Federal Reports

The VA Office of Inspector General’s information security inspection program assesses whether VA facilities are meeting federal security requirements related to four control areas the OIG determined to be at highest risk. For this inspection, the OIG selected the Health Eligibility Center (HEC) in Atlanta, Georgia. The OIG found deficiencies in three of the four areas inspected.
Configuration management controls, which identify and manage security features for all hardware and software components of an information system, were deficient in vulnerability remediation, system life-cycle management, and remediation of unauthorized software.
There were no deficiencies in contingency planning controls, which include physical and environmental controls.
In the area of security management, about 3.3 million veterans’ records containing sensitive personal information were not encrypted. VA security policy requires the encryption of sensitive information hosted on computer systems.
Access controls provide reasonable assurance that computer resources are restricted to authorized individuals. At the HEC, the OIG found deficiencies with access controls in the inventory of facility keys as well as in logging administrative actions, log retention, and log reviews.
The OIG made five recommendations aimed at correcting the identified deficiencies.

Our Objective(s)To perform a quality control review (QCR) of Allmond & Company LLC's audit of the Great Lakes St. Lawrence Seaway Development Corporation's (GLS) financial statements as of and for the fiscal years ended September 30, 2024, and September 30, 2023. We reviewed Allmond's report, dated November 6, 2024, and related documentation.
About This ReportWe contracted with the independent public accounting firm Allmond & Company, LLC to audit GLS's financial statements, provide an opinion on those financial statements, report on internal control over financial reporting, and report on compliance with laws and other matters.
What We FoundThe independent auditor, Allmond, found two significant deficiencies in GLS's internal controls over financial reporting.

Internal control relating to the valuation of operating materials and supplies was not properly designed and implemented in order to prevent or detect and correct errors in unit costs that were entered into the inventory tracking system.
Loss contingencies were not reported in accordance with generally accepted accounting principles.

Our QCR disclosed no instances in which Allmond did not comply, in all material respects, with U.S. generally accepted Government auditing standards.
RecommendationsWe agree with Allmond's six recommendations to help strengthen GLS's internal controls over financial reporting.