|
Office of the Inspector General Home
|
|
Semiannual Report to Congress Other format: PDF (83 KB) (Download Accessible PDF Plug-in) Board of Governors of the Federal Reserve System Semiannual Report to Congress
OFFICE OF INSPECTOR GENERAL
Dear Chairman Greenspan: We are pleased to present our Semiannual Report to Congress which summarizes the activities of our office for the reporting period April 1 through September 30, 2004. The Inspector General Act requires that you transmit this report to the appropriate committees of Congress within thirty days of receipt, together with a separate management report and any comments you wish to make. Sincerely, /signed/ Barry R. Snyder Enclosure Board of Governors of the Federal Reserve System Semiannual Report to Congress
OFFICE OF INSPECTOR GENERAL TABLE OF CONTENTS Introduction Return to table of contents Consistent with the Inspector General Act of 1978 (IG Act), as amended, the mission of the Office of Inspector General (OIG) of the Board of Governors of the Federal Reserve System (Board) is to
Congress has also mandated additional responsibilities that have a significant impact on our resources and workloads. For example, the Federal Deposit Insurance Act (as amended) requires the Board's OIG to review failed financial institutions supervised by the Board that result in a material loss to the bank insurance funds and produce, within six months of the loss, a report that includes possible suggestions for improvement in the Board's banking supervision practices. In the information technology arena, the Federal Information Security Management Act of 2002 (FISMA) provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. Consistent with FISMA requirements, we perform an annual independent evaluation of the Board's information security program and practices to include evaluating the effectiveness of security controls and techniques for selected information systems. Board of Governors of the Federal Reserve System
The OIG has identified three strategic goals and developed corresponding objectives to guide our work over the next five years. For each strategic goal, we have also identified specific strategies to help achieve the underlying objectives. The exhibit below depicts the relationship of the various elements of our strategic plan, within the context of our mission and values.
Audit of the Board's Outsourcing Efforts During this reporting period, we completed our audit of the Board's outsourcing operations. We conducted this audit to assess the Board's management of contracts for outsourced services and to evaluate the process for identifying and evaluating other outsourcing and competitive sourcing opportunities. Our audit identified a number of areas for improvement regarding the Board's outsourced activities that will require the efforts of the Board's Procurement Section, the divisions requesting services, and the Legal Division (Legal). Our audit report contains three recommendations designed to enhance the management of outsourcing contracts and the Board's overall outsourcing approach. Specifically, we recommended that the Management Division (MGT) enhance controls to ensure that statements of work and contracts for outsourced services specify the expected vendor performance, results, level of service, standards for performance measurements, and incentives or penalties, as appropriate, based on the actual level of vendor performance. We also recommended that Legal review all contracts involving outsourced services to help mitigate legal risks. Finally, we recommended that the Board develop a more proactive, strategic approach to outsourcing that is linked to workforce planning activities. We provided a copy of our report to the Staff Director for Management and the General Counsel for review and comment. Their responses indicate concurrence, in part or in principle, with the recommendations and discuss actions, such as revising the Board's Acquisition Policy, that have been or will be taken to implement the recommendations. Evaluation of the Effectiveness of Administrative Controls over
an Outsourced Contract Our outsourcing report contains recommendations to improve statements of work for outsourced contracts and to require a timely legal review of all contracts involving outsourced services. Implementation of these recommendations should address several of the issues we found during our evaluation of this particular acquisition. To address other contract administration issues that surfaced during our evaluation which went beyond the scope of the earlier outsourcing report's recommendations, we provided management two additional recommendations. Specifically, we recommended that the Staff Director for Management strengthen the contract administration process by ensuring that contract modifications and purchase orders authorizing additional work are approved and processed before the work is performed, and by ensuring that all contracts clearly establish the responsibilities and authorities of the contracting officer and contracting officer's technical representative (COTR) in accordance with the Board's Acquisition Policy. We also recommended that the Staff Director modify the Acquisition Policy to require that exceptions to the use of competitive acquisition methods be approved by the MGT director and to incorporate guidance regarding how to use the GSA Multiple Award Schedule to competitively select vendors for service contracts. We provided a copy of our report to the MGT director for review and comment. In her response, the director stated she intended to work with Legal to clear up ambiguities in contracts and related documents. The director also plans to review current standard contract language to identify any ambiguities that might cause a vendor to fail to understand the risk incurred by performing work without a contract authorization as well as any ambiguities in the description of the functions and limitations of a COTR. In response to our second recommendation, the director indicated that the Board's Acquisition Policy was modified as recommended.
