The Board Has Effective Processes to Collect, Aggregate, Validate, and Report CARES Act Lending Program Data

Summary

Federal Reserve Office of Inspector General audit report 2022-FMIC-B-004, dated February 28, 2022 and transmitted by Assistant Inspector General for Audits and Evaluations Cynthia Gray, on the Board's CARES Act lending program data processes. The OIG finds the Board of Governors meets its CARES Act reporting requirements, voluntarily reports transaction-specific data, and publishes complete and accurate data except for some immaterial inaccuracies, based in part on validation testing of Secondary Market Corporate Credit Facility and Main Street Lending Program data. It recommends that the Board document its key decision to rely on Reserve Bank internal controls for assurance over the published data, and identify lessons from the CARES Act reporting experience for future emergencies. The Board concurred, and the OIG closed the first recommendation on issuance.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

2022-FMIC-B-004
1 of 26

Audit Report
2022-FMIC-B-004
February 28, 2022
Board of Governors of the Federal Reserve System
The Board Has Effective Processes to
Collect, Aggregate, Validate, and Report
CARES Act Lending Program Data

2022-FMIC-B-004
2 of 26

Executive Summary, 2022-FMIC-B-004, February 28, 2022
The Board Has Effective Processes to Collect, Aggregate, Validate, and
Report CARES Act Lending Program Data
Findings
Section 13(3) of the Federal Reserve Act and section 4026 of the
Coronavirus Aid, Relief, and Economic Security (CARES) Act require
the Board of Governors of the Federal Reserve System to publicly
report on the CARES Act lending programs. The Board meets its CARES
Act reporting requirements; voluntarily reports transaction-specific
data; and publishes complete and accurate data, with the exception
of some immaterial inaccuracies.
The Board established and documented processes for collecting,
aggregating, validating, and reporting CARES Act lending program
data; however, it can improve the documentation of a key decision
related to how it gains assurance that the publicly reported
transaction-specific data are accurate and complete. Routinely
updating documentation and the associated key decisions may help
the Board quickly establish processes for the public reporting of
lending activities should similar circumstances arise in the future.
Although the Board’s decision to publish transaction-specific data
exceeded applicable statutory requirements for publishing aggregate-
level data on the lending programs, we identified additional
opportunities to enhance transparency and reduce the potential to
report immaterial inaccuracies in the supplemental data. The
opportunities we identified can further the Board’s long-term
strategic objective to increase the public’s understanding of its
activities.
These improvement opportunities arose because the Board created
the CARES Act lending programs within a compressed time frame. The
Board and the Federal Reserve Banks acted quickly to meet their
reporting requirements and focused on ensuring financial accuracy.
Recommendations
Our report contains recommendations designed to help the Board
quickly establish processes for reporting on lending programs under
similar future circumstances. In its response to our draft report, the
Board concurs with our recommendations and outlines actions that
have been or will be taken to address them. The Board has taken
sufficient actions to address our recommendation related to
documenting a key decision, and we are closing this recommendation
upon issuance of this report. We will follow up to ensure that the
remaining recommendation is fully addressed.
Purpose
The objective of our audit was to assess the Board’s
processes for collecting, aggregating, validating,
and reporting data related to its CARES Act lending
programs. The scope of our audit focused on the
Board’s internal controls over the transfer of data
from the Reserve Banks; Board processes for
ensuring that the data are accurate and complete;
and compliance with the relevant reporting
requirements for all of the CARES Act lending
programs—the Corporate Credit Facilities, which
include the Primary Market Corporate Credit
Facility and the Secondary Market Corporate Credit
Facility (SMCCF); the Main Street Lending Program
(MSLP); the Paycheck Protection Program Liquidity
Facility (PPPLF); the Term Asset-Backed Securities
Loan Facility; and the Municipal Lending Facility.
Although the PPPLF does not receive an equity
investment from the U.S. Department of the
Treasury, we include it in our definition of a CARES
Act lending program because it was created to
support the CARES Act–established Paycheck
Protection Program, and the Board treated the
PPPLF like the other CARES Act lending programs
for reporting purposes. In addition, we conducted
validation testing on SMCCF and MSLP transaction-
specific data. We excluded the other CARES Act
lending programs from our validation testing
activities because the other lending programs were
subject to other independent oversight, had no
active loans, had limited users, or were established
during the 2008 financial crisis.
Background
The COVID-19 pandemic disrupted economic
activity in the United States, which affected many
sectors of the financial system. In response to the
pandemic, the Board established lending programs
under the CARES Act to support state and local
governments and businesses of all sizes. The
Federal Reserve System is required by statute to
report on any outstanding loan or guarantee
programs once every 30 days. To meet its 30-day
reporting requirements, the Board has established
processes for collecting, aggregating, validating,
and reporting CARES Act lending program data.

