Federal Reports

The Tennessee Valley Authority (TVA) currently operates 101 natural gas- and fuel oil-fired generators at 18 sites.  During 2020, we performed an evaluation of overtime worked at TVA gas plants and found a significant amount of overtime was being worked by employees at some plants.  In response to that evaluation, TVA hired additional full-time employees at some gas plants.  However, overtime worked at gas plants has continued to increase since our previous evaluation.  Specifically, between June 1, 2022, and May 31, 2024, employees at TVA’s gas plants were paid a total of $119.75 million.  Of this $119.75 million, $33.6 million (28 percent) was paid for 369,218 hours of overtime to 360 employees.

To help manage the effects of fatigue, TVA Safety Procedure 18.018, Fatigue Management, establishes “. . . a process to provide reasonable assurance that the effects of fatigue and degraded alertness do not impact an individual’s ability to safely and competently perform their duties.”  Due to the high number of overtime hours worked at some gas plants and the potential impact on fatigue management, we performed an evaluation to assess TVA’s management of overtime at gas plants.

We determined significant amounts of overtime were worked by employees at some gas plants.  Specifically, we determined 73 percent (269,586 hours) of the 369,218 hours of overtime was performed at 7 of 18 plants between June 1, 2022, and May 31, 2024.  The overtime worked was the equivalent of 61 full-time employees.  We also determined some employees worked significant amounts of overtime.  There were 109 instances where employees worked over 1,000 hours of overtime in a single year, including three with over 1,800 hours. Additionally, we determined that TVA may not be accurately capturing the effects of fatigue because (1) fatigue evaluations are not being performed and (2) fatigue data is not being trended as required by the Fatigue Management procedure.

We found that an oil and gas company used natural gas from a Federal lease to power cryptocurrency mining operations without authorization. 

The Cybersecurity and Infrastructure Security Agency (CISA) did not implement effective controls for the selected High Value Asset (HVA) system per Federal and departmental requirements. CISA developed policies and procedures to reduce risks to sensitive information stored on the selected HVA system. However, we identified security deficiencies in two of eight security and privacy controls required by the National Institute of Standards and Technology pertaining to:
•
access controls; and
•
awareness and training.
These deficiencies occurred because CISA did not have effective continuous monitoring of the selected HVA system. Without effective controls, CISA could not be assured that sensitive information stored and processed by the selected HVA system was protected and secured.