Annual Report - 2024 07 Cigfo Annual 2024
Summary
This is the July 2024 Annual Report of the Council of Inspectors General on Financial Oversight (CIGFO). In the Message from the Acting Chair, signed /s/ Rich Delmar, the report states that CIGFO comprises eight Inspectors General and was created, with the Financial Stability Oversight Council (FSOC), by the Dodd-Frank Act signed into law on July 10, 2010. It states that the Special Inspector General for the Troubled Assets Relief Program ended its operations during the past year, that in August 2023 a working group released the Audit of the Financial Stability Oversight Council's Efforts to Address Climate-Related Financial Risk, and that in March CIGFO approved a new working group on FSOC's revised Guidance on Nonbank Financial Company Determinations.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
- Issuer
- Inspector general and oversight reports
- Document type
- Annual Report
- Case
- 2024 07 Cigfo Annual 2024
Cite this document
“Annual Report - 2024 07 Cigfo Annual 2024.”
Original at oig.treasury.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2024-07-cigfo-annual-2024/
, SHA-256 81a9f74d8b42d938138671f790a85a7d904444b760742e343015a3a757ef4a11.Full text
JULY 2024
Annual Report of the
Council of Inspectors General
on Financial Oversight
Mes
THIS PAGE INTENTIONALLY LEFT BLANK
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Message from the Acting Chair
On July 10, 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) was
signed into law, creating both the Financial Stability Oversight Council (FSOC or Council) and the
Council of Inspectors General on Financial Oversight (CIGFO). Chaired by the Treasury Secretary,
FSOC is charged with identifying threats to the financial stability of the country, promoting market
discipline, and responding to emerging risks to the stability of the nation’s financial system. CIGFO,
which comprises eight Inspectors General (IG) responsible for oversight of agencies and programs in the
financial sector, was established to facilitate information sharing among the IG members, provide a
forum for discussion of IG member work as it relates to the broader financial sector, and evaluate the
effectiveness and internal operations of FSOC.
During the past year, the Special Inspector General for the Troubled Assets Relief Program (SIGTARP)
ended its operations. I want to thank SIGTARP’s Acting Inspector General, Melissa Bruce, as well as her
predecessors, for their tireless work in their oversight efforts, and for their contributions to the work
of CIGFO. Since CIGFO’s creation, SIGTARP actively supported our mission by participating and helping
to lead several working groups. They will be missed.
As FSOC focuses on new challenges to the stability of the financial sector, CIGFO similarly focuses its
ability to understand and competently assess FSOC’s decisions and actions.
In November 2023, FSOC for the first time published an analytic framework describing the approach it
plans to take in identifying, assessing, and responding to potential risks to U.S. financial stability. This
analytic framework is intended to help market participants, stakeholders, and other members of the
public better understand how the Council expects to perform certain of its duties.
This is an important step towards increased transparency regarding the Council’s work, as well as an
improvement in its ability to counter damage both to the U.S. economy and the international financial
order.
Dodd-Frank grants CIGFO the authority to convene working groups, by a majority vote, for the
purpose of evaluating the effectiveness and internal operations of FSOC. CIGFO has, since 2011,
established working groups that are comprised of staff from the CIGFO member Inspector General
offices to conduct these reviews of FSOC operations and we have continued this important work this
past year. CIGFO convened a working group to review FSOC’s response to Executive Order 14030,
Climate-related Financial Risk. In August 2023, the working group released its report on the Audit of
the Financial Stability Oversight Council’s Efforts to Address Climate-Related Financial Risk. This report
can be found in the attached Appendix. This past March, CIGFO approved a new working group to
assess FSOC’s revised Guidance on Nonbank Financial Company Determinations.
CIGFO’s monitoring activities also include sharing financial regulatory information that enhances the
knowledge and insight of its members about specific issues related to members’ current and future
work. For example, during its quarterly meetings, CIGFO members discussed recent cyberattacks on
financial institutions and turmoil in the banking sector, as well as legislative activities that could impact
the financial regulatory system. CIGFO also heard briefings from the Government Accountability Office,
the Office of Financial Research, and the Committee on Foreign Investment in the United States.
It is particularly impressive that the working group that compiled the CIGFO Guidance in Preparing for
and Managing Crises, issued in 2022, was recognized this past year by the Council of the Inspectors
General on Integrity and Efficiency and received an Audit Excellence Award.
Message from the Chair i
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
In the coming year, CIGFO members will continue, through their individual and joint work, to help
strengthen the financial system by oversight of FSOC and its Federal member agencies.
/s/
Rich Delmar
Acting Chair, Council of Inspectors General on Financial Oversight
Acting Inspector General, Department of the Treasury
ii Message from the Chair
THIS PAGE INTENTIONALLY LEFT BLANK
iii
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Table of Contents
Council of Inspectors General on Financial Oversight ............................................................................... 1
The Council of Inspectors General on Financial Oversight Reports......................................................... 2
Office of Inspector General Board of Governors of the Federal Reserve System
and Consumer Financial Protection Bureau ................................................................................................. 3
Office of Inspector General Commodity Futures Trading Commission................................................. 15
Office of Inspector General Federal Deposit Insurance Corporation .................................................... 18
Office of Inspector General Federal Housing Finance Agency ................................................................ 32
Office of Inspector General U.S. Department of Housing and Urban Development ..........................42
Office of Inspector General National Credit Union Administration ........................................................ 49
Office of Inspector General U.S. Securities and Exchange Commission ................................................ 51
Office of Inspector General Department of the Treasury ........................................................................ 55
Appendix: Audit of the Financial Stability Oversight Council’s Efforts to Address
Climate-Related Financial Risk ...................................................................................................................................79
iv
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Council of Inspectors General on Financial Oversight
The Council of Inspectors General on Financial Oversight (CIGFO) was established by the
Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), and meets
on a quarterly basis to facilitate the sharing of information among Inspectors General. The
CIGFO members discuss the ongoing work of each Inspector General who is a member of the
Council, with a focus on concerns that may apply to the broader financial sector, and
exchange ideas about ways to improve financial oversight. The CIGFO publishes an annual
report that includes separate sections within the exclusive editorial control of each Inspector
General. Those sections describe the concerns and recommendations of each Inspector
General and a discussion of ongoing and completed work.
During the course of the year, the CIGFO continued to monitor coordination efforts among
and between Financial Stability Oversight Council (FSOC) members. Specifically, CIGFO
members were briefed on and/or discussed the following:
• Government Accountability Office (GAO) reports, ongoing efforts, and planned
work relating to the March 2023 bank failures
• MOVEit cyberattacks and agency responses
• Treasury’s Office of Financial Research - development and implementation of the
Joint Analysis Data Environment (JADE)
• The Committee on Foreign Investment in the United States (CFIUS) - CFIUS
operations and activities
• FSOC’s new Analytic Framework for Financial Stability Risk Identification, Assessment,
and Response and revised Guidance on Nonbank Financial Company Determinations
• Correspondence with Congress regarding financial sector disturbances generated
by failures in financial institutions
• Legislative matters of interest, including proposed legislation on various topics
including proposed changes to FSOC’s authorities and operations
Council of Inspectors General on Financial Oversight 1
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
The Council of Inspectors General on Financial
Oversight Reports
The Dodd-Frank Act authorizes CIGFO to convene a working group, by a majority vote,
for the purpose of evaluating the effectiveness and internal operations of the FSOC.
To date, CIGFO has issued the following reports—
• 2012 - Audit of the Financial Stability Oversight Council’s Controls over Non-public Information
• 2013 - Audit of the Financial Stability Oversight Council’s Designation of Financial Market
Utilities
• 2014 - Audit of the Financial Stability Oversight Council’s Compliance with Its Transparency
Policy
• 2015 - Audit of the Financial Stability Oversight Council’s Monitoring of Interest Rate Risk to the
Financial System
• 2017 - Audit of the Financial Stability Oversight Council’s Efforts to Promote Market Discipline
• 2017 - Corrective Action Verification of FSOC’s Implementation of CIGFO’s Audit
Recommendations in the 2013 Audit of FSOC’s Financial Market Utility
Designation Process
• 2018 - Top Management and Performance Challenges Facing Financial Regulatory
Organizations
• 2019 - Audit of the Financial Stability Oversight Council’s Monitoring of
International Financial Regulatory Proposals and Developments
• 2019 - Top Management and Performance Challenges Facing Financial-Sector Regulatory
Organizations
• 2020 - Survey of FSOC and its Federal Member Agencies’ Efforts to Implement the Cybersecurity
Act of 2015
• 2020 - Council of Inspectors General on Financial Oversight Presidential Transition Handbook
• 2022 - CIGFO Guidance in Preparing for and Managing Crises
• 2023 – Audit of the Financial Stability Oversight Council’s Efforts to Address Climate-Related
Financial Risk
The corrective actions described by FSOC, with respect to the audits listed above, met
the intent of our recommendations and may be subject to verification in future CIGFO
working group reviews.
2 The Council of Inspectors General on Financial Oversight Reports
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
Board of Governors of the Federal Reserve System
and Consumer Financial Protection Bureau
We provide independent oversight by conducting audits, evaluations, investigations, and other reviews of
the programs and operations of the Board of Governors of the Federal Reserve System and the
Consumer Financial Protection Bureau and demonstrate leadership by making recommendations to
improve economy, efficiency, and effectiveness, and by preventing and detecting fraud, waste, and
abuse.
Background
Congress established our office as an independent oversight authority for the Board, the
government agency component of the broader Federal Reserve System, and the CFPB.
Under the authority of the Inspector General Act of 1978, as amended (IG Act), we conduct
independent and objective audits, evaluations, investigations, and other reviews related to the
programs and operations of the Board and the CFPB.
• We make recommendations to improve economy, efficiency, and effectiveness, and
we prevent and detect fraud, waste, and abuse.
• We share our findings and make corrective action recommendations to the Board
and the CFPB; we do not manage agency programs or implement changes.
• We keep the Board chair, the CFPB director, and Congress fully informed of our
findings and corrective action recommendations, as well as the agencies’ progress in
implementing corrective action.
In addition to the duties set forth in the IG Act, Congress has mandated additional
responsibilities for our office. Section 38(k) of the Federal Deposit Insurance Act (FDI Act)
requires us to review failed financial institutions supervised by the Board that result in a
material loss to the Deposit Insurance Fund (DIF) and produce a report within 6 months. The
Dodd-Frank Wall Street Reform and Consumer Protection Act amended section 38(k) of the
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 3
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
FDI Act by raising the materiality threshold and requiring us to report on the results of any
nonmaterial losses to the DIF that exhibit unusual circumstances warranting an in-depth review.
Section 211(f) of the Dodd-Frank Act also requires us to review the Board’s supervision of any
covered financial company that is placed into receivership under title II of the act and produce a
report that evaluates the effectiveness of the Board’s supervision, identifies any acts or
omissions by the Board that contributed to or could have prevented the company’s
receivership status, and recommends appropriate administrative or legislative action.
The Federal Information Security Modernization Act of 2014 (FISMA) established a legislative
mandate for ensuring the effectiveness of information security controls over resources that
support federal operations and assets. In a manner consistent with FISMA requirements, we
perform annual independent reviews of the Board’s and the CFPB’s information security
programs and practices, including testing the effectiveness of security controls and techniques
for selected information systems.
Section 15010 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act established
the Pandemic Response Accountability Committee (PRAC) within the Council of the Inspectors
General on Integrity and Efficiency (CIGIE). PRAC is required to conduct and coordinate
oversight of covered funds and the coronavirus response to detect and prevent fraud, waste,
abuse, and mismanagement and identify major risks that cut across programs and agency
boundaries. PRAC is also required to submit reports related to its oversight work to relevant
federal agencies, the president, and appropriate congressional committees. The CIGIE chair
named our inspector general as a member of PRAC, and as such, we participate in PRAC
meetings, conduct PRAC oversight activities, and contribute to PRAC reporting responsibilities.
The economic disruptions caused by the COVID-19 pandemic resulted in an abrupt shock to
financial markets and affected many credit channels relied on by households, businesses, and
state and local governments. In response, the Board took steps to support the flow of credit to
U.S. households and businesses. Notably, the Board used its emergency lending authority under
section 13(3) of the Federal Reserve Act to create lending programs, with the approval of the
secretary of the U.S. Department of the Treasury, to ensure liquidity in financial markets and to
provide lending support to various sectors of the economy. In addition, the CFPB has played a
vital role throughout the pandemic by enforcing federal consumer protection laws and
protecting consumers from abuse.
OIG Reports and Other Products Related to the Broader Financial Sector
In accordance with section 989E(a)(2)(B) of the Dodd-Frank Act, the following highlights the
completed and ongoing work of our office, with a focus on issues that may apply to the broader
financial sector.
4 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
COMPLETED WORK, APRIL 1, 2023 – MARCH 31, 2024
Major Management Challenges for the Board and the CFPB
Although not required by statute, we biennially report on the major management challenges
facing the Board and the CFPB. These challenges identify the areas that, if not addressed, are
most likely to hamper the Board’s and the CFPB’s accomplishment of their strategic
objectives.
Among other items, we identified eight major management challenges for the Board:
• Strengthening Organizational Governance and Enterprise Risk Management
• Managing Hybrid Work and Workforce Planning, Updating the Human Capital
System, and Advancing Diversity Initiatives
• Remaining Adaptable While Supervising Financial Institutions
• Enhancing Oversight of Cybersecurity at Supervised Financial Institutions and
Service Providers
• Ensuring an Effective Information Security Program
• Evolving With Financial Sector Innovations
• Monitoring COVID-19 Pandemic Emergency Lending Facilities and Underlying
Loan Portfolios
• Ensuring That Physical Infrastructure Effectively Meets Mission Needs
Among other items, we identified four major management challenges for the CFPB:
• Ensuring an Effective Information Security Program
• Managing Human Capital to Maintain a Talented, Diverse, Inclusive, and Engaged
Workforce
• Continuing to Refine the Supervision and Enforcement Strategy
• Managing Consumer Complaints
The Board Can Further Enhance the Design and Effectiveness of the FOMC’s Investment
and Trading Rules, 2023-SR-B-006, April 26, 2023
Following multiple incidents involving senior System officials, the Federal Open Market
Committee (FOMC) adopted a new personal investment and trading policy that prohibits
covered individuals from purchasing individual securities, restricts active trading, and revises
certain public reporting and disclosure requirements. We assessed the design and
effectiveness of this policy as well as the Board’s and the Reserve Banks’ approach to
monitoring personal investment and trading activities for potential conflicts of interest.
We determined that the Board can further enhance the new FOMC personal investment and
trading policy. Specifically, requirements that apply to senior FOMC officials can be extended
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 5
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
to additional staff based on the risk presented by their access to confidential FOMC
information, ethics programs can be strengthened to make reviews of financial disclosure
reports more uniform and to enforce consequences for policy violations, and the information
individuals provide in their financial disclosure reports can be verified for completeness and
accuracy.
Our report contains six recommendations to strengthen the Board’s and the Reserve Banks’
approach to monitoring personal investment and trading activities for possible conflicts of
interest. The Board concurred with our recommendations.
Material Loss Review of Silicon Valley Bank, 2023-SR-B-013, September 25, 2023
Silicon Valley Bank (SVB)—which once had over $200 billion in total assets—failed in March
2023. SVB went into receivership and cost the DIF an estimated $16.1 billion. In accordance
with the requirements of section 38(k) of the Federal Deposit Insurance Act, as amended by
the Dodd-Frank Act, we conducted a material loss review to determine why SVB’s failure
resulted in a material loss to the DIF; to assess the Board’s and the Federal Reserve Bank of
San Francisco’s (FRB San Francisco) supervision during our period of review, January 2018
through March 2023; and to make recommendations, as appropriate.
SVB failed for several reasons. It was vulnerable to the business cycles of its customer base—
concentrated in science and technology—with a high share of uninsured deposits and large,
irregular cash flows. SVB also invested a large portion of deposits in securities with long-term
maturities and experienced significant unrealized losses on those securities as interest rates
rose. Further, SVB’s management and board failed to manage the risks of the bank’s rapid,
unchecked growth and concentrations. Finally, management’s ineffective communication about
the bank’s intent to raise capital, coupled with news of Silvergate Bank’s liquidation, led to a
$40 billion run on deposits with additional withdrawal requests totaling $100 billion that SVB
could not meet.
The Board and FRB San Francisco were responsible for ensuring that SVB conducted its
business activities in a safe and sound manner. However, their supervisory approach did not
evolve with SVB’s growth and increased complexity—for example, there were insufficient
examiner resources, and examiners lacked requisite expertise supervising a large, complex
institution. Further, the Board and FRB San Francisco did not effectively transition SVB
between supervisory portfolios. Finally, examiners did not closely scrutinize the risks that
rising interest rates posed to SVB’s investments.
Our report includes seven recommendations to improve banking organization supervisory
processes. The Board concurred with our recommendations.
6 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Review of the Supervision of Silvergate Bank, 2023-SR-B-014R, September 27, 2023
In March 2023, Silvergate Bank’s holding company announced its intent to voluntarily liquidate
the bank. Silvergate’s concentration in crypto industry deposit customers, rapid growth, and
multilayered funding risks led to the bank’s voluntary liquidation. We initiated this evaluation
in March 2023 on a discretionary basis following the voluntary liquidation announcement. We
assessed the Board’s and FRB San Francisco’s supervision of Silvergate. The scope of our
evaluation included supervisory activities conducted from 2013 to 2023 related to Silvergate’s
change in business strategy, deposit growth, concentrated business activities, and governance
and risk management practices.
We found that the Board and FRB San Francisco considered requiring Silvergate to file an
application under Regulation H as it evolved to a novel business model focused on the crypto
industry, but did not. Regulation H requires state member banks to obtain approval from the
Board before changing the general character of their business. In addition, we found that
examiners should have escalated concerns through stronger, earlier, and more-decisive
supervisory action; we identified ways in which FRB San Francisco could have strengthened
the process to transition Silvergate from the community banking organization portfolio to the
regional banking organization portfolio; we found that the Board’s examiner guidance does
not include information that could have helped examiners address the risks associated with
Silvergate’s business model and deposit composition; and we found that the Board does not
have guidance for examiners supervising banks projecting or experiencing significant, rapid
growth and does not have guidance on how examiners should assess whether a bank’s risk
management capabilities and key control functions have evolved with that growth.
Our report contains 12 recommendations to enhance supervisory processes based on lessons
learned from Silvergate’s voluntary liquidation. The Board concurred with our
recommendations. Given Silvergate’s status as an open institution and the confidential
supervisory and trade secret information described in our report, our full report is restricted.
Material Loss Review of Heartland Tri-State Bank, 2024-SR-B-004, February 7, 2024
Heartland Tri-State Bank, based in rural Kansas, had about $122 million in assets when it
failed in July 2023. The bank’s failure cost the DIF an estimated $54 million, prompting our
review.
Heartland failed because of alleged fraud by its CEO, who initiated wire transfers totaling
about $47.1 million of the bank’s funds as part of an apparent cryptocurrency scheme. Under
the CEO’s influence, bank employees circumvented internal controls and processed the
transfers. The wire transfers significantly impaired Heartland’s capital and liquidity, and the
bank became insolvent.
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 7
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
In earlier examinations, the Federal Reserve Bank of Kansas City had determined that
Heartland had adequate internal control policies for a bank of its size. When the Reserve
Bank became aware of the wire transfers, it promptly launched a target examination, but
Heartland’s financial troubles were already beyond its ability to repair.
Our report contains two recommendations to help the Board raise awareness among state
member banks of cryptocurrency scams and to train examiners on such scams and relevant,
preventive and detective controls at banks. The Board concurred with our recommendations.
FRB Boston Followed Its Processes for Monitoring the Credit Quality of Main Street
Lending Program Loans, 2023-FMIC-B-017, October 18, 2023
The Board authorized the MSLP to keep credit flowing to small and medium for-profit
businesses and nonprofits during the COVID-19 pandemic. The MSLP is administered by FRB
Boston, which established a special purpose vehicle to manage the MSLP loan portfolio. We
assessed the MSLP’s processes for monitoring credit quality, including credit scoring and
workout loan management.
To monitor the credit quality of MSLP loans, the MSLP special purpose vehicle team
established processes for quarterly credit scoring, including monitoring payment performance,
and workout loan management. The special purpose vehicle team followed its processes for
all of the loans in our sample.
Our report does not contain recommendations.
The Board and FRB Boston Generally Followed Their Process for Purchasing MSLP Loan
Participations but Can Formally Document Some Key Processes, 2023-FMIC-B-011, July
17, 2023
The Board authorized the MSLP during the COVID-19 pandemic to support lending to
businesses and nonprofits. Through the MSLP, lenders issued about $17.5 billion in loans. To
encourage the flow of credit, the MSLP, which is administered by FRB Boston, purchased loan
participations—a share of loan values— from lenders. We evaluated the Board and FRB
Boston’s process for purchasing MSLP loan participations.
All the loans we reviewed had complete and properly executed documentation, with reviews
of lender-submitted documents generally performed as required. However, some key
processes were not formally documented, which can lead to loss of institutional knowledge or
inconsistency in process.
Our report contains a recommendation to help the Board and FRB Boston ensure
consistency in their process for determining whether loans were purchased based on
inaccurate borrower certifications. The Board and FRB Boston concurred with our
recommendation.
8 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Following Established Processes Helped FRB New York and the Board Reduce Risks
Associated With Lending Facility Contracts, 2023-FMIC-B-005, April 17, 2023
The Federal Reserve Bank of New York (FRB New York) contracted with vendors to operate
certain emergency lending facilities supporting businesses and state and local governments
during the COVID-19 pandemic. We assessed the System’s vendor selection and management
processes for lending facilities operated by FRB New York.
FRB New York generally followed established processes for selecting and managing vendors,
while the Board provided oversight. Doing so helped foster transparency and consistency,
mitigate risks and conflicts of interest, and confirm that expected services were delivered. In
January 2023, FRB New York took additional steps to reduce risks associated with future
lending facility contracts by clarifying the vendor selection processes and identifying lessons
learned applicable to lending facility acquisitions.
Our report does not contain recommendations.
Results of Scoping of the Evaluation of the Board and Reserve Banks’ Cybersecurity
Incident Response Process for Supervised Institutions, 2023-SR-B-010, June 26, 2023
Cybersecurity risks present significant and dynamic challenges to financial institutions. A
significant cybersecurity incident at a Board-supervised financial institution could disrupt its
operations and ultimately affect financial stability. We evaluated the Board and Reserve Banks’
process for responding to cybersecurity incidents at supervised financial institutions.
