We determined EEO established and maintained a consistently implemented information security program and practices, consistent with applicable FISMA requirements, OMB policy and guidance, DHS guidance, and NIST standards and guidance. 

In accordance with the Accountability of Tax Dollars Act (ATDA), we have audited the financial statements of the U.S. Equal Employment Opportunity Commission (EEOC). EEOC's financial statements comprise the consolidated balance sheets as of September 30, 2022, and 2021, and the related consolidated statements of net cost and changes in net position, and combined statements of budgetary resources for the fiscal years then ended, and the related notes to the financial statements.
In our opinion, EEOC's financial statements present fairly, in all material respects, EEOC's financial position as of September 30, 2022, and 2021, and its net cost of operations, changes in net position, and budgetary resources for the fiscal years then ended in accordance with accounting principles generally accepted in the United States of America.

Based The Federal Managers’ Financial Integrity Act of 1982 (FMFIA), P.L. 97-255,
as well as the Office of Management and Budget’s (OMB) Circular A-123, Management’s
Responsibility for Enterprise Risk Management and Internal Control, M-16-17 establish specific
requirements for management control. Each executive agency must establish controls to
reasonably ensure that: (1) obligations and costs are in compliance with applicable law; (2)
funds, property, and other assets are safeguarded against waste, loss, unauthorized use, or
misappropriation; and (3) revenues and expenditures applicable to agency operations are
properly recorded and accounted for to permit the preparation of accounts and reliable financial
and statistical reports and to maintain accountability over the assets on the OIG’s review, the Agency’s management controls review process was conducted in accordance with applicable guidance.

As of this memorandum date, the independent auditors, Harper, Rains, Knight and Company (HRK) did not identify any material weaknesses resulting from their audit of EEOC’s Fiscal Year 2022 financial statements.

We found that the Agency has not established a common customer service vision. The Agency does not have a cohesive strategy that connects all its customer service channels. The Information Intake Group (IIG) staff have customer service performance measures included in their performance plans; however, it is unclear how meeting these standards would achieve the Agency’s intended customer service goals. We also found that Equal Employment Opportunity Commission (EEOC) customer service standards are not publicly available, nor does the Agency collect feedback from its customers. As a result, EEOC cannot measure its progress or make improvements to its customer service efforts.

We found that the IIG has improved its call hold time over the last two years, but it remains above industry standards at 23 minutes. In fiscal year (FY) 2021, the IIG’s call abandonment rate was 36 percent. Over the last five years, more customers are contacting the Agency via email and wait an average of eight days to receive a response which does not meet the IIG’s standard of 3 days. We also found that the IIG has a robust quality assurance program for incoming calls, but not for responses sent to customers via email.
The IIG collects information on approximately 30,000 customer inquiries each year, known as an 846, and this information is sent to the district offices. We found that there are no specific criteria for generating an 846 and the districts find most of these files duplicative. The returns on investment to address 846 inquiries is unclear.

We reviewed the EEOC’s payment integrity section of its FY 2021 AFR to assess the agency’s compliance with the requirements of PIIA, OMB guidance, and information on PaymentAccuracy.gov. We found that EEOC was not compliant with PIIA for FY 2021. The agency included a payment integrity section in the FY 2021 AFR in accordance with IPERIA. EEOC completed a risk assessment in FY 2020 and was not required to conduct a risk assessment in FY 2021. However, the agency did not conduct its annual OMB payment integrity review and data call resulting in our finding of non-compliance with PIIA.  

The Office of Inspector General (OIG) contracted with the independent certified public accounting
firm of Harper, Rains, Knight & Company, P.A. (HRK) to conduct a performance audit of EEOC’s
information security program and practices in accordance with the Federal Information Security
Modernization Act of 2014 (FISMA). The contract required HRK conduct the audit in accordance
with U.S. generally accepted government auditing standards (GAGAS) contained in Government
Auditing Standards, issued by the Comptroller General of the United States.

The objective of this performance audit was to assess the effectiveness of the EEOC’s information
security program and practices for the period October 1, 2020 through September 30, 2021. HRK
found that EEOC has established and maintained an effective information security program and
practices, consistent with applicable guidance. HRK has identified areas of improvement in the
form of findings and recommendations. EEOC’s management was given the opportunity to review
the draft report. Management’s responses are included in the report.

The Office of Inspector General contracted with the independent certified public accounting firm of Harper, Rains, Knight & Company, P.A. (HRK) to conduct a performance audit of the U.S. Equal Employment Opportunity Commission's (EEOC) compliance with the Digital Accountability and Transparency Act of 2014 (DATA Act). The contract required HRK to conduct the audit in accordance with generally accepted government auditing standards.