2022-FMIC-B-004
3 of 26

Recommendations, 2022-FMIC-B-004, February 28, 2022
The Board Has Effective Processes to Collect, Aggregate, Validate, and
Report CARES Act Lending Program Data
Finding 1: The Board Has Effective Processes to Meet 30-Day CARES Act Reporting Requirements and
Voluntarily Produces Materially Accurate Transaction-Specific Data but Could Have Documented a Key
Decision
Number
Recommendation
Responsible office
1
Document the key decision to rely on Reserve Bank internal
controls to gain assurance over publicly reported transaction-
specific CARES Act data, as well as the rationale for that decision.
Division of Reserve Bank Operations
and Payment Systems, in consultation
with Legal Division

Finding 2: The Board Can Enhance Its Discretionary Reporting
Number
Recommendation
Responsible office
2
Identify and document learning opportunities from the CARES Act
reporting experience so that they may be used by the Board when
future exigent circumstances arise.
Division of Reserve Bank Operations
and Payment Systems and Legal
Division

2022-FMIC-B-004
4 of 26

MEMORANDUM
DATE:
February 28, 2022

TO:
Matthew J. Eichner
Director, Division of Reserve Bank Operations and Payment Systems
Board of Governors of the Federal Reserve System

Mark E. Van Der Weide
General Counsel
Board of Governors of the Federal Reserve System

FROM:
Cynthia Gray
Assistant Inspector General for Audits and Evaluations

SUBJECT:
OIG Report 2022-FMIC-B-004: The Board Has Effective Processes to Collect, Aggregate,
Validate, and Report CARES Act Lending Program Data

We have completed our report on the subject audit. We conducted this audit to assess the Board of
Governors of the Federal Reserve System’s processes for collecting, aggregating, validating, and reporting
data related to its Coronavirus Aid, Relief, and Economic Security (CARES) Act lending programs. We have
defined CARES Act lending programs as all Federal Reserve Act section 13(3) emergency lending programs
that received equity investments from the U.S. Department of the Treasury pursuant to the CARES Act, as
well as the Paycheck Protection Program Liquidity Facility.
We provided you with a draft of our report for review and comment. In your response, you concur with
our recommendations and outline actions that have been or will be taken to address our
recommendations. For our recommendation related to documenting the key decision to rely on the
Federal Reserve Banks’ internal controls to gain assurance over publicly reported transaction-specific
CARES Act data, as well as the rationale for that decision, we have reviewed documentation associated
with the actions taken by the Board, and we believe that the agency has taken sufficient action to close
this recommendation. We will follow up to ensure that the remaining recommendation is fully addressed.
We have included your response as appendix C to our report.
We appreciate the cooperation that we received from the Division of Reserve Bank Operations and
Payment Systems, the Legal Division, and the Reserve Banks during our audit. Please contact me if you
would like to discuss this report or any related issues.

2022-FMIC-B-004
5 of 26

cc:
Patrick J. McClanahan
Andreas Lehnert
Ricardo A. Aguilera
Timothy Kirby
Lawrence Mize
Jeff Walker
Asad Kudiya
Melissa Ku
Bernard Kim
Sarah Podrygula
Katherine Tom
Cheryl Patterson
Kenneth Montgomery
Naureen Hassan
Ron J. Feldman
Andrew Danzig
Susan McLaughlin
Barbara Biel
Rita Csejtey
Meghan McCurdy
Alex Leonard
Steffanie A. Brady
Sandra E. Costa
Erin Boland
Clive Blackwood
Jon D. Colvin
Richard Thornton

2022-FMIC-B-004
6 of 26

Contents
Introduction
7
Objective
7
Background
7
Reporting on the CARES Act Lending Programs
8
Key Systems Used to Process and Store CARES Act Data
9
CARES Act Data Collection, Aggregation, Validation, and Reporting Processes
9
Finding 1: The Board Has Effective Processes to Meet 30-Day CARES Act Reporting
Requirements and Voluntarily Produces Materially Accurate Transaction-Specific Data
but Could Have Documented a Key Decision
11
The Board Meets Its 30-Day Reporting Requirements, Voluntarily Provides Transaction-Specific
Data for Some Lending Programs, and Has Complete and Materially Accurate Data
11
The Board Has Documented Its Processes to Meet CARES Act Reporting Requirements but Did
Not Document a Key Decision
13
Recommendation
14
Management Response
14
OIG Comment
14
Finding 2: The Board Can Enhance Its Discretionary Reporting
15
The Board Can Enhance Ongoing and Future Discretionary Disclosures of Data
15
Recommendation
18
Management Response
18
OIG Comment
18
Appendix A: Scope and Methodology
19
Appendix B: The Reserve Banks’ CARES Act Data Collection and Aggregation Processes
21
Appendix C: Management Response
23
Abbreviations
25

2022-FMIC-B-004
7 of 26

Introduction
Objective
The COVID-19 pandemic disrupted economic activity in the United States, which affected many sectors of
the financial system. Specifically, the availability of credit contracted for small and medium-size
businesses and debt issuers as well as state and local governments were affected by tax filing
postponement and significant decreases in other sources of tax revenue. This economic disruption
heightened the need for companies and government institutions to obtain credit to manage cash flows
and sustain operations until economic conditions normalized. In response, the Board of Governors of the
Federal Reserve System established emergency lending programs to support state and local governments
and businesses of all sizes. On a monthly basis, the Board publicly reports data on these lending
programs.
The objective of this audit was to assess the Board’s processes for collecting, aggregating, validating, and
reporting data related to its Coronavirus Aid, Relief, and Economic Security (CARES) Act lending
programs.1 The scope of our audit focused on the Board’s internal controls over the transfer of data from
the Federal Reserve Banks, the Board’s processes for ensuring that the data are accurate and complete,
and the Board’s compliance with the relevant reporting requirements for all the CARES Act lending
programs. In addition, we conducted validation testing on transaction-specific data by comparing public
data to source data in the relevant information systems for two CARES Act lending programs. We
excluded the other CARES Act lending programs from validation testing because they had no active loans,
had limited users, were subject to other independent oversight, or were established during the
2008 financial crisis. Details on our scope and methodology are in appendix A.
Background
Section 13(3) of the Federal Reserve Act permits the Board of Governors, in “unusual and exigent
circumstances” and under other conditions, to authorize Reserve Banks to extend credit to participants in
any program or facility with broad-based eligibility. In response to the economic effects of the COVID-19
pandemic, the Board of Governors determined that “unusual and exigent circumstances” existed for it to
exercise its authority under section 13(3) of the Federal Reserve Act, and it established the following
CARES Act lending programs:2