During our scoping activities, we found that the Board’s guidance documents do not clearly
describe the mission or governance structure of the cybersecurity incident response process.
In addition, the Board and Reserve Banks’ responses to cybersecurity incidents have not
consistently followed the process described in guidance, and some staff were unclear of their
roles and responsibilities in the process, highlighting the need for enhanced training.
Our report includes six recommendations to enhance the effectiveness of the Board and
Reserve Banks’ process for responding to cybersecurity incidents at supervised institutions.
The Board concurred with our recommendations.
The Board’s Approach to Climate Risk Supervision at Financial Institutions, July 31, 2023
In this OIG Insights paper, we noted that the Board is in the early stages of its supervisory
work to assess climate-related financial risk to the safety and soundness of financial
institutions. The Board is developing guidance on climate-related financial risk management for
the largest financial institutions and has begun a pilot program to understand firms’ financial
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 9
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
positions under various plausible climate scenarios. However, uncertainty about the timing
and magnitude of the effects of climate change and the lack of quality data about climate risks
pose challenges for supervisors and financial institutions.
The Board Can Enhance Its Procedures and Controls for Protecting Confidential
Information in Supervision Central, 2023-SR-B-009, June 14, 2023
While supervising and examining banking organizations, Reserve Bank examiners collect
sensitive, nonpublic information, including personally identifiable information. The loss or
misuse of this information could harm Board operations and bank customers. We assessed
the Board’s and the Reserve Banks’ controls for protecting such information in certain
examination applications used for supervising community and regional banks.
We found that examiners do not consistently use a process to help purge sensitive
documents that are not required to be retained. In addition, some examiners may have access
to more sensitive personally identifiable information than is necessary for their job duties.
Our report includes two recommendations to help the Board better protect sensitive,
nonpublic information. The Board concurred with our recommendations.
2023 Audit of the Board’s Information Security Program, 2023-IT-B-015, September 29,
2023
The Office of Management and Budget’s fiscal year 2023–2024 guidance for FISMA reporting
directs IGs to evaluate the maturity level (from a low of 1 to a high of 5) of their agency’s
information security program for fiscal year 2023. In accordance with FISMA requirements,
we assessed the effectiveness of the Board’s (1) security controls and techniques for selected
information systems and (2) information security policies, procedures, standards, and
guidelines.
The Board’s information security program continues to operate effectively at a level-4
(managed and measurable) maturity. Since our review last year, we found that the Board has
taken steps to strengthen its information security program, for example, by expanding the
coverage of its vulnerability disclosure program to include all internet-accessible systems and
by strengthening its supply chain risk management program through improved documentation
of its processes.
However, the Board can strengthen its information security program in the identify and
protect function areas. Specifically, the Board should define its cybersecurity risk tolerance,
complete its cybersecurity risk register, define its process for consistently inventorying and
documenting necessary attributes for its web application and third-party systems, strengthen
mobile device security, and update and review its privacy impact assessments.
10 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Seven recommendations from our prior FISMA audit reports remain open. This report
contains seven new recommendations. The Board concurred with our recommendations.
The CFPB Can Enhance Certain Aspects of Its Enforcement Investigations Process, 2024-
SR-C-002, January 8, 2024
The CFPB investigates potential violations of federal consumer financial laws by entities or
individuals within its authority and initiates public enforcement actions when appropriate.
Timely actions, according to the agency, help to better protect consumers. We assessed the
efficiency of the CFPB’s process for conducting enforcement investigations, including the
timeline of the investigation process, and we reviewed the Office of Enforcement’s practices
for tracking and monitoring matters.
Since fiscal year 2017, the CFPB had not met its goal to file or settle 65 percent of its
enforcement actions within 2 years of opening an investigation. We found that tracking timing
expectations for key steps in the enforcement process may help reveal inefficiencies that, if
addressed, could mitigate delays during investigations. In addition, training staff on
documentation requirements will lead to more accurate, complete information on
enforcement matters.
Our report contains two recommendations designed to enhance certain aspects of the
CFPB’s enforcement investigations process. The CFPB concurred with our recommendations.
The CFPB Can Enhance Certain Practices to Mitigate Risks of Conflicts of Interest for
Division of Supervision, Enforcement and Fair Lending Employees, 2024-SR-C-007,
February 26, 2024
To foster public confidence in the integrity of the agency’s work, CFPB officials and staff must
independently and objectively execute their financial institution supervision and oversight
activities. We assessed the extent to which the CFPB promotes a focus on independence and
has policies, procedures, and controls to mitigate the risk of conflicts of interest among
Division of Supervision, Enforcement and Fair Lending staff.
The CFPB can mitigate the risk of conflicts of interest for Division of Supervision,
Enforcement and Fair Lending examiners by formally adopting a policy to clarify rotation
requirements for certain key examiners and by implementing an assignment tracking
mechanism to monitor rotations and ensure compliance with the policy. These actions will
promote objectivity, cross-training, and broader expertise among examiners while reducing
the risk of regulatory capture.
Our report contains two recommendations designed to further enhance the CFPB’s approach
to mitigating the risk of conflicts of interest. The CFPB concurred with our recommendations.
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 11
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
2023 Audit of the CFPB’s Information Security Program, 2023-IT-C-016, September 29,
2023
The Office of Management and Budget’s fiscal year 2023–2024 guidance for FISMA reporting
directs IGs to evaluate the maturity level (from a low of 1 to a high of 5) of their agency’s
information security program for fiscal year 2023. We contracted with an independent
contractor who, in accordance with FISMA requirements, assessed the effectiveness of the
CFPB’s (1) security controls and techniques for selected information systems and (2)
information security policies, procedures, standards, and guidelines.
The independent contractor found that the CFPB’s information security program continues to
operate effectively at a level-4 (managed and measurable) maturity. In addition, the contractor
noted the CFPB has strengthened its information security program, for example, by maturing
its information security continuous monitoring and supply chain risk management processes
and working to meet the zero-trust architecture requirements.
However, the contractor identified new opportunities to strengthen the CFPB’s information
security program in the area of contingency planning. Specifically, the CFPB can improve its
continuity of operations processes by ensuring that it conducts and maintains an enterprise
business impact analysis and can maintain resilience by ensuring that it schedules and performs
contingency plan testing at least annually for all its systems. In addition, the CFPB should
continue its prior efforts regarding data loss prevention and software asset management to
ensure that its program remains effective.
The CFPB has taken sufficient actions to close prior OIG FISMA audit recommendations
related to its account management, risk management, configuration management, and identity
and access management. This report includes one new recommendation designed to
strengthen the CFPB’s information security program with regard to contingency planning. The
CFPB concurred with our recommendation.
ONGOING WORK AS OF MARCH 31, 2024
Evaluation of the Federal Reserve System’s Paycheck Protection Program Liquidity
Facility (PPPLF)
In response to the COVID-19 pandemic, the Board established the PPPLF to extend credit to
financial institutions that originate loans through the U.S. Small Business Administration’s
guaranteed Paycheck Protection Program (PPP), taking the PPP loans as collateral. The PPPLF,
managed by the Federal Reserve Bank of Minneapolis and operated out of the 12 Federal
Reserve Banks, distributed billions of dollars to eligible lenders. We are assessing the
effectiveness of the System’s PPPLF processes for (1) identifying and managing risk and
unresolved loans, (2) addressing nonpayment, and (3) detecting and mitigating fraudulent
collateral.
12 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
2024 Audit of the Board’s Information Security Program
The Federal Information Security Modernization Act of 2014 (FISMA) requires that each
agency inspector general conduct an annual independent evaluation of their respective
agency’s information security program and practices. To meet FISMA requirements for 2024,
we are conducting an audit of the Board’s information security program. Our objectives are
to evaluate the effectiveness of the Board’s (1) security controls and techniques for selected
information systems and (2) information security policies, procedures, standards, and
guidelines. We will use the results from our audit to respond to the Office of Management
and Budget’s fiscal year 2024 FISMA reporting metrics for inspectors general.
Audit of the CFPB’s Civil Penalty Fund Allocation and Disbursement Process
The Dodd-Frank Act authorizes the CFPB to collect civil penalties from any person or entity
in a judicial or administrative action brought under federal consumer financial laws. The CFPB
maintains these funds in its Civil Penalty Fund, and they are available to be used for payments
to the victims of activities for which civil penalties have been imposed. The CFPB may use
excess civil penalty funds for the purpose of consumer education and financial literacy (CEFL)
programs. As of September 30, 2023, the Civil Penalty Fund had collected almost $3.4 billion,
of which it has allocated over $1.4 billion to victim compensation and $28.8 million to CEFL
programs. We are reviewing the CFPB’s processes for allocating funds to CEFL programs and
overseeing contracts for disbursing funds to victims.
Audit of the CFPB’s Consumer Response Operations
Pursuant to the Dodd-Frank Act, the CFPB’s Office of Consumer Response collects,
monitors, and responds to consumer complaints on financial services and products. The CFPB
uses these consumer complaints to help inform the agency’s supervision activities, enforce
federal consumer financial laws, and write rules and regulations. With an increase in consumer
complaints during the COVID-19 pandemic, Consumer Response faces an operational risk
with respect to its effectiveness in reviewing and monitoring consumer complaints. We are
assessing the effectiveness of the CFPB’s processes for reviewing and monitoring company
responses to consumer complaints.
Evaluation of the CFPB’s Examiner Commissioning Program
CFPB examiners conduct supervisory reviews and examinations of institutions under the
CFPB’s jurisdiction. Given these responsibilities, examiners play a key role in executing the
CFPB’s mission. In October 2014, the CFPB transitioned from its Interim Examiner
Commissioning Program to its formal Examiner Commissioning Program (ECP). Successfully
completing the ECP is a significant milestone in an examiner’s career, signifying an examiner’s
attainment of the broad-based technical expertise, knowledge, skills, and tools necessary to
perform the duties of a commissioned examiner. We completed an evaluation of the program
in September 2017 that resulted in recommendations designed to enhance the effectiveness of
Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau 13
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
the ECP, which have since been implemented. For this evaluation, we are assessing how the
program has been operating over the last few years. Specifically, we are assessing the CFPB’s
approach to examiner commissioning, including the case study component of the program.
Further, we are benchmarking the CFPB’s ECP against other financial regulators’ examiner
commissioning programs.
2024 Audit of the CFPB’s Information Security Program
The Federal Information Security Modernization Act of 2014 (FISMA) requires that each
agency inspector general conduct an annual independent evaluation of their respective
agency’s information security program and practices. To meet FISMA requirements for 2024,
we are conducting an audit of the CFPB’s information security program. Our objectives are to
evaluate the effectiveness of the CFPB’s (1) security controls and techniques for selected
information systems and (2) information security policies, procedures, standards, and
guidelines. We will use the results from our audit to respond to the Office of Management
and Budget’s fiscal year 2024 FISMA reporting metrics for inspectors general.
14 Office of Inspector General Board of Governors of the Federal Reserve System and Consumer Financial Protection Bureau
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
Commodity Futures Trading Commission
The CFTC OIG acts as an independent Office within the CFTC that conducts audits, investigations,
reviews, inspections, and other activities designed to identify fraud, waste and abuse in connection
with CFTC programs and operations, and makes recommendations and referrals as appropriate.
During this year Acting Inspector General Dr. Brett M. Baker served with distinction, and the
Commission appointed Christopher Skinner as the new permanent Inspector General in April 2024.
Background
The CFTC OIG was created in 1989 in accordance with the 1988 amendments to the Inspector
General Act of 1978 (P.L. 95-452). OIG was established as an independent unit to:
• Promote economy, efficiency and effectiveness in the administration of CFTC programs
and operations and detect and prevent fraud, waste and abuse in such programs and
operations;
• Conduct and supervise audits, evaluations, and investigations relating to the
administration of CFTC programs and operations;
• Review existing and proposed legislation, regulations and exchange rules and make
recommendations concerning their impact on the economy and efficiency of CFTC
programs and operations or the prevention and detection of fraud and abuse;
• Recommend policies for, and conduct, supervise, or coordinate other activities carried
out or financed by such establishment for the purpose of promoting economy and
efficiency in the administration of, or preventing and detecting fraud and abuse in, its
programs and operations; and
• Keep the Commission and Congress fully informed about any problems or deficiencies in
the administration of CFTC programs and operations and provide recommendations for
correction of these problems or deficiencies.
Office of Inspector General Commodity Futures Trading Commission 15
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
CFTC OIG operates independently of the Agency, and has not experienced interference from
the CFTC Chairman or Commissioners in connection with the conduct of any investigation,
inspection, evaluation, review, or audit, and our investigations have been pursued regardless of
the rank or party affiliation of the subject. The CFTC OIG consists of the Inspector General,
the Deputy Inspector General/Chief Counsel, the Assistant Inspector General for Auditing, the
Assistant Inspector General for Evaluations (vacant), the Assistant Inspector General for
Investigations (vacant), one Attorney-Advisor (vacant), two Senior Auditors, and one Senior
Program Analyst. The CFTC OIG obtains additional audit, investigative, and administrative
assistance through consultancies, contracts and agreements.
Role in Financial Oversight
The CFTC OIG has no direct statutory duties related to oversight of the futures, swaps and
derivatives markets; rather, the CFTC OIG acts as an independent office within the CFTC that
conducts audits, evaluations, inspections, investigations, and other activities designed to identify
fraud, waste, and abuse in connection with CFTC programs and operations, and makes
recommendations and referrals as appropriate. The CFTC’s annual financial statement and
Customer Protection Fund audits are conducted by an independent public accounting firm, with
OIG oversight.
Recent, Current or Ongoing Work in Financial Oversight
In addition to our work on CIGFO projects described elsewhere in this report, CFTC OIG
continued the following projects during the past year:
2021-I-4 Pay Protection Program Proactive Investigation
In May 2021, OIG began a proactive investigation (2021-I-4) in coordination with CIGIE’s
Pandemic Response Accountability Committee (PRAC), CIGIE’s Pandemic Analytics Center for
Excellence, and the Small Business Administration, involving multiple phases. The first Phase
identified CFTC employees who had obtained PPP loans and whether proper authorization for
outside business activities had been obtained. CFTC OIG made recommendations to the
Agency to improve the business processes and disclosures concerning outside business
activities. Phase II and Phase III involve potential oversight issues. The Phase II and Phase III
objectives are to:
• Identify CFTC registrants who have received PPP loans, with the potential goal of
recommending that CFTC increase oversight efforts to assure CFTC’s no-action relief
is followed properly, if warranted, as well as other potential recommendations with
regard to the oversight of registrants who have received PPP loans (including issues, if
any, indicating potential systemic impact), and indicia of fraud in connection with the
PPP loans identified; and
16 Office of Inspector General Commodity Futures Trading Commission
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
• Identify CFTC contractors who obtained PPP loans to identify any indicia of fraud or
potential reputational risks to the Agency.
OIG contracted with a third-party vendor to provide analytic support to examine the millions
of records received in this investigation. OIG has shared its findings and has collaborated with
other CIGFO OIGs on investigative methods to maximize the value of this investigation to the
oversight community. We reported our ongoing work on this project last year. In 2023 we
suspended this project due to staff departures. During this year an Acting Inspector General
began the process of hiring a new Assistant Inspector General for Investigations, and in April
2024 the Commission appointed Christopher Skinner as the new permanent Inspector General.
The new IG is evaluating the merits of this project to determine whether or not it warrants
further OIG engagement. We note that the PPP and Bank Fraud Enforcement Harmonization
Act of 2022 established a 10-year statute of limitations for criminal charges and civil
enforcement against a borrower who engages in fraud with respect to a Paycheck Protection
Program loan.
White Paper Evaluating CFTC Experience with Digital Assets
Digital assets—including, among other things, cryptocurrency—have been widely adopted and
used by both market participants and ordinary consumers. The CFTC has played an active role
in the digital asset space, offering information to the public in the form of education and
guidance as well as prosecuting digital asset-related conduct that violates the Commodity
Exchange Act. We reported our ongoing work on this project last year. During this year we
suspended this project due to staff departures. During the past year, due to staff shortages and
departures, a former Acting Inspector General terminated this white paper.
Office of Inspector General Commodity Futures Trading Commission 17
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
Federal Deposit Insurance Corporation
The FDIC OIG mission is to prevent, deter, and detect fraud, waste, abuse, and misconduct in FDIC
programs and operations; and to promote economy, efficiency, and effectiveness at the Agency.
Jennifer L. Fain was sworn in as the FDIC’s fourth presidentially appointed Inspector General on
January 11, 2024.
Background
The Federal Deposit Insurance Corporation (FDIC) was created by the Congress in 1933 as an
independent agency to maintain stability in the Nation’s banking system by insuring deposits and
independently regulating state-chartered, non-member banks. The FDIC insures deposits;
examines and supervises financial institutions for safety and soundness and consumer protection;
makes large, complex institutions resolvable; and manages receiverships.
The FDIC insures $17.34 trillion in domestic deposits at about 4,587 institutions, and promotes
the safety and soundness of these institutions by identifying, monitoring, and addressing risks to
which they are exposed. The FDIC is the primary Federal regulator for approximately 2,930 of
the insured institutions. The Deposit Insurance Fund balance totaled $121.8 billion as of
December 31, 2023. Active receiverships as of March 31, 2024 totaled 65, with assets in
liquidation of about $39.3 billion.
The Office of Inspector General (OIG) at the FDIC is an independent and objective oversight
unit established under the Inspector General (IG) Act of 1978, as amended. Our mission is to
prevent, deter, and detect fraud, waste, abuse, and misconduct in FDIC programs and
operations; and to promote economy, efficiency, and effectiveness at the Agency. We pursued
audits, evaluations, and other reviews throughout the year in carrying out this mission. Of
particular interest for this CIGFO report and implications for the broader financial sector, our
audit and evaluation work covered topics such as the effectiveness of FDIC examinations in
identifying and addressing risks related to Government-guaranteed loans for banks that
participate in such programs, the FDIC’s processes to ensure that financial institutions receive
18 Office of Inspector General Federal Deposit Insurance Corporation
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
actionable and relevant threat and vulnerability information, FDIC efforts to increase consumer
participation in the insured banking system, the FDIC’s Orderly Liquidation Authority, and
Material Loss Reviews of two of the largest bank failures with combined estimated total losses
of $18 billion.
Importantly, and in connection with matters affecting the financial sector, in February 2024,
our Office also published its assessment of the Top Management and Performance Challenges
Facing the FDIC. Our Top Management and Performance Challenges document summarizes
the most serious challenges facing the FDIC and briefly assesses the Agency’s progress to
address them, in accordance with the Reports Consolidation Act of 2000 and Office of
Management and Budget Circular A-136 (revised August 10, 2021).
In addition to the above areas related to the broader financial sector, our Office conducted
significant investigations into criminal and administrative matters often involving sophisticated,
complex multi-million-dollar frauds. These schemes involve bank fraud, embezzlement, money
laundering, currency exchange manipulation, and other crimes involving banks, executives,
directors, officials, insiders, and financial professionals. We are also working to detect and
investigate cybercrime cases that threaten the banks and banking sector. Our cases reflect the
cooperative efforts of other OIGs, U.S. Attorneys’ Offices (USAO), FDIC Divisions and Offices,
and others in the law enforcement community throughout the country. These working
partnerships contribute to ensuring the continued safety and soundness of the Nation’s banks
and help ensure integrity in the FDIC’s programs and activities.
Our Office also continues to play a key role in the investigation of individuals and organized
groups perpetrating fraud through the Paycheck Protection Program (PPP) under the
Coronavirus Aid, Relief, and Economic Security Act (CARES Act) and American Rescue Plan
(ARP). To date, we have opened 197 cases associated with fraud in the CARES Act and ARP
programs. We strongly support the Pandemic Response Accountability Committee’s Fraud Task
Force and the Department of Justice’s COVID-19 Fraud Enforcement Task Force. We will
continue to work in close collaboration with our law enforcement partners to address
pandemic-related fraud.
FDIC OIG Audits, Evaluations, and Reviews
During the 12-month period ending March 31, 2024, the FDIC OIG issued 14 audit and
evaluation-related products and made 102 recommendations to strengthen controls in FDIC
programs and operations. One of our reports identified $9.9 million in funds that could be
put to better use. In the write-ups below, we discuss certain of our issued products, as they
cover issues relevant to the broader financial sector.
FDIC Examinations of Government-Guaranteed Loans
Federal agencies administer several Government-guaranteed loan programs to assist individuals
and businesses with, among other things, buying homes, financing agricultural production,
Office of Inspector General Federal Deposit Insurance Corporation 19
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
financing businesses, and purchasing equipment. FDIC-supervised banks participate in these
programs, originating billions of dollars in Government-guaranteed loans. These programs
promote lending to rural and underserved communities and to borrowers with collateral
weaknesses or that lack adequate credit history. Without proper due diligence and supervision,
Government-guaranteed loan programs can present substantial risks to banks. These risks
include but are not limited to operational risk, compliance risk, reputational risk, fraud risk, and
strategic risk.
Our Office conducted an evaluation to determine the effectiveness of the FDIC’s examinations
in identifying and addressing risks related to Government-guaranteed loans for banks that
participate in Government-guaranteed loan programs. We determined that FDIC bank
examinations were not always effective in identifying and addressing risks related to
Government-guaranteed loans. We found that:
• The FDIC’s guidance did not adequately address risks present in Government-
guaranteed loan programs;
• The FDIC could improve its supervision of bank activities in Government-guaranteed
loan programs, including the Paycheck Protection Program;
• The FDIC’s guidance differed from that of other Federal bank regulators;
• The FDIC did not provide adequate training to examination personnel on
Government-guaranteed lending programs;
• The FDIC did not maintain adequate data to identify, monitor, and research bank
participation in Government-guaranteed loan programs;
• The FDIC did not effectively share information externally and internally to enhance
risk oversight; and
• The FDIC’s examination guidance did not provide clear instructions on the retention
of examination workpapers.
We made 19 recommendations to the FDIC to address the findings in our report. The FDIC
concurred or partially concurred with all of our recommendations and planned to complete
corrective actions by March 31, 2024.
Sharing of Threat and Vulnerability Information with Financial Institutions
Financial institutions face a wide range of significant and persistent threats to their operations.
