Reports

Search for reports and investigative results.

Department of the Treasury OIG

Desk Review of Turtle Mountain Band of Chippewa Indians’ Use of Coronavirus Relief Fund Proceeds (Redacted)

Other | 7/07/2023

Small Business Administration OIG

COVID-19 and Disaster Assistance Information Systems Security Controls

This report presents the results of our audit to determine whether the U.S. Small Business Administration (SBA) maintained effective management control activities and monitoring of the design and implementation of third-party operated SBA systems. SBA needed information technology systems from third-party service providers that could improve the system efficiency and productivity to process high transaction volumes, transmit data between other information systems, and safeguard the integrity and confidentiality of the personally identifiable information processed by the programs.We found the...

Full Details: Oversight.gov Report Page

Audit | 9/27/2022

1 - Open

Ensure the existing SBA System Development Methodology is updated to include supply chain risk-management practices as required by OMB Circular A-130 and high-value asset system designation guidance. Also, ensure high-value asset system risks are incorporated into the enterprise risk management framework, as recommended by OMB M-19-03 and SBA SOP 90 47 6.

10 - Open

Implement an automated process to document and monitor system changes as recommended by NIST SP 800-53 Rev. 5.

2 - Open

Communicate and enforce the SBA System Development Methodology in which a traceability matrix is used to ensure that system requirements can be tested and demonstrated in the operational system. Ensure all requirements are aligned with the contractual acceptance criteria.

3 - Open

Implement in updated agency guidance, the requirements of OMB Circular No. A-123 that stipulate a SOC 1 Type 2 report is needed for all new and existing financial systems. This guidance should also require confirmation at least annually that the controls are functioning as designed.

4 - Closed

Enforce the requirement to establish and implement internal controls to ensure appropriate program officials perform and document contract reviews to ensure that information security is appropriately addressed in the contracting language, as required by OMB Circular A-130 and SBA SOP 90 47 6.

5 - Open

In conjunction with the Enterprise Risk Management Board, implement enterprise-wide privacy risk mitigation practices that can be assimilated into new and existing system program designs.

6 - Open

Complete an initial assessment and authorization for each information system and all agency-designated common controls before operation.

7 - Open

Transition information systems and common controls to an ongoing authorization process (when eligible for such a process) with the formal approval of the respective authorizing officials or reauthorize information systems and common controls as needed, on a time or event-driven basis in accordance with agency risk tolerance, as required by OMB Circular No. A-130 and SOP 90 47 6.

8 - Open

Review and update POA&Ms at least quarterly as required by SOP 90 47 6.

9 - Closed

Ensure data-sharing agreements are reviewed annually as required by SBA SOP 90 47 6.

Small Business Administration OIG

SBA’s Processing of COVID-19 Economic Injury Disaster Loan Reconsideration Requests

The Office of Inspector General is issuing this inspection report to assess the U.S. Small Business Administration’s (SBA) processing of Coronavirus Disease 2019 (COVID-19) Economic Injury Disaster Loan (EIDL) reconsideration requests.SBA began accepting COVID-19 EIDL applications on March 12, 2020, and continued to accept them through December 31, 2021, when the COVID-19 EIDL program ended. COVID-19 EIDL applicants who were not approved for a loan could request the agency reconsider their loan application, initiating the reconsideration process.We found SBA generally processed reconsideration...

Full Details: Oversight.gov Report Page

Department of War OIG

Audit of DoD Actions Taken to Implement Cybersecurity Protections Over Remote Access Software in the Coronavirus Disease–2019 Telework Environment

Full Details: Oversight.gov Report Page

Audit | 3/24/2023

D-2023-0057-D000CR-0001-0001.A1 - Closed

(U) Rec. A.1: The DoD OIG recommended that the Director of the U.S. Southern Command - Joint Interagency Task Force South Command, Control, Communications, Computers, Cyber and Intelligence direct its network administrators to scan the VMware Horizon main virtual desktop for malware in accordance with the McAfee Endpoint Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not scanning the main virtual desktop.

