Reports

Department of the Interior OIG

The Three Affiliated Tribes Did Not Account for CARES Act Funds Appropriately

We determined that the Three Affiliated Tribes did not follow applicable requirements in an agreement with the BIA.

Audit | 9/28/2022

Small Business Administration OIG

COVID-19 and Disaster Assistance Information Systems Security Controls

This report presents the results of our audit to determine whether the U.S. Small Business Administration (SBA) maintained effective management control activities and monitoring of the design and implementation of third-party operated SBA systems. SBA needed information technology systems from third-party service providers that could improve the system efficiency and productivity to process high transaction volumes, transmit data between other information systems, and safeguard the integrity and confidentiality of the personally identifiable information processed by the programs. We found the...

Full Details: Oversight.gov Report Page

Audit | 9/27/2022

1 - Open

Ensure the existing SBA System Development Methodology is updated to include supply chain risk-management practices as required by OMB Circular A-130 and high-value asset system designation guidance. Also, ensure high-value asset system risks are incorporated into the enterprise risk management framework, as recommended by OMB M-19-03 and SBA SOP 90 47 6.

10 - Open

Implement an automated process to document and monitor system changes as recommended by NIST SP 800-53 Rev. 5.

2 - Open

Communicate and enforce the SBA System Development Methodology in which a traceability matrix is used to ensure that system requirements can be tested and demonstrated in the operational system. Ensure all requirements are aligned with the contractual acceptance criteria.

3 - Open

Implement in updated agency guidance, the requirements of OMB Circular No. A-123 that stipulate a SOC 1 Type 2 report is needed for all new and existing financial systems. This guidance should also require confirmation at least annually that the controls are functioning as designed.

4 - Closed

Enforce the requirement to establish and implement internal controls to ensure appropriate program officials perform and document contract reviews to ensure that information security is appropriately addressed in the contracting language, as required by OMB Circular A-130 and SBA SOP 90 47 6.

5 - Open

In conjunction with the Enterprise Risk Management Board, implement enterprise-wide privacy risk mitigation practices that can be assimilated into new and existing system program designs.

6 - Open

Complete an initial assessment and authorization for each information system and all agency-designated common controls before operation.

7 - Open

Transition information systems and common controls to an ongoing authorization process (when eligible for such a process) with the formal approval of the respective authorizing officials or reauthorize information systems and common controls as needed, on a time or event-driven basis in accordance with agency risk tolerance, as required by OMB Circular No. A-130 and SOP 90 47 6.

8 - Open

Review and update POA&Ms at least quarterly as required by SOP 90 47 6.

9 - Closed

Ensure data-sharing agreements are reviewed annually as required by SBA SOP 90 47 6.

Department of the Interior OIG

The Lower Brule Sioux Tribe Did Not Account for CARES Act Funds Appropriately

We determined that the Lower Brule Sioux Tribe did not follow applicable requirements in its agreements with the BIA.

Full Details: Oversight.gov Report Page

Small Business Administration OIG

COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP Addresses

We evaluated the U.S. Small Business Administration’s (SBA) controls to flag or prevent potentially fraudulent Coronavirus Disease 2019 (COVID-19) Economic Injury Disaster Loan (EIDL) applications submitted from foreign Internet Protocol (IP) addresses. Although the agency implemented several layers of controls to prevent or reduce fraud from foreign countries, individuals at foreign IP addresses were able to access the COVID-19 EIDL application system. SBA received millions of attempts to submit COVID-19 EIDL applications from foreign IP addresses and stopped most of them; however, the agency...

Full Details: Oversight.gov Report Page

Audit | 9/12/2022

Architect of the Capitol OIG

Architect of the Capitol's COVID-19 Emergency Supplemental Spending

Full Details: Oversight.gov Report Page

Architect of the Capitol OIG

Effects of COVID-19 and the Events of January 6 Have Increased the Cannon House Office Building Renewal Project’s Contracts by $5.6 Million and Further Increases are Expected

The objective of this audit was to determine the effects of COVID-19 and the events of January 6, 2021, on the CHOBr Project.