Whether man-made or natural, these threats can disrupt the delivery of financial services and
inflict financial harm on consumers and businesses. The interconnected nature of the financial
20 Office of Inspector General Federal Deposit Insurance Corporation
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
services industry further elevates the potential impact that threats can have on financial
institutions. For example, many insured financial institutions rely on third-party service
providers to provide critical banking services. An incident at a large service provider could
have a cascading impact on a large number of financial institutions. If widespread, the impact
could ultimately diminish public confidence and threaten the stability of the United States
financial system.
Our Office conducted an evaluation to determine whether the FDIC has implemented
effective processes to ensure that financial institutions receive actionable and relevant threat
and vulnerability information. We determined the FDIC has implemented processes for the
sharing of threat and vulnerability information with financial institutions. For example, the
FDIC established formal procedures to communicate cyber threat and vulnerability
information. However, the FDIC can improve the effectiveness of its processes to ensure
financial institutions receive actionable and relevant threat and vulnerability information. We
determined that:
• The FDIC can improve its sharing of threat and vulnerability information with financial
institutions and other financial sector entities;
• The FDIC can improve its controls over the recording of computer-security incidents
to support threat intelligence operations and sharing activities;
• The FDIC can mature its threat information sharing program by establishing
procedures for sharing non-cyber related threat information and revising the
program’s existing threat sharing policies and procedures; and
• The FDIC can enhance its capabilities to identify threat and vulnerability information.
We made 10 recommendations to the FDIC to address the findings in our report. The FDIC
concurred with all of our recommendations and planned to complete corrective actions by
March 31, 2024.
FDIC Efforts to Increase Consumer Participation in the Insured Banking System
By way of background, the FDIC’s 2021 FDIC National Survey of Unbanked and Underbanked
Households found that an estimated 4.5 percent of U.S. households were unbanked—meaning
no one in the household had a checking or savings account at a bank or credit union.
Additionally, an estimated 14.1 percent of U.S. households were underbanked—meaning
someone in the household had a bank account, but they also used nonbank products or
services, such as money orders, check cashing, international remittances, rent-to-own services
or payday, pawn shop, tax refund anticipation, or auto title loans.
Office of Inspector General Federal Deposit Insurance Corporation 21
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
The FDIC defines economic inclusion as the general population’s ability to participate in all
aspects of a nation’s economy, to include access to safe, affordable financial products and
services. The FDIC published its Economic Inclusion Strategic Plan (EISP) in June 2019. Its
goal: to “promote the widespread availability and effective use of affordable, and sustainable
products and services from insured depository institutions that help consumers and
entrepreneurs meet their financial goals.” From 2020 to 2023, the FDIC identified an FDIC
Performance Goal to increase participation in the insured banking system through the
implementation of the FDIC EISP.
We conducted an evaluation to determine whether the FDIC developed and implemented an
effective strategic plan to increase the participation of unbanked and underbanked consumers
in the insured banking system. Key findings were as follows:
• The EISP aligned with several strategic planning best practices. However, the FDIC
could strengthen the effectiveness of future EISPs by incorporating additional best
practices into the strategic planning process. These include performing a
comprehensive assessment of the landscape; developing outcome-based measures for
monitoring and evaluating progress; and identifying the internal risks and resources
needed to achieve desired outcomes.
• The stated goal of the EISP generally supported the FDIC Performance Goal of
increasing consumer participation in the insured banking system. However, the FDIC
could strengthen connections between the annual FDIC Performance Goal and the
EISP by ensuring that the expressed intent of annual goals related to the FDIC’s
economic inclusion efforts matches the goals and objectives articulated in the EISP.
• The FDIC could improve the implementation of future EISPs by aligning internal
resources to achieve program objectives and measuring the outcomes of its economic
inclusion efforts.
• The FDIC’s risk mitigation strategies to address economic inclusion efforts could more
clearly address risks related to implementing strategic objectives, effective controls,
and responsive programs to promote economic inclusion.
We reported that collectively, these actions would help the FDIC make the best use of
Agency resources, ensure accountability, monitor progress, and make its strategic plan more
effective in promoting economic inclusion.
We made 14 recommendations in the report. The FDIC concurred with all
recommendations and plans to complete corrective actions by December 30, 2024.
22 Office of Inspector General Federal Deposit Insurance Corporation
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
The FDIC’s Orderly Liquidation Authority
Before the enactment of the Dodd-Frank Wall Street Reform and Consumer Protection Act
of 2010 (DFA), the FDIC only had the authority to resolve FDIC-insured depository
institutions. Title II of the DFA, Orderly Liquidation Authority (OLA) aimed to provide the
necessary authority to the FDIC to liquidate failing financial companies that pose a significant
risk to the financial stability of the United States in a manner that mitigates such risk and
minimizes moral hazard.
We conducted an evaluation to determine whether the FDIC maintained a consistent focus
on implementing the OLA program and established key elements to execute the OLA under
the DFA.
We determined that the FDIC has made progress in implementing elements of its OLA
program, including progress in OLA resolution planning for the global systemically important
financial companies (SIFC) based in the United States. However, we found that in the more
than 12 years since the enactment of the DFA, the FDIC had not maintained a consistent
focus on maturing the OLA program. Since the enactment of the DFA, the FDIC’s focus on
other important, but competing, priorities delayed maturity of the OLA program.
We also found that the FDIC had not fully established key elements to execute its OLA
responsibilities, including in the following areas:
• OLA Policies and Procedures. The FDIC had made significant progress in
developing high-level policies and procedures for the execution of an OLA resolution
of a systemically important bank holding company. However, it had not completed
operational-level policies and procedures, nor identified how it would need to adjust
its policies and procedures for an OLA resolution of other types of SIFCs. In addition,
the FDIC had not developed two regulations required by the DFA or completed
policies and procedures for ongoing OLA resolution planning activities.
• OLA Roles and Responsibilities. The FDIC had not fully defined governance and
individual practitioner-level roles and responsibilities related to the execution of an
OLA resolution.
• OLA Resources, Training, and Exercises. The FDIC needed to obtain additional
staff resources to plan for an OLA resolution, and to fully identify and document the
staff and contractor resources needed to execute an OLA resolution. In addition, the
FDIC needed to enhance OLA-related training and exercises to regularly ensure that
personnel had the skills needed to execute an OLA resolution.
• Monitoring of OLA Activities. The FDIC did not have adequate monitoring
mechanisms in place to ensure it promptly implemented the OLA program and
consistently measured, monitored, and reported on the OLA program status and
results.
Office of Inspector General Federal Deposit Insurance Corporation 23
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
• Crisis Readiness-Related Planning. The FDIC had not documented a readiness
plan for executing OLA resolution authorities in a financial crisis scenario involving
concurrent failures of multiple SIFCs.
Absent a consistent focus and fully established key elements for executing the OLA, the FDIC
may not be able to readily meet the OLA requirements for every type of SIFC the FDIC might
be required to resolve. If the FDIC were unable to resolve a SIFC, the banking sector and the
stability of the U.S. and global financial systems could be severely affected.
We made 17 recommendations to the FDIC intended to improve key elements for executing
the FDIC’s OLA responsibilities. The FDIC concurred with all of these recommendations and
plans to complete corrective actions by December 31, 2025.
Material Loss Review of Signature Bank of New York
On March 12, 2023, the New York State Department of Financial Services closed Signature
Bank of New York (SBNY) and appointed the FDIC as receiver. On April 28, 2023, the FDIC
estimated the loss to the Deposit Insurance Fund to be approximately $2.4 billion.
Under a contract overseen by the OIG, Cotton & Company Assurance and Advisory, LLC
(Cotton) performed the Material Loss Review. The objectives of the engagement were to (1)
determine why the bank’s problems resulted in a material loss to the Deposit Insurance Fund
and (2) evaluate the FDIC’s supervision of the bank, including the FDIC’s implementation of
the Prompt Corrective Action requirements of section 38 of the Federal Deposit Insurance
Act, and make recommendations for preventing any such loss in the future.
SBNY’s failure was caused by insufficient liquidity and contingency funding mechanisms, which
impeded the bank’s ability to withstand a run on deposits. In addition, SBNY management
prioritized aggressive growth over the implementation of sound risk management practices
needed to counterbalance the liquidity risk associated with concentrations in uninsured
deposits.
Cotton found that the FDIC:
• Missed opportunities to downgrade SBNY’s Management component rating and
further escalate supervisory concerns;
• Did not consistently perform supervisory activities in a timely manner and was
repeatedly delayed in issuing supervisory products;
• Appropriately downgraded SBNY’s Liquidity component rating, but changing market
conditions warrant the FDIC’s review and potential revision of examination guidance;
and
24 Office of Inspector General Federal Deposit Insurance Corporation
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
• Determined that SBNY was well capitalized throughout each examination cycle prior
to its failure based on defined capital measures.
Cotton made six recommendations intended to improve the FDIC’s supervision processes
and its ability to apply effective forward-looking supervision in a changing banking
environment. The FDIC concurred with all of the recommendations and planned to complete
corrective actions by March 31, 2024.
Material Loss Review of First Republic Bank
Several months after the failure of Signature Bank as discussed above, on May 1, 2023, the
California Department of Financial Protection and Innovation closed First Republic Bank and
appointed the FDIC as receiver. On June 5, 2023, the FDIC recorded a final estimated loss to
the Deposit Insurance Fund of $15.6 billion. Under another contract overseen by the OIG,
Cotton & Company Assurance and Advisory, LLC performed a Material Loss Review.
First Republic Bank’s failure was caused by contagion effects stemming from the failure of
other prominent financial institutions, which led to a run on deposits, significantly reducing its
liquidity and exposing vulnerabilities in its business strategy. Specifically, First Republic Bank’s
strategy of attracting high net-worth customers with competitive loan terms, and funding
growth through low-cost deposits, resulted in a concentration of uninsured deposits while
increasing the bank’s sensitivity to interest rate risk. This strategy ultimately led to a
significant asset/liability mismatch for the bank, and fair value declines on its portfolio of low-
yielding, long-duration loans, which limited its ability to obtain sufficient liquidity and
prevented its recovery.
Cotton determined that:
• The FDIC missed opportunities to take earlier supervisory actions and downgrade
First Republic Bank component ratings consistent with the FDIC’s forward-looking
supervisory approach;
• The FDIC assessed First Republic Bank’s uninsured deposits consistent with FDIC
policies, but the magnitude and velocity of uninsured deposit outflows warrants the
FDIC’s re-evaluation of assumptions and guidance pertaining to uninsured deposits;
and
• First Republic Bank was well-capitalized throughout each examination cycle based on
defined capital measures, but that the bank’s failure may warrant changes to the
guidelines establishing standards for safety and soundness, including the adoption of
noncapital triggers requiring regulatory actions.
Cotton made 11 recommendations intended to improve the FDIC’s supervision processes
and its ability to apply effective forward-looking supervision in a changing banking
environment. The FDIC concurred with all of the recommendations and planned to complete
corrective actions by July 31, 2024.
Office of Inspector General Federal Deposit Insurance Corporation 25
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Top Management and Performance Challenges
Our Top Management and Performance Challenges document summarizes the most serious
challenges facing the FDIC and briefly assesses the Agency’s progress to address them, in
accordance with the Reports Consolidation Act of 2000 and Office of Management and
Budget Circular A-136 (revised August 10, 2021). The Top Challenges document that we
issued in February 2024 was based on the OIG’s experience and observations from our
oversight work, reports by other oversight bodies, review of academic and relevant literature,
perspectives from Government agencies and officials, and information from private-sector
entities.
We identified nine Top Challenges facing the FDIC. The Challenges identify risks to FDIC
mission-critical activities and to FDIC internal programs and processes that support mission
execution. These Challenges included all aspects of the Challenges that we reported last year,
with important updates. Among these updates were the need for the FDIC to address
increasing staff attrition--especially for examiners--and to focus on improving the FDIC’s
workplace environment. We also noted that the failures of Signature Bank of New York and
First Republic Bank demonstrated the need for the FDIC to escalate supervisory actions when
risks are identified, consistent with the FDIC’s forward-looking supervision initiative. Further,
the FDIC should consider emerging risks in its failure estimation process and ensure that the
FDIC can execute its orderly liquidation resolution authority. Challenges identified were as
follows:
1. Strategic Human Capital Management at the FDIC
• Addressing FDIC Staff Attrition
• Managing a Wave of Prospective Retirements at the FDIC
• Sustaining a Work Environment Free from Discrimination, Harassment, and Retaliation
2. Identifying and Addressing Emerging Financial Sector Risk
• Escalating Supervisory Actions to Address Identified Risks
• Assessing Emerging Risks Through Data Gathering and Analysis
• Considering Emerging Risks in the FDIC’s Bank Failure Estimation Process
• Sharing Threat and Vulnerability Information with Financial Institutions
3. Ensuring Readiness to Execute Resolutions and Receiverships
• Readiness for FDI Act Resolutions
• Preparing for an Orderly Liquidation
26 Office of Inspector General Federal Deposit Insurance Corporation
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
4. Identifying Cybersecurity Risks in the Financial Sector
• Examining for Bank Third-Party Service Provider Cybersecurity Risk
• Improving Bank IT Examination Processes
• Ensuring FDIC Staff Have Requisite Financial Technology Skills
• Continuing to Assess Risks Posed by Emerging Technology
5. Assessing Crypto-Asset Risk
• Assessing the Impact of Crypto-Asset Risks to FDIC-Supervised Banks
• Clarifying Processes for Supervisory Feedback Regarding Bank Crypto-Asset-Related
Activities
6. Protecting Consumer Interests and Promoting Economic Inclusion
• Assessing Risks in Bank Consumer Services Models
• Improving the FDIC’s Ability to Increase Economic Inclusion
• Preparing to Examine for Changes to the Community Reinvestment Act
• Addressing Misuse of the FDIC Name and Misrepresentation of Deposit Insurance
7. Fortifying IT Security at the FDIC
• Strengthening the FDIC’s Information Security Profile
• Improving Information Security Controls
• Managing Systems Migration to the Cloud
• Protecting the FDIC’s Wireless Network
• Assessing the FDIC’s Ransomware Attack Readiness
8. Strengthening FDIC Contract and Supply Chain Management
• Improving Contract Management
• Addressing Supply Chain Risk Management
• Ensuring Contractors Are Appropriately Vetted and Are Not Performing Inherently Governmental
Functions
• Ensuring Whistleblower Rights and Protections for Contractor Personnel
9. Fortifying Governance of FDIC Programs and Data
• Strengthening Performance Goal Development and Monitoring
• Improving Internal Controls by Addressing Outstanding Recommendations
• Ensuring Data Quality to Assess Program Performance
Office of Inspector General Federal Deposit Insurance Corporation 27
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
FDIC OIG Investigations
Our Office is committed to partnerships with other OIGs, the Department of Justice (DOJ),
USAOs, and other state and local law enforcement agencies in pursuing criminal acts affecting
banks and in helping to deter fraud, waste, abuse, and misconduct. We play a key role in
investigating sophisticated schemes of bank fraud, embezzlement, money laundering,
cybercrime, and currency exchange rate manipulation—fraudulent activities affecting FDIC-
supervised or insured institutions. Whether it is bank executives who have caused the
failures of banks, or criminal organizations stealing from Government-guaranteed loan
programs, these cases often involve bank directors and officers, Chief Executive Officers,
attorneys, real-estate insiders, financial professionals, crypto-firms and exchanges, Financial
Technology (FinTech) companies, and international financiers.
The OIG also actively participates in many financial fraud and cyber working groups
nationwide to keep current with new threats and fraudulent schemes that can undermine the
integrity of the FDIC’s operations and the financial services industry as a whole.
Our investigative results over the 12 months ending March 31, 2024, included the following:
182 indictments; 106 convictions; 158 arrests; and potential monetary recoveries (fines,
restitution, asset forfeitures, settlements, special assessments) of more than $1.32 billion.
As illustrated in the case examples that follow, we continue to identify financial fraud schemes
that affect FDIC-supervised and insured institutions. We also partner with other agencies,
including the Small Business Administration (SBA), to identify fraud in the guaranteed loan
portfolios of FDIC-supervised institutions. These investigations are important, as large-scale
fraud schemes can significantly affect the financial industry and the financial condition of FDIC-
insured institutions. In this regard, and as illustrated below, we continue to investigate PPP
cases of individuals defrauding the Government guaranteed-loan program intended to help
those most in need during the pandemic crisis. In fact, as mentioned earlier, since inception
of the CARES Act, we have been involved in 197 such cases. Notably, during the period April
1, 2023 through March 31, 2024, the FDIC OIG’s efforts related to the Federal Government’s
COVID-19 pandemic response resulted in 82 indictments and informations; 47 arrests; and 41
convictions involving fraud in the CARES Act Programs. Fines, restitution ordered,
settlements, and asset forfeitures resulting from these cases totaled in excess of $77.6 million.
Examples from the past year illustrating the varied nature of our impactful investigative cases
follow.
Former Bank Chairman and Chief Executive Officer (CEO) Sentenced to 14 Years in Prison for
Conspiracy to Defraud Bank
Former First NBC (FNBC) Bank CEO, Ashton Ryan Jr., was sentenced to a term of
imprisonment of 14 years and 2 months for bank fraud and making false statements in bank
records. Ryan was ordered to pay restitution totaling over $214 million to the FDIC.
28 Office of Inspector General Federal Deposit Insurance Corporation
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Following a 5-week trial, a jury convicted Ryan in February 2023 on all 43 counts against him.
The charges related to Ryan’s tenure as President, CEO, and Chairman of the Board at
FNBC, a now-defunct Federally insured financial institution with its main branch in New
Orleans, Louisiana. Ryan and others conspired to defraud the bank through a variety of
schemes, including by disguising the true financial status of certain borrowers and their
troubled loans, and concealing the true financial condition of the bank from the bank’s board,
external auditors, and federal examiners. As Ryan’s fraud grew, it included several other bank
employees and business people from the Gulf South area. Several borrowers who conspired
with Ryan used FNBC money to pay Ryan individually or fund Ryan’s own businesses. Using
the bank’s money this way helped Ryan conceal his use of such money for his own benefit.
When the bank’s board, external auditors, and FDIC examiners asked about loans to these
borrowers, Ryan and his fellow conspirators lied about the borrowers and their loans, hiding
the truth about the borrowers’ inability to pay their debts without receiving new loans. As a
result, the balance on the borrowers’ fraudulent loans continued to grow, resulting,
ultimately, in the failure of FNBC in April 2017. This failure caused about $1 billion in losses
to the FDIC and the loss of approximately 500 jobs.
We also note that throughout the course of the investigation, many defendants pleaded guilty
to various counts of bank fraud, conspiracy to defraud FNBC, and false bank entries. These
defendants included, FNBC bank customers Jeffrey Dunlap, Kenneth Charity, Arvind “Mike”
Vira, Gary R. Gibbs, Warren G. Treme, Frank Adolph, Glen Diaz, a former lead trial
prosecutor in St. Bernard Parish, and his associates, Peter Jenevein and Mark Grelle.
In addition to the bank customers, three high-level bank employees also pleaded guilty to
various charges. These bank employees included Gregory St. Angelo, former counsel to
FNBC, Chief Credit Officer Bill Burnell, and Executive Vice President Brad Calloway.
Source: The FDIC Legal Division.
Responsible Agencies: This is a joint investigation by the FBI, FDIC OIG, and Federal Reserve
Board OIG.
Prosecuted by the USAO, Eastern District of Louisiana.
Tallahassee Couple Sentenced to Federal Prison for Wire Fraud Conspiracy, Money
Laundering Conspiracy, and Making False Statements Relating to COVID-19 Relief
Programs
Wilbert Jean Stanley, III and Felicia Jackson Stanley were sentenced, after previously pleading
guilty to one count each of wire fraud conspiracy, money laundering conspiracy, and making
false statements in connection with COVID-19 pandemic relief. Wilbert Stanley was
sentenced to 40 months in Federal prison, and Felicia Stanley was sentenced to 24 months in
prison.
Office of Inspector General Federal Deposit Insurance Corporation 29
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Between March 1, 2020, and September 1, 2021, the Stanleys made false and fraudulent
representations in applications to the Small Business Administration (SBA), financial
institutions, and other lenders, for three different Federal COVID-19 relief programs: PPP
loans, Economic Injury Disaster Loans (EIDL), and Shuttered Venue Operators Grants
(SVOG). The false representations included inflated average monthly payroll expenses and
the use of false tax forms as supporting documentation. The Stanleys submitted 166 false and
fraudulent EIDL applications, of which 50 were funded, in their names for businesses that they
owned and in the names of other individuals (whom they recruited). The Stanleys also
submitted 20 false and fraudulent PPP loan applications, and 3 false and fraudulent SVOG
applications in their names for businesses that they owned and in the names of other
individuals (whom they recruited). For most of the applications that the Stanleys submitted
(which were not in their names), the Stanleys had an arrangement with the named applicants
to receive a kickback from the named applicants, which was paid from the PPP, EIDL, and
SVOG proceeds.
Additionally, the Stanleys engaged in multiple monetary transactions that involved at least
$10,000 of fraudulently obtained PPP loan, EIDL, or SVOG proceeds that they obtained
through their scheme. Many of these transactions included payments for the purchase of real
estate and to invest in virtual currency.
In total, through their false applications for Federal COVID-19 relief funds, the Stanleys
attempted to obtain over $7 million for themselves and others, to which they were not
entitled. The Stanleys were successful in fraudulently obtaining over $4.8 million in such
funds.
Source: U.S. Attorney’s Office, Northern District of Florida.
Responsible Agencies: FDIC OIG, Treasury Inspector General for Tax Administration, Internal
Revenue Service-Criminal Investigation, and SBA OIG.
Prosecuted by the USAO, Northern District of Florida.
Twice Convicted Bank Fraud Felon Sentenced to 110 Months
Wavy Curtis Shain pled guilty to one count of bank fraud and one count of money laundering
in United States District Court, Western District of Kentucky. The victim institutions were
PNC Bank and Small Business Bank. Shain was sentenced to 110 months of incarceration,
followed by 5 years of supervised release. In addition, he was ordered to pay $4,455,755 in
restitution.
