Federal Reports

We performed a review to verify all production servers, databases, and the mainframe were being backed up. Our review found (1)all but 20 production distributed servers, (2)all production databases, and (3)the mainframe were being backed up at the time of our testing. Information Services provided explanations and/or actions taken for the 20 servers not being backed up. We also determined 13 backup policies (rules within the software used to backup servers) were obsolete or inactive and 9 servers did not have their exclude lists documented. Based on other observations noted during the audit, we believe an overall process design review could facilitate a better integrated and more efficient backup and restore process. TVA Management agreed with our findings and is taking action to address the recommendations.

We audited $3.8million of costs billed to TVA by a contractor for providing reclearing and maintenance for transmission line right-of-way areas. In summary, we found the contractor could not provide support for an estimated $33,521 in labor costs. The contractor agreed with our finding and explained that on several occasions employees had been paid in cash. TVA management plans to recover the unsupported costs.

As part of our annual audit plan, we audited $11.3million in costs billed to TVA by a contractor, to design and install hydrated lime injection systems at various TVA fossil plants. Our audit objective was to determine if the costs the contractor billed to TVA were in compliance with the provisions of the contract. In summary, we determined the contractor billed TVA an estimated $310,818 for costs that were unsupported or not in accordance with the contract provisions. TVA management stated that discussions with the contractor are currently underway to reach a final resolution of all the audit issues and to address each of the recommendations.

Our review of TVA's compliance with FISMA of 2002 determined that among improvements made during fiscal year 2007, TVA completed revisions to align the security program with NIST FIPS 199 standards and implemented measures to ensure personnel complete security training. While TVA continues to make progress in implementing information technology controls required by FISMA, we noted additional controls are needed to improve (1)oversight and evaluation of contractor systems, (2)the Privacy Program, and (3)consideration of e-authentication risks at TVA.