1 We define CARES Act lending programs as all Federal Reserve Act section 13(3) emergency lending programs that received
equity investments from the U.S. Department of the Treasury (Treasury) pursuant to the CARES Act, as well as the Paycheck
Protection Program Liquidity Facility (PPPLF). The Board established the PPPLF to support the CARES Act–established Paycheck
Protection Program, which is administered by the U.S. Small Business Administration, and treated it like the other CARES Act
lending programs for reporting purposes. The PPPLF does not receive an equity investment from Treasury.
2 In addition to the CARES Act lending programs established in response to the COVID-19 pandemic, the Board also established
three other facilities: the Primary Dealer Credit Facility, the Commercial Paper Funding Facility, and the Money Market Mutual
Fund Liquidity Facility. These facilities were not part of our scope.

2022-FMIC-B-004
8 of 26

•
the corporate credit facilities, including the Primary Market Corporate Credit Facility (PMCCF) and
the Secondary Market Corporate Credit Facility (SMCCF)
•
the Main Street Lending Program (MSLP), which includes the Main Street New Loan Facility, the
Main Street Expanded Loan Facility, the Main Street Priority Loan Facility, the Nonprofit
Organization Expanded Loan Facility, and the Nonprofit Organization New Loan Facility
•
the Paycheck Protection Program Liquidity Facility (PPPLF)
•
the Term Asset-Backed Securities Loan Facility (TALF)
•
the Municipal Lending Facility (MLF)
In addition to authorizing and establishing the CARES Act lending programs, the Board established the
structure and basic terms of the lending programs. Further, the Board authorized the Federal Reserve
Banks of New York and Boston to manage and administer specific lending programs, which includes
establishing policies and procedures associated with the programs, implementing internal controls, and
maintaining related data.3
Reporting on the CARES Act Lending Programs
Section 13(3) of the Federal Reserve Act requires the Board to provide to the Senate Committee on
Banking, Housing, and Urban Affairs and the House Committee on Financial Services a report on (1) any
new lending facility not later than 7 days after Board authorization and (2) any outstanding loan or
guarantee programs once every 30 days. Further, section 13(3)(C)(ii) of the Federal Reserve Act requires
that the 30-day reports include
•
the value of collateral
•
the amount of interest, fees, and other revenue or items of value received in exchange for the
assistance
•
the expected or final cost to the taxpayers of such assistance
In addition to these Federal Reserve Act section 13(3) reporting requirements, the CARES Act mandates
public reporting of data about the government’s pandemic response. Specifically, section 4026 requires
the Board to post to its public website a copy of each report submitted to Congress under section 13(3) of
the Federal Reserve Act no later than 7 days after transmittal to Congress.
In April 2020, in an effort to remain transparent and accountable, the Board voluntarily committed to
reporting transaction-specific data as a supplement to the required 30-day reports for the CARES Act
lending programs. Transaction-specific data can include the names and details of the participants in each
program; the amounts borrowed; the interest rate charged; and the overall costs, revenues, and fees for
each purchase or loan.4

3 The Federal Reserve Bank of New York manages the corporate credit facilities, the TALF, and the MLF; the Federal Reserve Bank
of Boston manages the MSLP; the Federal Reserve Bank of Minneapolis manages the operations of the PPPLF; and each Reserve
Bank implements the operations of the PPPLF for its district.
4 During the course of our review, the Board published CARES Act lending programs reports and related transaction-specific data
on its public website.

2022-FMIC-B-004
9 of 26

The Board’s decision to voluntarily disclose transaction-specific data aligns with its Strategic Plan 2020–
23. This plan includes a goal to promote broader, ongoing engagement with external individuals and
groups and improved understanding of the Board’s mission through outreach and public engagement.
Key Systems Used to Process and Store CARES Act Data
The Federal Reserve System uses three existing information systems to maintain CARES Act lending
program data. The Federal Reserve Banks of Dallas, Philadelphia, and Boston are responsible for
maintaining the information systems noted below, respectively.5 The Reserve Banks are also responsible
for establishing and maintaining processes to ensure that internal controls for their respective systems
are designed and operating effectively. These information systems and the data they maintain include the
following:
•
The System’s lending application processes discount window lending activity, among other
things.6 The lending application helps the Reserve Banks understand, manage risk, and facilitate
extensions of credit within the System.
•
The collateral management application facilitates the recordkeeping of pledged collateral,
including securities and whole loans, and provides collateral valuation functionality.
•
The general ledger is the accounting application used by the System. The general ledger is a
system that tracks the assets, liabilities, and commitments of the Reserve Banks.
CARES Act Data Collection, Aggregation, Validation, and
Reporting Processes
To meet its 30-day reporting requirements, the Board has developed processes for collecting,
aggregating, validating, and reporting CARES Act lending program data. To collect and aggregate the
CARES Act lending program data from the Reserve Banks, the Board developed templates for the Reserve
Banks to populate for the 30-day reports and transaction-specific disclosures. The Board also established
time frames within which the Reserve Banks provide the data. Details on the process steps used by the
Federal Reserve Banks of New York, Boston, and Minneapolis to collect and aggregate their respective
CARES Act lending program data are included in appendix B.
Further, the Board established consistent data validation and reporting processes across the six CARES
Act lending programs in our scope. The data validation process steps are as follows:
•
Upon receipt of the CARES Act lending program data provided via email or secure site by the
Reserve Banks, the Board’s Division of Reserve Bank Operations and Payment Systems (RBOPS)

5 Our scope did not include a security control review of systems involved in the data transfer process for the CARES Act lending
programs or third-party systems. These information systems will be reviewed separately.
6 The discount window is the System’s lending to depository institutions; this lending plays an important role in supporting the
liquidity and stability of the banking system and the effective implementation of monetary policy. By providing ready access to
funding, the discount window helps depository institutions manage their liquidity risks efficiently and avoid actions that have
negative consequences for their customers.

