Reports

Small Business Administration OIG

COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP Addresses

We evaluated the U.S. Small Business Administration’s (SBA) controls to flag or prevent potentially fraudulent Coronavirus Disease 2019 (COVID-19) Economic Injury Disaster Loan (EIDL) applications submitted from foreign Internet Protocol (IP) addresses. Although the agency implemented several layers of controls to prevent or reduce fraud from foreign countries, individuals at foreign IP addresses were able to access the COVID-19 EIDL application system. SBA received millions of attempts to submit COVID-19 EIDL applications from foreign IP addresses and stopped most of them; however, the agency...

Full Details: Oversight.gov Report Page

Audit | 9/12/2022

Railroad Retirement Board OIG

The RRB Did Not Have Detailed Project Plans to Expend Information Technology Modernization Funds

Full Details: Oversight.gov Report Page

Audit | 6/29/2022

Railroad Retirement Board OIG

Railroad Retirement Board Did Not Implement Sufficient Internal Controls in the Mobile Phones Deployed as a Result of the Pandemic

Full Details: Oversight.gov Report Page

Audit | 3/17/2022

1 - Open

The Bureau of Information Services should update their mobile phone policies to include and implement a National Archives and Records Administration-approved records schedule and transfer procedures for electronic records associated with mobile phones.

10 - Open

The Bureau of Information Services should develop and implement a records management and retention system for electronic records.

11 - Open

The Bureau of Information Services should research the capabilities of Railroad Retirement Board's Microsoft Azure Cloud's functionality to determine feasibility of incorporating the automated records management and retention capabilities to govern the mobile phones electronic records.

2 - Open

The Bureau of Information Services should submit a yearly affidavit to confirm electronic records associated with mobile phones have been identified and retained until the full transition into Microsoft Azure Cloud.

3 - Open

The Railroad Retirement Board's Director of Administration should define and communicate 'personal usage' establishing Railroad Retirement Board's core hours of 5:00 am to 7:00 pm. Any usage outside of core hours would be considered personal usage excluding business management purposes.

4 - Open

The Railroad Retirement Board's Bureau of Information Services should 1) continue efforts to update the Telecommuting and Mobile Security Computing Policy with current laws and regulations and 2) develop a periodic monitoring control to assess personal usage and address it according to agency guidance.

5 - Open

The Bureau of Information Services should incorporate the mobile phones in an existing assessable unit and update their mobile phone policies to include documentation regarding the specific roles and responsibilities of each office overseeing the mobile phone program.

6 - Open

The Bureau of Information Services should enforce and execute a review and approval process for application and software download and restrict access to specified applications found in their Railroad Retirement Board G-6 Rules of Behavior.

7 - Open

The Bureau of Information Services should implement procedures to periodically track, log, and monitor iPhone usage and the completion of the G-6 Acknowledgement Statement.

8 - Open

The Bureau of Information Services should periodically review the mobile phone inventory for completeness and accuracy to include a comparison with Railroad Retirement Board's personnel position index.

9 - Open

The Bureau of Information Services should implement the use of unique identifiers between disparate data sets (e.g., mobile phone inventory, personnel position index) to facilitate comparisons and reconcile inconsistent information.

Railroad Retirement Board OIG

Management Information Report - Railroad Retirement Board's Actions in Response to Pandemic Funding

Full Details: Oversight.gov Report Page

Audit | 3/16/2022

Tennessee Valley Authority OIG

Remote Application and Desktop Virtualization

The Office of the Inspector General OIG audited the Tennessee Valley Authority’s (TVA) use of remote application and desktop virtualization due to the risk of increased remote users during the COVID-19 pandemic and recent publicized remote access vulnerabilities. We found several areas where TVA was consistent with cybersecurity remote access best practices. However, we identified gaps in TVA’s configuration settings, architectural design, and administrative procedures. We recommend the Vice President and Chief Information and Digital Officer, Technology & Information, review the identified...

