Federal Reports

The enclosed report presents the results of the audit of the Commission’s financial statements for the fiscal year ended September 30, 2018

Following the January 13, 2018, false missile alert in Hawaii, Congress requested we examine the Federal Emergency Management Agency’s (FEMA) role in the incident. We concluded that FEMA has limited responsibility for the sending and canceling of state and local alerts. Following the Hawaii false missile alert, three U.S. Senators proposed legislation to define the federal government’s role during false missile alerts, as well as to direct FEMA to recommend best practices in the alerting process. We also identified two areas of concern regarding FEMA’s overall oversight of IPAWS. Although FEMA maintains IPAWS as a messaging platform, state and local alerting authorities must obtain commercially-available emergency alert software to generate a message which passes through IPAWS for authentication and delivery. However, we found that FEMA does not require that this software perform functions critical to the alerting process, such as the ability to preview or cancel an alert. Instead, FEMA only recommends that software vendors include these capabilities as “best practices.”

Our objective was to assess whether Decision Analysis Reports (DAR) I and II cybersecurity investments’ stated performance metrics aligned with the Corporate Information Security Office (CISO) strategic and cost objectives.

What We Looked AtWe contracted with the independent public accounting firm KPMG LLP to audit the Department of Transportation's (DOT) closing package financial statements for fiscal year 2018, and to provide a report on internal control over the financial reporting process for closing package financial statements and compliance with the U.S. Treasury's Financial Manual Chapter 4700. The contract required that the audit be performed in accordance with U.S. generally accepted Government auditing standards and Office of Management and Budget audit guidance.What We FoundOur quality control review disclosed no instances in which KPMG did not comply, in all material respects, with U.S. generally accepted Government auditing standards.RecommendationsKPMG did not include any recommendations in its report.