Office of Inspector General
Equal Employment Opportunity Commission
Semiannual Report to Congress
October 1, 2014 – March 31, 2015
OIG VISION
Effective, efficient and accountable management of Agency programs, operations and personnel.
OIG MISSION
To detect and prevent waste, fraud, and abuse, and promote economy, efficiency, and effectiveness in the
programs and operations of the
Equal Employment Opportunity Commission.
A MESSAGE FROM THE INSPECTOR GENERAL
In accordance with the Inspector General Act of 1978, as amended, I herewith submit the semiannual report for the period October 1, 2014, through March 31, 2015, which summarizes the major activities of our office for the reporting period. Section 5 of the Inspector General Act requires the Chair to transmit this report to the appropriate committees or subcommittees of Congress within 30 days of its receipt.
EXECUTIVE SUMMARY
This semiannual report is issued by the Equal Employment Opportunity Commission’s (EEOC’s) Office of Inspector General (OIG) pursuant to the Inspector General Act of 1978, as amended. It summarizes the OIG’s activities and accomplishments for the period October 1, 2014, through March 31, 2015.
- Harper, Rains, Knight & Company, P.A. (HRK), audited the financial statements of EEOC for fiscal year (FY) 2014 and issued an unmodified opinion on the FY 2014 financial statements. In its Report on Internal Control over Financial Reporting, HRK noted two areas involving internal control that were considered to be significant deficiencies: (1) the lack of sufficient controls over supporting documentation for personnel expenses, and (2) a lack of controls over financial management.
- Brown & Company CPAs, PLLC (Brown & Company), conducted and independent evaluation of EEOC’s compliance with the provisions of the Federal Information Security Management Act of 2002 (FISMA). FISMA requires agencies to develop, document, and implement an agency-wide information security program to provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.
- Agency policy directive EEOC Order 195.001 Management Accountability and Controls requires the OIG to annually provide a written advisory to the head of the Agency regarding whether the management control evaluation process complied with OMB guidelines. The OIG issued its annual report to the Chair on November 14, 2014, validating the Agency’s compliance with the Federal Managers’ Financial Integrity Act of 1982 (FMFIA).
INTRODUCTION
The Equal Employment Opportunity Commission
The Office of Inspector General
The U.S. Congress established the OIG at the EEOC through the 1988 amendments to the Inspector General Act of 1978, which expanded the authority of designated Federal entities to create independent and objective OIGs. Under the direction of the Inspector General (IG), the OIG meets this statutory responsibility by conducting and supervising audits, evaluations, and investigations relating to the programs and operations of the Agency; providing leadership and coordination; and recommending policies for activities designed to promote economy, efficiency, and effectiveness in the administration of programs and operations.
Work currently under way includes the following:
- FY 2015 Audit of the Consolidated EEOC Financial Statements
- Evaluation of Outreach and Education
- Evaluation of Litigation
- Open Government and Transparency Progress Review
- Cooperative Audit Resolution and Oversight Initiative (CAROI)
THE AUDIT AND EVALUATION PROGRAM
COMPLETED PROJECTS
Audit of the EEOC’s Fiscal Year 2014 Financial Statements (OIG Report No. 2014-01-FIN)
Management Letter Report for FY 2014 Financial Statement Audit (OIG Report No. 2014-02-FIN)
- Inaccurate and incomplete property information
- Capital assets policies and procedures need to be updated
- Lack of supporting documentation for charge cards
- Charge card transaction approval
- Nonpayroll expenses
- Noncompliance with OMB Circular A-136
- Zero object class transactions
HRK recommended the following:
- EEOC should monitor and enforce its policies and procedures over sensitive property. EEOC should monitor these controls to ensure that the controls remain adequate and continue to operate effectively.
- EEOC should update its policies and procedures to correctly state their current process for capital assets.
- EEOC should monitor and enforce its policies and procedures over record retention for purchase and travel card transactions. EEOC should monitor these controls to ensure that the controls remain adequate and continue to operate effectively. Additionally, management should enforce penalties, such as disciplinary action, including restitution to the government and/or dismissal.
- EEOC should implement and monitor controls to ensure that approving officials’ review and approval is documented for each purchase and travel card transaction. The policy or procedure should establish an appropriate period of time for retention of records, monitoring by the purchase card program manager, and appropriate disciplinary actions for noncompliance.
- EEOC should follow its guidelines for all expense transactions and develop an assessment of EEOC’s internal control process in order to proactively manage internal controls and get the most from them.
- EEOC should implement procedures to ensure that it has read and implemented all Federal guidance issued through the year.
Agency Compliance with the Federal Managers’ Financial Integrity Act
- Assurance statements submitted by headquarters and district office directors attesting that their systems of management accountability and control were effective and that use of resources under their control was consistent with the Agency’s mission and in compliance with the laws and regulations set out in FMFIA
- All functional area summary tables and functional area reports submitted by headquarters and field offices
- The Office of Research, Information, and Planning’s (ORIP’s) FY 2014 FMFIA Assurance Statement and Assurance Statement Letter, with supporting documents
Report to Congress on Open and Unimplemented Inspector General Recommendations
Federal Information Security Management Act of 2002
- Development of a risk assessment at the organization and mission-business level to include field offices
- Updating system-level risk assessment report
- Improvement to Bring Your Own Device (BYOD) program
- Improvement to privacy notifications on the EEOC official website and alerts when visitors are directed to nongovernment websites
- Improvement to virtual private network configuration settings for password length
- Implementation of encryption to protect digital backup media during transport
- Updating policies and procedures to include EEOC’s response time for security alerts
- Updating policies and procedures to include file integrity process for detecting unauthorized changes to software, firmware, and information
- Improvement to monitoring laptops issued to employees for disaster recovery and ensuring that patches and updates are installed for operating systems, antivirus software, and other security applications
- Implementation of background checks for student interns to ensure that international visas are current
- Improvement to the security awareness training program to ensure that all personnel in field offices who use information systems receive annual training
- Development of policies and procedures to properly manage physical security access cards
- Implementation of full device encryption or container-based encryption for mobile laptops
- Development of Continuity of Operations Plan for field offices
- Development of a telecommuting policy that meets FISMA requirements
- Development of policies and procedures for managing shared group accounts
- Improvement to account management procedures that includes disabling inactive accounts as required
- Improvement to physical access control to the data center and technology storage room
- Resolution of high and medium vulnerabilities identified from the internal vulnerability assessment
NEW AND ONGOING AUDIT AND EVALUATION PROJECTS
FY 2015 Audit of the Consolidated EEOC Financial Statements
Evaluation of Outreach and Education
Key evaluation objectives are listed below in order of probable complexity:
- Determine how outreach and education efforts are organized and managed at EEOC.
