An official website of the United States government
Here's how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Brought to you by the Council of the Inspectors General on Integrity and Efficiency
Federal Reports
Report Date
Agency Reviewed / Investigated
Report Title
Type
Location
Internal Revenue Service
The Vulnerability Disclosure Policy Has Been Implemented; However, Actions Are Needed to Improve the Program
From our limited testing, we did not identify a systemic issue in which U.S. Customs and Border Protection (CBP) lost revenue due to expired statute of limitations. We reviewed 152 penalty cases, totaling $858.1 million, and determined that 144 (95 percent) were either closed, settled, in litigation, or submitted to the Treasury Offset Program. The statute of limitations no longer applied to these cases. The remaining eight penalty cases, totaling $1.5 million (0.2 percent) had expired and were subsequently closed. However, this does not equate to $1.5 million in lost revenue because CBP is allowed to close cases, for example, when the cost of continuing to pursue the case would exceed the potential amount to be recovered.
What We Looked At The Federal Information Security Modernization Act of 2014 (FISMA) requires agencies to implement information security programs. FISMA also requires agencies to have annual independent evaluations performed to determine the effectiveness of their programs and report the results of these reviews to the Office of Management and Budget. To meet this requirement, the Surface Transportation Board (STB) requested that we perform its fiscal year 2024 FISMA review. We contracted with Williams Adley & Company-DC LLP, an independent public accounting firm, to conduct this audit subject to our oversight. The audit objective was to determine the effectiveness of STB’s information security program and practices in five function areas—Identify, Protect, Detect, Respond, and Recover. We performed a quality control review (QCR) of Williams Adley’s report and related documentation. What We Found Our QCR disclosed no instances in which Williams Adley did not comply, in all material respects, with generally accepted Government auditing standards. Our Recommendations STB concurs with Williams Adley’s audit’s findings and nine recommendations.