2022-FMIC-B-004
10 of 26

reconciles the aggregate-level data by matching the totals in the Reserve Bank spreadsheets to
those in the general ledger.7
•
RBOPS requests supporting documentation for 30-day reports, as needed, to better understand
how the Reserve Banks recorded the transactions.
•
Once validated, RBOPS emails the review results to the Legal Division.
The data reporting process steps are as follows:
•
The Legal Division leads the 30-day reporting process by collecting the Reserve Bank–provided
lending program data and uses these data to prepare and review the consolidated draft 30-day
report.
•
The Legal Division sends the draft 30-day reports and the spreadsheets to relevant Board staff in
the Legal Division, RBOPS, and the Division of Financial Stability for concurrent review.
•
The Board chair reviews and approves the package, which includes the 30-day reports,
transaction-specific spreadsheets, and letters to the required Senate and House committee
representatives.
•
The Division of Board Members’ Public Information Outreach program is notified that the
spreadsheets and the reports are ready for publishing.
•
The Public Information Outreach program publishes the documents on the Board’s monthly
COVID-19 reporting website.

7 To gain assurance over the transaction-specific data in the Reserve Bank–provided spreadsheets, RBOPS officials stated that
division staff members review Reserve Bank internal controls over the data.

2022-FMIC-B-004
11 of 26

Finding 1: The Board Has Effective
Processes to Meet 30-Day CARES Act
Reporting Requirements and Voluntarily
Produces Materially Accurate Transaction-
Specific Data but Could Have Documented
a Key Decision
We found that the Board met its 30-day reporting requirements for the CARES Act lending programs. The
Board also provided the public with additional transparency by voluntarily reporting transaction-specific
data; from our testing, we found the data to be complete and accurate, with the exception of some
immaterial inaccuracies. Moreover, we found that the Board has documented its processes for collecting,
aggregating, validating, and reporting CARES Act lending program data but also could have documented a
key decision related to how it gains assurance over the publicly reported transaction-specific data.
Section 13(3) of the Federal Reserve Act and section 4026 of the CARES Act both require the Board to
report to Congress every 30 days on its CARES Act lending programs, and internal control standards
highlight the importance of establishing and documenting policies and procedures and communicating
them to personnel. The Board established processes for fulfilling its CARES Act reporting requirements in
a compressed timeframe. Routinely updating the documented CARES Act collection, aggregation,
validation, and reporting processes and associated key decisions helps the Board mitigate the loss of
institutional knowledge if a key person leaves the agency, facilitates the transition of new employees into
lending program roles, and sets the Board up to quickly establish processes for reporting if similar
circumstances arise in the future.
The Board Meets Its 30-Day Reporting
Requirements, Voluntarily Provides Transaction-
Specific Data for Some Lending Programs, and Has
Complete and Materially Accurate Data
On March 30, 2020, the Board began publicly reporting CARES Act lending program data in accordance
with section 13(3) of the Federal Reserve Act and section 4026 of the CARES Act for the initial lending
programs within our scope that were established to address the COVID-19 pandemic: the PMCCF, the
SMCCF, and the TALF. Similarly, as the additional CARES Act lending programs in our scope were
established, the Board issued the required 30-day reports to Congress for them as well.
In addition, the Board voluntarily reported transaction-specific data to supplement the 30-day reports in
a manner consistent with its stated commitment to transparency. As of October 2021, the Board was

2022-FMIC-B-004
12 of 26

publishing transaction-specific data for the PPPLF, the SMCCF, the TALF, and the MLF.8 The Board
published transaction-specific data for the MSLP from August 2020 through April 2021; according to
Board officials, the Board stopped publishing MSLP transaction-specific data because the MSLP ceased
purchasing loans in January 2021 and ongoing updates could reveal nonpublic data about the status and
financial condition of individual MSLP borrowers.
We tested the Board’s publicly reported transaction-specific data for its April 12, 2021, public reporting
submission for the SMCCF and its February 9, 2021, public reporting submission for the MSLP.9 Our
testing identified that all 1,830 MSLP records and all 1,223 SMCCF records were complete.
We also found that the SMCCF data were accurate. The MSLP data were generally accurate; however, we
identified some immaterial inaccuracies.10 Specifically, we identified imprecisions in the following areas:
•
Customer data: We reported in April 2021 that there were 43 inaccurate borrower city or state
entries, such as invalid city and state combinations, misspellings, and other inaccuracies.11 These
items generally resulted from lender input error, character input limits in a system involved in
loan data entry, or manual intervention by Federal Reserve Bank of Boston personnel. Because of
the circumstances associated with establishing the lending programs, the Reserve Banks quickly
developed and implemented their reporting practices. The Board and the Reserve Banks have
been responsive in addressing these customer data issues that we have brought to their
attention; the March 2021 and April 2021 30-day reports include corrections of the inaccuracies
in the transaction-specific data.
•
Interest rates: According to Reserve Bank staff, some reported interest rates vary slightly from
the actual interest rate because lenders used different dates for calculating the underlying
London interbank offered rate (LIBOR).12 According to Reserve Bank staff, in the absence of a
standardized approach, some lenders calculated the LIBOR using the loan’s origination date, and
others used the loan’s funding date. The different approaches led to immaterial differences in the
interest rate reported and the actual interest rate on the loan. According to Reserve Bank staff,
the Federal Reserve Bank of Boston is resolving the discrepancy prior to the repayment of the
loans.

