The Office of the Inspector General audited the controls for key Sarbanes-Oxley (SOX) spreadsheets to determine if the controls are sufficiently defined, appropriately designed, and operating effectively. The audit’s scope was information technology general controls for the SOX critical spreadsheets within TVA. We identified several issues that could provide a stronger control environment for critical spreadsheets. Specifically, we found (1) shared passwords used to modify critical spreadsheets are not appropriately managed, (2) one spreadsheet was accessible using a shared account with no known business need, (3) TVA’s SOX Control Environment group’s inventory controls over critical spreadsheets are ineffective, (4) critical spreadsheets are not documented consistently in SOX control narratives maintained by TVA’s SOX Control Environment group, (5) naming convention controls are not being enforced which limits TVA’s ability to quickly assess if critical spreadsheets are properly stored for access control and backup purposes, and (6) TVA’s SOX Control Environment group’s spreadsheet policy could be strengthened by adding controls for user training, baselining, templates, and testing. TVA management agreed with our findings and recommendations.
| Report Date | Agency Reviewed / Investigated | Report Title | Type | Location | |
|---|---|---|---|---|---|
| Tennessee Valley Authority | Key Sarbanes-Oxley Financial Spreadsheets | Audit | Agency-Wide | View Report | |
| Internal Revenue Service | Trends in Compliance Activities Through Fiscal Year 2017 | Audit | Agency-Wide | View Report | |
| Department of Housing and Urban Development | HUD Privacy Program Evaluation Report | Inspection / Evaluation | Agency-Wide | View Report | |
| Millennium Challenge Corporation | Financial Audit of MCC Resources Managed by Yayasan Pendidikan dan Kesejahteraan Islam Hadji Kalla Under the Agreement with MCA-Indonesia, December 18, 2015, to March 31, 2017 | Other |
|
View Report | |
| Appalachian Regional Commission | Spartanburg Community College | Audit |
|
View Report | |
| Appalachian Regional Commission | Audit of Grant Award Wallace State Community College | Audit |
|
View Report | |
| Department of Energy | Management of Calibration Activities at the Kansas City National Security Campus | Inspection / Evaluation |
|
View Report | |
| Nuclear Regulatory Commission | Audit of NRC's Process for Reimbursing Agreement State Personnel Training Expenses | Audit | Agency-Wide | View Report | |
| Environmental Protection Agency | Management Alert: EPA Oversight of Employee Debt Waiver Process Needs Immediate Attention | Audit | Agency-Wide | View Report | |
| Department of Justice | Audit of the Office of Justice Programs, Office for Victims of Crime, Victim Assistance Formula Grants Awarded to the Massachusetts Victim and Witness Assistance Board, Boston, Massachusetts | Audit |
|
View Report | |