Federal Reports

For our audit of the U.S. Department of Commerce’s (the Department’s) Enterprise Continuous Diagnostics and Mitigation (ECDM) program, our objective was to assess the effectiveness of the program. To address this objective, we assessed data quality, data security, and aspects of program management in a recent ECDM tool procurement decision. We found that I. ECDM data quality does not fully support Department oversight and reporting needs; II. The National Institute of Standards and Technology does not consistently control and thoroughly test the ECDM program’s information system changes; III. The ECDM program’s information system is relatively secure but has some internal security weaknesses; IV. Deficiencies in ECDM program management place future enterprise cybersecurity tool deployments at risk; and V. The Department does not fully incorporate bureau-incurred costs in its ECDM project cost tracking.

We found issues with inaccurate and incomplete bankruptcy data, outdated policies and procedures, and inconsistent internal control documentation.

We performed this audit to determine whether Federal Student Aid's (FSA) oversight of its contractor’s acceptability review process ensured that annual proprietary institutions audits meet applicable audit reporting requirements. We found that FSA’s oversight of its contractor’s acceptability review process could be improved to ensure that annual proprietary institution audits meet applicable audit reporting requirements. We identified the following weaknesses in FSA’s oversight processes:

• FSA did not ensure its contractor’s compliance audit acceptability review process included audit reporting requirements necessary for program oversight.
• FSA’s sampling methodology used to select some proprietary institution audits for quality control reviews (QCR) had not been reassessed since it was established around 2005.
• FSA’s oversight activities relating to some proprietary institution audits did not always identify instances where audit reporting requirements necessary for program oversight were not met.
• FSA did not perform an additional level of review of audit reporting requirements for proprietary institution audits that were identified by its contractor as requiring review and resolution by FSA.

In addition, the Other Matters section of this report includes information on a substantial backlog of financial statement audits identified by the contractor for detailed review and resolution by FSA.

This report presents the results of our audit of Priority Mail Express: Michigan 1 District.