D-2023-0057-D000CR-0001-0002.A2a - Closed

(U) Rec. A.2.a: The DoD OIG recommended that the Chief Information Officer of the Department of the Air Force revise its policy to align with the Windows 10 Security Technical Implementation Guide requirement for disabling inactive user accounts after no more than 35 days.

D-2023-0057-D000CR-0001-0002.A2b - Closed

(U) Rec. A.2.b: The DoD OIG recommended that the Chief Information Officer of the Department of the Air Force direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0003.A3 - Closed

(U) Rec. A.3: The DoD OIG recommended that the Chief Information Officer of the Naval Surface Warfare Center - Panama City Division direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0004.A4a - Closed

(U) Rec. A.4.a: The DoD OIG recommended that the Chief Information Officer of the Defense Intelligence Agency revise its policy to align with the Windows 10 Security Technical Implementation Guide requirement for disabling inactive users after no more than 35 days.

D-2023-0057-D000CR-0001-0004.A4b - Closed

(U) Rec. A.4.b: The DoD OIG recommended that the Chief Information Officer of the Defense Intelligence Agency direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0005.A5a - Closed

(U) Rec. A.5.a: The DoD OIG recommended that the Director of the Marine Corps Information Command, Control, Communications, and Computers revise the organization's policy to align with the Windows 10 Security Technical Implementation Guide requirement for disabling inactive users after no more than 35 days.

D-2023-0057-D000CR-0001-0005.A5b - Closed

(U) Rec. A.5.b: The DoD OIG recommended that the Director of the Marine Corps Information Command, Control, Communications, and Computers direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0006.A6 - Closed

(U) Rec. A.6: The DoD OIG recommended that the Director of the Defense Information Systems Agency Joint Service Provider direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0002-0001.B1 - Closed

(U) Rec. B.1: The DoD OIG recommended that the Director of the Defense Information Systems Agency Joint Service Provider direct network and system administrators to revise the vulnerability management program to include mitigation timeframes for all vulnerabilities and develop plans of actions and milestones for all vulnerabilities that cannot be mitigated in a timely manner.

Department of the Treasury OIG

Desk Review of the Kiowa Tribe of Oklahoma's Use of Coronavirus Relief Fund Proceeds

Full Details: Oversight.gov Report Page

Other | 12/20/2024

1-1 - Open

Treasury OIG should follow-up with Kiowa's management to confirm if the $6,919,819 in Contracts greater than or equal to $50,000 payment type are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace unsupported transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for the Contracts greater than or equal to $50,000 payment type.

10-1 - Open

Treasury OIG should determine the feasibility of following up with Kiowa over the $579,443 of additional hardship payments to determine whether these amounts charged to the CRF included previously budgeted expenditures and, if so, Castro recommends Treasury OIG recoup the funds or request that Kiowa's management provide support for eligible expenditures, not previously charged to CRF, that were incurred during the period of performance.

11-1 - Open

Treasury OIG should follow-up with Kiowa's management to request they perform an analysis over its Aggregate Reporting less than $50,000 payment type claimed costs to determine if there are any additional hardship payments included within that payment type. Based on the results of this assessment, Treasury OIG should consider the feasibility of performing additional testing over these balances.

12-1 - Open

Treasury OIG should determine the feasibility of performing additional follow-up with Kiowa to determine if there were other instances of ineligible or unsupported hardship balances within all four of the hardship payment types claimed within its Aggregate Payments to Individuals payment type.

2-1 - Open

Treasury OIG should follow-up with Kiowa's management to confirm if the $62,744 in Contracts greater than or equal to $50,000 payment type are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace unsupported transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for the Contracts greater than or equal to $50,000 payment type.