Full Details: Oversight.gov Report Page

Railroad Retirement Board OIG

Management Information Report - Interim Review of Railroad Retirement Board CARES Act Benefit Payments During the Pandemic

Full Details: Oversight.gov Report Page

Audit | 3/26/2021

Small Business Administration OIG

Inspection of Small Business Administration's Initial Disaster Assistance Response to the Coronavirus Pandemic

Full Details: Oversight.gov Report Page

Disaster Recovery Report | 10/28/2020

1 - Open

Review all loans that had a bank account number changed from that shown on the original application to determine if the changes were legitimate or fraudulent. If not legitimate, work to recover the funds, deobligate any undisbursed funds, and refer to the OIG.

10 - Closed

Strengthen controls for verifying an entity’s start date to ensure applicants meet eligibility requirements.

2 - Closed

Establish or strengthen controls to ensure loan deposits are made to legitimate bank accounts for eligible borrowers only.

3 - Closed

Review duplicate loans to IP addresses, email addresses, business addresses, and bank accounts to determine if there are undisbursed funds that should be suspended until the duplicate loans are assessed for eligibility.

4 - Closed

Cancel all ineligible loans that are not disbursed, recover funds from all loans disbursed to ineligible applicants, and flag those loans for the improper payments estimation process.

5 - Closed

Strengthen or establish controls to ensure multiple loans are provided only to eligible applicants and prevent the erroneous duplication of loans.

6 - Open

Strengthen data integrity to make it possible to determine if the inaccurate information allowed loans to be made to ineligible entities and to strengthen SBA’s ability to service loans appropriately.

7 - Closed

Review the applicants with approved loans to determine if there are undisbursed funds remaining that should be suspended until the business start date is verified and the applicant is deemed eligible based on the CARES Act eligibility requirements. If the applicant is deemed ineligible, recover any disbursed funds, deobligate any undisbursed funds, and flag the application as ineligible.

8 - Closed

Review the advance grants to determine if the application was legitimate and the business met CARES Act eligibility requirements. If not, recover the funds and flag the application as ineligible.

9 - Closed

Revise the FY 2021 Improper Payments Act Checklist to include checking EIN dates for COVID-19 EIDLs and advance grants or program the system to flag erroneously approved loans and advance grants as improper payments; the information should be used during the FY 2021 improper payments estimation process.

Railroad Retirement Board OIG

Management Information Report - Interim Report Regarding CARES Act Expenditures and Controls

The objective of this interim review is to provide RRB management with information that will assist them in ensuring compliance, transparency, and fiscal accountability under the CARES Act.

Full Details: Oversight.gov Report Page

Audit | 9/28/2020

Small Business Administration OIG

Third White Paper: Risk Awareness and Lessons Learned from Prior Audits of Entrepreneurial Development Programs

Full Details: Oversight.gov Report Page

Small Business Administration OIG

Second White Paper: Risk Awareness and Lessons Learned from Audits and Inspections of Economic Injury Disaster Loans

Full Details: Oversight.gov Report Page

Date Range

Report Type

Report Category

Submitting Agency

State/Local Agency

State (State and Local Reports)

Fraud Type

Agency Reviewed

Related Organizations

Management Challenges

Any Recommendations

Any Open Recommendations

Reports

COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP Addresses

The RRB Did Not Have Detailed Project Plans to Expend Information Technology Modernization Funds

Railroad Retirement Board Did Not Implement Sufficient Internal Controls in the Mobile Phones Deployed as a Result of the Pandemic

Management Information Report - Railroad Retirement Board's Actions in Response to Pandemic Funding

Remote Application and Desktop Virtualization

Management Information Report - Interim Review of Railroad Retirement Board CARES Act Benefit Payments During the Pandemic

Inspection of Small Business Administration's Initial Disaster Assistance Response to the Coronavirus Pandemic

Management Information Report - Interim Report Regarding CARES Act Expenditures and Controls

Third White Paper: Risk Awareness and Lessons Learned from Prior Audits of Entrepreneurial Development Programs

Second White Paper: Risk Awareness and Lessons Learned from Audits and Inspections of Economic Injury Disaster Loans

Glossary

Glossary name will go here