Some Corrective Actions to Address Reported Information Technology Weaknesses Were Not Adequately Documented and Effectively Implemented

Submitting OIG:

Date Issued:

Wednesday, June 12, 2024

Agency Reviewed / Investigated:

Submitting OIG-Specific Report Number:

2024-200-025

Location(s):

Agency-Wide

Type of Report:

Audit

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
2024200025fr.pdf	2.12 MB

Related Open Recommendations

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
The Chief Information Officer (CIO) should ensure that sufficient management oversight is provided to verify the use of older software versions is properly documented with an RBD or RAFT.
2	Open	No
The Chief Information Officer (CIO) should ensure that the Enterprise Standards Profile is updated with fields to track the use of older software versions, along with their associated RBD or RAFT.
3	Open	No
The CIO should ensure that ***************************************** ********************************************* are remediated by the plan of action and milestones due date.
4	Open	No
The Chief Risk Officer should ensure that any appropriate documentation subsequently provided during this review is uploaded to the JAMES for the judgmentally sampled PCAs that lacked sufficient documentation to support their closure.
5	Open	No
The Chief Risk Officer should ensure that the EAM organization evaluates sufficient testing documentation to demonstrate that corrective actions taken are fully implemented as stated in the PCA and ensures sufficient documentation is uploaded to the JAMES prior to approving PCA closures.