Federal Reports

The Federal Emergency Management Agency (FEMA) did not consistently apply the information technology (IT) access controls needed to restrict unnecessary access to its systems and information. Specifically, FEMA did not promptly remove or adjust system and information access when personnel separated or changed positions.

We conducted this evaluation to assess the maturity of HUD’s Robotic process automation (RPA) activities and determine whether HUD had implemented related controls to address technology and program management risks. RPA is a software technology used to emulate human actions on a computer. RPA software programs, referred to as “bots,” can complete repetitive tasks quickly and consistently, freeing up employees to work on other, higher value activities. RPA has the potential to increase business process efficiency, improve the effectiveness and consistency of mission services, and lower costs. However, because RPA interacts with HUD information technology (IT) systems and can be used within important agency business processes, it can introduce new technology and operational risks for HUD programs.We found that HUD lacked adequate controls and capacity to operate its RPA program efficiently and effectively. After more than 3 years since its inception, HUD’s program had achieved minimal progress and results. HUD lacked adequate internal controls and staffing capacity to effectively oversee and manage the program. HUD had not established a clear vision for the RPA program or set measurable metrics to define program success. HUD also did not maintain adequate oversight of bot development and operations to ensure that limited RPA program funds were used efficiently. Finally, HUD lacked important IT controls related to the security and auditability of its RPA system. As a result of these weaknesses, HUD missed opportunities to capitalize on the potential benefits of RPA and expended IT resources inefficiently on projects that provided minimal value.This evaluation report contains four recommendations for HUD to implement new internal controls and further develop its internal capacity to manage and oversee the RPA program. Appendix A of the report includes opportunities for improvement that will not be tracked as formal recommendations but are noted as general suggestions to improve HUD’s RPA program effectiveness.

A clerk based in Beech Grove, Indiana, resigned from employment on February 16, 2023, prior to his administrative hearing. Our investigation found that the employee violated company policies by misusing his company-owned computer and email address for his personally owned business by downloading unauthorized software onto the company’s workstation. He also used his company email during regular work hours to solicit Amtrak employees and others to join his business ventures.

The Time and Attendance Collection System (TACS) is the primary application for collection of Postal Service employee time and attendance data. As of September 2021, the Postal Service had 653,167 employees, including more than 17,000 supervisors, who were compensated based on time entered in TACS. Supervisors are generally categorized as special exempt employees according to the Fair Labor Standards Act. Special exempt employees do not receive overtime but are eligible for extra straight time pay for extra hours worked.