Federal Reports

This report summarizes the results of our fiscal year 2023 Federal Information Security Modernization Act (FISMA) of 2014 evaluation and assessment of the U.S. Small Business Administration’s (SBA) information security systems policies, procedures, and practices.Our objectives were to determine whether SBA complied with FISMA and assess the maturity of controls used to address risks in each of the nine security domains.There are five open recommendations from two previous evaluations. In this report, we made 11 recommendations for improvements in 6 domains: risk management, supply chain risk management, identity and access management, data protection and privacy, security training, and contingency planning. We did not repeat recommendations from previous years being implemented in the areas of risk management, supply chain risk management, and contingency planning. The agency agreed with all 11 recommendations.

Peer Review: External Peer Review Report for the SEC OIG Inspection and Evaluation Function

An Amtrak employee based in Seattle, Washington, was terminated from employment on March 7, 2024, following our investigation. Our investigation found that the employee violated company policies by using his company email to conduct business for an outlaw motorcycle gang and by maintaining sexually explicit images on his company devices. The former employee also acknowledged that he was denied entry into Canada due to his association with the outlaw motorcycle gang, thus interfering with his ability to perform his duties.

An Amtrak car inspector based in New York, New York, violated company policies by engaging in outside employment as a bus operator; providing security services at night clubs, lounges, and bars; and working as a bouncer while on a medical leave of absence. The employee was on a medical leave of absence from the company since November 8, 2015, and had not returned to work. On March 6, 2024, after his corporate trial and in accordance with his union agreement, the employee forfeited his seniority and is considered out of service.

The objective of the audit is to express an opinion on whether the Commission’s financial statements are presented fairly, in all material respects, in accordance with U.S. generally accepted accounting principles.

This report was revised on October 17, 2024, to correct a sentence on page 12, which provided information that contained a minor, factual error. The error was not significant to the findings and audit conclusion.