Reports

Search for reports and investigative results.

Treasury Inspector General for Tax Administration

Fingerprinting and Employment Eligibility Verification Delays Due to the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks

Audit | 7/07/2022

Small Business Administration OIG

COVID-19 and Disaster Assistance Information Systems Security Controls

This report presents the results of our audit to determine whether the U.S. Small Business Administration (SBA) maintained effective management control activities and monitoring of the design and implementation of third-party operated SBA systems. SBA needed information technology systems from third-party service providers that could improve the system efficiency and productivity to process high transaction volumes, transmit data between other information systems, and safeguard the integrity and confidentiality of the personally identifiable information processed by the programs.We found the...

Full Details: Oversight.gov Report Page

Audit | 9/27/2022

1 - Open

Ensure the existing SBA System Development Methodology is updated to include supply chain risk-management practices as required by OMB Circular A-130 and high-value asset system designation guidance. Also, ensure high-value asset system risks are incorporated into the enterprise risk management framework, as recommended by OMB M-19-03 and SBA SOP 90 47 6.

10 - Open

Implement an automated process to document and monitor system changes as recommended by NIST SP 800-53 Rev. 5.

2 - Open

Communicate and enforce the SBA System Development Methodology in which a traceability matrix is used to ensure that system requirements can be tested and demonstrated in the operational system. Ensure all requirements are aligned with the contractual acceptance criteria.

3 - Open

Implement in updated agency guidance, the requirements of OMB Circular No. A-123 that stipulate a SOC 1 Type 2 report is needed for all new and existing financial systems. This guidance should also require confirmation at least annually that the controls are functioning as designed.

4 - Closed

Enforce the requirement to establish and implement internal controls to ensure appropriate program officials perform and document contract reviews to ensure that information security is appropriately addressed in the contracting language, as required by OMB Circular A-130 and SBA SOP 90 47 6.

5 - Open

In conjunction with the Enterprise Risk Management Board, implement enterprise-wide privacy risk mitigation practices that can be assimilated into new and existing system program designs.

6 - Open

Complete an initial assessment and authorization for each information system and all agency-designated common controls before operation.

7 - Open

Transition information systems and common controls to an ongoing authorization process (when eligible for such a process) with the formal approval of the respective authorizing officials or reauthorize information systems and common controls as needed, on a time or event-driven basis in accordance with agency risk tolerance, as required by OMB Circular No. A-130 and SOP 90 47 6.

8 - Open

Review and update POA&Ms at least quarterly as required by SOP 90 47 6.

9 - Closed

Ensure data-sharing agreements are reviewed annually as required by SBA SOP 90 47 6.

Department of the Treasury OIG

CORONAVIRUS DISEASE 2019 PANDEMIC RELIEF PROGRAMS: Audit of Air Carrier Worker Support Certifications - Empire Airlines, Inc. (Redacted)

Full Details: Oversight.gov Report Page

Election Assistance Commission OIG

Audit of the Help America Vote Act Grants Awarded to the State of Indiana

EAC OIG, through the independent public accounting firm of McBride, Lock & Associates, LLC, audited funds received by the State of Indiana under the Help America Vote Act, including state matching funds and program income, totaling $26.3 million. This included Election Security and Coronavirus Aid, Relief, and Economic Security Act grants.

Full Details: Oversight.gov Report Page

Audit | 9/02/2022

Department of Housing and Urban Development OIG

Drawdown Levels for the Initial Round of CARES Act Emergency Solutions Grants Were Minimal

We conducted this limited review to identify the U.S. Department of Housing and Urban Development’s (HUD) Coronavirus Aid, Relief, and Economic Security Act (CARES Act) drawdown levels for the initial round of Emergency Solutions Grants (ESG) funding. In addition, we researched information published by grantees on how they have used and will use their funds. Our objective was to highlight the grantees’ (1) drawdown levels for the initial round of ESG CARES Act funding and (2) published information on how the funds have and will be used. Our review determined that as of July 1, 2020, the ESG...

Full Details: Oversight.gov Report Page

Department of the Treasury OIG

CORONAVIRUS DISEASE 2019 PANDEMIC RELIEF PROGRAMS: Audit of Air Carrier Worker Support Certifications - Bird Acquisition, LLC (Redacted)

Full Details: Oversight.gov Report Page

Audit | 6/13/2023

Department of Education OIG

Missouri’s Administration of the Governor’s Emergency Education Relief Fund Grant

The objectives of the audit were to determine whether the State of Missouri (Missouri) designed and implemented awarding processes that ensured that the Governor's Emergency Education Relief Fund (GEER grant) was used to support local educational agencies (LEAs) and institutions of higher education (IHEs) that were most significantly impacted by the coronavirus or LEAs, IHEs, or other education-related entities within the State that were deemed essential for carrying out emergency educational services; and monitoring processes to ensure that subgrantees used GEER grant funds in accordance with...

