Audit Reports

KPMG recommends that DOT OCIO management revise the website containing the policy documentation to ensure all documents are consistent and contain the same listing of required controls for moderate-impact systems.

KPMG recommends that DOT OCIO management should document any Department-wide tailoring decisions within the appropriate security documentation, as required by NIST.

KPMG recommends that DOT OCIO management should define and document control tailoring requirements for the Department and its Operating Administrations.

KPMG recommends that DOT OCIO management ensure that the process for provisioning privileged database system administrator accounts supporting the Federal Highway Administration’s grant system is performed in accordance with DOT policies.

KPMG recommends that ESC management create monitoring procedures over the existing management review of the JV control logs monthly reconciliation to ensure the consistent operation of the control, as defined within policy.

KPMG recommends that OST-CFO management revise its accounting process to accrue TIFIA interest each period or document its current process as a non-GAAP policy and perform an annual materiality assessment to determine the annual impact of the unaccrued interest policy.

KPMG recommends that OST-CFO management should perform a review of OST-CFO’s accounting policies and procedures as a control activity over the completeness of non-GAAP policies and procedures and update the non-GAAP listing and assessment accordingly.

KPMG recommends that OST management implement policies and procedures to strengthen their process to timely assess applicable third-party service organization reports such as consistently identifying and documenting the relevant control objectives, related controls, and rationale for non-relevant control objectives and controls.

KPMG recommends that OST management implement policies and procedures to strengthen their process to timely assess applicable third-party service organization reports such as consistently identifying and documenting the relevant complementary end user controls designed and implemented by DOT.

KPMG recommends that OST management implement policies and procedures to strengthen their process to timely assess applicable third-party service organization reports such as consistently identifying and documenting the criteria used by management to evaluate the results of the service organization controls report and related findings.

KPMG recommends that FTA management design and implement controls to track the status of Treasury warrant requests to ensure that the warrants are recorded in the financial system timely when processed.

KPMG recommends that FTA management perform a review for the completeness of the financial statements provided to OST, including reviews for transactions recorded subsequent to the OST reporting date.