During this period, we completed an evaluation of the Board's Fine Arts
Program (Program). We performed this evaluation to review the suitability
of the Program's current organizational placement within MGT, and assess
inventory management practices. The Board's collection includes over 400
works of art, consisting of Board-owned items and pieces on loan from
museums, privately owned galleries, and individuals. The Program operates
with a budget of about $420,000 for the two-year period 2004-05, and is
staffed by a program director and an administrative assistant. The program
director is responsible for collection management, which includes applying
"museum standards" for recordkeeping. Because Board funds are
not used to purchase works of art, the program director expands the collection
by actively soliciting monetary and artwork donations. Our review of the Program's inventory management revealed that the program director maintains two separate inventory databases that include different information. Neither of these databases reflected a complete or accurate inventory of the Board's fine arts collection. We worked with the program director to reconcile the two inventory databases, and, once this was completed, we conducted a physical inspection of a judgmentally selected sample that included high-value works of art housed in each of the Board's three buildings. We found each of the items in our sample in the appropriate location. The difficulty associated with determining the exact count of the Program's current inventory prompted us to conduct additional testing to determine the accuracy of the Board's accounting records. In January 1995, the Board voluntarily adopted a Financial Accounting Standards Board (FASB) provision that allows for recording purchased artwork at cost and donated works of art at fair market value as of the date they are received. Although the amounts involved were not material to the Board's financial statements, we found that the FASB provision was not consistently applied, and that many works of art had not been valued. During the 2003 financial statement audit, the Board determined that it was not required to comply with the FASB provision, and made accounting adjustments to exclude the fine arts collection from the financial statement. The absence of an accurate inventory management system also prompted us to expand the scope of our review to include a broader based examination of the Program's internal controls. We found that the Program's key functions, such as obtaining monetary contributions, as well as receiving and recording purchased or donated works of art, are all handled and controlled by the program director. To strengthen the Program's internal controls and to improve overall
program operations, we recommended that the director of MGT
The director and the Board's Committee on Board Affairs agreed with our recommendations except for the independent appraisal which was deemed to not be cost effective given the change in accounting procedures. Audit of the Board's Information Security Program We performed this audit pursuant to requirements in the Federal Information Security Management Act (FISMA), which requires each agency Inspector General (IG) to conduct an annual independent evaluation of the agency's information security program and practices. Our specific audit objectives, based on the legislation's requirements, were to evaluate the effectiveness of security controls and techniques for selected information systems and to evaluate compliance by the Board with FISMA and related information security policies, procedures, standards, and guidelines. To test security controls and techniques, we reviewed controls over the Board's database application (DB2) and three applications that interface with that software. We also reviewed security settings for selected hardware such as servers, workstations, and routers. Our review of DB2 and our security control tests of the applications did not identify any significant security control deficiencies, although we found several areas where controls need to be strengthened. Our review of security settings also identified additional improvement opportunities related to documentation and the processes for establishing, monitoring, and remediating security settings. Given the sensitivity of the issues involved with these reviews, we provided the specific results to management under separate restricted cover. We also followed up on the status of the recommendations made in our prior control reviews and found that sufficient actions had been taken to close all recommendations. To evaluate the Board's compliance with FISMA and related policies and procedures, we followed up on the open recommendations in our 2003 information security audit report and reviewed the Board's processes related to security control reviews, certifications and accreditation, remedial action monitoring, incident response, security awareness and training, and patch management. Our follow-up work showed that over the past year the Board has continued to make progress in developing and implementing a structured information security program as outlined by FISMA, and the actions taken are sufficient to allow us to close all of our previous recommendations. We did find, however, that opportunities exist to further enhance the Board's information security program and strengthen compliance with the legislative requirements and related guidance. Our report contains five recommendations designed to improve the Board's procedures related to the plan of action and milestones, security training, security reviews, system inventory, and incident response. In her response to our draft report, the director of the Division of Information Technology, who serves as the Board's Chief Information Officer for FISMA purposes, concurred with our recommendations regarding enhancements to the Board's plan of action and milestones, security training, and security review procedures. The director agreed with portions of our other two recommendations. The director's response describes actions that have been or will be taken regarding all five recommendations and we will evaluate these actions as part of our continued work related to information security. In addition to the five recommendations discussed above, our report also
discusses several significant challenges for Board management as they
begin implementing the new security-related guidance produced by the National
Institute of Standards and Technology and the Office of Management and
Budget. Based on our review of the guidance issued to date and the draft
guidance expected to be finalized over the next year, we believe that
the Board will need to fundamentally redesign many of its information
security processes to remain consistent with applicable standards. These
changes will affect the Board's current processes for risk assessments,
control identification and review, as well as certification and accreditation.