Full Details: Oversight.gov Report Page

Audit | 2/10/2022

Department of War OIG

Audit of DoD Actions Taken to Implement Cybersecurity Protections Over Remote Access Software in the Coronavirus Disease–2019 Telework Environment

Full Details: Oversight.gov Report Page

Audit | 3/24/2023

D-2023-0057-D000CR-0001-0001.A1 - Closed

(U) Rec. A.1: The DoD OIG recommended that the Director of the U.S. Southern Command - Joint Interagency Task Force South Command, Control, Communications, Computers, Cyber and Intelligence direct its network administrators to scan the VMware Horizon main virtual desktop for malware in accordance with the McAfee Endpoint Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not scanning the main virtual desktop.

D-2023-0057-D000CR-0001-0002.A2a - Closed

(U) Rec. A.2.a: The DoD OIG recommended that the Chief Information Officer of the Department of the Air Force revise its policy to align with the Windows 10 Security Technical Implementation Guide requirement for disabling inactive user accounts after no more than 35 days.

D-2023-0057-D000CR-0001-0002.A2b - Closed

(U) Rec. A.2.b: The DoD OIG recommended that the Chief Information Officer of the Department of the Air Force direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0003.A3 - Closed

(U) Rec. A.3: The DoD OIG recommended that the Chief Information Officer of the Naval Surface Warfare Center - Panama City Division direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0004.A4a - Closed

(U) Rec. A.4.a: The DoD OIG recommended that the Chief Information Officer of the Defense Intelligence Agency revise its policy to align with the Windows 10 Security Technical Implementation Guide requirement for disabling inactive users after no more than 35 days.

D-2023-0057-D000CR-0001-0004.A4b - Closed

(U) Rec. A.4.b: The DoD OIG recommended that the Chief Information Officer of the Defense Intelligence Agency direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0005.A5a - Closed

(U) Rec. A.5.a: The DoD OIG recommended that the Director of the Marine Corps Information Command, Control, Communications, and Computers revise the organization's policy to align with the Windows 10 Security Technical Implementation Guide requirement for disabling inactive users after no more than 35 days.

D-2023-0057-D000CR-0001-0005.A5b - Closed

(U) Rec. A.5.b: The DoD OIG recommended that the Director of the Marine Corps Information Command, Control, Communications, and Computers direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0001-0006.A6 - Closed

(U) Rec. A.6: The DoD OIG recommended that the Director of the Defense Information Systems Agency Joint Service Provider direct network and system administrators to disable inactive user accounts after no more than 35 days of inactivity in accordance with the Windows 10 Security Technical Implementation Guide, develop compensating controls, or formally accept the risk of not disabling the inactive user accounts.

D-2023-0057-D000CR-0002-0001.B1 - Closed

(U) Rec. B.1: The DoD OIG recommended that the Director of the Defense Information Systems Agency Joint Service Provider direct network and system administrators to revise the vulnerability management program to include mitigation timeframes for all vulnerabilities and develop plans of actions and milestones for all vulnerabilities that cannot be mitigated in a timely manner.

Treasury Inspector General for Tax Administration

Implementation of Tax Year 2020 Employer Tax Credits Enacted in Response to the COVID-19 Pandemic

Full Details: Oversight.gov Report Page

Department of Health & Human Services OIG

Home Health Agencies Rarely Furnished Services Via Telehealth Early in the COVID-19 Public Health Emergency

Full Details: Oversight.gov Report Page

Date Range

Report Type

Report Category

Submitting Agency

State (State and Local Reports)

Fraud Type

Agency Reviewed

Related Organizations

Management Challenges

Any Recommendations

Any Open Recommendations

Reports

Fingerprinting and Employment Eligibility Verification Delays Due to the COVID-19 Pandemic May Increase Taxpayer Data Exposure Risks

COVID-19 and Disaster Assistance Information Systems Security Controls

CORONAVIRUS DISEASE 2019 PANDEMIC RELIEF PROGRAMS: Audit of Air Carrier Worker Support Certifications - Empire Airlines, Inc. (Redacted)

Audit of the Help America Vote Act Grants Awarded to the State of Indiana

Drawdown Levels for the Initial Round of CARES Act Emergency Solutions Grants Were Minimal

CORONAVIRUS DISEASE 2019 PANDEMIC RELIEF PROGRAMS: Audit of Air Carrier Worker Support Certifications - Bird Acquisition, LLC (Redacted)

Missouri’s Administration of the Governor’s Emergency Education Relief Fund Grant

Audit of DoD Actions Taken to Implement Cybersecurity Protections Over Remote Access Software in the Coronavirus Disease–2019 Telework Environment

Implementation of Tax Year 2020 Employer Tax Credits Enacted in Response to the COVID-19 Pandemic

Home Health Agencies Rarely Furnished Services Via Telehealth Early in the COVID-19 Public Health Emergency

Glossary

Glossary name will go here