8 As of September 30, 2021, the total outstanding amount of the Federal Reserve Bank of New York’s loans under the PMCCF and
the SMCCF was $0. Therefore, the October 2021 30-day report was the final report with SMCCF loans.
9 We excluded the other CARES Act lending programs from reliability testing because these lending programs had no active loans,
had limited users, were subject to other independent oversight, or were established during the 2008 financial crisis.
10 We concluded that the inaccuracies were immaterial because the customer data were not financial information. Further, we
confirmed that the differences in the London interbank offered rate, or LIBOR, were minimal and, in our opinion, insignificant in
terms of the reported financial information.
11 Office of Inspector General, Results of Analytical Testing of the Board’s Publicly Reported Data for the Main Street Lending
Program, April 14, 2021.
12 LIBOR is the average interest rate at which major global banks borrow from one another and is used as the basis for many
financial products, including MSLP loans.

2022-FMIC-B-004
13 of 26

The Board Has Documented Its Processes to Meet
CARES Act Reporting Requirements but Did Not
Document a Key Decision
RBOPS and the Legal Division have documented processes for collecting, aggregating, validating, and
reporting CARES Act lending program data; however, they did not document a key decision related to
validating transaction-specific data.
•
Data collection and aggregation processes: During the initial design of the CARES Act lending
programs, the Legal Division developed templates for the Reserve Banks to complete for
transmitting CARES Act data to the Board during each 30-day reporting period. The templates
enhance consistency across CARES Act lending programs while allowing for customization based
on each individual CARES Act facility’s specific terms, structure, and features.
•
Data validation processes: RBOPS has documented its processes for obtaining assurance over the
aggregate-level data but has not documented its decision to rely on Reserve Bank internal
controls to gain assurance over the transaction-specific data.
▪
Aggregate-level data: RBOPS documented the division’s process for validating the CARES
Act lending programs’ 30-day report aggregate data in an internal procedure. According
to an RBOPS official, relevant section members can access the document on the division’s
network drive.
▪
Transaction-specific data: Conversely, RBOPS has not documented a key decision related
to gaining assurance for the publicly reported transaction-specific data. RBOPS has
determined that it is comfortable relying on Reserve Bank controls to ensure the
accuracy and completeness of publicly reported transaction-specific data; however,
RBOPS has not documented its rationale for this determination.
•
Data reporting processes: The Legal Division has documented its processes for collecting,
reviewing, and distributing the 30-day reports. According to a Legal Division official, all division
staff who are involved in preparing the CARES Act reports have access to the document on a
division intranet site. A Legal Division official also clarified that the procedures are a living
document that will be updated over time as changes are made to the reporting process. For
example, the procedures were updated when the Board decided to report on a fixed date each
month rather than every 30 days, to ensure more consistent and predictable reporting across
months.13 The Legal Division stated that it plans to finalize the document when the CARES Act
reporting process has concluded.
The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government
and the Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control—
Integrated Framework highlight the importance of establishing policies and procedures, integrating them

13 During the course of our audit, the Board determined that the requirement under section 13(3)(C)(ii) for a report “once every
30 days” was intended as a monthly reporting requirement. In May 2021, the Board chair approved a new schedule for providing
the reports to the House and Senate committees: 30-day reports are issued on the 10th calendar day of each month or, if the
10th calendar day of a month is not a business day, the next business day after the 10th.

2022-FMIC-B-004
14 of 26

into the organization’s operations, and communicating necessary information and rationale to personnel.
The U.S. Government Accountability Office’s guidance also notes that policies and procedures help
ensure that staff can implement the activities for their assigned responsibilities.
Given the circumstances, the Board quickly established processes for fulfilling its CARES Act reporting
requirements. Documenting its processes and key decisions for collecting, aggregating, validating, and
reporting CARES Act data helps the Board prevent against the loss of institutional knowledge if a key
person leaves the agency. Similarly, documenting its processes allows for Board staff newly assigned to
work on the Board’s CARES Act lending programs to quickly come up to speed. Routinely updating the
process documentation to reflect practices and key decisions, such as the determination to use different
processes to validate aggregate and transaction-specific data, may help the Board quickly establish
processes for reporting on lending programs should similar circumstances arise in the future.
Recommendation
We recommend that the director of RBOPS, in consultation with the general counsel,

1. Document the key decision to rely on Reserve Bank internal controls to gain assurance over
publicly reported transaction-specific CARES Act data, as well as the rationale for that decision.
Management Response
In response to our draft report, the director of RBOPS and the general counsel concur with this
recommendation. On January 5, 2022, RBOPS, in conjunction with the Legal Division, documented its key
decision to rely on internal controls to gain assurance over publicly reported transaction-specific CARES
Act data in a memorandum to file. In this memorandum, the Board concluded that information on
Reserve Bank processes and internal controls obtained from oversight and monitoring activities, in
combination with review procedures performed by Board staff, provide reasonable assurance of the
accuracy of the information provided by the Reserve Banks for use in preparing the 30-day reports.
OIG Comment
We have reviewed the January 5, 2022, memorandum the Board prepared in response to
recommendation 1. We are closing recommendation 1 upon issuance of this report based on the actions
taken.