Full Details: Oversight.gov Report Page

Tennessee Valley Authority OIG

Remote Application and Desktop Virtualization

The Office of the Inspector General OIG audited the Tennessee Valley Authority’s (TVA) use of remote application and desktop virtualization due to the risk of increased remote users during the COVID-19 pandemic and recent publicized remote access vulnerabilities. We found several areas where TVA was consistent with cybersecurity remote access best practices. However, we identified gaps in TVA’s configuration settings, architectural design, and administrative procedures. We recommend the Vice President and Chief Information and Digital Officer, Technology & Information, review the identified...

Full Details: Oversight.gov Report Page

National Science Foundation OIG

Performance Audit of the Implementation of OMB COVID-19 Flexibilities – University of Michigan

Full Details: Oversight.gov Report Page

Audit | 8/02/2021

National Science Foundation OIG

Performance Audit of the Implementation of OMB COVID-19 Flexibilities – University of Central Florida

Full Details: Oversight.gov Report Page

Audit | 5/27/2021

Finding 1, Rec. 1 - Closed

Direct UCF to provide documentation supporting that it has repaid or otherwise credited the $134 in questioned fringe benefit costs for which it has agreed to reimburse NSF.

Finding 1, Rec. 2 - Closed

Direct UCF to notify its Federal sponsors that its personnel have not yet certified their effort for the Fall 2019, Spring 2020, Summer 2020, and Fall 2020 semesters.

Finding 1, Rec. 3 - Closed

Direct UCF to require its employees to certify their effort for the Fall 2019, Spring 2020, Summer 2020, and Fall 2020 semesters and then process any cost transfers needed to ensure that UCF charged NSF for salary costs that were consistent with the effort certified.

Finding 1, Rec. 4 - Closed

Direct UCF to review all salary earned during June 2020 to verify that its accounting system appropriately applied fringe benefits at the correct rate and, if the accounting system did not apply fringe benefits at the correct rate, process any adjustments necessary.

Finding 2, Rec. 1 - Closed

Direct UCF to provide documentation supporting that it has repaid or otherwise credited the $160 of questioned participant support costs for which it has agreed to reimburse NSF.

Finding 2, Rec. 2 - Closed

Direct UCF to establish policies and procedures to ensure that it obtains and documents proper approval for insurance costs before charging the costs to NSF awards.

Finding 2, Rec. 3 - Closed

Direct UCF to establish policies and procedures to ensure that it does not apply fringe benefit rates to participant support costs that it processes through its payroll subledger.

National Science Foundation OIG

Performance Audit of the Implementation of OMB COVID-19 Flexibilities – California Institute of Technology

Full Details: Oversight.gov Report Page

Audit | 5/26/2021

Finding 1, Rec. 1 - Closed

Resolve the $16,351 in questioned salary expenses for which Caltech has not agreed to reimburse NSF and direct Caltech to repay or otherwise remove the sustained questioned costs from its NSF awards.

Finding 1, Rec. 2 - Closed

Direct Caltech to provide documentation supporting that it has repaid or otherwise credited the $418 of questioned salary expenses for which it has agreed to reimburse NSF.

Finding 1, Rec. 3 - Closed

Direct Caltech to strengthen its policies and procedures by retroactively establishing expiration dates on its use of the Other Paid Leave Pool on Federal awards and ensuring that these expiration dates align with the expiration dates and criteria specific to Flexibility 6 of Office of Management and Budget Memorandum M-20-17.

Finding 2, Rec. 1 - Closed

Resolve the $31,856 in questioned subaward expenses for which Caltech has not agreed to reimburse NSF and direct Caltech to repay or otherwise remove the sustained questioned costs from its NSF awards.