3-1 - Open

Treasury OIG should follow-up with Kiowa's management to confirm if the $727,002 in Contracts greater than or equal to $50,000 payment type are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace unsupported transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for the Contracts greater than or equal to $50,000 payment type.

4-1 - Open

TOIG should follow-up with Kiowa's management to confirm if the $124,535 noted as ineligible expenditures within the Contracts greater than or equal to $50,000, payment type are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace ineligible transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for the Contracts greater than or equal to $50,000 payment type.

5-1 - Open

Treasury OIG should follow-up with Kiowa's management to confirm if the $1,832 in Aggregate Reporting less than $50,000 payment type are recouped or replaced by other supported expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace unsupported transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for the Aggregate Reporting less than $50,000 payment type.

6-1 - Open

Treasury OIG should follow-up with Kiowa's management to confirm if the $38,162 noted as unsupported expenditures within the Aggregate Payments to Individuals payment type are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace ineligible transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for Aggregate Payments to Individuals.

7-1 - Open

Treasury OIG should follow-up with Kiowa's management to confirm if the $1,860 noted as ineligible expenditures within the Aggregate Payments to Individuals payment type are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace ineligible transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for Aggregate Payments to Individuals.

8-1 - Open

Treasury OIG should follow-up with Kiowa's management to confirm if the $654,200 noted as ineligible expenditures within the Aggregate Payments to Individuals payment type are recouped or replaced by other eligible expenditures, not previously charged to CRF, that were incurred during the period of performance. Further, based on Kiowa's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace ineligible transactions charged to CRF with valid expenditures, Treasury OIG should determine the feasibility of conducting an audit for the Contracts greater than or equal to $50,000 payment type.

9-1 - Open

Treasury OIG should follow-up with Kiowa's management regarding the remaining $12,678 of attorney's fees expenses within the Contracts greater than or equal to $50,000 payment type not tested during Castro's desk review to determine if there are additional unsupported or ineligible questioned costs.

Department of Education OIG

Federal Student Aid’s Performance Measures and Indicators for Returning Borrowers to Repayment

The inspection sought to determine whether the Federal Student Aid office (FSA) established performance measures and indicators for returning borrowers to repayment. We found that FSA needed to establish effective performance measures and indicators to evaluate its performance for returning borrowers to repayment. Although FSA and the Office of the Undersecretary established operational and strategic objectives and operational goals for returning borrowers to repayment, they were not written in specific and measurable terms. In addition, although FSA identified several data metrics as...

Full Details: Oversight.gov Report Page

Inspection / Evaluation | 8/14/2024

Department of Health & Human Services OIG

Home Health Agencies Rarely Furnished Services Via Telehealth Early in the COVID-19 Public Health Emergency

Full Details: Oversight.gov Report Page

Department of Labor OIG

ETA Did Not Provide Adequate Oversight of Emergency Administrative Grants

Full Details: Oversight.gov Report Page

Audit | 7/27/2023

Department of Labor OIG

The Employment and Training Administration Needs to Improve Oversight of Grants Awarded in Texas

Full Details: Oversight.gov Report Page

Audit | 6/10/2026

001 - Open

Develop and implement controls to ensure more efficient use of statutory grant funds, which should include performing data analytics on grant spending and performance data.

002 - Open

Establish and implement procedures to collect and analyze detailed financial data on career services expenditures, which should include identifying the reason for the growth in career services.

003 - Open

Develop and implement controls to ensure ETA leadership and other stakeholders are aware of the complete administrative costs—including those of workforce entities currently exempt from reporting administrative costs—incurred by the WIOA statutory grant programs.

004 - Open

Develop guidance for grant recipients and subrecipients to clarify how to determine if an expenditure materially increases the value or useful life of a capital asset.

005 - Open

Establish a dollar threshold for construction projects over which grant recipients need to obtain approval from ETA.

006 - Open

Remedy the $998,253 in questioned costs associated with construction.

007 - Open

Remedy the $23,718 in questioned costs due to not reconciling the provisional rate with the final indirect cost rate.

