Audit Reports

KPMG recommends that the Chief Information Officers of DOT and FTA develop policies, procedures and controls to address the provisioning of IT access, vulnerability management, system audit log review and change management control deficiencies identified in the FTA financial IT systems.

KPMG recommends that the Chief Information Officers of DOT and FTA monitor progress to ensure that procedures and controls are appropriately designed, implemented, and maintained.

KPMG recommends that the Chief Information Officers of DOT and FTA establish procedures and controls, at the appropriate level of precision, for unusual or infrequent events (e.g. system implementations) by establishing an IT steering committee that is composed of management from all relevant stakeholder functional areas, including the IT office, program office, and financial reporting office to ensure that system implementation meets the needs of all users and that policies, procedures, and system controls are appropriately redesigned, as necessary, to respond to the process changes resulting from the system implementation.

KPMG recommends that the Chief Information Officer of FTA execute a Service Level Agreement with all external service providers that defines the level of service expected from the service provider and appropriately identifies and delineates the roles and responsibilities of the service provider and the end user entity.

KPMG recommends that the Chief Information Officer of FTA d esign and implement policies and procedures to formally request, obtain, and review the external service provider's SSAE No. 16 report, and evaluate any deficiencies and end user considerations noted in the report.

KPMG recommends that the Chief Information Officer of FTA document the required procedures for assessing the impact of identified deficiencies, noted in the external service provider's SSAE No. 16 report, which may impact FTA, to ensure appropriate end user controls are in place to mitigate those noted deficiencies.

KPMG recommends that FTA enhance the grant accrual retrospective review policies, procedures, and controls to ensure that the retrospective review is performed at the appropriate level of precision, using relevant and reliable data inputs (complete and accurate FFR data);

KPMG recommends that FTA establish procedures and controls over the completeness and accuracy of the data inputs used in the grant accrual calculation.

KPMG recommends that FTA enhance the methodology and consider creating a user checklist of each of the program elements and appropriation codes that should be selected as inputs.

KPMG recommends that FTA establish policies and procedures for handling deviations from the standard methodology, including maintaining the evidence to support the deviation.

KPMG recommends that FTA establish a review control, with the appropriate level of precision, over the grant accrual calculation.

KPMG recommends that FTA perform an analysis and calculate an independent grant accrual for abnormalities in grantee spending patterns, in particular when a grantee is placed on suspension or restricted drawdowns as the billing cycle days for such grantees are not indicative of the true accrual period for that expenditure category.

KPMG recommends that FHWA establish a review control, with the appropriate level of precision, over the cash flow projections to ensure that the inputs to the Subsidy Calculator are relevant and reliable.

KPMG recommends that FHWA review the overall cash flow model functionality and implementation to ensure that all assumptions are properly applied, documented, and supported in the execution of the cash flow projections.

KPMG recommends that FHWA consider automating the calculations that are performed manually to reduce the risk of misapplication of assumptions due to human error.

KPMG recommends that DOT follow established policies and procedures designed to prevent Anti-Deficiency Act violation.

KPMG recommend that DOT increase training and communications with personnel responsible for performing the established policies and procedures.

KPMG recommended that DOT improve its general information technology controls at FTA, as noted above (under Section A - Lack of Sufficient General Information Technology Controls at FTA), to ensure that DOT's financial management systems comply with the requirements of the FFMIA.