Quality Control Review of the Independent Auditors' Report on the Department of Transportation's Audited Consolidated Financial Statements for Fiscal Year 2025

Date Issued

Friday, January 16, 2026

Submitting OIG

Department of Transportation OIG

Agencies Reviewed/Investigated

Department of Transportation

Components

Office of the Secretary of Transportation

Report Number

QC2026011

Report Description

Our Objective(s)To perform a quality control review (QCR) of KPMG LLP's audit of the Department of Transportation's consolidated financial statements as of and for the fiscal year ended September 30, 2025. We reviewed KPMG's report, dated January 14, 2026, and related documentation.
About This ReportWe contracted with the independent public accounting firm KPMG to audit DOT's consolidated financial statements, provide an opinion on those financial statements, report on internal control over financial reporting, and report on compliance with laws and other matters.
What We FoundThe independent auditor, KPMG, found one significant deficiency in DOT's IT internal controls over financial reporting:

Weaknesses in General Information Technology Controls.

Our QCR disclosed no instances in which KPMG did not comply, in all material respects, with U.S. generally accepted Government auditing standards.
RecommendationsWe agree with KPMG's three recommendations to help strengthen DOT's General Information Technology Controls.

Report Type

Audit

Agency Wide

Yes

Number of Recommendations

Questioned Costs

Funds for Better Use

Report updated under NDAA 5274

External Link

https://www.oig.dot.gov/library-item/47050

Open Recommendations

This report has 3 open recommendations.

Recommendation Number	Significant Recommendation	Recommended Questioned Costs	Recommended Funds for Better Use
1	Yes	$0	$0
Implement processes to perform administrative functions without the use of shared accounts.
2	Yes	$0	$0
Design and implement controls over privileged developer access to certain systems, including periodic recertification of accounts and enforcing segregation of duties.
3	Yes	$0	$0
Design, implement, and re-enforce requirements for controls to consistently approve and document recertification requests as required by internal policy and standards for effective internal control systems.