2022-FMIC-B-004
15 of 26

Finding 2: The Board Can Enhance Its
Discretionary Reporting
The Board’s decision to publish transaction-specific data exceeded its statutory requirements to report
aggregate-level data on the lending programs. We identified four opportunities for the Board to enhance
its reporting of discretionary data that may help improve transparency and reduce the risk of reporting
inaccuracies. The Board has a long-term strategic objective to increase the public’s understanding of the
Board’s activities, as established in its Strategic Plan 2020–23. We believe these improvement
opportunities arose from the Board’s need to act quickly to meet its reporting requirements.
Documenting and acting on these opportunities can help the Board quickly establish processes for
reporting on lending programs under similar future circumstances and increase the public’s
understanding of Board-reported data related to its programs and other discretionary disclosures of data.
The Board Can Enhance Ongoing and Future
Discretionary Disclosures of Data
The Board exceeded its statutory obligations by publishing transaction-specific data. During the course of
our audit, we identified four improvement opportunities that would help the Board to enhance the
public’s understanding of the published discretionary data (table 1). Although the current lending facility
program operations have ceased purchases, we believe that the Board’s consideration of these
opportunities can be applied in similar future circumstances in which public reporting is necessary and for
any new CARES Act reporting.

2022-FMIC-B-004
16 of 26

Table 1. Opportunities to Enhance CARES Act Reporting and Other Discretionary Disclosures of Data
CARES Act reporting issue
Opportunity
Reporting losses: The circumstances surrounding the
Board’s reporting of a $4 million actual loss to the MSLP—
which occurred prior to the loan’s repayment phase—is
described in a footnote to the report.a Specifically, the
June 2021 30-day report states that “the Board continues
to expect that the MSLP will not result in losses to the
Federal Reserve.” Directly following this statement is a
footnote identifying that the program established a
$2.7 billion loan loss reserve in April 2021 to guard against
potential losses experienced by the program. The footnote
in the Board’s 30-day report mentions that as of May 31,
2021, the MSLP has recognized approximately $4 million in
an actual loss. To increase the public’s understanding of the
circumstances surrounding this loss, the Board could have
included this information in the body of the report and
further explained which entity absorbed the loss and
whether the loss had any bearing on the potential for
additional future defaults.
Disclosing changes in reporting: When the Board stopped
publishing transaction-specific data for the MSLP in
April 2021, it disclosed the change in the May 30-day report
but not on the Board’s public website where those
spreadsheets are posted. More clearly disclosing such
reporting changes will help to ensure that users understand
that the changes are intentional rather than the result of an
oversight in posting the data.

Presenting partially redeemed or matured bonds: In
July 2021, we reported on opportunities to enhance the
clarity and transparency of publicly reported SMCCF
transaction disclosure data. Specifically, while there were
no inaccuracies in the Board’s public reporting, the
presentation of partially redeemed bonds during the
reporting period could have been interpreted as duplicate
records, and the presentation of several redemptions
included duplicate records. In July 2021, the Board and
Federal Reserve Bank of New York addressed this finding by
updating how they present publicly reported SMCCF
transaction-specific data.b
Ensure that data disclosures are clear and designed
to increase the public’s overall understanding of the
Board’s activities.

2022-FMIC-B-004
17 of 26

CARES Act reporting issue
Opportunity
Some of the CARES Act lending program publicly reported
data are populated from third-party administrator
information systems. The Board relies on third-party
administrators or lenders to enter customer data, such as
names and location information, and the Board does not
review the third-party customer data for accuracy. The
Board corrected the inaccuracies we identified; however, if
the public is not provided any information on the data
source or the Board’s decision not to review the data, users
who identify errors in customer data may question the
accuracy of other Board data.
Further, disclosing known data discrepancies, such as the
immaterial discrepancies in reported interest rates as
identified in finding 1, could also help users evaluate the
data’s usefulness. Neither the 30-day report nor the public
website describes known discrepancies in the reported
transaction-specific CARES Act data.
Clearly convey known limitations to enhance the
public’s understanding of the data.
We used data analytics to identify (1) invalid city-state
combinations (for example, New York, DC), (2) misspellings,
and (3) inaccuracies based on OIG research and analysis.c
While these discrepancies in the supplemental data have
been corrected and are not financially material, periodic
data analytics testing conducted by the Board or the
Reserve Banks may have identified the inaccuracies earlier.
Consider implementing controls to detect
nonfinancial discrepancies in the data.
By August 2021, all lending programs ceased lending
activities, and Board officials have stated that they do not
plan to provide additional information to supplement the
ongoing 30-day reports. The Board can continue to enhance
public transparency by expanding its CARES Act reporting,
such as by reporting portfolio management data. Examples
of portfolio management data could include information on
the percentage of loans that are being repaid according to
the terms of the loans, as well as the average number of
days that nonperforming loans are past due.
Consider adjusting discretionary disclosures as
programs evolve.
Source: OIG analysis of Board and Reserve Bank documents and interviews.
a According to the MSLP term sheets, loans purchased by the program have a deferred principal payment for 2 years and a
deferred interest payment for 1 year. The first loan was purchased by the program on July 15, 2020, and therefore none had
entered the repayment period as of the June 2021 30-day report.
b Office of Inspector General, Results of Analytical Testing of the Board’s Publicly Reported Data for the Secondary
Market Corporate Credit Facility, July 14, 2021.
c Office of Inspector General, Results of Analytical Testing of the Board’s Publicly Reported Data for the Main Street Lending
Program, April 14, 2021.