From 2019 to 2020, Shain, an individual previously convicted of mail fraud and bank fraud,
carried out a scheme to defraud multiple banks and non-bank lenders through an identity
theft and fraudulent documents scheme. While incarcerated on a prior bank fraud conviction,
30 Office of Inspector General Federal Deposit Insurance Corporation
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Shain met and befriended numerous other inmates while assisting in appealing their criminal
convictions. After his release from prison, Shain used the victims’ identities to obtain
fraudulent loans. He devised a scheme to defraud the banks by obtaining second mortgages
and refinance loans on homes owned by his friends and other associates without their
consent or knowledge. Shain created fraudulent identification and financial documents to
induce lenders into making loans. To hide the loans from the victims, Shain intercepted
correspondence from lenders by diverting late notifications to post office boxes he created in
furtherance of the fraud. In some instances, Shain posed as a lawyer to obtain the
information needed to carry out the fraud. He laundered the proceeds of his fraud through
real estate purchases, debt repayments, and the purchase of luxury cars. Shain also obtained
seven CARES Act loans by creating fraudulent businesses he claimed were owned by his
various victims.
Source: USAO, Western District of Kentucky.
Responsible Agencies: FDIC OIG and Internal Revenue Service-Criminal Investigation.
Prosecuted by the USAO, Western District of Kentucky.
***
Learn more about the FDIC OIG at www.fdicoig.gov
Follow us on X, formerly known as Twitter at FDIC_OIG.
LinkedIn: www.linkedin.com/company/fdicoig
Office of Inspector General Federal Deposit Insurance Corporation 31
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
Federal Housing Finance Agency
The Federal Housing Finance Agency (FHFA or Agency) Office of Inspector General (OIG) promotes the
economy, efficiency, and integrity of FHFA programs and operations, and deters and detects fraud,
waste, and abuse, thereby supporting FHFA’s mission. We accomplish our mission by conducting
audits, evaluations, inspections, compliance reviews, and investigations of the Agency’s programs and
operations, engaging in robust enforcement efforts to protect the interests of the American taxpayers,
and keeping our stakeholders fully and currently informed of our work.
Background
The Housing and Economic Recovery Act of 2008 established FHFA in July 2008. FHFA serves
as regulator and supervisor of several entities: Fannie Mae and Freddie Mac (the Enterprises);
Common Securitization Solutions, LLC (CSS), an affiliate of each Enterprise; the Federal Home
Loan Banks (FHLBanks) (collectively, the Enterprises, CSS, and the FHLBanks are the regulated
entities); and the FHLBanks’ fiscal agent, the Office of Finance. FHFA is responsible for ensuring
the regulated entities’ safety and soundness so that they serve as reliable sources of liquidity
and funding for housing finance and community investment. As of December 31, 2023, the
Enterprises collectively reported more than $7.6 trillion in assets and the FHLBanks reported
almost $1.3 trillion.
Since September 2008, FHFA also has served as the Enterprises’ conservator. Initially, the
conservatorships were intended to be a temporary measure during a period of extreme stress
to stabilize the mortgage markets and promote financial stability. They are now in their
sixteenth year.
OIG’s Risk-Based Oversight Strategy
FHFA’s dual roles as the regulated entities’ supervisor and the Enterprises’ conservator
present unique challenges for OIG. These dual responsibilities put FHFA in a position
different from other financial regulators, and OIG structures its oversight program to
rigorously examine the Agency’s exercise of both responsibilities. As part of that
32 Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
oversight, OIG makes informed and targeted choices about what we audit, evaluate,
review for compliance, inspect, and investigate. OIG focuses resources on the areas of
greatest risk to FHFA and its regulated entities by monitoring, analyzing, and disseminating
information on both existing and emerging risks.
Management and Performance Challenges
An integral part of OIG’s oversight is to identify and assess FHFA’s top management and
performance challenges and align oversight work with these challenges. On an annual
basis, we assess and report to the FHFA Director our view of the Agency’s most
significant management and performance challenges that, if not addressed, could adversely
affect FHFA’s accomplishment of its mission. Our memorandum identifying FHFA’s most
significant management and performance challenges for Fiscal Year (FY) 2024 is available
on our website. A summary of the planned oversight activities during FY 2024 is discussed
in our Annual Plan
FHFA’s most significant management and performance challenges for FY 2024 are:
• Continue strengthening supervision of the regulated entities
• Continue stewardship of the Enterprise conservatorships
• Respond to market volatility and change
• Enhance oversight of cybersecurity at the regulated entities and ensure an effective information
security program at FHFA
• Ensure oversight of counterparty risk, third-party risk, and fourth-party risk at the regulated entities
• Strengthen oversight of the regulated entities’ model risk
• Oversee people risk at the regulated entities and enhance FHFA’s human capital management
• Ensure resiliency at the regulated entities and at FHFA
Many of these challenges reiterate themes we identified in prior years.
Significant Reports
OIG focuses much of its oversight activities on identifying vulnerabilities in these areas and
recommending positive, meaningful actions that the Agency could take to mitigate these
risks and remediate identified deficiencies. Taken together, our body of work published
between April 1, 2023, and March 31, 2024, provides important insights across FHFA’s
programs and operations, including the entities under the Agency’s purview.
Enterprises and CSS
FHFA’s Division of Enterprise Regulation (DER) serves as regulator and supervisor for the
Enterprises and their affiliate, CSS. During the relevant period we assessed the
effectiveness of those functions in a number of key risk areas.
Office of Inspector General Federal Housing Finance Agency 33
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
EVL-2024-001 verified that DER completed several examination activities focused on
Fannie Mae’s business resiliency practices during the 2021 and 2022 examination cycles.
We also confirmed that DER examiners assessed the Enterprise’s practices against criteria
from FHFA’s advisory bulletin on business resiliency management. Similarly, we found in
COM-2024-002 that DER completed all planned ongoing monitoring activities reflected in
the 2022 examination plans for Fannie Mae and CSS as scheduled. No activities were
canceled, amended, delayed, or deferred. In another report, EVL-2023-003, we found that
examiners completed work sufficient for DER to determine whether the Enterprises’
credit default models met supervisory expectations. AUD-2024-003 found that DER’s
examination teams conducted effective oversight to ensure that the Enterprises managed
nonbank seller/servicers’ risks. However, DER has not developed policies and procedures
for reviews of nonbank seller/servicers or policies and procedures that govern the
monitoring and analysis work of DER’s Nonbank Seller Servicer Risk Monitoring Branch.
In COM-2024-005, we concluded that the Agency conducted active oversight of both
Enterprises’ fraud risk management programs, including examination activity pertaining to
selected fraud management expectations.
In light of its roles as regulator and supervisor, as well as conservator, FHFA’s actions
relative to the Enterprises can have broad effects on the housing finance industry.
According to FHFA, modernizing the appraisal process can create a more streamlined and
accurate property valuation process. In AUD-2024-001, we explained that the Enterprises
incorporated desktop appraisals into their Selling and Seller/Servicer Guides and submitted
the required quarterly reports to FHFA containing key performance metrics. We found
that FHFA did not document reviews of desktop appraisal reports in accordance with
internal control standards. While we acknowledge the current de minimis volume of
desktop appraisals, FHFA management may nevertheless be challenged in assessing the
effectiveness of desktop appraisals without documenting its reviews.
We assessed FHFA’s implementation of the requirements in the 2018 Economic Growth,
Regulatory Relief, and Consumer Protection Act that apply to the validation and approval
of credit score models used by the Enterprises in EVL-2024-002. We concluded that
FHFA performed the independent analysis required by the Agency’s Regulation on
Validation and Approval of Credit Score Models in general accord with the Act. We
offered four recommendations to improve FHFA’s review process through instructional
guidance and to enhance the level of detail and clarity in its documentation. FHFA agreed
to implement them.
FHLBank System
FHFA also serves as supervisor and regulator of the FHLBank System. Specifically, the
Agency’s Division of Federal Home Loan Bank Regulation (DBR) is responsible for
ensuring the FHLBanks’ safe and sound operation. In AUD-2024-004, we concluded that
DBR conducted effective oversight of the FHLBanks’ management of third-party provider
risks. While we found that DBR did not fully document sampling in the examination
workpapers as required by FHFA’s examination practice guidance, the samples with
34 Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
documentation concerns were a small part of DBR’s overall exam work and, therefore, did
not affect our overall conclusion on the effectiveness of DBR’s oversight. Another report,
COM-2024-001, concluded that FHFA has taken steps to strengthen its oversight of the
FHLBanks’ community support requirements and to address the deficiencies we identified
in a 2015 report, including the failure to adhere to its examination schedule and to review
all FHLBank members.
In response to an abrupt increase in demand for FHLBank advances and the collapse of
several member banks, we assessed in EVL-2023-004 the extent to which DBR adapted its
2023 examination planning for a sample of six FHLBanks. Based on our sample, we found
that DBR planning practices generally incorporated previously identified areas of high risk
for further review. We also found that examiners generally complied with the intent of
DBR’s workpaper standards and adjusted their examination planning in response to the
heightened risk environment resulting from the March 2023 market disruption.
Agency Operations
Our body of work encompasses not only FHFA’s oversight of the regulated entities but
also the Agency’s internal operations. Like many organizations, FHFA relies on both
employees and contractors to accomplish its mission. We conducted a review to follow
up on our 2015 report analyzing FHFA workforce and diversity data. In COM-2024-004,
we concluded that FHFA regularly performed analysis of workforce data and assessed
trends in hiring, awards, and promotions. We also found in COM-2024-003 that FHFA
complied with our previous recommendation to include in all open market solicitations
and awards above a specified threshold certain regulatory language implementing statutory
protections for contractor employees who engage in whistleblowing.
FHFA must also manage information risk as a core component of Agency operations. In
AUD-2023-006, our contracted certified independent accounting firm found that the
Agency had generally implemented comprehensive privacy and data protection policies,
procedures, and practices governing the Agency’s collection, use, sharing, disclosure,
transfer, storage, and security of information in an identifiable form relating to Agency
employees and the public, consistent with legal and regulatory guidance. However, the
Agency did not fully achieve implementation of certain privacy requirements. The same
independent accounting firm concluded in AUD-2023-004 that, collectively, the Agency’s
information security programs and practices were effective and complied with the Federal
Information Security Modernization Act and related information security policies and
procedures, standards, and guidelines by achieving an overall Level 4 – Managed and
Measurable maturity level. Although the Agency implemented effective information
security programs and practices, a subset of selected controls was not fully effective. To
support our ongoing oversight of FHFA’s compliance with the Federal Information Security
Modernization Act, we periodically audit FHFA’s networks and information security. In
AUD-2023-008, we found that FHFA effectively implemented spam protection security
control, safeguarding its network and systems against external threats. We also found
Office of Inspector General Federal Housing Finance Agency 35
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
vulnerabilities in FHFA’s websites of which its Office of Technology and Information
Management was unaware because it was not using its own scanning tool. We issued 17
recommendations related to these information security shortcomings, all of which were
accepted by FHFA.
Investigative Accomplishments
OIG’s investigative mission is to prevent and detect fraud, waste, and abuse in the
programs and operations of FHFA and its regulated entities. OIG’s Office of Investigations
executes its mission by investigating allegations of significant criminal and civil wrongdoing
that affect the Agency and its regulated entities. The Office’s investigations are conducted
in strict accordance with professional guidelines established by the Attorney General of
the United States and also with the Council of the Inspectors General on Integrity and
Efficiency’s Quality Standards for Investigations.
The Office of Investigations is comprised of highly trained law enforcement officers,
investigative counsels, analysts, and attorney advisors. We maximize the impact of our
criminal and civil law enforcement efforts by working closely with federal, state, and local
law enforcement agencies nationwide.
The Office of Investigations is the primary federal law enforcement organization that
specializes in deterring and detecting fraud perpetrated against the Enterprises, which
collectively held more than $7.6 trillion worth of assets as of December 31, 2023. Each
year, the Enterprises acquire millions of mortgages worth hundreds of billions of dollars.
The Office of Investigations also investigates cases involving the 11 regional FHLBanks,
which had almost $1.3 trillion in assets as of December 31, 2023, and, in some instances,
cases involving banks that are members of the FHLBanks.
Notable Criminal Cases
Former Mortgage Company Executives Sentenced in $7 Million Mortgage Fraud Scheme,
California
During the reporting period, in Sacramento Superior Court, a former mortgage company
president and former owner were sentenced for their roles in a $7 million mortgage fraud
scheme throughout California that victimized elderly people in financial distress who
sought mortgage relief services from Grand View Financial LLC (Grand View). Several of
the affected mortgage loans were owned or guaranteed by the Enterprises.
The former president of Grand View, Robert Sedlar, was sentenced to 25 years and four
months in prison and ordered to pay $158,155 in restitution. Former Grand View owner
Steven Rogers was sentenced to 10 years in prison and ordered to pay $154,930 in
restitution, jointly and severally.
36 Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
According to court records, Grand View advertised assistance to desperate homeowners
facing foreclosure. The conspirators promised consumers that if they transferred title of
their house to Grand View and paid money, the company would eliminate the mortgage
lien and deed the home back to the homeowner, clear of any liens. They filed false court
documents, false documents with county recorders’ offices, and false bankruptcies that
stalled the foreclosures but did nothing to eliminate the liens, all while collecting funds
from the victims.
Every single victim lost their home as a result.
Former Wells Fargo Bank Executive Sentenced for Role in Account Sales, California
On September 15, 2023, the former head of Wells Fargo’s retail banking division, Carrie
Tolstedt, was sentenced to three years of probation, including six months of home
confinement, and ordered to pay a $100,000 fine in connection with the bank’s widespread
sales practices misconduct, which included opening millions of unauthorized accounts.
Wells Fargo is a member bank of multiple FHLBanks. Tolstedt pleaded guilty to
obstructing a government examination.
According to court records, from approximately 2007 to 2016, Tolstedt was head of the
Community Bank and Wells Fargo’s senior executive vice president of community banking.
Community Bank managed many of the products that Wells Fargo sold to individual
customers and small businesses, including checking and savings accounts, certificates of
deposit, and debit cards.
Wells Fargo previously admitted that, from 2002 to 2016, excessive sales goals led
Community Bank employees to open millions of unauthorized or fraudulent accounts.
Many of these practices were referred to within Wells Fargo as “gaming.” Gaming
included using existing customers’ identities, without their consent, to open accounts, then
forging customer signatures and creating personal identification numbers to activate
unauthorized debit cards.
According to her plea agreement, by 2004, Tolstedt was aware of sales practices
misconduct within Community Bank and that employees were terminated each year for
gaming. By 2006, corporate investigations uncovered steadily increasing employee
terminations for gaming. The misconduct was linked in part to sales goals within
Community Bank. Termination numbers likely underestimated the scope of the problem.
Although Community Bank eventually took steps to identify sales misconduct, the
measures flagged only a small portion of activity for investigation. As of 2014, only about 1
percent of the most egregious employees engaging in “red flag” activity were investigated.
The remaining 99 percent were left unexamined.
Office of Inspector General Federal Housing Finance Agency 37
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
In 2015, Tolstedt participated in a memorandum that she knew would be provided to the
Office of the Comptroller of the Currency for its examination of sales practice issues at
Wells Fargo. To minimize the scope of misconduct within Community Bank, Tolstedt
failed to disclose statistics for employee termination or resignation, nor did she disclose
the internal investigation of employees who were flagged for potential sales practices
misconduct.
In 2020, Wells Fargo acknowledged the widespread sales practices misconduct within
Community Bank and paid a $3 billion penalty.
UBS Pays $1.435 Billion for Fraud in the Sale of Residential Mortgage-Backed Securities,
New York
On August 14, 2023, UBS AG and several of its U.S. affiliates agreed to pay $1.435 billion
to settle a civil action alleging misconduct related to UBS’ underwriting and issuance of
residential mortgage-backed securities (RMBS) in 2006 and 2007. The securitized loan
packages included loans insured by the Enterprises.
Following an extensive investigation, the United States filed a complaint alleging that UBS
defrauded investors in connection with the sale of 40 RMBS. The complaint alleged that
UBS knowingly made false and misleading statements to buyers in violation of the Financial
Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA). FIRREA’s alleged
violations involved mail, wire, and bank fraud statutes.
Additionally, contrary to UBS’ representations, UBS allegedly knew that significant
numbers of the loans backing the RMBS did not comply with underwriting guidelines.
Further, UBS knew the property values were unsupported and that many loans had not
followed consumer protection laws. UBS was allegedly aware because it had conducted
extensive due diligence prior to the RMBS’ issuance. Ultimately, the 40 RMBS sustained
substantial losses.
Nomura Securities International Will Pay a $35 Million Penalty for Fraudulent Trading of
Residential Mortgage-Backed Securities, Connecticut
On August 22, 2023, Nomura Securities International (NSI) and the U.S. Attorney’s Office
entered into a non-prosecution agreement relating to NSI’s fraudulent trading of RMBS,
which included loans insured by the Enterprises.
As part of the agreement, NSI will pay a penalty of $35 million as well as pay $807,717 in
restitution to victim customers. Victims include firms affiliated with recipients of federal
bailout funds through the Troubled Asset Relief Program and firms investing as fiduciaries
on behalf of pension funds, charitable and educational endowments, insurance companies,
and others.
38 Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
The government’s investigation revealed that NSI, principally from its trading floor in New
York City, perpetrated a scheme from 2009 to 2013 to defraud its customers by
increasing its profits on RMBS trades. NSI conducted this scheme by and through its
employees, who acted with the knowledge, encouragement, and participation of NSI
supervisors, including those tasked with compliance responsibilities. Individual RMBS
traders were also criminally prosecuted for their roles in this scheme.
NSI misrepresented material facts in RMBS trades and then lied to those who suspected
that they had been the victims of fraud. NSI concealed its fraudulent conduct from its
customers, and from its own employees who were not participants in the scheme, to
prevent or delay discovery.
Seventeen Sentenced in Multimillion-Dollar COVID Relief Fraud Scheme, Texas
From October 2023 through February 2024, in the Southern District of Texas, 17
conspirators were sentenced for their roles in fraudulently obtaining and laundering
millions of dollars in forgivable Paycheck Protection Program (PPP) loans.
• Amir Aqeel—180 months in prison, three years supervised release, and ordered to
pay over $17.2 million in restitution, jointly and severally, and over $5.5 million in a
money judgment;
• Hamza Abbas—44 months in prison, three years supervised release, and ordered to
pay over $2.5 million in restitution, jointly and severally, and $373,067 in a money
judgment;
• Pardeep Basra—41 months in prison, three years supervised release, and ordered to
pay over $2.3 million in restitution, jointly and severally, and $422,395 in forfeiture;
• Rifat Bajwa—36 months in prison, three years supervised release, and ordered to pay
over $3.8 million in restitution, jointly and severally, and $95,000 in a money judgment;
• Abdul Fatani—36 months in prison, three years supervised release, and ordered to
pay $511,520 in restitution, jointly and severally;
• Khalid Abbas—30 months in prison, three years supervised release, and ordered to
pay over $2 million in restitution, jointly and severally, and $373,067 in a money
judgment;
• Richard Reuth—30 months in prison, three years supervised release, and ordered to
pay over $1.3 million in restitution, jointly and severally, and $135,196 in a money
judgment;
Office of Inspector General Federal Housing Finance Agency 39
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
• Siddiq Azeemuddin—24 months in prison, three years supervised release, and ordered
to pay over $3.1 million in restitution, jointly and severally;
• Nishant Patel—24 months in prison, three years supervised release, and ordered to
pay $474,993 in restitution, jointly and severally, and $292,133 in forfeiture;
• Syed Ali—24 months in prison, three years supervised release, and ordered to pay
$937,499 in restitution, jointly and severally, and $178,328 in a money judgment;
• Muhammad Anis—21 months in prison, three years supervised release, and ordered
to pay $483,333 in restitution, jointly and severally, and $279,044 in a money
judgment;
• Ammas Uddin—18 months in prison, three years supervised release, and ordered to
pay $498,415 in restitution, jointly and severally, and $92,095 in a money judgment;
• Arham Uddin—18 months in prison, three years supervised release, and ordered to
pay $491,664 in restitution, jointly and severally, and $103,881 in a money judgment;
• Raheel Malik—18 months in prison, three years supervised release, and ordered to
pay over $3.1 million in restitution, jointly and severally;
• Bijan Rajabi—13 months in prison, three years supervised release, and ordered to pay
$634,232 in restitution, jointly and severally;
• Jesus Acosta Perez—12 months and a day in prison, three years supervised release,
and ordered to pay $391,300 in restitution, jointly and severally, and $171,290 in a
money judgment; and
• Harjeet Singh—five years of probation and ordered to pay $486,083 in restitution,
jointly and severally.
According to court documents, in the overall scheme, conspirators submitted more than
80 false and fraudulent PPP loan applications. They falsified the number of employees and
the average monthly payroll expenses of the applicant businesses. In total, the scheme
participants sought over $35 million in PPP loan funds and obtained approximately $18
million in PPP loan proceeds.
Further, some of the money was laundered by writing checks to fictional employees.
Those who received checks allegedly included some of the conspirators and their relatives.
The fake paychecks were then allegedly cashed at Fascare International Inc. doing business
as Almeda Discount Store, a check-cashing company. Charging documents alleged that
over 1,100 falsified paychecks totaling more than $3 million in fraudulent PPP loan
proceeds were cashed at Almeda.
40 Office of Inspector General Federal Housing Finance Agency
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Two Conspirators Sentenced to a Combined 34 Years in Debt Elimination Fraud Scheme,
Maryland
In February 2024, in the District of Maryland, two conspirators were sentenced to a
combined 34 years in prison for their roles in a debt elimination fraud scheme. Willie
Hicks was sentenced to 22 years in prison, three years supervised release, and ordered to
pay over $3.2 million in restitution, jointly and severally, and over $1.6 million in a
forfeiture money judgment. Mary Ann Mendoza was sentenced to 12 years in prison,
three years supervised release, and ordered to pay over $3.2 million in restitution, jointly
and severally, and $981,293 in a forfeiture money judgment.
In October 2023, after a seven-day trial, a federal jury convicted Hicks and Mendoza of
conspiracy to commit wire and mail fraud and wire fraud.
Hicks and Mendoza, who represented themselves as partners and as husband and wife,
held in-person trainings purporting to educate victim-debtors on how to discharge
consumer debt, including mortgage debt. Trial testimony revealed that during the debt
elimination classes, Hicks, who claimed to be an attorney, and Mendoza told victims that
on the backs of their social security cards and birth certificates was a number that
unlocked access to a special bank account with funds owed to the victims by the U.S.
government.
