Federal Reports

What We Looked AtThis report presents the results of our quality control review (QCR) of the management letter that KPMG issued on its audit, under contract with us, of the Federal Aviation Administration’s (FAA) consolidated financial statements for fiscal years 2022 and 2021. This management letter discusses internal control matters that KPMG was not required to include in its audit report. What We FoundOur QCR disclosed no instances in which KPMG did not comply, in all material respects, with U.S. generally accepted Government auditing standards. RecommendationsKPMG made 17 recommendations to FAA in its management letter. FAA concurred with all 17 recommendations.

The unclassified version of the SAR covers the period from 1 April 2021 – 30 September 2022, and reflects what the NSA OIG could release publicly about its work for that SAR Report Cover reporting period. The OIG made 327 recommendations that we believe will be impactful in improving the economy, efficiency, and effectiveness of this critical Agency's operations. The Director of the NSA and Congress previously received the classified version of the SAR in accordance with the IG Act.

This report summarizes the results of our fiscal year (FY 2022) Federal Information Security Modernization Act (FISMA) evaluation and assesses the maturity of controls used to address risks in each of the nine information security areas, called domains. We assessed the effectiveness of information security programs on the required maturity model spectrum, which is a rating scale for information security. We rated the Denali Commission’s overall program of information security as “effective.” A majority of the FY 2022 FISMA metrics were rated Defined (Level 2). Three of four recommendations for corrective action from the FY 2021 evaluation have been implemented.