An official website of the United States government
Here's how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Brought to you by the Council of the Inspectors General on Integrity and Efficiency
Federal Reports
Report Date
Agency Reviewed / Investigated
Report Title
Type
Location
Department of Transportation
FTA Does Not Effectively Assess Security Controls or Remediate Cybersecurity Weaknesses To Ensure the Proper Safeguards Are in Place To Protect Its Financial Management Systems
What We Looked AtThe Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 set up appropriations to support executive agency operations during the COVID-19 pandemic. The Federal Transit Administration (FTA) has received nearly $70 billion in CARES Act and other COVID-19 relief appropriations. FTA uses several financial management systems to approve, process, and disperse this funding for the transit industry’s COVID-19 response and recovery. Given the size of this investment, we initiated this audit. Our audit objective was to assess the effectiveness of FTA’s financial management systems’ security controls designed to protect the confidentiality, integrity, and availability of the systems and their information. What We FoundFTA’s financial management systems have security control deficiencies that could affect FTA’s ability to approve, process, and disburse COVID-19 funds. FTA security officials mislabeled and incorrectly documented control types for over 180 security controls in its fiscal year 2020 system security plans for these systems. FTA also does not adequately monitor security controls provided by or inherited from DOT’s common control provider. FTA also has not remediated security control weaknesses identified since 2016. Lastly, FTA lacks sufficient contingency planning and incident response capabilities such as alternate set of personnel to restore its financial management systems if its primary personnel are unavailable. Due to these security control weaknesses, FTA’s security officials cannot be sure financial management systems have the proper safeguards and countermeasures in place to protect the systems and that they effectively manage information security risk. Our RecommendationsFTA concurred with all of our 13 recommendations to help the Agency address its security control weaknesses and improve its systems’ cybersecurity posture. Sensitive information exempt from public disclosure under the Freedom of Information Act, 5 U.S.C. § 552, has been redacted and we have marked the document as FOR OFFICIAL USE ONLY.
What We Looked AtAmerican Airlines, one of the world’s largest commercial air carriers, has not experienced a fatal accident in nearly two decades. Despite this safety record, reports of potentially unsafe maintenance practices have raised concerns about the Federal Aviation Administration’s (FAA) oversight of the carrier’s maintenance programs. At the request of then-ranking members of the House Committee on Transportation and Infrastructure and its Aviation Subcommittee, we initiated this review. Specifically, we examined whether FAA ensures that American Airlines implemented effective corrective actions to address the root causes of maintenance problems and FAA’s oversight of American Airlines’ safety management systems (SMS). What We FoundFAA lacks effective oversight controls to ensure American Airlines’ corrective actions for maintenance non-compliances addressed root causes. According to FAA guidance, FAA inspectors should collaborate with the air carrier to correctly identify and fix the root cause(s) of deviations or non-compliances. However, in 171 of 185 (92 percent) of cases we sampled, FAA inspectors accepted root cause analyses by the air carrier that did not identify the true root cause of the problem. Furthermore, FAA closed compliance actions before the air carrier implemented its corrective actions. FAA’s oversight controls are also not effective for evaluating if American Airlines’ SMS sufficiently assesses and mitigates risk. FAA requires American Airlines to use its SMS to determine the level of risk associated with maintenance non-compliances. However, we found that FAA inspectors did not routinely or consistently evaluate whether the carrier adequately and effectively assessed and rated risks. This is in part because FAA did not provide its inspectors with comprehensive training and tools for overseeing and evaluating the carrier’s SMS. Our RecommendationsFAA concurred with five and partially concurred with two of our seven recommendations to improve FAA’s oversight of American Airlines maintenance programs. We consider recommendations 1, 2, 4, and 6 resolved but open, pending completion of planned actions. However, we are asking FAA for additional information and to reconsider its actions for recommendations 3, 5, and 7.
Financial Audit of Fundacin Crislida Internacional's Management of the Program "Imagine: The Country We Want" in El Salvador, Cooperative Agreement 72051918CA00004, for the Fiscal Year Ended December 31, 2020
Tennessee Medicaid Claimed Hundreds of Millions of Federal Funds for Certified Public Expenditures That Were Not in Compliance With Federal Requirements
Why OIG Did This Audit Under a Medicaid waiver, Tennessee was allowed to claim as certified public expenditures (CPEs) the uncompensated cost of care (UCC) at public hospitals for Medicaid enrollees and uninsured patients. During State fiscal years (SFYs) 2009 through 2014, Tennessee claimed a total of $2 billion in CPEs.For SFYs 2010 through 2013, Tennessee claimed the same amount of $373.8 million each year, indicating that it may not have calculated specific estimates of the CPEs for each of those years, as required. Additionally, a recent audit found that a State had improperly paid $686 million in Medicaid supplemental pool payments. Our objective was to determine whether Tennessee complied with Federal requirements for claiming CPEs for public hospital unreimbursed costs. How OIG Did This AuditOur audit covered the $2 billion in CPEs that Tennessee claimed for SFYs 2009 through 2014 (audit period), which were the most recent SFYs for which supporting calculations of actual CPEs were available. We compared the CPEs that Tennessee claimed to its summaries of actual CPEs for each SFY and reviewed the UCC calculations and supporting documentation for five hospitals that received disproportionate share hospital (DSH) payments and five institutions for mental diseases (IMDs).
The Office of Special Counsel (OSC) completed an investigation based on a referral from the Federal Election Commission (FEC) Office of Inspector General (OIG). On January 31, 2019, the FEC OIG received an anonymous hotline complaint that alleged prohibited personnel practices (i.e., nepotism) on the part of a senior FEC employee.
The objective of this review was to identify specific gaps in transparency in award data for federal assistance spending in response to COVID-19. We looked at 51,000 awards worth $347 billion that supported the pandemic response (as of June 15, 2021). The report includes three findings, including we found more than 15,400 awards worth $33 billion with meaningless descriptions that make it difficult to know how COVID-19 relief money was used. The report includes five recommendations to help improve the transparency into COVID-19 relief spending.