Hicks, Mendoza, and their associates offered to assist in settling the victim-debtors’ debt
for a fee equal to a percentage of their outstanding debt. Payment was accepted in the
form of cash, wire transfers, personal and cashier’s checks, and the use of the victim-
debtors’ credit. Victim-debtors also paid the defendants by liquidating their retirement
savings, leasing apartments, and purchasing vehicles and office equipment and
supplies. One victim transferred almost $100,000 from a bank account to fraudulent
corporate entities controlled by Hicks and Mendoza. Testimony showed that victim-
debtors were induced into providing the conspirators with over a million dollars in cash
and other forms of payment during the scheme.
Several victim-debtors sought to have their mortgages extinguished with their lenders
through this scheme.
Office of Inspector General Federal Housing Finance Agency 41
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
U.S. Department of Housing and Urban Development
The U.S. Department of Housing and Urban Development (HUD), Office of Inspector General (OIG),
safeguards HUD’s programs from fraud, waste, and abuse and identifies opportunities for HUD
programs to progress and succeed.
Background
While organizationally located within HUD, HUD OIG provides independent oversight of
HUD programs and operations, which are intended to create strong, sustainable, inclusive
communities and quality affordable homes for all.
HUD has two component entities that have a major impact on the Nation’s financial
system: the Federal Housing Administration (FHA) and the Government National
Mortgage Association (Ginnie Mae). As one of the largest mortgage insurers in the world,
FHA protects lenders against losses when homeowners, multifamily property owners, and
healthcare facilities default on their loans. FHA has insured approximately 54 million
single-family loans since its inception in 1934. 1 FHA reported that in fiscal year 2023 it
served a total of 732,319 forward mortgage borrowers. 2 This included 581,725 purchase
mortgages with over 82 percent going to first-time home buyers. In FY 2023, FHA
endorsed a total of $208.73 billion in forward mortgages, which was down 18.31 percent
from FY 2022. FHA’s portfolio also included 3,520 insured residential care facilities, and
58 hospitals. 3 As of December 2023, FHA had a combined insurance portfolio valued at
$1.38 trillion. 4 FHA receives limited congressional funding and is primarily self-funded
through mortgage insurance premiums.
Ginnie Mae is a self-financing, U.S. Government corporation within HUD. It approves
lenders (known to Ginnie Mae as issuers) to issue mortgage-backed securities (MBS)
secured by pools of government-backed home loans. These loans are insured or
guaranteed by FHA, HUD’s Office of Public and Indian Housing (PIH), the U.S. Department
1
https://www.hud.gov/sites/dfiles/CFO/documents/2025_CJ_Program_-_FHA.pdf, page 29-10
2
2023FHAAnnualReportMMIFund.pdf (hud.gov), pages 6 and 18
3
https://www.hud.gov/sites/dfiles/CFO/documents/2025_CJ_Program_-_FHA.pdf, page 29-10
4
2023FHAAnnualReportMMIFund.pdf (hud.gov), page 73
42 Office of Inspector General U.S. Department of Housing and Urban Development
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
of Veterans Affairs, and the U.S. Department of Agriculture. Ginnie Mae guarantees
investors the timely payment of principal and interest on MBS backed by the full faith and
credit of the United States government. If an issuer of an MBS fails to make the required
pass-through payment of principal and interest to investors, Ginnie Mae is required to
advance the payment as part of its guarantee and, in the instances of issuer default, will
assume control of the issuer’s MBS pools and the servicing of the loans in those pools.
The purchasing, packaging, and reselling of mortgages in a security form frees up funds that
lenders use to originate more loans. In fiscal year 2023, Ginnie Mae issued $404 billion
MBSs, pushing the total MBS outstanding to over $2.476 trillion. 5
HUD OIG Oversight Relating to Financial Matters
HUD OIG strives to influence positive outcomes for HUD programs and operations through
timely and relevant oversight, while safeguarding HUD’s programs from fraud, waste, and abuse.
HUD OIG’s oversight efforts focus on identifying and addressing HUD’s most significant
management challenges, including through our Top Management Challenges for Fiscal Year
2024 report highlighting the following areas most related to the financial sector:
Mitigating Counterparty Risks in Mortgage Programs – FHA and Ginnie Mae
must work with outside entities, including property owners, banks, nonbank lenders,
and issuers. Each one of these outside entities has responsibilities and obligations they
must meet in responsibly doing business with the government. FHA, Ginnie Mae, and
HUD must identify, mitigate, and manage risks related to each entity (also referred to
as “counterparty”) to limit loss to the Federal Government and minimize disruption to
the mortgage market.
Managing Fraud Risk and Improper Payments – Fraud poses a significant risk to
the integrity of Federal programs and erodes public trust in government. Beyond the
monetary loss to taxpayers, fraud against HUD programs reduces HUD’s ability to
meet the needs of vulnerable communities with critical housing needs. HUD is
challenged to develop more robust fraud risk assessments and fraud risk frameworks
in its programs, integrate program accountability measures. While managing fraud risk
is a pervasive challenge across the government, it is critical that HUD address this risk
since fraud in HUD programs undercuts HUD’s ability to meet all of its strategic goals.
In addition, HUD OIG issued an updated list of Priority Open Recommendations for FY
2024. HUD OIG is in close communication with HUD as it attempts to resolve the most
significant open recommendations identified by HUD OIG which, if implemented, will have
the greatest impact on helping HUD achieve its mission. HUD OIG tracks HUD’s progress
in addressing all HUD OIG recommendations, including those designated as priorities, on
a Recommendations Dashboard.
5
2023 Ginnie Mae Annual Report, page 5
Office of Inspector General U.S Department Housing and Urban Development 43
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
HUD OIG Oversight Related to the Financial Sector
During the 1-year period ending March 31, 2024, HUD OIG completed the following key
oversight reports related to the financial sector.
Servicers Generally Did Not Meet HUD Requirements When Providing Loss Mitigation
Assistance to Borrowers With Delinquent FHA-Insured Loans
HUD OIG conducted an audit of loan servicers’ compliance with FHA’s requirements for
providing loss mitigation assistance to borrowers after their COVID-19 forbearance ended.
HUD OIG initiated this audit because the loss mitigation programs available to the large
number of borrowers exiting forbearance were new and created a risk for both borrowers and
the FHA insurance fund when servicers did not properly provide loss mitigation. The audit
includes a finding that servicers did not provide proper loss mitigation assistance to
approximately two-thirds of delinquent borrowers after their COVID-19 forbearance
ended. Based on a statistical sample drawn from 231,362 FHA-insured forward loans totaling
$41 billion, servicers did not meet HUD requirements for providing loss mitigation assistance
to borrowers of 155,297 FHA-insured loans. Nearly half of the borrowers did not receive the
correct loss mitigation assistance. These borrowers did not receive the loss mitigation option
for which they were eligible, had their loss mitigation option not calculated properly, or
received a loss mitigation option that did not reinstate arrearages, which refers to any amount
needed to bring the borrower current. HUD OIG made six recommendations to HUD to
address these findings, to include providing training and guidance to servicers and developing a
plan to mitigate noncompliance moving forward. (HUD OIG Report 2023-KC-0005, Office
of Single Family Housing)
Nationstar Generally Did Not Meet HUD Requirements When Providing Loss Mitigation to
Borrowers of Delinquent FHA-Insured Loans
HUD OIG conducted an audit of Nationstar Mortgage, LLC’s compliance with FHA’s
requirements for providing loss mitigation assistance to borrowers. This audit was initiated
due to a 2021 risk assessment that identified a significant volume of delinquent loans with prior
COVID-19 forbearance in Nationstar’s portfolio and HUD OIG’s awareness of complaints
made about Nationstar to the Consumer Financial Protection Bureau and the HUD OIG
hotline. OIG found that Nationstar did not provide proper loss mitigation assistance to more
than 80 percent of borrowers with delinquent FHA-insured loans after their COVID-19
forbearance ended. The report made six recommendations, including that HUD require
Nationstar to take corrective actions to review and remediate sampled loans for which
borrowers did not receive appropriate loss mitigation and implement controls and employee
training. (HUD OIG Report 2023-KC-1001, Office of Single Family Housing)
44 Office of Inspector General U.S. Department of Housing and Urban Development
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
HUD Can Improve Oversight of Its Temporary Endorsement Policy for Loans in COVID-19
Forbearance
HUD OIG conducted an audit of HUD’s temporary policy for endorsement of loans with
coronavirus disease 2019 (COVID-19) forbearance activity to determine (1) whether HUD’s
temporary endorsement policy related to COVID-19 forbearance activity was properly
followed by lenders, (2) whether HUD monitored and enforced indemnification agreements for
loans that were subject to the temporary policy, and (3) HUD’s reasons for ending the policy
during the pandemic and its plans to evaluate and use such policies in the future. The audit
found that HUD did not ensure that lenders consistently followed policy requirements or that
indemnification agreement data and records related to the policy were complete and accurate.
HUD OIG recommended that HUD (1) require lenders to execute 5-year indemnification
agreements for loans that were missing required agreements or were otherwise ineligible to
put up to $1.8 million to better use by avoiding potential losses; (2) request and analyze data
from lenders for loans at risk of noncompliance to identify loans that should have been subject
to the policy or were otherwise ineligible for insurance and require lenders to protect HUD
against losses on these loans to put up to $26.8 million to better use; (3) record
indemnification agreement data in its system for agreements that were executed but not
recorded to put up to $3.5 million to better use; (4) review and correct indemnification
agreement data as needed in its system; (5) update indemnification agreements with incorrect
or missing information; and (6) consider evaluating whether and how a similar policy could be
used in the future. This should include studying lenders’ use of the policy, the long-term
performance of loans endorsed under it, and the compliance, guidance, and process issues
discussed above to refine future policies. (HUD OIG Report No. 2023-NY-0002, Office of
Single Family Housing)
Audit of Government National Mortgage Association’s Fiscal Years 2023 and 2022 Financial
Statements
HUD OIG contracted with the independent public accounting firm of CliftonLarsonAllen LLP
(CLA) to audit the financial statements of Ginnie Mae as of and for the fiscal years ended
September 30, 2023, and 2022, and to provide reports on Ginnie Mae’s (1) internal control
over financial reporting and (2) compliance with laws, regulations, contracts, and grant
agreements and other matters. In its audit of Ginnie Mae, CLA reported:
• That Ginnie Mae’s financial statements as of and for the fiscal years ended September
30, 2023, and 2022, were presented fairly, in all material respects, in accordance with
U.S. generally accepted accounting principles.
• No material weaknesses or significant deficiencies for fiscal year 2023 in internal
control over financial reporting, based on limited procedures performed.
• No reportable noncompliance issues for fiscal year 2023 with provisions of applicable
laws, regulations, contracts, and grant agreements or other matters.
Office of Inspector General U.S Department Housing and Urban Development 45
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
There were no recommendations made to Ginnie Mae. (HUD OIG Report No. 2023-FO-
0001, Ginnie Mae)
Audit of FHA’s Fiscal Years 2023 and 2022 Financial Statements
HUD OIG contracted with the independent public accounting firm of CliftonLarsonAllen LLP
(CLA) to audit the financial statements of FHA as of and for the fiscal years ended September
30, 2023, and 2022, and to provide reports on FHA’s (1) internal control over financial
reporting and (2) compliance with laws, regulations, contracts, and grant agreements and other
matters.
In its audit of FHA, CLA reported:
• That FHA’s financial statements as of and for the fiscal year ended September 30,
2023, and 2022, were presented fairly, in all material respects, in accordance with U.S.
generally accepted accounting principles.
• No material weaknesses for fiscal year 2023 in internal control over financial
reporting, based on limited procedures performed.
• One significant deficiency for fiscal year 2023 in internal control over financial
reporting, based on the limited procedures performed. The significant deficiency was
related to weaknesses in internal controls over loans receivable.
• No reportable noncompliance issues for fiscal year 2023 with provisions of applicable
laws, regulations, contracts, and grant agreements or other matters.
The significant deficiency identified was related to several control weaknesses surrounding
FHA’s loans receivable balance relating to (1) due and payable single-family partial claims not
referred for collection, and (2) monitoring and servicing of the Home Equity Conversion
Mortgage (HECM) loan portfolio. Misstatements caused by these weaknesses were not
detected and prevented by FHA’s existing internal controls. CLA made several
recommendations to FHA to address these weaknesses. (HUD OIG Report No. 2023-FO-
0002, Federal Housing Administration)
Investigative Activity and Outcomes
HUD OIG also helps protect HUD from counterparty risk by conducting investigations of
alleged fraud negatively affecting the FHA insurance funds and securing recoveries. HUD OIG
also investigates misconduct with the FHA and Ginnie Mae programs. For the period April 1,
2023, through March 31, 2024, HUD OIG Office of Investigation completed 66 single-family
investigations of fraud against the FHA insurance fund. Many of the investigations focused on
46 Office of Inspector General U.S. Department of Housing and Urban Development
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
loan origination fraud involving forward mortgages. Recoveries from these cases totaled over
$21.68 million (criminal, civil, and administrative recoveries). The following are significant
investigative cases related to the financial sector:
Laredo Salesman Sent to Prison for Fraud Conspiracy Costing HUD $1 Million in Losses
On November 28, 2023, a defendant was sentenced to 36 months of incarceration, 3 years of
supervised release and ordered to pay $1.17 million in restitution for his role in committing
wire fraud. The defendant admitted to using his position to attempt to get potential customers
approved for HUD-backed mortgages by forging various documents for at least 38 unqualified
homebuyers and submitting them to a bank. The defendant received a commission for each
sale and received a profit of more than $200,000. More than three dozen loans ultimately
defaulted or had to be restructured, costing HUD approximately $971,310.
New York Men Sentenced for Mortgage Fraud Scheme Involving Hartford Apartment Building
On January 8, 2024, two defendants were collectively sentenced to 62 months of incarceration,
5 years of probation, 4 years of supervised release and ordered to pay more than $1 million in
fines for their role in a conspiracy to commit mail fraud and wire fraud affecting a financial
institution. From September 2016 through May 2021, the defendants engaged in a scheme to
defraud several financial institutions, government-sponsored enterprises, and HUD by providing
false information to overstate the value of multifamily housing properties in connection with
loans secured by the property. The falsified information induced the financial institutions to
issue loans that were larger than they would have authorized or issued. These loans were
purchased by Freddie Mac and Fannie Mae, which induced HUD to issue a mortgage insurance
commitment to the financial institutions.
Essex County Man Sentenced to 20 Months in Prison for Conspiring To Commit Mortgage
Fraud
On January 10, 2024, a defendant was sentenced to time served (46 months), 2 years of
supervised release, and ordered to pay $1.29 million in restitution for his role in a conspiracy
to commit wire fraud. The defendant admitted that between October 2012 and March 2016
he created fraudulent verifications of employment, bank statements, and lease agreements to
have unqualified borrowers obtain FHA-insured mortgages.
Disbarred Real Estate Attorney Sentenced to Federal Prison for Stealing Millions From Clients
On March 3, 2024, a defendant was sentenced to 27 months of incarceration, 3 years of
supervised release and ordered to pay more than $3 million in restitution for his role in
committing wire fraud. From an unknown date and continuing until August 2019, the
defendant, while employed as an attorney, knowingly devised and conducted a scheme to
defraud and obtain money from clients under false pretenses. Specifically, he misappropriated
Office of Inspector General U.S Department Housing and Urban Development 47
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
millions of dollars belonging to clients who trusted him to handle their real estate transactions.
To conceal his scheme, he took clients’ money and used it to pay his own or other clients’
expenses. This activity allowed the scheme to go undetected for years. He also hid his fraud by
causing false and misleading information to be entered into his law firm’s accounting system to
make it appear that the firm had paid clients’ mortgages when he had used the money for
fraudulent purposes. Many of the impacted mortgages were insured by FHA.
Additional Investigative Cases Related to the Financial Sector
• Movement Mortgage To Pay $23.7 Million To Resolve Allegations It Caused the
Submission of False Claims to Government Mortgage Programs (June 29, 2023)
• Independence Man Sentenced to 17 Years in Prison for $2.2 Million Fraud Schemes
(September 20, 2023)
• Asheville Man Convicted of Bank Fraud Involving the Purchase of Short-Term Rental
Properties and Illegal Firearms Possession Is Sentenced to More Than 7 Years in
Prison (December 14, 2023)
• Kissimmee Real Estate Broker Pleads Guilty to Committing Bank Fraud (January 05,
2024)
48 Office of Inspector General U.S. Department of Housing and Urban Development
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
National Credit Union Administration
The National Credit Union Administration (NCUA) Office of Inspector General (OIG) promotes the
economy, efficiency, and effectiveness of NCUA programs and operations and detects and deters fraud,
waste, and abuse, thereby supporting the NCUA’s mission of providing, through regulation and
supervision, a safe and sound credit union system that promotes confidence in the national system of
cooperative credit.
Background
Under the IG Act, the OIG conducts independent audits, investigations, and other activities and
keeps the NCUA Board and the Congress informed of our work. In addition to the duties set
out in the IG Act, the Federal Credit Union Act requires the OIG to conduct a material loss
review of an insured credit union if the loss to the NCUA’s Share Insurance Fund exceeds $25
million and an amount equal to 10 percent of the total assets of the credit union at the time in
which the NCUA Board initiated assistance or was appointed liquidating agent. In addition, for
any loss to the Share Insurance Fund that does not meet the threshold, the Federal Credit Union
Act requires the OIG to conduct a limited-scope review to determine whether unusual
circumstances exist related to the loss that would warrant conducting a full-scope MLR.
OIG Reports Related to the Broader Financial Sector
We issued a report on the Top Management and Performance Challenges facing the NCUA,
which could relate to the broader financial sector:
• Managing Interest Rate Risk and Liquidity Risk
• Managing Credit and Liquidity Risks
• Cybersecurity - Protecting Systems and Data
• Risks Posed by Third-Party Service Providers
• Industry Consolidation and Challenges Facing Small Credit Unions
Office of Inspector General National Credit Union Administration 49
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
We also issued several audit reports that could relate to the broader financial sector, including an
audit assessing whether the NCUA adequately addressed risk when contracting cloud computing
services and effectively managed operational and security risks of implemented cloud computing
services. Our audit determined that the NCUA needed an enterprise-wide approach to cloud
computing to effectively contract and manage cloud computing services and should align policies
and procedures with this enterprise-wide approach. Our audit also determined the NCUA
implemented cloud computing services as the situation or business need occurred, which did not
allow it to clearly address federal guidance, created inconsistent processes, and allowed for
decisions and implemented services to be made unsystematically.
Also in the information technology area, we issued an audit report, performed by a contractor,
that assessed the effectiveness of the NCUA’s network firewalls and audit logging security
technologies to determine if they were designed and implemented to prevent and detect
cybersecurity threats to the NCUA’s network. The audit report concluded that the NCUA
adequately designed and implemented firewall and audit logging security technologies to prevent
and detect cybersecurity threats, but noted weaknesses related to account recertification
processes for privileged users with access to cybersecurity tools and controls over audit logging,
visibility, and retention processes.
Another audit that could relate to the broader financial sector was our audit of the NCUA’s
quality assurance program, which assesses all activities relating to the oversight of Federally
insured credit unions. Our audit report concluded that the NCUA substantially conducted its
quality assurance program in compliance with requirements but did not fully comply with the
requirements for performing or documenting quality assurance reviews or for completing quality
assurance reviews or issuing response memos within established timeframes.
Finally, we are participating in a CIGFO working group to conduct a review of FSOC’s
designation of non-bank financial companies.
50 Office of Inspector General National Credit Union Administration
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
U.S. Securities and Exchange Commission
The U.S. Securities and Exchange Commission (SEC or agency) Office of Inspector General (OIG) pro-
motes the integrity, efficiency, and effectiveness of the critical programs and operations of the SEC and
operates independently of the agency to help prevent and detect fraud, waste, and abuse in those
programs and operations, through audits, evaluations, investigations, and other reviews.
Background
The SEC’s mission is to protect investors, maintain fair, orderly, and efficient markets, and
facilitate capital formation. The SEC strives to promote capital markets that inspire public
confidence and provide a diverse array of financial opportunities to retail and institutional
investors, entrepreneurs, public companies, and other market participants. Its core values consist
of integrity, excellence, accountability, teamwork, fairness, and effectiveness. On November 29,
2022, the SEC issued its Strategic Plan: Fiscal Years (FY) 2022-2026, identifying its goals to (1)
Protect the investing public against fraud, manipulation, and misconduct; (2) Develop and
implement a robust regulatory framework that keeps pace with evolving markets, business
models, and technologies; and (3) Support a skilled workforce that is diverse, equitable, inclusive,
and fully equipped to advance Agency objectives.
The SEC is responsible for overseeing the nation’s securities markets and certain primary
participants, including broker-dealers, investment companies, investment advisers, clearing
agencies, transfer agents, credit rating agencies, and securities exchanges, as well as organizations
such as the Financial Industry Regulatory Authority, Municipal Securities Rulemaking Board, and
the Public Company Accounting Oversight Board. Under the Dodd-Frank Wall Street Reform
and Consumer Protection Act of 2010 (Dodd-Frank), the Agency’s jurisdiction was expanded to
include certain participants in the derivatives markets, private fund advisers, and municipal
advisors.
The SEC accomplishes its mission through six main divisions—Corporation Finance,
Enforcement, Examinations, Investment Management, Trading and Markets, and Economic and
Office of Inspector General U.S. Securities and Exchange Commission 51
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Risk Analysis—and 25 functional offices. The Agency’s headquarters are in Washington, DC, and
it has 11 regional offices located throughout the country. As of March 2024, the SEC employed
4,606 full-time equivalent employees.
The SEC OIG was established as an independent office within the SEC in 1989 under the
Inspector General Act of 1978, as amended (IG Act). The SEC OIG’s mission is to promote the
integrity, efficiency, and effectiveness of the SEC’s critical programs and operations. The SEC
OIG prevents and detects fraud, waste, and abuse through audits, evaluations, investigations, and
other reviews related to SEC programs and operations.
The SEC OIG Office of Audits conducts, coordinates, and supervises independent audits and
evaluations of the SEC’s programs and operations at its headquarters and 11 regional offices.
These audits and evaluations are based on risk and materiality, known or perceived vulnerabilities
and inefficiencies, and information received from the Congress, SEC staff, the U.S. Government
Accountability Office, and the public.
The SEC OIG Office of Investigations performs investigations into allegations of criminal, civil, and
administrative violations involving SEC programs and operations by SEC employees, contractors,
and outside entities. These investigations may result in criminal prosecutions, fines, civil penalties,
administrative sanctions, and personnel actions. The Office of Investigations also identifies
vulnerabilities, deficiencies, and wrongdoing that could negatively impact the SEC’s programs and
operations.
