Quality Control Review of the Independent Service Auditors’ Report on DOT’s Enterprise Services Center’s System Organization and Controls

What We Looked At This report presents the results of our quality control review (QCR) of an attestation examination of the Department of Transportation’s (DOT) Enterprise Services Center (ESC) controls. ESC provides financial management services to DOT and other agencies and operates under the direction of DOT’s Chief Financial Officer. The Office of Management and Budget requires ESC, as a service organization, to either provide its user organizations with independent audit reports on the design and effectiveness of its internal controls or allow user auditors to perform tests of its controls.   We contracted with KPMG LLP to conduct this examination subject to our oversight. The objectives of the review were to determine whether (1) management’s description of ESC’s systems is fairly presented, (2) ESC’s controls are suitably designed, and (3) ESC’s controls are operating effectively throughout the period of October 1, 2022, through June 30, 2023. We performed a QCR on KPMG’s report and related documentation.   What We Found Our QCR disclosed no instances in which KPMG did not comply, in all material respects, with generally accepted Government auditing standards.   Our Recommendations KPMG made no recommendations.   We are publicly releasing a summary of the report rather than the full report itself because the Federal Information Security Management Act of 2002 (FISMA), as amended, requires OIGs to take appropriate steps to ensure the protection of information that, if disclosed, may adversely affect information security.1 144 U.S.C. § 3555(f)