008 - Open

Remedy the $14,581 in questioned costs associated with the Texas State Board director’s salary expense charged directly to the statutory grant programs.

009 - Open

Develop guidance that clarifies what documentation is required to support individualized career services provided to participants by grant recipients and subrecipients.

010 - Open

Ensure ETA officials responsible for monitoring grant recipients enforce the documentation requirements in their grant agreements.

Small Business Administration OIG

Evaluation of SBA’s Eligibility and Forgiveness Reviews of Paycheck Protection Program Loans Made to Borrowers with Treasury’s Do Not Pay Data Matches

This report is a follow up to SBA OIG Report Number 21-06, Paycheck Protection Program (PPP) Loan Recipients on the Department of Treasury’s (Treasury) Do Not Pay (DNP) List, which reported SBA did not use Department of Treasury (Treasury) DNP data to screen borrowers for eligibility prior to approving loans originated before August 8, 2020 (PPP round one). In this report, we assess SBA actions to address potentially ineligible loans identified in report 21-06 and its implementation of controls to review DNP data for PPP loans originated after August 8, 2020 (PPP round two).SBA implemented a...

Full Details: Oversight.gov Report Page

Inspection / Evaluation | 2/22/2024

1 - Open

Review the 1,799 PPP loans totaling over $89 million that matched a DNP data source to ensure eligibility requirements were met and seek remedy or repayment of all loans deemed ineligible.

2 - Open

Review the 49 PPP loans totaling approximately $3.5 million and the 43 loans totaling approximately $7.2 million to ensure borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.

3 - Open

Review PPP loans in which the DNP hold codes were cleared to 1) identify those cleared using pre-decisional memos and 2) those cleared without sufficient evidence to support the reviewer’s loan decision and seek remedy or repayment of loans deemed ineligible.

4 - Closed

Develop and implement controls, such as supervisory reviews, to ensure PPP loans and loans for future stimulus programs with DNP matches receive manual reviews, as required. The reviews should ensure that pre-decisional memos are not used to clear DNP hold codes and that loan files contain relevant and appropriate documentary evidence to support the loan review decisions.

5 - Closed

Develop and implement clear guidance requiring responsible officials to maintain documentary evidence used to support loan decisions in the loan files.

6 - Open

Review the 59,893 PPP applications that matched a DNP data source to ensure borrowers met eligibility requirements and seek remedy or repayment of loans deemed ineligible.

7 - Open

Review the additional 47,940 PPP loans totaling over $1.7 billion, identified through the DNP data match, to ensure borrowers met the eligibility requirements and seek remedy or repayment of loans deemed ineligible.

Date Range

Report Category

Submitting Agency

Fraud Type

Agency Reviewed

Related Organizations

Any Open Recommendations

Reports

Desk Review of Turtle Mountain Band of Chippewa Indians’ Use of Coronavirus Relief Fund Proceeds (Redacted)

COVID-19 and Disaster Assistance Information Systems Security Controls

SBA’s Processing of COVID-19 Economic Injury Disaster Loan Reconsideration Requests

Audit of DoD Actions Taken to Implement Cybersecurity Protections Over Remote Access Software in the Coronavirus Disease–2019 Telework Environment

Desk Review of the Kiowa Tribe of Oklahoma's Use of Coronavirus Relief Fund Proceeds

Federal Student Aid’s Performance Measures and Indicators for Returning Borrowers to Repayment

Home Health Agencies Rarely Furnished Services Via Telehealth Early in the COVID-19 Public Health Emergency

ETA Did Not Provide Adequate Oversight of Emergency Administrative Grants

The Employment and Training Administration Needs to Improve Oversight of Grants Awarded in Texas

Evaluation of SBA’s Eligibility and Forgiveness Reviews of Paycheck Protection Program Loans Made to Borrowers with Treasury’s Do Not Pay Data Matches

Glossary

Glossary name will go here