Federal Reports

We did not substantiate allegations that a now-former DOI senior official may have violated Federal ethics laws and the Federal ethics pledge.

The objective was to determine how effectively FEMA supported and coordinated Federal efforts to distribute personal protective equipment (PPE) and ventilators in response to the COVID-19 outbreak. We determined that FEMA did not have reliable data to inform allocation decisions and ensure accurate adjudication of resource requests, it did not have a process to allocate the limited supply of PPE, and FEMA’s strategic documents did not clearly outline roles and responsibilities to lead the Federal response. We made three recommendations that FEMA improve the reliability of WebEOC, formally document the policies and procedures for allocating critical lifesaving supplies and equipment, and that FEMA work with the Secretary of Health and Human Services to clarify the agencies’ pandemic response roles and responsibilities under Stafford Act declarations. FEMA concurred with all three recommendations which remain open and resolved.

Our objective was to analyze the risk of illegal, improper, and erroneous purchases and payments made through the Department’s purchase card program.We assessed the risk of illegal, improper, and erroneous purchases made through the Department’s purchase card program as moderate-high and determined that an audit or review of the program by OIG may be warranted.

To see our report, click on the link below

We performed an audit of the Tennessee Valley Authority’s (TVA) management of privileged accounts. Our objective was to determine if TVA's management of privileged accounts is following TVA policy and best practices. A privileged user has an account that is authorized for the performance of security-related functions that ordinary users cannot perform. Privileged account management can be defined as managing and logging account and data access by privileged users.In summary, we found several controls of TVA’s privileged account management to be generally effective, including (1) an accurate inventory of privileged network device accounts, (2) appropriate segregation of duties, (3) appropriate account lifecycle management for most privileged users, and (4) monitoring of privileged accounts. However, we also found (1) improper usage of primary user accounts with privileged access, (2) one account with inappropriate privileged access, and (3) several gaps in TVA’s Standard Programs and Processes when compared to best practices.