Federal Reports

Our objective was to evaluate the Postal Service’s efforts to respond to mail theft. For this audit, we reviewed processes and procedures for addressing mail theft, management of arrow keys, and mail theft complaints, investigations, and carrier robberies from October 1, 2020, through September 30, 2022, for five Postal Inspection Service divisions: Chicago, Houston, Los Angeles, New York, and Washington, DC.

Objective: To determine whether the Social Security Administration appropriately applied the Windfall Elimination Provision and Government Pension Offset. We also gathered information about the Agency’s efforts to obtain non-covered pension data for beneficiaries.

This report contains information about recommendations from the OIG's audits, evaluations, reviews, and other reports that the OIG had not closed as of the specified date because it had not determined that the Department of Justice (DOJ) or a non-DOJ federal agency had fully implemented them. The list omits information that DOJ determined to be limited official use or classified, and therefore unsuitable for public release.The status of each recommendation was accurate as of the specified date and is subject to change. Specifically, a recommendation identified as not closed as of the specified date may subsequently have been closed.

The VA Office of Inspector General (OIG) conducts information security inspections to assess whether VA facilities are meeting federal security requirements. They are typically conducted at selected facilities that have not been assessed in the sample for the annual audit required by the Federal Information Security Modernization Act of 2014 (FISMA) or at facilities that previously performed poorly. The OIG selected the VA Dublin Healthcare System in Georgia because it had not been previously visited as part of the annual FISMA audit.The OIG’s information security inspections focus on three security control areas that apply to local facilities and have been selected based on their levels of risk: configuration management, security management, and access controls. During this inspection, the OIG found deficiencies in all three areas.Deficiencies in configuration management included critical-risk vulnerabilities that VA’s Office of Information and Technology did not identify. These security vulnerabilities were not being remediated within VA’s established time frames, which could risk unauthorized access to, or the alteration or destruction of, critical systems.The team identified three security management control weaknesses at the healthcare system: several special-purpose systems did not have authorization to operate, two of these systems did not have appropriate security categorizations, and the healthcare system identified but did not remediate unapproved software.The healthcare system also had deficiencies in physical access security, emergency power, and monitoring of physical and environmental controls.The OIG made four recommendations to the assistant secretary for information and technology and chief information officer to improve controls at the facility because they are related to enterprise-wide information security issues similar to those identified on previous FISMA audits and information security inspections. The OIG also made three recommendations to the Carl Vinson VA Medical Center director.