Where To Report Waste

Fraud, Abuse, Or Retaliation

Implementation of the FDIC’s Information Technology Risk Examination (InTREx) Program

Submitting OIG:

Federal Deposit Insurance Corporation OIG

Date Issued:

Tuesday, January 31, 2023

Agency Reviewed / Investigated:

Federal Deposit Insurance Corporation

Submitting OIG-Specific Report Number:

AUD-23-001

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

$0

Funds for Better Use:

$0

Number of Recommendations:

19

Report updated under NDAA 5274:

No

View Document:

Attachment	Size
AUD-23-001.pdf	6.39 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation	Additional Details
1	Open	No
Update and implement the InTREx program to reflect current IT and cyber risks and guidance.
2	Open	No
Work with the InTREx Interagency Committee to develop and implement procedures to govern the process to update the InTREx program.
3	Open	No
Communicate updates to the InTREx program to examiners in a timely manner and prior to implementation.
4	Open	No
Issue revised or updated guidance to examiners to address InTREx program updates.
5	Open	No
Develop and implement control mechanisms to ensure that examiners complete examination procedures and decision factors.
8	Open	No
Update and implement examination policy and InTREx procedures to require that IT examination workpapers be reviewed for adequacy and that workpapers sufficiently support examination conclusions prior to the issuance of the ROE.
9	Open	No
Share the results of ICRS Regional Reviews with all supervisory regions.
11	Open	No
Develop and implement examination policy and procedures to designate the roles and responsibilities for filing and maintaining IT examination workpapers in RADD.
12	Open	No
Develop and implement procedures and controls to ensure that workpapers are properly filed in RADD in accordance with the FDIC’s examination policy and procedures.
13	Open	No
Establish and document the timeframe for uploading IT examination workpapers to RADD.

Pages