Finding 2, Rec. 2 - Closed

Direct Caltech to strengthen its internal control processes and procedures surrounding the transfer of significant portions of NSF-funded research to other organizations. Updated processes could include: a. Establishing procedures to verify whether the scope of work for a proposed subcontract on an NSF award is programmatic in nature before issuing the subcontract. If the scope of work is programmatic in nature, Caltech should obtain the NSF Grants Officer’s approval before issuing the subcontract. Caltech could obtain this approval either as part of the initial NSF grant proposal/budget or through a formal request to transfer the research or effort, submitted through NSF’s FastLane system. b. Requiring periodic training for Caltech personnel that are permitted to subaward, issue, or subcontract out research under NSF awards, to ensure that they request the appropriate approvals. c. Establishing procedures to confirm that Caltech personnel perform pass-through entity risk assessments to identify the appropriate monitoring procedures when Caltech awards NSF research to a pass-through entity. d. Establishing periodic monitoring procedures to ensure that Caltech appropriately assesses indirect costs on the first $25,000 invoiced by each subawardee.

Finding 3, Rec. 1 - Closed

Direct Caltech to provide documentation supporting that it has repaid or otherwise credited the $1,515 of questioned indirect costs for which it has agreed to reimburse NSF.

Finding 3, Rec. 2 - Closed

Direct Caltech to strengthen its monitoring procedures and internal control processes for applying indirect costs to Federal awards. Updated procedures could include: a. Requiring that personnel review rental expenses charged to NSF awards to assess whether the expenses included indirect costs. Specifically, Caltech should ensure the general ledger account codes it establishes to account for equipment rental charges do not apply indirect costs. b. Requiring that personnel review capitalized expenses charged to an NSF award to ensure that the capitalized amount includes all applicable costs.

Finding 3, Rec. 3 - Closed

Direct Caltech to quantify the total indirect costs inappropriately applied to NSF awards as a result of its rental equipment account inappropriately applying indirect costs and to reimburse NSF for the appropriate amount.

Finding 4, Rec. 1 - Closed

Direct Caltech to provide documentation supporting that it has repaid or otherwise credited the $581 of questioned salary and fringe costs for which it has agreed to reimburse NSF.

Finding 4, Rec. 2 - Closed

Direct Caltech to strengthen its administrative and management controls and processes surrounding the charging of salary to Intergovernmental Personnel Act awards. Updated processes could include requiring departmental payroll personnel to perform additional procedures to ensure that Caltech appropriately established initial salary payments, including verifying that all payments are within the Intergovernmental Personnel Act assignment dates.

Finding 5, Rec. 1 - Closed

Direct Caltech to update its current award set-up practices to require that, when setting up accounts established for NSF awards, personnel ensure that the accounts apply indirect costs using either the rates that were established in the Negotiated Indirect Cost Rate Agreement in effect as of the date of the NSF grant award or the rates identified in the NSF award letters, as appropriate.

Date Range

Report Type

Report Category

Submitting Agency

State/Local Agency

State (State and Local Reports)

Fraud Type

Agency Reviewed

Related Organizations

Management Challenges

Any Recommendations

Any Open Recommendations

Reports

The Three Affiliated Tribes Did Not Account for CARES Act Funds Appropriately

COVID-19 and Disaster Assistance Information Systems Security Controls

The Lower Brule Sioux Tribe Did Not Account for CARES Act Funds Appropriately

COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP Addresses

Architect of the Capitol's COVID-19 Emergency Supplemental Spending

Effects of COVID-19 and the Events of January 6 Have Increased the Cannon House Office Building Renewal Project’s Contracts by $5.6 Million and Further Increases are Expected

Remote Application and Desktop Virtualization

Performance Audit of the Implementation of OMB COVID-19 Flexibilities – University of Michigan

Performance Audit of the Implementation of OMB COVID-19 Flexibilities – University of Central Florida

Performance Audit of the Implementation of OMB COVID-19 Flexibilities – California Institute of Technology

Glossary

Glossary name will go here