2022-FMIC-B-004
18 of 26

The likelihood that the Board will make future discretionary data disclosures is supported by the Board’s
Strategic Plan 2020–23. Specifically, the plan includes a goal to promote broader, ongoing engagement
with external individuals and groups and improved understanding of the Board’s mission through
outreach and public engagement. To meet this goal, the Board has an objective to expand
communication and outreach efforts with the public to increase transparency and understanding of its
mission and activities and to better inform their decisions. One way in which the Board identifies that this
objective can be achieved is through producing content tailored to meet the interests and needs of a
wide variety of audiences.
The Board worked quickly to establish processes for fulfilling its CARES Act reporting requirements. In
addition to reporting every 30-days on the aggregate-level data, the Board opted to include supplemental
transaction-specific data for some facilities. Under these conditions, System officials were focused more
on ensuring financial accuracy for the reported data than on the accuracy of nonfinancial data.
Documenting these and any other System-identified improvement opportunities related to the Board’s
CARES Act lending program reporting may help the Board when similar future circumstances arise. For
example, Board officials explained that the Board had some lessons learned documented from the
2008 financial crisis, which, supplemented with institutional knowledge, helped the Board establish the
CARES Act lending programs. In addition, addressing these improvement opportunities may help the
Board meet its transparency goal and enhance the public’s understanding of the discretionary data.
Recommendation
We recommend that the director of RBOPS and the general counsel
2. Identify and document learning opportunities from the CARES Act reporting experience so that
they may be used by the Board when future exigent circumstances arise.
Management Response
In its response to our draft report, the director of RBOPS and the general counsel concur with our
recommendation. They state that RBOPS and the Legal Division, in consultation with applicable Reserve
Banks, have implemented enhancements to the reporting function. They further state that the Board will
continue to review the CARES Act facilities reporting function for opportunities to improve, including
examining whether these lessons learned can be documented and applied to similar reporting initiatives
in the future. The Board anticipates that it will document final lessons learned by the end of calendar
year 2022.
OIG Comment
The planned and completed actions described by the Board appear to be responsive to our
recommendation. We will follow up to ensure that the recommendation is fully addressed.

2022-FMIC-B-004
19 of 26

Appendix A: Scope and Methodology
Our objective was to assess the Board’s processes for collecting, aggregating, validating, and reporting
data related to its CARES Act lending programs. The scope of our audit focused on the Board’s internal
controls over the data provided by the Federal Reserve Banks of Boston, Minneapolis, and New York;
Board processes for ensuring that the data are accurate and complete; and compliance with the relevant
reporting requirements. The programs in our scope were the MSLP, the PPPLF, the PMCCF, the SMCCF,
the MLF, and the TALF.
To accomplish our objective, we reviewed applicable laws, 30-day reports on the lending programs and
associated transaction-specific data, and Board and Reserve Bank documentation on key processes. We
also interviewed officials from the Legal Division; RBOPS; and the Federal Reserve Banks of Boston, New
York, and Minneapolis.
To assess the Board’s processes for collecting and aggregating CARES Act lending program data, we
interviewed Board officials. We corroborated this information with statements from Reserve Bank
officials. We also reviewed a completed 30-day report template sent from a Reserve Bank to the Board.

To assess the Board’s processes for validating CARES Act lending program data, we interviewed RBOPS
officials. Additionally, RBOPS provided us with a walk-through of the process for validating the aggregate-
level data for 1 month. We interviewed officials from the Board and the Federal Reserve Banks of Boston,
New York, and Minneapolis to determine the processes used to validate MSLP, SMCCF, and PPPLF
transaction-specific data. In addition, we conducted data reliability testing on transaction-specific data by
comparing public data to source data from the relevant information systems supporting the April 2021
30-day report for the SMCCF and the February 2021 30-day report for the MSLP. The data in the 30-day
reports include transactions that occurred over the course of the lending facilities’ activity; therefore, the
1 month of data tested included prior MSLP transactions or existing SMCCF holdings for that lending
facility. We excluded the other CARES Act lending programs from reliability testing because these lending
programs had no active loans, had limited users, were subject to other independent oversight, or were
established during the 2008 financial crisis.

To assess the Board’s processes for reporting CARES Act lending program data, we reviewed applicable
laws, coordinated with Legal Division officials on the Board’s statutory reporting requirements in section
4026 of the CARES Act and section 13(3) of the Federal Reserve Act, and assessed the Board’s compliance
with those requirements for 30-day reports issued from March 2020 through August 2021. In addition, to
supplement the Board’s testimonial description of its processes for reviewing the 30-day reports, we
reviewed internal communications for the December 2020 30-day report evidencing that all aggregate
lending program data received appropriate reviews and approvals prior to the Board sending the 30-day
report to Congress and making the information publicly available.

Auditing standards require that we assess internal controls significant to our audit objective. Accordingly,
we assessed certain internal controls related to the Board’s collection, aggregation, validation, and
reporting processes for CARES Act lending program data. Our assessment included reviewing laws and
Board policies and procedures applicable to the Board’s processes for collecting, aggregating, validating,

2022-FMIC-B-004
20 of 26

and reporting CARES Act lending program data. We also assessed the effectiveness of these controls by
testing public reports against legal requirements and reviewing a re-creation of key processes, including
(1) an internal review of a 30-day report and (2) a walk-through observing a Board official conducting data
validation for aggregate-level data in one 30-day report. The results of our assessment are in the body of
this report.
We conducted this performance audit from October 2020 to November 2021 in accordance with
generally accepted government auditing standards. Those standards require that we plan and perform
the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objective.

