Federal Reports

For our final report on our audit of First Responder Network Authority’s (FirstNet Authority’s) process for identifying, developing, and selecting reinvestment opportunities to construct, maintain, operate, and improve the Nationwide Public Safety Broadband Network, our audit objective was to determine whether FirstNet Authority's process for reinvesting fee payments is effective and consistent with established practices, procedures, and regulations. We found that FirstNet Authority: I. did not conduct a needs analysis; II. did not conduct an analysis of alternatives or sufficiently justify the need in the business case analysis; and III. relied on information from AT&T that appeared to influence the process of identifying and selecting reinvestment opportunities.

The Department of Energy spends about 90 percent of its annual budget on site facility management contracts, which includes the management and operation of its scientific laboratories using a performance-based contracting approach which focuses on the evaluation of actual performance goals and progress toward those goals as measured through a set of objectives. Each objective’s success is measured based on demonstrated performance. Given challenges identified in prior reporting on contract and project oversight, we initiated this audit to determine if the performance management process at the Idaho National Laboratory provides assurance that award fees correlated with contractor performance.We found that the Idaho Operations Office’s performance management process was unclear in how it awarded fees that correlated with contractor performance at the Idaho National Laboratory. Specifically, documentation of the Federal oversight activities was not always recorded in the official oversight repository or maintained outside the system. Additionally, the Idaho Operations Office lacked a document that included the elements of a quality assurance surveillance plan that would facilitate the assessment of contractor performance and ensure the appropriateness of award fees. We attributed these issues to several factors, including a lack of a standardized approach as to how oversight was conducted, the level of documentation to substantiate oversight activities that took place throughout the course of the year to support the final grades and associated award fee, and a high turnover of Federal oversight personnel conducting and documenting oversight to support the final evaluation and fee determination.The performance management process at the Idaho National Laboratory did not provide assurance that the award fees correlated with the contractor performance. Without adequate documentation and the absence of elements of a quality assurance surveillance plan, the Idaho Operations Office was unable to adequately support the contractor’s performance and associated award fee of approximately $15 million. Supporting effective performance management requires a culture of commitment to strong oversight. In support of that culture, future Office of Inspector General audits of performance awards will analyze supporting documentation and evaluations to determine if the award fees are reasonable, while questioning any costs that are determined to be unreasonable or not fully supported.To address the issues identified in this report, we have made four recommendations that, if fully implemented, should help improve the performance management process.

The Federal Energy Regulatory Commission (FERC) regulates the wholesale and interstate transmission of the Nation’s electricity and natural gas and the pipeline transportation of oil. Further, FERC establishes standards to protect the reliability and cybersecurity of the bulk-power system. Given its mission and responsibilities, FERC’s information technology environment must be reliable and protected against attacks from malicious sources. The Federal Information Security Modernization Act of 2014 establishes requirements for Federal agencies to develop, implement, and manage agency-wide information security programs to ensure that information technology resources are adequately protected. In response to the Federal Information Security Modernization Act of 2014 mandate, the Office of Inspector General contracted with KPMG LLP to assist in the assessment of FERC’s unclassified cybersecurity program. The objective of the evaluation was to determine whether FERC’s unclassified cybersecurity program adequately protected its data and information systems. This report presents the results of that evaluation for fiscal year 2022. FERC’s unclassified cybersecurity program was effective overall. In addition, based on the results of the test work, we determined that FERC had achieved a calculated maturity level of “managed and measurable” for its overall unclassified cybersecurity program. Based on fiscal year 2022 test work performed by KPMG LLP, nothing came to our attention to indicate that attributes required by the Office of Management and Budget and the National Institute of Standards and Technology were not incorporated into FERC’s unclassified cybersecurity program for each of the major topic areas tested. Because nothing came to our attention that would indicate significant control weaknesses in the areas tested by KPMG LLP, we are not making any recommendations or suggested actions related to this evaluation.

OIG evaluated Animal and Plant Health Inspection Service’s oversight of response activities related to cattle diseaseincidents for the tuberculosis, brucellosis, and bovine spongiform encephalopathy programs.