Federal Reports

This report presents the results of our audit to determine whether the U.S. Small Business Administration (SBA) maintained effective management control activities and monitoring of the design and implementation of third-party operated SBA systems. SBA needed information technology systems from third-party service providers that could improve the system efficiency and productivity to process high transaction volumes, transmit data between other information systems, and safeguard the integrity and confidentiality of the personally identifiable information processed by the programs.We found the agency’s entity-level control environment was not designed in accordance with federal guidance at the beginning of the COVID-19 assistance programs. The agency allowed the third-party systems to be put into service without conducting the baseline assessments. With no baseline, the agency could not perform effective continuous monitoring. Also, we found that control processes did not identify, communicate, and capture privacy and identity risks on an enterprise-wide basis.We made 10 recommendations to strengthen the agency’s entity-level IT control environment. The areas addressed included cybersecurity risk and privacy controls, system development life cycle, continuous monitoring, and the supply chain risk management processes.SBA management fully agreed with seven recommendations, disagreed with two recommendations, and stated one recommendation was specific to the pandemic and will not likely be repeated. While the agency agreed to implement seven recommendations, management’s planned corrective actions did not fully address identified control issues.

The U.S. Postal Service uses the Time and Attendance Collection System (TACS) as the primary application to collect employee time and attendance data to capture the number of workhours employees spend working various Postal Service operations.This was a follow-up to our Timecard Administration audit issued December 9, 2020. In the prior audit we identified issues with disallowed timecard adjustments, management oversight, time collection devices replacement strategies, and TACS control deficiencies. We recommended management reiterate disallowed time policy; establish a formal oversight process to ensure periodic reviews of supervisors’ documentation supporting disallowed timecard adjustments; resolve system deficiencies that allow supervisors to bypass completing the time disallowance record in TACS; and procure and test new, automated time collection devices.

Independent Review of 4003(b) Loan Recipient’s Validation Memo – SpinLaunch Inc.