In addition to the responsibilities set forth in the IG Act, Section 966 of Dodd-Frank required the
SEC OIG to establish a suggestion program for SEC employees. The SEC OIG established its
SEC Employee Suggestion Program in September 2010. Under this program, the OIG receives,
reviews and considers, and recommends appropriate action with respect to such suggestions or
allegations from agency employees for improvements in the SEC’s work efficiency, effectiveness,
and productivity, and use of its resources, as well as allegations by employees of waste, abuse,
misconduct, or mismanagement within the SEC.
SEC OIG Work Related to the Broader Financial Sector
In accordance with Section 989E(a)(2)(B)(i) of Dodd-Frank, below is a discussion of the SEC OIG’s
completed and ongoing work, focusing on issues that may apply to the broader financial sector.
Completed Work
Final Management Letter: Review of SEC Controls Over Public Comments Submitted
Online and Actions Taken in Response to a Known Error, April 14, 2023
Rulemaking is the process by which federal agencies implement legislation passed by Congress and
signed into law by the President. Federal agencies, including the SEC, are generally required to give
interested persons an opportunity to participate in the rulemaking process through submission of
52 Office of Inspector General Securities and Exchange Commission
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
written data, views, or arguments (referred to hereafter as comments or public comments). The
SEC invites interested persons to comment on SEC proposed rules and self-regulatory
organization filings, among other matters, using several methods, including online through an
internet comment form.
On August 31, 2022, SEC management reported to the OIG that a technological error prevented
the agency from receiving a number of public comments submitted through the agency’s internet
comment form. We confirmed that this occurred because of an error between the SEC’s email
threat protection tool—managed by a vendor and used to scan emails and attachments for
malicious content—and the agency’s email servers. After learning of the error, the SEC worked
with the vendor to deploy a fix, established a semi-manual workaround, and contacted certain
commenters affected by the error to request that they resubmit their comments. Additionally, on
October 7, 2022, the SEC reopened the comment periods until November 1, 2022, for 11
affected rulemaking releases (that is, proposed rules, none of which had been finalized as of March
21, 2023) and one request for comment. The agency also notified the public that the
technological error may have affected certain comments related to eight self-regulatory
organization matters.
Based on information available at the time of our review, the SEC’s initial response to the
technological error once the error was known appears sufficient and appropriate. Due to the
SEC’s corrective action, the technological error appears to be resolved and the agency recovered
all but one of the 168 comments from 2021 and 2022 that were identified as affected by the error.
However, we requested confirmation of agency actions to post to the SEC’s public website (as
appropriate) and distribute to relevant rulemaking teams comment letters not initially received but
subsequently recovered and/or resubmitted and determined to be comments regarding
rulemaking releases. Doing so would allow those teams the opportunity to consider the
comments when preparing a recommendation to the Commission regarding a final rulemaking.
Moreover, we identified information technology control weaknesses that delayed the SEC’s
awareness of the technological error and magnified the error’s overall impact, which may require
additional attention and response. Specifically, the responsible Information System Owner and
system administrators did not configure alerts or regularly monitor system logs, which would have
permitted agency personnel to timely identify and respond to the error. The SEC also did not
back up some data submitted through the internet comment form, which delayed recovery of
comments. Strengthening information technology controls in these areas could provide additional
safeguards to prevent the loss of public comments submitted to the SEC as part of the rulemaking
process—which may be classified as permanent records—and ensure such comments are
received and processed as required. Finally, we identified another matter for management’s
consideration regarding comments that are not posted to the SEC’s public website or promptly
provided to rulemaking staff, and the overall efficiency of related processes.
On April 14, 2023, we issued our final management letter addressing these topics. The
management letter is available on our website at https://www.sec.gov/files/finl-mgmt-ltr-review-
sec-controls-over-public-comments-submitted-online-and-actions-taken-response.pdf. In response,
Office of Inspector General U.S. Securities and Exchange Commission 53
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
on May 30, 2023, agency management provided additional information about actions the SEC has
taken or plans to take to further strengthen safeguards and significantly reduce the risk of the loss
of public comments.
Ongoing Work
Audit of Aspects of the SEC’s Rulemaking Process and Related Internal Controls
The SEC OIG has initiated an audit to assess aspects of the SEC’s rulemaking process and related
internal controls. The overall objective of the audit is to review the SEC’s processes for (1) giving
interested persons an opportunity to participate in rulemaking; and (2) assessing and documenting
the impact(s) of proposed rules on competition, efficiency, and capital formation. We will also
review agency actions to ensure staff with sufficient and appropriate skills, experience, and
expertise are involved in formulating and reviewing proposed rules.
We expect to issue a report in FY 2025.
Audit of the SEC’s Controls for Safeguarding Consolidated Audit Trail Data
The SEC OIG is performing an audit of the SEC’s controls for safeguarding consolidated audit trail
(CAT) data available to SEC users. The objective of this audit is to determine whether the SEC’s
information security controls for safeguarding CAT data available to SEC users and responding to
CAT security events within the SEC’s environment comply with select requirements established in
National Institute of Standards and Technology SP 800-53, Security and Privacy Controls for
Information Systems and Organizations. As part of the audit, we will review SEC processes and
significant internal controls (including policies and procedures) related to securing CAT data,
requesting access to CAT data, extracting and sharing CAT data, and logging and monitoring SEC
user access.
We expect to issue a report during the next reporting period.
Evaluation of the Division of Examinations’ Oversight of Broker-Dealer Examinations
The SEC OIG has initiated an evaluation to determine whether the SEC’s Division of Examinations
(EXAMS) is effectively overseeing its broker-dealer examinations. Specifically, we will determine
whether EXAMS (1) effectively uses risk-based strategies in the selection and scoping of broker-
dealer examinations; (2) performs and documents broker-dealer examinations in accordance with
applicable policies and procedures; and (3) monitors and assesses results of examinations to
enhance oversight of broker-dealer compliance and accurately measure EXAMS’ performance.
We expect to issue a report during the next reporting period.
54 Office of Inspector General Securities and Exchange Commission
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Office of Inspector General
Department of the Treasury
The Department of the Treasury (Treasury) Office of Inspector General (OIG) performs independent,
objective reviews of specific Treasury programs and operations with oversight responsibility for one
federal banking agency – the Office of the Comptroller of the Currency (OCC). OCC supervises
approximately 1,100 financial institutions.
Introduction
Treasury OIG was established pursuant to the 1988 amendments to the Inspector General Act of
1978. The Treasury Inspector General is appointed by the President, with the advice and consent
of the Senate. Treasury OIG performs independent, objective reviews of Treasury programs and
operations, except for those of the Internal Revenue Service (IRS) and those programs and
activities under the jurisdictional oversight of the Special Inspector General for Pandemic
Recovery (SIGPR). Treasury OIG also keeps the Secretary of the Treasury and Congress fully
informed of problems, deficiencies, and the need for corrective action. Treasury OIG is
headquartered in Washington, DC and is comprised of four components: (1) Office of Audit, (2)
Office of Investigations, (3) Office of Counsel, and (4) Office of Management.
Treasury OIG has oversight responsibility for OCC, which supervises approximately 765 national
banks, 248 federal savings associations, and 49 federal branches and agencies of foreign banks. The
total assets under OCC’s supervision are $16.2 trillion. 6 Treasury OIG also oversees four offices
created by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank)
which are (1) the Office of Financial Research (OFR), (2) the Federal Insurance Office (FIO),
(3) the Office of Minority and Women Inclusion within Treasury’s Departmental Offices, and
(4) the Office of Minority and Women Inclusion within OCC.
Treasury OIG is also responsible for audit and investigative oversight of Treasury programs
providing financial assistance to address the economic impacts of the Coronavirus Disease 2019
(COVID-19). Since March 2020, more than $655 billion of financial assistance, overseen by
6
Office of the Comptroller of the Currency, 2023 Annual Report (December 2023), p. 26
Office of Inspector General Department of Treasury 55
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Treasury OIG, has been authorized by the Coronavirus Aid, Relief, and Economic Security Act (CARES
Act) 7 enacted on March 27, 2020; the Consolidated Appropriations Act, 2021 (CAA, 2021) 8 enacted
on December 27, 2020; the American Rescue Plan Act (ARP) 9 enacted on March 11, 2021; and the
Consolidated Appropriations Act, 2023 (CAA, 2023) 10 enacted on December 29, 2022. Through
these pieces of legislation, Treasury provides financial assistance to the transportation industry for
the continuation of salaries and benefits; to all 50 States, units of local government, U.S.
territories, and tribal governments to provide economic relief including rental and mortgage
assistance and support for small businesses; and to community development financial institutions
to inject emergency capital investment into low-income communities to address the ongoing
pandemic. Treasury established the Office of Recovery Programs (ORP), which was renamed the
Office of Capital Access on November 2, 2023, to administer the pandemic relief funds. 11 The
enormity of these programs requires continued coordination between the Office of Audit, the
Office of Investigations, and the Office of Counsel to handle complaints concerning thousands of
recipients and sub-recipients that received financial relief.
Treasury Management and Performance Challenges Related to Financial
Regulation and Economic Recovery
In accordance with the Reports Consolidation Act of 2000, the Treasury Inspector General
annually provides the Secretary of the Treasury with his perspective on the most serious
management and performance challenges facing the Department of the Treasury (herein
“Treasury” or “the Department”). In a memorandum to the Secretary dated October 10, 2023,
the Deputy Inspector General reported five management and performance challenges that were
directed towards financial regulation and economic recovery. Those challenges are discussed
below and include: COVID-19 Pandemic Relief; Cyber Threats; Anti-Money Laundering and
Terrorist Financing/Bank Secrecy Act Enforcement; Climate Initiatives Risk; and Operating in an
Uncertain Environment. 12
Challenge 1: COVID-19 Pandemic Relief
The COVID-19 pandemic continues to affect the health and economic stability of
communities worldwide and thus the Department’s responsibilities and workloads are still
enormously expanded. Specifically, Treasury has been instrumental to the implementation of
economic relief provisions of the CARES Act, CAA, 2021, ARP, and CAA, 2023. Treasury is
7
Public Law 116-136 (March 27, 2020).
8
Public Law 116-260 (December 27, 2020)
9
Public Law 117-2 (March 11, 2021)
10
Public Law 117-328 (December 29, 2022)
11
ORP was renamed the Office of Capital Access on November 2, 2023, which is subsequent to the issuance of
the October 10, 2023 management and performance challenges memorandum discussed herein; therefore, we
refer to this office as ORP throughout this report.
12
The Treasury Deputy Inspector General’s memorandum included one other challenge not directly related to
financial regulation and economic recovery: Information Technology Acquisition and Project Management.
56 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
tasked with disbursing over $655 billion13 in aid to more than 30,000 recipients, including
state, local, territorial, and tribal government entities, in a relatively short period of time and
with limited staffing. As such, the Department established ORP to implement Treasury’s
COVID-19 pandemic programs. A Chief Recovery Officer, who is the lead administrator and
the principal advisor to the Treasury Secretary and Deputy Secretary on pandemic programs,
leads the office. With ORP leading, the Department implemented multiple pandemic
programs and is now challenged with managing those programs in different stages of maturity.
In addition, Treasury must carry the administrative and monitoring responsibilities in its role
resolving Single Audit Act findings and potentially serving as cognizant agency for a significant
number of entities 14 in compliance with the Office of Management and Budget’s (OMB)
Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. 15
Pandemic Programs – End of Period of Performance
For pandemic programs near the end of the period of performance, Treasury faces challenges
(1) closing out awards, (2) resolving Single Audit Act findings, (3) maintaining internal control,
guidance, and methodologies for oversight of funds disbursed, (4) collecting high quality, reliable
data, and (5) sustaining operations with limited funding. The pandemic programs near maturity
or in the close out phase include the Payroll Support Programs (PSP), Coronavirus Economic
Relief for Transportation Services (CERTS), the Coronavirus Relief Fund (CRF), and the first
Emergency Rental Assistance Program (ERA1).
Payroll Support Programs (PSP)
To maintain pay and benefits of airline industry workers, Treasury implemented PSP1
authorized under the CARES Act for up to $32 billion of direct financial assistance for
passenger air carriers, cargo air carriers, and contractors. Financial support for air carrier
workers was extended twice by CAA, 2021 and ARP, which provided additional assistance to
passenger air carriers and contractors up to $16 billion (PSP2) and $15 billion (PSP3),
respectively. Using existing resources and contractor support, Treasury disbursed a total of
approximately $58.9 billion, as of June 30, 2023, to air carriers and contractors under all three
payroll support programs. Treasury OIG has completed 10 audits of recipients’ certified
financial data provided to Treasury in applications for a PSP1 award. Treasury OIG audits
identified approximately $1.37 million in questioned costs/improper payments. It is important
for Treasury to recoup these payments and to obtain support documentation to confirm
awarded amounts for the hundreds of other recipients that have not yet been audited.
13
Amount excludes Economic Impact Payments distributed by the IRS and support to small businesses under the
Paycheck Protection Program administered by the Small Business Administration.
14
Single Audit Act of 1984 (P.L 98-502; October 19, 1984), as amended by the Single Audit Act Amendments of
1996 (P.L 104-156; July 5, 1996)
15
https://www.ecfr.gov/current/title-2/part-200
Office of Inspector General Department of Treasury 57
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Treasury OIG will continue audits of PSP1 recipients’ certifications and initiate audits of
certifications submitted by PSP2 recipients in fiscal year 2024. It is incumbent upon the
Department to maintain strong internal controls over recipients’ compliance with signed terms
and conditions for receiving financial assistance.
Coronavirus Economic Relief for Transportation Services (CERTS)
Congress expanded financial support to non-air carrier transportation service providers under
the CERTS provisions of CAA, 2021. Treasury established the CERTS Program that provides
$2 billion in non-competitive grants to eligible companies that certify revenue loss of 25
percent or more due to the COVID-19 pandemic. Treasury disbursed approximately $1.97
billion to 1,464 recipients as of February 3, 2023. The CERTS period of performance ended on
October 22, 2022. During the close out phase of this program, Treasury should maintain strong
internal controls to ensure compliance with grant agreements. Although there is no mandate
directing Treasury OIG to audit CERTS recipients, we are currently auditing Treasury’s
administration of the program.
Coronavirus Relief Fund (CRF)
The $150 billion CRF, established under Title VI of the Social Security Act, as amended by Title V
of the CARES Act, continues to be a large endeavor for both the Department and Treasury
OIG. The Department disbursed the entire $150 billion in direct payments to states, units of
local government, the District of Columbia, U.S. territories, and tribal governments.
Disbursement of funds was a complicated undertaking given the number of recipients at varying
levels of government and other payment requirements of the CARES Act. Although Treasury is
authorized to make payments, the CARES Act assigned Treasury OIG with responsibility for
monitoring and oversight of the receipt, disbursement, and use of funds. Additionally, Treasury
OIG has authority to recoup funds if it is determined that recipients fail to comply with uses of
funds for COVID-19 related costs under Section 601 (d), “Use of Funds,” of the Social Security
Act, as amended. 16
The Department also has a fundamental role to clarify its policy 17 over the uses of funds when
interpretation matters arise. As of September 30, 2023, recipients are still in the process of
reporting on and closing out their awards, and questions may arise that require interpretation.
16
Section 601 (d), Use of Funds, recipients shall use the funds to cover only those costs of the state, tribal
government, or unit of local government that (1) are necessary expenditures incurred due to the public health
emergency with respect to COVID–19; (2) were not accounted for in the budget most recently approved as of the
date of enactment of this section for the State or government; and (3) were incurred during the period that begins
on March 1, 2020, and ends on December 31, 2021. The period of performance end date of the CRF was extended
through December 31, 2021 by the Consolidated Appropriations Act, 2021. The period of performance end date
for Tribal entities was further extended to December 31, 2022 by the State, Local, Tribal, and Territorial Fiscal
Recovery, Infrastructure, and Disaster Relief Flexibility Act, Division LL of the Consolidated Appropriations Act,
2023, P.L. 117-328, December 29, 2022, 136 Stat. 4459.
17
Coronavirus Relief Fund Guidance for State, Territorial, Local, and Tribal Governments Federal Register, Vol. 86, No. 10;
January 15, 2021
58 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Treasury OIG has completed desk reviews 18 of CRF recipients and has identified approximately
$2 billion in questioned costs, which will require interpretation of Treasury’s policy to
determine eligibility of those expenditures and whether funds should be returned or recouped.
The quarterly reporting for the CRF ended with the third quarter of calendar year 2023 making
it critical that Treasury provided as much clarity as possible for ensuring recipients understood
the compliance requirements and were accountable and transparent in how they reported uses
of funds. Treasury OIG has received over 400 complaints regarding recipient, and in some
instances sub-recipient, uses of CRF proceeds and approximately 300 of these complaints
require continued collaboration between the Department and our office. In addition, Treasury’s
responsibilities to provide management response to Single Audit Act findings for the CRF
within required timeframes is a challenge given limited resources and funding.
First Emergency Rental Assistance Program (ERA1)
To assist vulnerable households at risk of housing instability, Congress established the first of
two ERA programs, ERA1, in CAA, 2021 availing about $25 billion to households in need.
Division N, Title V, Subtitle A, of CAA, 2021, created ERA1 and requires that Treasury OIG
conduct monitoring and oversight of the receipt, disbursement, and use of ERA1 funds. As of
June 22, 2023, Treasury disbursed $24.98 billion of the $25 billion appropriated by CAA, 2021
for ERA1. Treasury disbursed ERA1 funds to states (including the District of Columbia), U.S.
territories, tribal governments (with a provision for the Department of Hawaiian Home Lands),
and units of local government with populations of 200,000 or greater to pay for rent, utilities,
and other housing-related expenses and arrears through September 30, 2022. With ERA1
disbursements complete and the end of the period of performance for these awards, Treasury
faces challenges administering the closeout process and resolving Single Audit Act findings
associated with hundreds of eligible grantees and related sub-recipients. As of the date of the
letter, Treasury OIG had received more than 3,500 complaints from the public concerning ERA
usage, expediency of payments to beneficiaries, and potential improper payments. Treasury will
need to work with our office to recoup ERA funds not used for allowable purposes.
Pandemic Programs – Ongoing Period of Performance
For programs where the period of performance and administration is ongoing, Treasury faces
challenges (1) ensuring proper allocation and distribution of funds, (2) developing and
maintaining internal control, guidance, and methodologies and procedures for monitoring and
reporting, (3) finding and/or maintaining qualified staff needed to administer and monitor
programs, (4) collecting high-quality, reliable data, (5) resolving Single Audit Act findings, (6)
remediating and recouping funds, and (7) sustaining operations with limited funding. These
programs include the second Emergency Rental Assistance Program (ERA2), the Homeowner
Assistance Fund (HAF), the Coronavirus State and Local Fiscal Recovery Funds (SLFRF), the
18
The CARES Act assigned the Treasury OIG with responsibility for compliance monitoring and oversight of the
receipt, disbursement, and use of CRF payments. The purpose of a desk review is to perform monitoring
procedures of the prime recipient’s receipt, disbursement, and use of CRF proceeds as reported in the grants
portal on a quarterly basis.
Office of Inspector General Department of Treasury 59
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
State Small Business Credit Initiative (SSBCI), the Emergency Capital Investment Program
(ECIP), and the Community Development Financial Institutions (CDFI) Fund’s Equitable
Recovery Program (ERP).
Second Emergency Rental Assistance (ERA2) and Homeowner Assistance Funds (HAF)
With ARP, Congress established a second ERA program, ERA2, to provide additional assistance
to vulnerable households at risk of housing instability, availing over $21.55 billion to households
in need. For ERA2, as of June 22, 2023, Treasury disbursed $20.94 billion of the $21.55 billion
appropriated in ARP. Similar to ERA1, ERA2 provides funding for eligible renter households’
rent, utilities, and other housing-related expenses and arrears, but ERA 2 does not include
tribal governments as eligible grantees. ERA2 funds are to remain available until September 30,
2027. While CAA, 2021 requires that Treasury OIG conduct monitoring and oversight of the
receipt, disbursement, and use of ERA1 funds, ARP does not require our office to monitor
ERA2. ERA2 disbursements are ongoing and Treasury faces challenges in maintaining internal
control and establishing guidance and methodologies for monitoring, reporting, and oversight of
funds disbursed. In addition, the lack of consistent quality, reliable grantee disbursement data
and an adequate workforce impedes Treasury’s ability to perform proper monitoring and
recoupment functions. Further, Treasury faces challenges resolving Single Audit Act findings
associated with hundreds of eligible grantees and related sub-recipients. As of the date of the
letter, Treasury OIG has received more than 3,500 complaints from the public concerning ERA
usage, expediency of payments to beneficiaries, and potential improper payments. Treasury will
need to work with our office to recoup ERA funds not used for allowable purposes.
In addition to ERA2, ARP created HAF to prevent mortgage delinquencies, defaults,
foreclosures, loss of utility services, and displacement by covering mortgage-related expenses,
utility expenses, and arrears for homeowners experiencing financial hardship after January 21,
2020. Treasury has implemented the HAF program and as of July 2023, disbursed more than
$9.8 billion of the $9.9 billion authorized to states (including the District of Columbia and
Puerto Rico), tribal governments (including the Department of Hawaiian Home Lands), Guam,
American Samoa, the U.S. Virgin Islands, and the Commonwealth of the Northern Mariana
Islands. The funds are available until September 30, 2025.
The ERA and HAF programs are fully implemented and, while Treasury has issued relevant
guidance for each of the programs, it is essential its program offices continue to respond to
recipients to clarify guidance and to provide insight into the eligible uses of the funds
distributed. Clear and timely responses to recipient questions is critical in enabling program
recipients to administer their programs and disburse funds to households effectively.