2022-FMIC-B-004
21 of 26

Appendix B: The Reserve Banks’ CARES Act
Data Collection and Aggregation Processes
To meet the 30-day reporting requirements, each of the Reserve Banks established processes for
collecting and aggregating their respective CARES Act lending program data (table B-1).
Table B-1. CARES Act Lending Program Data Collection and Aggregation Processes
Process
Federal Reserve Bank of
Boston (MSLP)
Federal Reserve Bank of
New York (PMCCF, SMCCF,
TALF, MLF)
Federal Reserve Bank of
Minneapolis (PPPLF)
Data collection
Participating lenders
enter loan updates and
payment information
into the MSLP lender
portal. The third-party
accounting administrator
processes the loan
updates and payment
information.
Upon completion of a
transaction, the third-party
administrators collect CARES
Act lending program data and
transfer the data electronically
to the Reserve Bank.
Each Reserve Bank collects
PPPLF loan data directly from
the lenders and enters the
data directly into the System
lending application. Reserve
Bank staff review, verify, and
approve the data.

MSLP staff consolidate
the third-party loan data
into the Reserve Bank’s
general ledger.
Reserve Bank accounting staff
enter the accounting data
received from the third-party
administrators into the Reserve
Bank’s general ledger. A
different staff member reviews
and approves this information.
The lending application
automatically transfers
CARES Act lending program
data into the general ledger
of each Reserve Bank
following the end-of-day
reconciliation process
performed by each Reserve
Bank.
Data aggregation
MSLP staff populate
templates provided by
the Legal Division for the
aggregate-level 30-day
and transaction-specific
reports using the data
from the third-party
accounting
administrator.a
Reserve Bank accounting and
operations staff populate
templates provided by the
Legal Division for the
aggregate-level 30-day and
transaction-specific reports
using general ledger, collateral,
and transaction-specific data.
A central data team
supporting the PPPLF obtains
the data by querying the
Systemwide application for
lending transactions. The
central data team populates
templates provided by the
Legal Division for the
aggregate-level 30-day and
the transaction-specific
report.

2022-FMIC-B-004
22 of 26

Process
Federal Reserve Bank of
Boston (MSLP)
Federal Reserve Bank of
New York (PMCCF, SMCCF,
TALF, MLF)
Federal Reserve Bank of
Minneapolis (PPPLF)

MSLP staff reconcile the
data in the aggregate-
level 30-day report
template to the Federal
Reserve Bank of Boston’s
general ledger. The
information is reviewed
and approved by one or
more MSLP staff
members.
A different staff member
reviews and approves this
information.
Reserve Bank staff verify
transaction-level data against
the general ledger. Two or
more Reserve Bank staff
members review and
approve the information.

MSLP staff email the
CARES Act lending
program data to Board
staff.
Reserve Bank accounting and
operations staff upload the
CARES Act lending program
data to a secured site that
Board staff can access. Reserve
Bank staff notify Board staff
about the upload via email.
Reserve Bank staff email the
aggregate-level and
transaction-level data to
Board staff.

Source: OIG analysis of Board and Reserve Bank documents and interviews.
a The Board published transaction-specific data for the MSLP from August 2020 through April 2021.

In addition to the established processes for collecting and aggregating data for each CARES Act lending
program, general auditors in each Reserve Bank oversee Reserve Bank operations. Their ongoing
oversight covers lending facility activities and internal controls over the systems used to process, transfer,
and store lending program data.

2022-FMIC-B-004
23 of 26

Appendix C: Management Response

2022-FMIC-B-004
24 of 26

2022-FMIC-B-004
25 of 26

Abbreviations
CARES Act
Coronavirus Aid, Relief, and Economic Security Act
LIBOR
London interbank offered rate
MLF
Municipal Lending Facility
MSLP
Main Street Lending Program
PMCCF
Primary Market Corporate Credit Facility
PPPLF
Paycheck Protection Program Liquidity Facility
RBOPS
Division of Reserve Bank Operations and Payment Systems
SMCCF
Secondary Market Corporate Credit Facility
TALF
Term Asset-Backed Securities Loan Facility

2022-FMIC-B-004
26 of 26

Report Contributors
La’ Toya Holt, Senior Auditor
Monica Cook, Forensic Auditor
Melissa Dorow, Auditor
Alain Habimana, Auditor
Joe Hackett, Auditor
Eric Shapiro, Auditor
Victor Calderon, OIG Manager for Data Analytics
Megan Taylor, OIG Manager, Financial Management and Internal Controls
Jackie Ogle, Senior OIG Manager for Financial Management and Internal Controls
Cynthia Gray, Assistant Inspector General for Audits and Evaluations
Michael VanHuysen, Associate Inspector General for Audits and Evaluations
Contact Information
General
Office of Inspector General
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue NW
Mail Stop K-300
Washington, DC 20551
Phone: 202-973-5000
Fax: 202-973-5044
Media and Congressional
OIG.Media@frb.gov
OIG Hotline

Hotline
Report fraud, waste, and abuse.
Those suspecting possible
wrongdoing may contact the
OIG Hotline by mail,
web form, phone, or fax.
OIG Hotline
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue NW
Mail Stop K-300
Washington, DC 20551
Phone: 800-827-3340
Fax: 202-973-5044

File and source

File

2022-fmic-b-004-cares-act-lending-program-data.pdf

Size

1,226,497 bytes

SHA-256

dfc5f1cd5ffe8f6407642570737b775cc26aa0346b3aa2bba8efc68c3f7d7c7e

Our copy

2022-fmic-b-004-cares-act-lending-program-data.pdf

Original

oig.federalreserve.gov