the overrun. Congress meanwhile extended the participation window in two consecutive authorization acts and left the date for a clean opinion untouched, because nothing happens on either side of that date.

What observation would mean it is solved?

Candidates — (a) the Department receives an unqualified opinion on its agency-wide financial statements (b) the count of agency-wide material weaknesses reaches zero (c) a consequence attaches to failure and is observed to operate at least once.

(a) alone is the one everybody names, and as a lasting observation it is the weakest. A single clean opinion can be reached on a narrowed scope, on a staggered cycle, or in a year when several entities did not publish. The FY2025 report shows how that happens: three entities were outside the count because two of them had not published an annual report by the report date and one is on a two-year audit cycle. A first clean opinion also says nothing about whether a second one arrives.

(b) alone counts an object that can be merged. The count fell from 28 to 26 in FY2025 and one of those two was a consolidation. Nobody publishes, across the eight years, how many distinct weaknesses have ever been closed on the merits as against consolidated, redefined or downgraded. Without that split the series cannot be read as progress or as bookkeeping. Counting weaknesses rewards merging weaknesses, and merging is cheaper than fixing.

(c) is the observation this document is actually about, and no source reports it. The one enforcement instrument that exists has never been reported to fire, and nobody publishes a count of the times it did or a confirmation that it never did. Until some component, official or budget line is observed to lose something, this remains a measurement regime, and the eight-year series is what a measurement regime without a consequence produces.

What is it connected to?

Fills with researchfederal financial management across the other CFO Act agencies, defense acquisition and contract oversight, the fraud risk area that GAO added to this high-risk designation in February 2025, and the enterprise system replacements that carry most of the remediation work. Relation type and evidence grade were not confirmed in this round.

What these sources do not say

• What the audit costs. Every section of the FY2025 Agency Financial Report was searched for the cost of the audit and returned nothing. The document that reports USD 4,651.7 billion in assets to the tenth of a billion does not report what was spent to fail to verify them, and the congressional summary states that per-year audit costs are not clearly stated. The eight-year cumulative cost, and the cost per material weakness closed, therefore exist nowhere.
• What happens if the 2028 date is missed. Not the statute, not the congressional summary, not GAO, not the Department. The closest any source comes is a statement that failure brings potential congressional scrutiny and reputational consequences rather than explicit financial penalties specified in statute, which describes the absence rather than answering the question.
• Whether the 1.5 percent cancellation has ever been applied to any component. The mechanism is three years old. No source publishes a count of the times it fired, and no source confirms that it never has. That silence covers the only enforcement instrument in the regime.
• How much money is actually unsupported. The auditor gives the share of assets held by disclaimed entities, which is an entity-level figure and not a dollar figure for unsupported balances, and states that the Joint Strike Fighter misstatement cannot be sized. A political figure of 63 percent of nearly USD 4 trillion in assets, dated November 2023, circulates alongside the auditor figures of at least 43 percent of assets and at least 64 percent of budgetary resources. No opened source states how the three relate, and this document does not reconcile them.
• Whether the material weaknesses can reach zero in time. GAO publishes a remediation rate for working-level findings. Nobody publishes one for material weaknesses, so nobody publishes the rate at which 26 would have to fall to reach zero across three remaining audit cycles. Every source states the target date and no source states the required rate.
• What the FY2025 result was for the component held up as the model. Independent oversight records clean opinions for the Marine Corps in FY2023 and FY2024. The FY2025 auditor report says only that as of the report date the Marine Corps annual report had not been published, and no opened source explains the non-publication.
• How many entities received a clean opinion for FY2025. For FY2024 the breakdown was published in full. For FY2025 the auditor names eleven disclaimed entities and stops there. The plain-language companion report that would carry the breakdown was not located as of 2026-08-08, which is not the same as saying it does not exist.
• Whether anyone has faced a consequence. No source names an individual, a component or a contractor that lost anything because of a disclaimer. The one provision pointing at personal accountability asked for a briefing due 2024-09-30 on whether audit metrics could enter senior performance evaluations, and the trail of that briefing goes cold.

See the evidence

Primary documents carry most of this document. Four sections of the FY2025 Agency Financial Report, four enacted public laws and two introduced bills were read directly, and those ten sources supply every statutory quantity, every exhibit count and every audit finding stated above. The two congressional research summaries and the GAO testimony were also read directly and supply the eight-year framing, the high-risk history and the beneficiary denominator. Two news reports were read to test what general coverage carries, and their role here is corroboration of the headline result plus evidence of what general coverage omits. Five sources could not be opened and their rows are kept with the URL cell empty and the reason stated. Where sources disagree the disagreement is left visible rather than resolved. Two federal bodies publish different counts of the same year of audit findings, 2,848 against 2,387, and neither footnotes the other. The FY2025 report gives 42 conditions across 11 units in one section and 39 across 10 in an exhibit three pages later. The statute states a calendar date of December 31, 2028 while the congressional summary says fiscal year 2028 and both the Department and GAO call it a goal. A political figure of 63 percent of nearly USD 4 trillion in assets, dated November 2023, sits near but not on the auditor figures of at least 43 percent of assets and at least 64 percent of budgetary resources, and no opened source states the relationship, so all three are reported here with their own scope words attached. One naming note: an executive order of 2025-09-05 gave the Department a secondary Department of War designation, which is why the comptroller domain and some letterheads in the source documents read that way, while the audited legal entity and every statute cited remain the Department of Defense. This is a Path A output, so observation_refs is empty and provenance_mode: press-derived.

People affected

Estimated range Not derivable

The reason and what is missing are listed under “What is missing” below