Because complying with these new requirements will, in our opinion, be
essential to maintaining compliance with the security legislation, Board
management will need to make the necessary time and resource commitment
to ensure that this transition is completed effectively and timely. Review of the Oversight Function of the Division of Reserve Bank
Operations and Payment Systems OIG Application Replacement Follow-Up on the Audit of the Federal Reserve's Background Investigation
Process Follow-Up on the Audit of Retirement Plan Administration Investigative Activity
At the end of this reporting period, we had eight active cases. Our summary statistics on investigations are provided in the table that follows: Summary Statistics on Investigations for the Period April 1 through September 30, 2004
Hotline Operations In addition to the hotline complaints, the investigative services program received a total of forty allegations; thirty-four were referred to the OIG from Board program staff and six from other sources. As a result of those allegations, the OIG opened three investigations. In addition, we are continuing our review of fictitious instrument fraud complaints. Fictitious instrument fraud schemes are those in which promoters promise very high profits based on fictitious instruments that they claim are issued, endorsed, or authorized by the Federal Reserve System or a well-known financial institution. Our summary statistics of the hotline results are provided in the table that follows: Summary Statistics on Hotline for the Period April 1 through September 30, 2004
IG Community Participation As Vice Chair of the Executive Council on Integrity and Efficiency (ECIE), the Board's IG provides leadership, vision, direction, and initiatives for the ECIE on behalf of the Council Chair (Deputy Director for Management, Office of Management and Budget). Collectively, the members of the ECIE have continued to work with the members of the President's Council on Integrity and Efficiency (PCIE) to help improve Government programs and operations. The Board's IG also serves on the Comptroller General's Advisory Council on Government Auditing Standards (Yellow Book), a twenty-member group that works with the General Accountability Office (GAO) to keep the auditing standards current through the issuance of revisions and guidance. Congressional interest in strengthening IG functionality and independence continued during this semiannual reporting period. As a follow-on to a 2003 hearing which commemorated the twenty-fifth anniversary of the IG Act, the Subcommittee on Government Efficiency and Financial Management, House Committee on Government Reform, invited the Vice Chairs of the PCIE and the ECIE, as well as the Chair of the PCIE's Legislative Committee, to share their views and perspectives on legislation that had been introduced to enhance the IG Act. The July 2004 hearing provided an excellent opportunity to discuss IG roles and responsibilities, as well as present opinions that had the support of a majority of the federal IGs that comprise the two Councils. Going forward, the Subcommittee expressed interest in a continued dialogue on opportunities to further enhance IG functionality and independence. In addition, as ECIE Vice Chair, the Board's IG once again collaborated with the PCIE Vice Chair in producing A Progress Report to the President, Fiscal Year 2003. This annual publication provides a variety of information about the IG community and captures the progress that the PCIE and the ECIE have made toward achieving strategic goals and objectives. Developing this report is a substantial undertaking that involves gathering and consolidating statistical data on thousands of audits, evaluations, and investigations conducted across the federal OIG community, and the 2003 report was particularly important since it commemorated the twenty-fifth anniversary of the IG Act. Under the Vice Chairs' leadership, the report development team further capitalized on automation to substantially simplify and streamline the data collection and consolidation process. The resulting report effectively highlights the collective work and accomplishments of the IGs as a community and focuses attention on the role that the IG community plays in fostering improvement in the numerous challenges facing the federal government today and in the near future. Review of Legislation and Regulations Return to Cross-References to the Inspector General Act As part of fulfilling our mission under the IG Act, we review existing and proposed legislative and regulatory items both as part of our routine activities and on an ad hoc basis. We routinely keep track of proposed and pending legislation and regulations by researching relevant documents and databases, reviewing lists prepared by the Board's law library, sharing information with others in the IG community, and coordinating with Board programs that also review new and proposed legislation. We then independently analyze the effect that the new or proposed legislation or regulations may have on the efficiency and effectiveness of the programs and operations of the Board, including the OIG. During this reporting period, we reviewed numerous bills on a variety of topics. For example, we reviewed H.R. 3457, a bill designed to enhance the operations of the government's IGs. This proposed legislation is similar in many respects to the suggested recommendations arising out of the PCIE/ECIE Legislation Committee project, which we are participating in, to improve the IG Act of 1978. We have been working with staff of the cognizant House committee and subcommittee to reconcile the PCIE/ECIE recommended provisions with the language of H.R. 3457. Among other bills we reviewed were the Law Enforcement Officers Safety Act of 2004, the Data-Mining Reporting Act of 2003, the Department of Homeland Security Financial Accountability Act, and the Missing Child Cold Case Review Act of 2004. Our review of legislation and regulations also includes commenting on revisions or additions to the Board's management policy statements and internal administrative procedures. For example, we analyzed proposed updates to the Board's "Policy Statement on Firearms and Dangerous Weapons" and provided comments on it that have been adopted. We also reviewed a draft revision of the Board's "Information Security Policy" to ensure its sufficiency.