- Determine the financial, human, and other resources used in EEOC’s outreach and education efforts. In particular, measure the financial and other resources used for education and for outreach efforts, and assess how this information could be useful to EEOC and stakeholders.
- Determine how EEOC establishes and accomplishes its outreach and education objectives, goals, and performance measures.
- Determine what EEOC can learn from other organizations regarding management of outreach and education.
- Determine how EEOC should improve its organization, management, and delivery of outreach and education.
The final report will be issued in the third quarter of FY 2015.
Open Government and Transparency Progress Review
Cooperative Audit Resolution and Oversight Initiative
AUDIT FOLLOW-UP
Reports Issued During This Reporting Period
|
|
|
|
||
Recommendations Pending Corrective Actions from
|
|||||||
- Identify all headquarters and field offices where classified national security information is safeguarded, handled, processed, reproduced, transmitted, transported, or destroyed.
- Identify all EEOC employees with
- Develop and implement policies and procedures to address the safeguarding, transfer, storage, or disposal of classified information. The policy should include the requirements for Memorandums of Understanding (MOUs) between agencies.
- Designate a senior agency official to direct and administer the program in accordance with Executive Order 13526 and 32 CFR Parts 2001 and 2003. This senior agency official/office must be provided the resources and authority to achieve compliance with the requirements associated with the Classified National Security Information program.
- Implement a formalized training program for individuals who use classified information as a part of their duties. If an external agency is to assume the responsibility of training these individuals, this agreement should be documented in an MOU.
- Perform and document an assessment/evaluation of current classified information practices and safeguarding at headquarters and field offices to determine any noncompliances. Immediate corrective action should be taken to address any non-compliances noted.
- Incorporate a review of controls over classified information in EEOC’s annual FMFIA process.
- Complete risk designations for the remaining estimated 194 EEOC covered positions.
- Complete and begin any outstanding reinvestigations as required by the CFR.
- Adhere to EEOC policy and Federal requirements pertaining to reinvestigations. EEOC should follow their internal policy until further guidance is provided by the Office of Personnel Management (OPM).
- Update the policy for the Federal Personnel Payroll System with a timeline and implement the revised standard.
- Review all employee Electronic Official Personnel File (e-OPF)s to ensure proper inclusion of the employee’s Certificate of Investigation (COI) and, in instances where the documentation is missing, insert the COI.
- Report any outstanding EEOC adjudication decisions to the OPM, and going forward adhere to the 90-day timeline.
- Develop and implement a procedure to maintain relevant evidence documenting that the EEOC has informed OPM of the adjudication decisions it has made.
- Explore and document the decision on using alternative staffing options, such as contract employees or part-time employees, or obtaining an employee on detail in order to become current on risk designations, reinvestigations, Federal Personnel Payroll System (FPPS), COIs, and adjudication reporting.
- Update and implement comprehensive policies and procedures for physical security.
These policies and procedures should include but not be limited to
- providing training for the Financial Cloud Solutions (FSC) member or designee at each field office location at least annually;
- developing and implementing a field office on-site security assessment program that includes performing assessments and/or spot checks of field office security measures by the Office of the Chief Financial Officer (OCFO) on a rotational basis as it relates to Interagency Security Committee requirements; and
- assisting and ensuring field offices correct noted security weaknesses or document acceptance of risk where EEOC has determined corrective action will not be taken.
- Revise the field office self-assessment checklist to include facility security and credentialing information.
- Immediately correct any known weaknesses. If EEOC determines not to correct a noted weakness, EEOC should document this analysis and their acceptance of the associated risk.
- Increase coordination between OCFO and the Office of Federal Programs (OFP) to improve field office security posture, awareness and training to ensure compliance with applicable EEOC orders and guides; Facility Security Committees: An ISC Standard, dated January 1, 2012, second edition; and other applicable Interagency Security Committee Standards.
THE INVESTIGATION PROGRAM
Fraudulent Settlement Agreement
ONGOING INVESTIGATIVE ACTIVITY
Peer Review of EEOC OIG Audit Function
APPENDIX I. FINAL OIG AUDIT AND EVALUATION REPORTS
Agency Compliance with the Federal Managers’ Financial Integrity Act (FMFIA) |
||||
Report on Open and Unimplemented OIG Recommendations to Congress |
||||
APPENDIX II. INDEX OF REPORTING REQUIREMENTS
APPENDIX III. SINGLE AUDIT ACT REPORTS
EEOC HOTLINE CONTACT INFORMATION
Call:
EEOC-OIG Hotline
Toll-free 1-800-849-4230
To Report Fraud, Waste, and Abuse: HTTPS://OIG.EEOC.GOV/HOTLINE
General Inquiries: HTTPS://OIG.EEOC.GOV/CONTACT