Coronavirus State and Local Fiscal Recovery Funds
Provisions of ARP provide state, local, U.S. territorial, and tribal governments another $350
billion under the Coronavirus State Fiscal Recovery Fund and the Coronavirus Local Fiscal
Recovery Fund (together referred to as SLFRF); $10 billion under the Coronavirus Capital
60 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Projects Fund (CPF); and $2 billion under the Local Assistance and Tribal Consistency Fund
(LATCF). Administering SLFRF requires recipients to obligate funds by December 31, 2024 and
expend all obligations by December 31, 2026, except as noted below for the Surface
Transportation projects and Title I. This poses challenges given the volume of recipients that
Treasury must oversee that include all 50 states, U.S. territories, tribal governments, local
government recipients with population sizes of 250,000 or more, and approximately 26,000
Non-Entitlement Units (NEU) of Local Governments that received funding through a state or
U.S. territory. States and U.S. territories were required to establish a process for NEUs to
provide pre-pandemic budget and other critical information and documentation before
distributing funds. In addition to the volume of NEUs for Treasury to oversee, reconciliation
between states’ and U.S. territories’ disbursements to NEUs and recipient performance
reporting may be challenging. That is, performance reporting for NEU funding is the
responsibility of the NEUs and not the states and U.S. territories where accountability for the
disbursement of funds resides. Furthermore, due to increased pandemic funding, many NEUs
are required to have a Single Audit or alternate compliance examination engagement over
which Treasury may have agency cognizance or oversight. As a result, Treasury will face
challenges with ongoing compliance monitoring of SLFRF recipients and related administrative
issues.
While Treasury has built the Treasury Recovery Award Management System for recipient
communication and reporting, there are still challenges obtaining sufficient quality data from
SLFRF, CPF, and LATCF recipients. For SLFRF recipients, Treasury allows for lengthy narrative
responses as part of the data collection that may be more cumbersome to review and lack
critical details. Confirming data quality and providing timely data to the public and oversight
community has been challenging for Treasury. To effectively administer and monitor recipients’
compliance, Treasury must have access to sufficient data that accurately reflects how recipients
have expended pandemic awards. While progress has been made, it is critical that Treasury
continues to refine mechanisms to ensure the data is complete, accurate, reliable, and
transparent in reflecting how recipients have expended pandemic awards. Treasury will need to
continue to collect sufficient and timely data for monitoring recipients’ compliance with
pandemic programs, and to ensure remediation and recoupment actions occur, as appropriate.
Additionally, while much of Treasury’s pandemic funding has been distributed, Treasury must
deliver the remaining CPF and LATCF funds through fiscal year 2024, ensuring accurate
allocations and award distributions, and timely obligations.
Treasury ORP initially had difficulty finding specialized staff to administer and monitor the
SLFRF program and faces ongoing challenges to recruit and retain staff as the program matures.
Treasury has also been challenged with compliance report review backlogs and vast testing
workloads. As discussed in more detail under the Accountability and Transparency section
below, Treasury faces future funding challenges to support the ORP (currently the Office of
Capital Access) operations, to include ongoing administration of the SLFRF program and
recipient monitoring. An additional challenge for Treasury has been coordinating with other
Federal Agencies, such as Federal Emergency Management Agency, the Department of
Transportation, and the Department of Housing and Urban Development to develop
Office of Inspector General Department of Treasury 61
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
regulations and update reporting guidance for SLFRF recipients. In August 2023, Treasury
published an interim rule for guidance to ensure that recipients are aware of the additional
SLFRF allowable uses of funds for emergency disaster relief and infrastructure projects, in
accordance with program flexibilities provided under Division LL of the CAA, 2023 legislation.
While provisions in the interim rule became effective September 20, 2023, Treasury will need
to consider additional feedback through fiscal year 2024. Consistent with the existing SLFRF
eligible uses, recipients must obligate funds for the new SLFRF eligible uses by December 31,
2024. Recipients must expend SLFRF funds obligated to provide emergency relief from natural
disasters by December 31, 2026. Recipients must expend SLFRF funds obligated for Surface
Transportation projects and Title I projects by September 30, 2026.
With the overlap of CRF, SLFRF, CPF, and LATCF recipients, we expect that there may be
continued confusion between the uses of funds requirements and reporting mechanisms that
may be a challenge for recipients. Given the volume of recipients and varying requirements
under these programs, Treasury will need to ensure that there are sufficient resources for the
remaining distribution of funds and ongoing monitoring of recipient reporting and compliance
with terms and conditions for funds received. Furthermore, with the level of funding under
both CRF and SLFRF, Treasury may have agency cognizance over many smaller local
governments (particularly NEUs) and tribal governments now required to have Single Audits.
To minimize recipient burden, Treasury developed alternate reporting requirements for smaller
SLFRF recipients, which would otherwise be subject to Single Audit. In the Compliance
Supplement for 2023, Treasury provides the option of an alternate compliance examination
engagement for SLFRF recipients meeting certain eligibility requirements. Treasury worked with
OMB and the audit community to find a solution for receiving these non-audit reports. The
Federal Audit Clearinghouse, which operates on behalf of OMB to support oversight and
assessment of federal award audit requirements and maintain a public database of completed
audits, is now receiving these alternate compliance examination reports for fiscal year 2022,
and will continue to do so going forward. Single Audit and alternative compliance examination
procedures are relatively new to 25,000 SLFRF recipients, so there will continue to be more
guidance and oversight required of Treasury.
State Small Business Credit Initiative (SSBCI)
The SSBCI, which was originally created in the Small Business Jobs Act of 2010 19 to increase
availability of credit for small businesses, ended in 2017. However, Section 3301 of ARP
reauthorized SSBCI and provided $10 billion in funding for the program. Under SSBCI,
participating states, U.S. territories, and tribal governments may obtain funding for programs
that partner with private lenders to extend credit to small businesses. Additionally, ARP
modified SSBCI in ways including the following set-asides: (1) $500 million in allocations to
tribal governments in proportions determined appropriate by the Secretary of the Treasury;
(2) $1.5 billion in allocation to states, U.S. territories, and tribal governments for business
enterprises owned and controlled by socially and economically-disadvantaged individuals (SEDI);
(3) $1 billion to be allocated as an incentive for states, U.S. territories, and tribal governments
19
Public Law 111-240 (September 27, 2010)
62 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
that demonstrate robust support for SEDI businesses; (4) $500 million to be allocated to very
small businesses with fewer than 10 employees; and (5) $500 million to provide technical
assistance to certain businesses applying for SSBCI or other state or federal programs that
support small businesses. As a result of the debt ceiling crisis, the Fiscal Responsibility Act of
2023 20, enacted June 3, 2023, rescinds $150 million from the SSBCI program. As of July 2023,
out of $8 billion in approved applications in the capital program, Treasury has distributed $2.45
billion to 64 states, U.S. territories, and Tribal governments.
Treasury faces challenges as it continues to administer the program through the approval of
applications, distribution, and monitoring of the funds. Primary oversight of the use of SSBCI
funds is the responsibility of the participating state, U.S. territory, or Tribal government. The
participants are responsible for providing Treasury with quarterly assurances that their
programs approved for SSBCI funding comply with program requirements. In November 2022,
Treasury issued its SSBCI Capital Program National Compliance Standards to set forth
recommended practices to support participating jurisdictions in implementing their SSBCI
capital programs. 21 These standards compliment the SSBCI Capital Program Policy Guidelines,
which require certifications from lenders, investors, borrowers, and investees for each SSBCI
supported transaction. 22 Certifications include information on conflicts of interest and use of
proceeds among other things. The guidelines also state that participating jurisdictions should, as
part of their compliance monitoring procedures and as appropriate to the requirements of a
specific certification, establish a process to determine whether the required certifications have
been properly documented. However, Treasury does not require participating jurisdictions to
independently verify the representations made by the authorized representative of the small
business borrower or investee. Relying on the participating jurisdictions to ensure that required
certifications are collected could lead to Treasury not (1) identifying non-compliant recipients,
(2) holding recipients accountable for SSBCI supported transactions, and/or (3) properly
remediating and recouping funds.
Additionally, under the SSBCI program, an Allocation Agreement establishes the terms and
conditions for participating jurisdictions to receive capital funds. The Allocation Agreement, in
part, requires a participating jurisdiction to promptly notify Treasury in writing if there has been
any material adverse change in the condition, financial or otherwise, or operations of the
participating jurisdiction that may affect its approved programs. As noted in our previous
Management Challenges Letter, Treasury still needs to define what constitutes a material
adverse change that may affect the participating jurisdictions’ approved programs. Treasury may
have difficulty collecting high quality, reliable data and monitoring the recipients’ use of funds.
Further, Treasury must ensure proper allocation and distribution of funds in compliance with
the multiple set-asides of the program. Therefore, Treasury must continue to develop and
maintain internal controls, program guidance, and methodologies and procedures for
20
Public Law 118-5 (June 3, 2023)
21
SSBCI Capital Program National Compliance Standards. U.S. Department of the Treasury. November 17, 2022.
22
SSBCI Capital Program Policy Guidelines, U.S. Department of the Treasury, November 10, 2021, and as amended
August 16, 2023.
Office of Inspector General Department of Treasury 63
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
monitoring and reporting the use of SSBCI funding. Treasury must also be cognizant of possible
additional reductions in the funding of the program, which could impact their ability to maintain
qualified staff needed to administer and monitor programs and sustain operations.
Emergency Capital Investment Program (ECIP)
As authorized under CAA, 2021, Treasury has invested $8.57 billion in 175 CDFIs 23 and
Minority Deposit Institutions, which is all of the capital available for investment under ECIP,
providing capital to low-to-moderate income community financial institutions that support small
businesses and consumers. Originally, Treasury experienced challenges in fully implementing
ECIP. As reported in our audit of ECIP’s implementation, Treasury had not completed key
documentation, such as policies and procedures to include a post-investment compliance and
monitoring plan to fully implement and administer investments. 24 With all allowable investments
made, The Fiscal Responsibility Act of 2023 rescinded the funding that was available for a second
investment round. After the implementation audit, Treasury provided policies and procedures
related to ECIP. It is imperative that Treasury implement and uphold policies and procedures to
govern its post–investment activities.
Participants in the ECIP are required to calculate and provide their baseline amount of qualified
lending through an Initial Supplemental Report. This baseline will be used to calculate the
dividend or interest rates applicable to each participant in accordance with the Rate Reduction
Incentive Guidelines and the ECIP legal agreements. In June 2023, Treasury provided waivers
for certain ECIP recipients, removing the requirement in the ECIP Securities Purchase
Agreement for attestation from their independent auditor that the processes and controls used
to generate the Supplemental Reports are satisfactory for 2022. This change potentially lowers
the reliability of self-reported data. Also in June 2023, Supplemental Reporting deadlines were
extended for progress reports from certain ECIP recipients because Treasury had not yet
received final approval on the forms and instructions. Treasury also extended 2022 quarterly
reporting to August 17, 2023 and first and second 2023 quarterly reporting to
September 1, 2023. Treasury needs to implement planned controls to ensure that investments
provide the intended benefits. Accountability and transparency are crucial for the integrity of
the program.
CDFI Equitable Recovery Program (ERP)
On April 10, 2023, the CDFI Fund announced the awarding of $1.75 billion of the $3 billion
authorized under CAA, 2021 for the CDFI ERP. Awards granted under ERP are intended for
low- or moderate-income minority communities that have significant unmet capital or financial
services needs and were disproportionately impacted by the COVID-19 pandemic.
23
Treasury OIG is required to submit to the Committee on Financial Services of the House of Representatives
and the Committee on Banking, Housing, and Urban Affairs of the Senate, and the Secretary of the Treasury, not
less frequently than 2 times per year, a report relating to the oversight provided including any recommendations
for improvements to the Community Development Investment programs.
24
Treasury OIG, Audit of Treasury’s Implementation of the Emergency Capital Investment Program (OIG-22-028; March
8, 2022)
64 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
The CDFI Fund is in the process of adapting existing policies and procedures, compliance
monitoring tools, and data collection forms that have been successfully used to monitor the
CDFI Fund’s other programs to effectively monitor the CDFI ERP Awards.
In addition, the CDFI Fund plans to implement designation of minority lending institutions (MLI)
as defined under the CAA, 2021 separately from the award of ERP funds. CDFI Fund requested
public comment on the criteria that will be used to designate a certified CDFI as a MLI from
July 28, 2022, to November 25, 2022. As noted within the CDFI ERP Notice of Funds
Availability, this criterion was not used as part of the CDFI ERP award process. Going forward,
Treasury has a lengthy period of performance for award recipients, so there is much work to
be done overseeing the CDFI ERP awards and determining next steps regarding the new MLI
certification.
Accountability and Transparency
In the context of this overarching challenge, we recognize the breadth and scope of Treasury’s
responsibilities as it impacts programs, operations, and activities regardless of jurisdictional
oversight boundaries. Along with administering and delivering economic relief, Treasury must
manage the unprecedented oversight of the pandemic relief funding. As noted above, Treasury
is evaluating whether it will have cognizance over thousands of non-federal recipients of SLFRF
and be required to carry out a larger administrative and monitoring role to ensure compliance
under OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for
Federal Awards. Among its responsibilities as a Federal awarding agency, Treasury must follow-
up on Single Audit findings to ensure that recipients take appropriate and timely corrective
action and issue management decision letters. 25 Many recipients are smaller governments,
which for the first time are subject to Single Audit or the alternative compliance examination
available to eligible recipients meeting eligibility requirements. Regardless of cognizance,
Treasury will have to work with recipients to resolve Single Audit and alternative compliance
examination findings specific to each of its pandemic relief programs. Given the anticipated
budget shortfalls as noted below, carrying out this level of oversight of thousands of recipients
will be very challenging for Treasury.
In addition to our office’s ongoing work on pandemic programs, Treasury is subject to
additional Congressional oversight bodies, SIGPR, 26 Treasury Inspector General for Tax
Administration, the Government Accountability Office (GAO), and the Pandemic Response
Accountability Committee (PRAC). Treasury is also accountable for providing transparency
over the expenditure of pandemic relief funds. Many reporting requirements of sections 15010
and 15011 of the CARES Act were extended under the CAA, 2021, PRAC amendments. Most
25
2 CFR § 200.521, “The management decision must clearly state whether or not the audit finding is sustained, the
reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments, or
take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given...”
(https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200/subpart-F/subject-group-
ECFR4424206eaecf751/section-200.521)
26
SIGPR was authorized under the CARES Act to oversee loans, loan guarantees, and other investments provided
by Treasury and must report to Congress quarterly on SIGPR’s activities and Treasury’s loan programs. SIGPR
terminates five years after enactment of the CARES Act (March 27, 2025).
Office of Inspector General Department of Treasury 65
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
notably, Treasury is responsible for reporting obligations and expenditures of large covered
funds (over $150,000) to the PRAC. While Treasury OIG continues to collect and report CRF
data to the PRAC under an agreement with the Department, Treasury is responsible for
reporting expenditures of its other pandemic relief programs. As noted above, data collection
and quality are still challenges for Treasury under the various pandemic programs. The
Department must balance its ongoing response to the financial impacts of the public health
emergency with its responsibility to stakeholders for reporting and transparency.
While Treasury has leveraged its existing workforce, hired contractors, and obtained detailees
from other Federal agencies to address the demands of the pandemic programs, it continues to
face future funding challenges to carry out its expansive administrative and compliance
monitoring role. For fiscal year 2023, Treasury ORP supported nine pandemic programs valued
at over $648 billion for awards across 30,000 recipients. Total administrative budget for the
year was $96.6 million. 27 At the same time Treasury worked to modify its operating model to
rely on data-centric, risk-based monitoring and to minimize staffing to oversee the programs,
Treasury is pro-actively working to reduce spending across the board on SLFRF and other
impacted programs, as well as in central service areas to extend essential operations. However,
this may not be enough to carry out the large-scale compliance monitoring responsibilities of
SLFRF, CPF, ERA, HAF, and LATCF.
Going forward, Treasury may experience difficulties in balancing its ongoing pandemic oversight
responsibilities and workloads while managing several ongoing challenges as described
throughout our management and challenges memorandum. While the COVID-19 pandemic
national emergency declaration ended in May 2023, we remain mindful that both short-term
and long-term challenges lay ahead for both Treasury and Treasury OIG.
Challenge 2: Cyber Threats
Cybersecurity remains a long-standing and serious challenge facing the Nation as reported by
GAO as a government-wide issue in its 2023 high-risk list published biennially. 28 A reliable
critical infrastructure, including information systems and networks, is vital to our national
security and economic stability. Cyber threats remain a persistent concern as Treasury’s
information systems are critical to the core functions of government and the Nation’s financial
infrastructure, along with the financial sector it oversees. As cyber threats continue to evolve
and become more sophisticated, subtle, and easier to perform, Treasury must fortify and
safeguard its internal systems and operations while modernizing and maintaining them. Although
managing known risks is an ongoing challenge, Treasury must also be ready to reinforce and/or
27
https://home.treasury.gov/system/files/266/07A.-COVID-FY-2023-CJ.pdf
28
GAO, High-Risk Series: Efforts Made to Achieve Progress Need to Be Maintained and Expanded to Fully Address All
Areas (GAO-23-106203: April 20, 2023).
66 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
redirect cybersecurity efforts when unforeseen events occur, such as the COVID-19 pandemic,
the on-going conflict in Ukraine, 29 or when serious flaws are discovered in software or systems
that allow for remote administrative-level access.
Threat actors frequently exploit vulnerable networks or systems in a string of trusted
connections to gain access to government systems. Organized hacking groups leverage
published and unpublished vulnerabilities and vary their methods to make attacks hard to detect
and even harder to prevent. Criminal groups and nation-states are constantly seeking to steal
information; commit fraud; disrupt, degrade, or deny access to information systems; or infiltrate
information systems and maintain a presence to enable future actions. Through information
sharing, federal agencies are better prepared to thwart potential attacks to the cyber
infrastructure of the Federal Government and the financial sector.
The tools used to perpetrate cyber-attacks continue to become easier to use and more
widespread, lowering the technological knowledge and resources needed to launch successful
attacks of increasing sophistication. Such attacks include distributed denial of service, phishing,
fraudulent wire payments, business email compromise, malicious spam (malspam), ransomware,
and compromise of supply chains (both hardware and software). Additionally, Treasury must
remain cognizant of the increased risk profile a remote workforce presents, as it provides
threat actors with a broader attack surface. Increased network traffic from remote sources
provides cover for attackers to blend in with the federal workforce and launch cyber assaults,
and denial of service attacks upon a network or service can disrupt operations and prevent
remote workers from performing their duties.
Treasury is looked upon to provide effective leadership to financial institutions in particular, and
the financial sector in general, to strengthen awareness and preparedness against cyber threats
to the Nation’s critical infrastructure. As such, effective public-private coordination is essential
to the Nation’s financial and national security. In this regard, The Office of Cybersecurity and
Critical Infrastructure Protection coordinates Treasury’s efforts to enhance the security and
resilience of the financial services sector critical infrastructure and reduce operational risk
including risks associated with cybersecurity. That said, Treasury and other federal agencies
have yet to fully implement the National Institute of Standards and Technology (NIST) guidance
to assist federal agencies in managing cybersecurity risks. 30 In 2018, GAO had reported that the
extent of adoption of the NIST framework by critical infrastructure sectors was unknown since
agencies were not measuring framework implementation. 31 With respect to Treasury, GAO
29
A joint Cybersecurity Advisory was issued by the Cybersecurity and Infrastructure Security Agency to “warn
organizations that Russia’s invasion of Ukraine could expose organizations both within and beyond the region to
increased malicious cyber activity. This activity may occur as a response to the unprecedented economic costs
imposed on Russia as well as materiel support provided by the United States and U.S. allies and partners.” (Alert
(AA22-110A) Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure; April 20, 2022)
30
NIST, Framework for Improving Critical Infrastructure Cybersecurity (Version 1.0, February 12, 2014; superseded by
Version 1.1; April 16, 2018).
31
GAO, Critical Infrastructure Protection: Additional Actions Are Essential for Assessing Cybersecurity Framework Adoption
(GAO-18-211; February 18, 2018).
Office of Inspector General Department of Treasury 67
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
had recommended that steps be taken to consult with respective sector partners to develop
methods for determining the level and type of adoption by entities across the financial services
sector. In 2020, GAO recommended that Treasury track the content and progress of sector
wide cyber risk mitigation efforts, and prioritize their completion according to sector goals and
priorities in the sector-specific plan. Additionally, Treasury should update the financial services
sector-specific plan to include specific metrics for measuring the progress of risk mitigation
effects and information on the sector’s ongoing and planned risk mitigation efforts. 32 However,
as of January 2023, GAO reported Treasury had yet to develop methods to determine the level
and type of framework adoption, stating that the voluntary nature of private sector
participation in sector risk management agency activities affects the agency's ability to
implement certain recommendations related to critical infrastructure protection. Treasury was
planning implementation of a tool to track sector risks and mitigation efforts, but it was still in
development. Lastly, Treasury reported to GAO that it did not believe it would be beneficial to
update the sector-specific plan until the Department of Homeland Security completes its
updates to the national plan and provides guidance on sector-specific plans. 33
The Department reported in its response to last year’s letter that it has made strategic
investments to evolve their cybersecurity infrastructure and bring it into alignment with zero
trust requirements, and mitigate risks associated with the modern threat landscape. Treasury
also reported a continued focus on network defense efforts for its High Value Assets. 34 While
addressing increases in cyber threats, Treasury will need to continue to balance cybersecurity
demands while maintaining and modernizing Information Technology (IT) systems.
Challenge 3: Anti-Money Laundering and Terrorist Financing/Bank Secrecy Act Enforcement
Over the past year, the Office of Terrorism and Financial Intelligence (TFI) has remained
dedicated to countering the ability of financial networks that support terrorists, organized
transnational crime, weapons of mass destruction proliferators, and other threats to
international security through intelligence analysis, sanctions, and international private-sector
cooperation. As previously reported, identifying, disrupting, and dismantling these networks
continue to be challenging. Additionally, criminals and other bad actors evolve and continue to
develop sophisticated money laundering methods in an attempt to avoid detection.
TFI’s authorities are key tools in implementing U.S. policy to pressure foreign countries and
regimes, such as Russia, by using designations and economic sanctions. TFI has significantly
increased sanctions against Russia related to its actions against Ukraine and other malign
activities. TFI’s counter-terrorism designations disrupt the financial networks that support
terrorist organizations. Other TFI tools, such as diplomatic and private sector engagement,
32
GAO, Critical Infrastructure Protection: Treasury Needs to Improve Tracking of Financial Sector Cybersecurity Risk
Mitigation Efforts (GAO-20-631; September 17, 2020).
33
GAO, Priority Open Recommendations: Department of the Treasury (GAO-23-106469; July 7, 2023).
34
High Value Assets are assets, information systems, information, and data for which an unauthorized access, use,
disclosure, disruption, modification, or destruction could cause a significant impact to the U S.’ national security
interests, foreign relations, economy, or to the public confidence, civil liberties, or public health and safety.
