Federal Reports

The Office of the Inspector General determined the Cumberland Energy Solution project complied with most elements of scope management and the bid process. However, we identified certain areas under each process that need improvement to help mitigate potential Tennessee Valley Authority (TVA) risk. In summary:• TVA’s Cybersecurity, a business unit under TVA’s Technology and Innovation business unit, was not included as a stakeholder throughout the project. • TVA did not adequately mitigate risks related to the use of equipment from nondesignated countries. Specifically,- Cybersecurity concerns related to the use of equipment from a nondesignated country had not been evaluated. - Some procurements were not evaluated for compliance with the Trade Agreements Act.• The Cumberland Energy Solution project risk register could be improved related to (1) project staffing and (2) gas pipeline construction. • TVA’s contract pricing strategies may cause TVA to pay inflated costs.

The Office of the Inspector General performed an audit to determine if TVA manages access to nonpublic critical and sensitive information in accordance with TVA information management policy. Our scope was limited to TVA’s SharePoint® sites as of March 19, 2024. We determined TVA’s management of access to nonpublic critical and sensitive information could be improved. In addition, we determined TVA was not providing SharePoint® site owners with appropriate training to properly manage access to TVA nonpublic critical and sensitive information. This report, specifically identifies Microsoft, a nongovernmental organization/business entity. Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Pub. L. No. 117-263 §5274, any such organization may submit a written response to the report within 30 days, clarifying or providing additional context for each instance within the report in which the organization is specifically identified. Any response provided for that purpose will be appended to the final, published report. If you have any questions about this process, please contact Jeffrey McKenzie at (865) 633-7374 or jtmckenzie@tvaoig.gov within 30 days of publication.

Objective: To determine whether the Social Security Administration has adequate controls in place that are functioning as intended to properly prevent unauthorized access and use of Business Services Online services.

During the week of April 1, 2024, we performed a self-initiated audit at the Tallahassee Processing and Distribution Facility (P&DF) and three delivery units serviced by the P&DF. The delivery units included the Lake Jackson, Leon, and Westside Stations located in Tallahassee, FL.We issued individual reports for the three delivery units and the P&DF. We issued another report summarizing the results of our audits at all three delivery units with specific recommendations for management to address.

This compendium focuses on a total of 90 recommendations to the EPA that remained unimplemented-79 open and 11 unresolved-as of May 31, 2024. The 90 recommendations we address in this compendium represent $74.5 million in potential cost savings. The compendium includes 17 open or unresolved recommendations that the OIG deemed high priority, as well as 53 open recommendations that are at least three years old or will be by their scheduled completion date. This year we provide a separate analysis of the five unresolved OIG recommendations made to the U.S. Chemical Safety and Hazard Investigation Board as of May 31, 2024.