Audit of the Board's Automated Travel System In late 2003, we initiated an audit of the Board's new automated travel management system. We began the audit based on user concerns that the new system did not meet expectations and was difficult to use. Our objectives were to evaluate the continued viability of the automated system as part of the Board's travel administration process, identify opportunities to improve the efficiency and effectiveness of future system implementations, and follow up on our 1997 Report on the Business Process Review of Travel Administration. To accomplish our objectives, we reviewed supporting documentation; interviewed travel project team members, MGT staff, and representatives from ten divisions; and spoke with representatives of other government agencies that use the same automated travel system software. We have issued a draft report to Board management officials for review and comment and plan to issue our final report during the next reporting period.
We recently began an audit of the Board's processes for managing its fixed
assets. Based on a preliminary analysis of the balances in the fixed asset
accounts, we decided to focus our audit work on the accounts for office
automation
On June 25, 2004, the Utah Commissioner of Financial Institutions closed The Bank of Ephraim-a $57 million state member bank headquartered in central Utah. The FDIC estimates that The Bank of Ephraim failure will result in an approximately $14 million loss to the Bank Insurance Fund. The amount of this loss is below the Federal Deposit Insurance Act threshold that requires the OIG to assess a failed institution's supervision. Nevertheless, we have decided to perform this review because The Bank of Ephraim failure involved fraud, and the loss constitutes a high percentage of the institution's total assets. The objectives of our review are to analyze the Bank's supervision, ascertain why the institution's problems led to failure, and determine if steps can be taken to prevent any such losses in the future. We plan to issue a report on The Bank of Ephraim failure during the next period. Review of the Board's Worker's Compensation Program The Board's employees are covered by the Federal Employees' Compensation Act, which pays workers' compensation benefits to federal civilian government employees for disability due to personal injury or occupational disease sustained while in the performance of duty. We decided to review the Board's worker's compensation program in light of a reorganization that transferred the program from MGT's Support Services function to its Human Resources function, and the potential for dramatic increases in workers' compensation cases now that the Board has hired and trained its own sizable guard force. The objectives of our review are to determine if the Board complies with the requirements established in the Department of Labor's worker's compensation guidance, and to assess the Board's efforts to prevent future worker's compensation cases and encourage timely return to work for employees who have recovered from their injuries. We plan to issue our report during the next period. OIG Governance Framework With our implementation of a new information technology (IT) infrastructure, the OIG initiated a project to develop a governance framework that encompasses the full range of our work; leverages the capabilities of the new technology, in a user-friendly manner; and strengthens and simplifies our policies and procedures. During this reporting period, we designed the governance framework and key policy overview documents, and began redesigning the more detailed policy and procedures to better integrate with the new IT infrastructure and in the context of the governance framework. We anticipate completing this work during the next reporting period. Appendix 1 - Audit Reports Issued with Questioned Costs for the Period April 1 through September 30, 2004 Return to table of contents Return to Cross-References to the Inspector General Act
Appendix 2 - Audit Reports Issued with Recommendations that Funds be Put to Better Use for the Period April 1 through September 30, 2004 Return to table of contents Return to Cross-References to the Inspector General Act
Appendix 3 - OIG Audit Reports With Outstanding Recommendations Return to table of contents  Return to Cross-References to the Inspector General Act
Appendix 4 - Cross-References to the Inspector General Act Return to table of contents Indexed below are the reporting requirements prescribed by the Inspector General Act of 1978, as amended, for the reporting period:
Footnotes 1. A recommendation is closed if (1) the corrective action has been taken; (2) the recommendation is no longer applicable, or (3) the appropriate oversight committee or administrator has determined, after reviewing the position of the OIG and division management, that no further action by the Board is warranted. A recommendation is open if (1) division management agrees with the recommendation and is in the process of taking corrective action or (2) division management disagrees with the recommendation and we have referred it to the appropriate oversight committee or administrator for a final decision Return to text
Inspector General Hotline Report: Fraud, Waste or Mismanagement You may also write the: |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||