Federal Reports

The Office of Inspector General (OIG) initiated this review to identify AbilityOne Program data generated or maintained by Central Nonprofit Agencies (CNA) and/or Nonprofit Agencies (NPA), that is not currently available to the U.S. AbilityOne Commission (Commission).

The evaluation team reviewed and analyzed the new 2024 Cooperative Agreements between the Commission and CNAs, as well as Commission policies and procedures related to data collection and reporting.

The OIG found no data had been collected in the new electronic systems at the time of our re-view. Based on the updated Cooperative Agreements between the Commission and CNAs, the Commission anticipates having access to relevant program data and the new CNA electronic data systems October 1, 2025. The Commission stated it anticipates collecting data using the new electronic systems for approximately one year so that they have enough data points to ensure they are receiving the appropriate data and identifying various trends and patterns within the data.

Through this evaluation, the OIG observed that if the Commission wants to meet its deadline of implementing the electronic data collection and data dashboard by October 1, 2025, it needed to improve communication with DWG. Specifically, clear communication between the Commission and DWG is needed to ensure that relevant data is displayed on the dashboards once they are created.

The OIG has no specific recommendations associated with this report.

This report presents the results of our audit of U.S. Postal Inspection Service’s Expense Purchase Card Use. 

Background

The U.S. Postal Inspection Service, an investigative agency within the Postal Service, uses purchase cards for local buying of general goods and services when day-to-day operational needs cannot be satisfied. Expense purchase cards can be used to purchase items for events, including on-site or off-site official meetings, training, employee recognition and appreciation events, and all event-related expenses. However, cardholders must comply with policies and procedures, such as obtaining approval for purchases and maintaining accurate records for three years. Adhering to these policies is critical to ensure financial integrity and to maintain the public trust and reputation of the U.S. Postal Service and Postal Inspection Service.

What We Did

Our objective was to assess the U.S. Postal Inspection Service’s expense purchase card use. To accomplish our objective, we reviewed 379 purchase card transactions, valued at $367,462, and interviewed Postal Service and Postal Inspection Service Headquarters management.

What We Found

We found opportunities to improve the Postal Inspection Service’s management of the purchase card program. Specifically, Postal Inspection Service personnel made restricted purchases and purchases that may not align with the organization’s business needs. Also, the Postal Inspection Service did not enter awards and gifts presented to employees into the award system. Controls over purchase cards are important to prevent misuse and promote accountability.

This report presents a review of the U.S. Postal Regulatory Commission’s (PRC) information security program and practices for fiscal year (FY) 2025. The Federal Information Security Modernization Act, amended in 2014 (FISMA) requires agencies to develop, implement, and document agencywide information security programs and practices. FISMA also requires inspectors general to conduct annual reviews of their agencies’ information security programs and report the results to the Office of Management and Budget. 

In September 2025, the OIG issued a special report on the Peace Corps’ Information Technology environment. OIG contracted with technical subject matter experts to conduct three cybersecurity tests from January 2025 to March 2025. The three tests included a simulated phishing campaign, a review of the agency’s internal vulnerability management practices, and penetration tests that targeted critical Peace Corps systems.

While observing the agency’s security processes throughout the assessment, OIG found that the Peace Corps’ monitoring capabilities were able to identify the testing activities and demonstrate its incident response procedures. However, the cybersecurity tests also uncovered multiple vulnerabilities and misconfigurations, ranging from informational issues to critical severity risks that the Peace Corps needs to review and address.