Federal Reports

The U.S. Government Publishing Office, Office of the Inspector General, conducted an audit to assess the maturity of cybersecurity incident response capabilities for detection, analysis, and handling, Project Number A-2025-002.The OIG reported two findings and made three recommendations to improve cybersecurity incident response. 

We audited the Government National Mortgage Association’s (Ginnie Mae) management of its portfolio of federally guaranteed mortgage-backed securities (MBS).  We initiated this audit because of our internal monitoring of the Ginnie Mae portfolio as well as the issuance of a Financial Stability Oversight Council report in 2024 on the rising risks presented by nonbank mortgage companies.  Our audit objective was to assess Ginnie Mae's evaluation of nonbank issuer concentration risk.  

Ginnie Mae’s portfolio experienced a rise in nonbank concentration risk.  Specifically, a few nonbank mortgage companies hold a large percentage of Ginnie Mae’s portfolio of guaranteed MBS.  However, Ginnie Mae does not formally assess whether the risk impacts its operations, existing internal controls, or its ability to meet its agency goals.  If this continues, it could complicate Ginnie Mae’s ability to effectively monitor or respond to any failures of the largest nonbank mortgage companies.

We recommend that the President of Ginnie Mae perform an assessment of concentration risk and take appropriate action based on the results. 

An Amtrak reservation sales agent based in Philadelphia, Pennsylvania, resigned from the company on March 30, 2026, while under investigation. Our investigation found that the former employee obtained passenger credit card information and used it to make purchases for himself, as well as booking Amtrak travel for associates. The former employee is not eligible for rehire.

Judicial proceedings are pending.

The Department’s Federal award administration included significant control deficiencies related to expenditure tracking and reimbursement requests.

An Amtrak on-board services supervisor based in Queens, New York, was terminated from employment on March 26, 2026, following his administrative hearing. Our investigation found that the former employee violated company policies by ordering unauthorized cleaning supplies from the company, such as a vacuum cleaner and large commercial-sized containers of cleaning products, and giving them to his girlfriend. While the former employee did not admit to these actions, his former girlfriend provided the stolen items and a text message exchange with the former employee that corroborated the theft. The former employee is not eligible for rehire.