68 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
regulatory oversight, and intelligence analysis, also play an important role. Disrupting terrorist
financing depends on a whole-of-government approach and requires collaboration and
coordination within Treasury, other federal agencies, the private sector, and international
partners.
Collaboration and coordination are key to successfully identifying and disrupting all of these
financial networks and meeting TFI’s mission. This effort requires effective and efficient working
relationships among components within TFI and the Intelligence Community. In an effort to
effectively implement U.S. policy and disrupt these financial networks, officials stated that TFI is
moving towards a more collaborative approach to achieve its mission. Given Treasury’s critical
mission and its role to carry out U.S. policy, we continue to consider anti-money laundering
and combating terrorist financing programs and operations as inherently high-risk.
Data privacy and information sharing are challenges for the Financial Crimes Enforcement
Network (FinCEN), which has experienced unauthorized disclosures of Bank Secrecy Act (BSA)
information. 35 FinCEN is required to maintain a highly secure database for financial institutions
to report BSA information. FinCEN has previously identified that the success of that system
depends on the financial sector’s confidence that those reports are adequately protected, but
unauthorized disclosures threaten to undermine that confidence. The challenge for FinCEN is
to ensure the BSA information remains secure in order to maintain the confidence of the
financial sector, while meeting the access needs of law enforcement, regulatory, and intelligence
partners. FinCEN also faces an additional challenge, to develop and implement a new secure
database for certain businesses to report their beneficial ownership information, as required by
the Corporate Transparency Act. 36 FinCEN implemented the database in January 2024.
Challenge 4: Climate Initiatives Risk
In January 2021, Executive Order (EO) 14008, Tackling the Climate Crisis at Home and Abroad,
identified the immediate need for comprehensive action to address the catastrophic impacts of
climate change. EO 14008 emphasizes that U.S. leadership, and that of federal departments and
agencies, will be required to significantly enhance global action and achieve the necessary policy
outcomes on climate change. Furthermore, in May 2021, the White House introduced EO
14030, Climate- Related Financial Risk, which aims to: (1) advance consistent, clear, intelligible,
comparable, and accurate disclosure of climate-related financial risk, including both physical and
transition risks; 37 (2) mitigate that risk and its drivers, while accounting for and addressing
disparate impacts on disadvantaged communities and communities of color and spurring the
creation of well-paying jobs; and (3) achieve the Administration’s target of a net-zero emissions
35
Public Law 91-508 (October 26, 1970).
36
Public Law 116-283 (January 1, 2021).
37
Physical risk refers to the harm to people and property arising from acute, climate-related disaster events such
as hurricanes, wildfires, and floods as well as longer-term chronic phenomena such as higher average
temperatures. Transition risk refers to stresses to certain institutions or sectors arising from the shifts in policy,
consumer and business sentiment, or technologies associated with the changes necessary to limit climate change.
Office of Inspector General Department of Treasury 69
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
economy by no later than 2050. The Secretary of the Treasury, as the Chair of the Financial
Stability Oversight Council (FSOC), will lead several efforts related to EO 14030. Taken
together, these two EOs place an emphasis on ensuring climate change is at the forefront of
U.S. foreign policy and national security; establishing a government-wide approach to the
climate crisis; and bolstering the resiliency of our communities, States, Tribes, territories, and
financial institutions to position the United States to lead the global economy to a more
prosperous and sustainable future.
Treasury continues to play a significant role working with other federal agencies, foreign
governments, and international financial institutions to stimulate global action on addressing
climate change, promoting environmental justice, and addressing climate-related risks. In 2021,
Treasury created a new Climate Hub and appointed a Climate Counselor to help set the
strategic direction of its efforts to address climate change and coordinate across those efforts.
The Treasury Climate Hub will coordinate and enhance existing climate-related activities by
engaging the tools, capabilities, and expertise from across the Department, including officials
from Domestic Finance, Economic Policy, International Affairs, and Tax Policy. With a view of
all Treasury climate initiatives, the Hub will enable Treasury to prioritize climate action. On July
27, 2023, Treasury announced the appointment of a new Climate Counselor.
Treasury is also engaged in work to address climate-related risks to the financial system
through its role as a leading banking regulator, with the OCC, and its responsibilities within
FSOC. Internationally, Treasury represents the United States at the G7 and G20, at the
Financial Stability Board, and other institutions and forums such as the International Monetary
Fund. OCC and the FIO are members of the international organization, the Network of
Central Banks and Supervisors for Greening the Financial System (NGFS). In October 2021,
FSOC issued its Report on Climate-Related Financial Risk, as mandated by EO 14030. The
report highlights challenges in efforts to comprehensively understand and address climate-
related financial risk. Those challenges include the types and quality of available data and
measurement tools, the ability to assess climate-related financial risks and vulnerabilities, and
the incorporation of these risks into management practices and supervisory expectations as
appropriate. FSOC concluded the report with thirty-five recommendations. Many, if not most,
apply to the Department, through either OFR, FIO, or OCC. It will be important that each
recommendation be addressed not only timely, but also collectively with the other FSOC
members to ensure a cohesive response.
To meet the challenges relating to the types and quality of available data and measurement
tools, the OFR is developing an interagency data and analytics platform – the Joint Analysis Data
Environment (JADE). Based on a pilot program, JADE will provide FSOC member agencies with
access to data, analytical software, and high-performance computing tools to allow users to
jointly analyze financial stability risks and vulnerabilities. With an initial version now operational,
the OFR will need to continue to expand JADE to evolve and include new data and allow
access to other FSOC member agencies. Furthermore, OCC has implemented multiple
initiatives to address climate-related financial risk. They have partnered with other federal
banking regulators to work collaboratively in understanding the risks and continue to consider
70 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
the comments received on the draft Principles for Climate-Related Financial Risk Management
for Large Banks. OCC also engages with international groups such as the NGFS to share best
practices and understand the development of climate-related financial risk management in the
financial sector. Internally, OCC’s Office of Climate Risk led by a Chief Climate Risk Officer
assesses climate-related financial risks and advises management on OCC policy, banking
supervision, and research. These collaborations will continue to be important for developing a
common understanding of climate-related financial risks and their impact to ensure the
continued safety and soundness of the banking system. OCC also continues to work with
FSOC and other member agencies to understand the broader implications of climate-related
financial risks and their potential impact on financial stability.
Challenge 5: Operating in an Uncertain Environment
In assessing the Department’s most serious challenges, we remain mindful of external factors
and future uncertainties that affect its operations. These factors include, but are not limited to,
the repeated cycle of budget and debt ceiling stopgaps, rising interest rates, and inflation.
Congress has yet to resolve unfinished business when it comes to the Nation’s debt, and the
long-term sustainability of programs. Although legislation was passed to temporarily suspend
the debt limit until January 1, 2025, 38 no long-term solution has been found. The impact of
these challenges and their uncertainties require the Department to continue to focus its
resources on programs that are in the highest need to citizens and/or where there is a unique
federal role. It is essential that programs and reforms be managed and communicated effectively
to achieve performance and accountability.
Debt Limit and the Budget
The debt limit—commonly called the debt ceiling— is the total amount of money that the U.S.
government is authorized to borrow to meet its existing legal obligations. The amount is set by
law and has been increased or suspended over the years to allow for the additional borrowing
needed to finance the government’s operations. Failing to increase or suspend the debt limit
would have catastrophic economic consequences, as it would cause the government to default
on its legal obligations. As experienced, even threats that the U.S. government may fail to meet
its obligations have led credit agencies to downgrade the Federal Government’s credit rating in
2011 and 2023, which increases borrowing costs and hurts the long-run budget. Until
lawmakers enact legislation to raise or suspend the debt limit, Treasury must use its cash
balance and the available extraordinary measures— special temporary strategies to handle cash
and debt management—to fund ongoing government activities. The challenges Treasury
generally faces with a debt limit impasse include the disruption of its prudent cash management
policy implementation, uncertainty in the Treasury debt market, communicating and managing
the economic impact, and diversion of resources.
38
Public Law 118-5, (June 3, 2023)
Office of Inspector General Department of Treasury 71
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Treasury’s prudent cash balance policy is to maintain sufficient funds to cover at least the one-
week-ahead cash need, including net fiscal outflows and the gross volume of maturing
marketable debt. This policy is a risk-management tool to protect against potential
interruptions to market access. However, because the debt limit constrains Treasury’s
borrowing, it can become impossible to comply with this policy during debt limit impasses. A
cash balance below the policy level creates substantial risks in the event of unexpected adverse
circumstances. These risks typically worsen as a debt limit impasse goes on and the cash
balance declines towards zero. For example, on June 1, 2023, Treasury had an end-of-day cash
balance of just $23 billion compared to a policy level that called for approximately $300 billion
on that day (and an average balance in 2022 of more than $600 billion). Furthermore, once a
debt limit impasse is resolved, Treasury must rapidly replenish its cash balance back towards
the policy level, which can result in elevated volatility in the primary and secondary markets for
bills. Also, actions to manage the amount of outstanding Treasury securities when outstanding
debt is at or near the statutory limit can add uncertainty to the Treasury market. For example,
during past debt limit impasses, Treasury has postponed auctions and dramatically reduced the
amount of bills outstanding, which compromised the regularity of auctions and the certainty of
supply, on which Treasury relies to achieve the lowest borrowing cost over time.
As debt nears the limit, managing both debt and cash require more time and Treasury
resources. Treasury's operational focus on the debt limit begins as early as 6 to 9 months
before the debt limit is expected to be reached and increases as debt nears the limit. In 2023,
while Congress deliberated on increasing the debt limit, Fiscal Service and the Office of Fiscal
Projections implemented extraordinary measures to prevent the United States from defaulting
on its obligations. Extraordinary measures included (1) suspending investments in the
Government Securities Investments Fund of the federal employees’ Thrift Savings Plan and Civil
Service Retirement and Disability Fund (CSRDF), (2) redeeming certain investments held by
CSRDF and Postal Service Retiree Health Benefits Fund earlier than normal, (3) suspending new
issuances of State and Local Government Series securities, and (4) exchanging $1.9 billion of
Treasury securities held by the CSRDF for securities issued by the Federal Financing Bank.
These activities diverted time and Treasury resources from other cash and debt management
issues and impacted people ranging from senior leaders to operational staff. This diversion of
staff resources increases the risk in performing daily operational activity as normal processes
are delayed and fewer staff resources are available for normal operational tasks. Estimates
provided by Fiscal Service and the Office of Fiscal Projections, the entities primarily affected by
the delays, indicated that these entities' personnel devoted approximately 7,730 hours to
managing debt near the limit when delays in raising the debt limit occurred in 2023.
The Fiscal Responsibility Act of 2023, enacted on June 3, 2023, suspends the debt limit through
January 1, 2025; increases the limit on January 2, 2025, to accommodate the obligations issued
during the suspension period; and sets statutory caps on defense and non-defense discretionary
spending for fiscal years 2024 and 2025. Specifically, discretionary budget authority will be
capped at $1.59 trillion in 2024— a reduction of $12 billion compared to fiscal year 2023,
which provides the first cut to base discretionary spending authority in more than a decade —
and $1.61 trillion in 2025— an overall increase of 1 percent compared with fiscal year 2024.
72 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
The legislation also includes a penalty for failure to enact regular appropriations by January
2024 in the form of one percent reductions to defense and nondefense spending levels (to take
effect by April 30, 2024), which is intended to aid the budget process and deter excessive
reliance on continuing resolutions; a similar penalty and timeline also apply for fiscal year 2025.
Continued delays in enacting annual appropriations timely could have a negative impact on
Treasury's operations. According to the Treasury Departmental Office (DO) fiscal year 2024
Congressional Budget Justification, the lack of adequate funding for inflationary increases and
gradual reduction of full-time employee levels across Treasury policy offices, erodes DO’s
capacity to maintain support of fundamental DO mission areas. DO mission areas include
maintaining the public debt, setting Treasury’s strategy, and performing legal analysis on issues
related to Treasury equities. Inflationary pressures lead to increased funding needs for
programs and modernization efforts budgeted in prior years. Funding is needed to ensure that
DO can sustain critical policy work necessary to maintain a strong economy and create
economic growth and financial stability.
Rising Interest Rates and Inflation
Rising interest rates and lower bond ratings impact Treasury’s costs to manage the Federal
Government’s finances and resources effectively. The increasing cost to service the federal debt
makes these critical markets vulnerable to stresses, which could have significant consequences
for economic growth and financial stability. With federal, state, and local government debt now
exceeding $30 trillion, ensuring that these markets remain resilient is a critical component of
sound fiscal policy.
The rapid increase in interest rates were a contributing factor to multiple bank failures in early
2023, resulting in a period of increased market volatility that threatened U.S. financial stability.
When the Federal Reserve increased interest rates throughout 2022 and into 2023, some
banks did not have sufficient liquidity to satisfy their obligations. Banks often invest the money
received from demand deposits and checking and savings accounts in long-term assets with the
intention that the interest rates on their long-term investments will exceed the interest rates
paid to their customers resulting in a gain for the bank. However, the rapid pace of interest
rate hikes resulted in many banks having to pay customers a higher interest rate while their
funds were tied up in long-term investments that were paying lower interest rates. The result
was some banks experienced a liquidity crisis. Because these banks did not have sufficient
liquidity and access to capital, they failed. Sound banks were also adversely impacted, because
the interest rate increases depreciated the value of their investment portfolios. As a result of
the liquidity crisis, many banks have taken steps to strengthen their financial positions; however,
they remain under pressure. Uncertainty regarding future interest rates continue to pose risk
to banks. Treasury as a leading banking regulator, through OCC, must be mindful of these
liquidity risks on the institutions they supervise and the broader U.S. financial system.
Office of Inspector General Department of Treasury 73
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Completed and In-Progress Work on Financial Oversight
CDFI Fund’s Implementation of the CDFI Equitable Recovery Program
We initiated an audit to assess the implementation of the CDFI Fund’s CDFI Equitable
Recovery Program (ERP) including making funds available, and establishing policies, procedures,
as well as other program guidance and documentation. We found that CDFI Fund took
appropriate steps to establish the CDFI ERP to include making funds available to recipients, as
well as establishing policies, procedures, and program guidance. CDFI Fund management took
appropriate steps to establish the CDFI ERP in compliance with GAO’s Standards for Internal
Control in the Federal Government (the “Green Book”), the CAA, 2021, and OMB Uniform
Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. The CDFI
Fund established internal controls over the CDFI ERP in accordance with the Green Book to
include: (1) a process for CDFIs to apply for CDFI ERP awards conforming to the CAA, 2021;
and (2) a CDFI ERP application evaluation process (including award determinations) to meet
the legislative requirements.
We determined that the CDFI Fund provided sufficient guidance to potential CDFI ERP
applicants and developed CDFI ERP-specific application submission and review processes,
policies and procedures, and internal guidance for program personnel. In designing a framework
to comply with the CAA, 2021, CDFI Fund management consulted with officials from Treasury,
the OMB, and staff members from the Senate Committee on Banking, Housing, and Urban
Affairs and the House Financial Services Committee. CDFI Fund management allocated existing
staff, hired new personnel, and contracted external reviewers in standing up the CDFI ERP.
Additionally, the CDFI Fund leveraged existing program structures from the CDFI Rapid
Response Program and the CDFI Financial Assistance Program and used existing tools to
evaluate CDFI ERP candidates’ financial and compliance risk. We did not make any
recommendations. (OIG-23-033)
CDFI Fund’s Award and Post Award Administration of the CDFI Rapid Response Program
We initiated an audit to assess the compliance of the CDFI Fund’s award process for ensuring
accuracy of rapid response program (RRP) payments, and the design and implementation of the
post-award administration to include the CDFI RRP recipient monitoring process. We found
that CDFI Fund management documented the CDFI RRP awards process across multiple
standard operating procedures (SOPs), consistent with the U.S. Government Accountability
Office’s (GAO) Standards for Internal Control in the Federal Government (Green Book). CDFI
Fund management also accurately calculated CDFI RRP awards and administered them in
accordance with the CAA, 2021 and the OMB Uniform Administrative Requirements, Cost
Principles, and Audit Requirements for Federal Awards (Uniform Guidance). However, the CDFI
74 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
Fund did not comply with subsequent payment review and approval timelines for 2 of the 91
payments we tested. Despite the CDFI Fund’s delays in approving the recipients’ subsequent
award payment requests, we do not believe there is a systemic issue with the timeliness of
CDFI RRP payment reviews.
The CDFI Fund designed and implemented the CDFI RRP post-award administration process,
to include recipient monitoring, in compliance with the CAA, 2021, Uniform Guidance, and
GAO Green Book. CDFI Fund management developed post-award and monitoring SOPs as
well as the Assistance Agreement, which incorporated Uniform Guidance requirements to
recipients. Furthermore, management established: (1) procedures for evaluating CDFI RRP
annual compliance reports; (2) a non-compliance process; and (3) a process for closing CDFI
RRP awards. Finally, the CDFI Fund provided CDFI RRP available data for Treasury’s report on
the impact of programs under the CAA, 2021. We did not make any recommendations. (OIG-
23-032)
OCC’s Supervision of Federal Branches of Foreign Banks (In Progress)
We initiated an audit of OCC’s supervision of federal branches of foreign banks. The objective
of this audit is to assess OCC’s supervision of federal branches and agencies of foreign banking
organizations operating in the United States.
OCC’s Controls over Purchase Cards (In Progress)
We initiated an audit of OCC’s controls over purchase cards. The objective for this audit is to
assess the controls in place over OCC’s purchase card use and identify any potential illegal,
improper, or erroneous transactions.
OCC’s Crisis Readiness (In Progress)
We initiated an audit of OCC’s crisis readiness. The objective for this audit is to assess OCC’s
readiness to address crises that could impact OCC’s operations and the institutions it
supervises.
Corrective Action Verification (CAV) Material Loss Review of Washington Federal Bank for
Savings (In Progress)
We initiated an audit to assess whether OCC’s management has taken corrective actions in
response to the six recommendations made in the Treasury OIG audit report, Material Loss
Review of Washington Federal Bank for Savings (OIG-19-009, issued November 6, 2018).
Office of Financial Research Workforce Reshaping Efforts (In Progress)
We initiated an audit of Treasury OFR’s implementation of its workforce reshaping efforts and
its compliance with applicable laws, regulations, policies, and procedures.
Office of Inspector General Department of Treasury 75
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
CDFI Fund’s Award and Post-Award Administration of the CDFI Equitable Recovery Program (In
Progress)
We initiated an audit to assess the CDFI Fund’s award process for ensuring the accuracy of the
CDFI ERP payments and the design of the post-award administration over recipient monitoring
in compliance with applicable laws, regulations, and policies and procedures.
Review of Financial Crimes Enforcement Network Beneficial Ownership Information Reporting
(In Progress)
We will (1) summarize external comments and complaints and any related completed
investigations conducted by the OIG related to FinCEN’s collection of Beneficial Ownership
Information (BOI); and (2) provide recommendations, in coordination with FinCEN, to improve
BOI reporting processes to ensure the information reported to FinCEN is accurate, complete,
and highly useful.
Treasury’s Implementation of the Coronavirus Economic Relief for Transportations Services
(CERTS) Program (In Progress)
We initiated an audit to assess Treasury’s implementation activities to include the establishment
of policies, procedures, and other terms and conditions of financial assistance under the CERTS
Program.
Treasury’s Implementation of the Coronavirus State and Local Fiscal Recovery Funds (In
Progress)
We initiated an audit to assess Treasury’s implementation activities, including the establishment
of policies, procedures, and processes for making payments to eligible recipients, and the terms
and conditions for receiving financial assistance under the Coronavirus State and Local Fiscal
Recovery Fund (SLFRF). As part of our audit, we will review Treasury’s policies and procedures
to monitor recipients’ uses of funds.
Treasury’s Implementation of the Coronavirus Capital Projects Fund (In Progress)
We initiated an audit to assess Treasury’s implementation activities to include the establishment
of policies, procedures, and processes for making funds available to eligible recipients, and the
terms and conditions for receiving financial assistance under the CPF. As part of this audit, we
will review Treasury’s policies and procedures to monitor recipients’ uses of funds.
Treasury’s Implementation of the Local Assistance and Tribal Consistency Fund (In
Progress)
We initiated an audit to assess Treasury’s implementation activities, including establishing
policies, procedures, and processes for making funds available to eligible recipients, and the
76 Office of Inspector General Department of Treasury
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
terms and conditions for receiving financial assistance under the LATCF. As part of this audit,
we will review Treasury's policies and procedures to monitor recipients' uses of fund.
Treasury’s Soundness of Investment Decisions When Approving Institutions’
Participation in the Emergency Capital Investment Program (In Progress)
We initiated an audit to determine if Treasury accurately allocated investments under the
Emergency Capital Investment Program (ECIP), to comply with applicable laws, regulations and
policies and procedures. We plan to assess the ECIP applications, eligibility and participation
requirements, allocation methodologies and calculations, and award determination decisions,
including investment amounts for ECIP applicants.
Failed Bank Reviews
In 1991, Congress enacted the Federal Deposit Insurance Corporation Improvement Act
amending the Federal Deposit Insurance Act (FDIA). The amendments require that banking
regulators take specified supervisory actions when they identify unsafe or unsound practices or
conditions. Also added was a requirement that the Inspector General for the primary federal
regulator of a failed financial institution conduct a material loss review when the estimated loss
to the Deposit Insurance Fund is “material.” FDIA, as amended by Dodd-Frank, defines the loss
threshold amount to the Deposit Insurance Fund triggering a material loss review as a loss that
exceeds $50 million for 2014 and thereafter (with a provision to temporarily raise the
threshold to $75 million in certain circumstances). The act also requires a review of all bank
failures with losses under these threshold amounts for the purposes of (1) ascertaining the
grounds for appointing Federal Deposit Insurance Corporation (FDIC) as receiver and
(2) determining whether any unusual circumstances exist that might warrant a more in-depth
review of the loss. As part of the material loss review, OIG auditors determine the causes of
the failure and assess the supervision of the institution, including the implementation of the
prompt corrective action provisions of the act. 39 As appropriate, OIG auditors also make
recommendations for preventing any such loss in the future.
From 2007 through March 2024, FDIC and other banking regulators closed 551 banks and
federal savings associations. One hundred and forty-four (144) of these were Treasury-
regulated financial institutions; in total, the estimated loss to FDIC’s Deposit Insurance Fund for
these failures was $36.5 billion. Of the 144 failures, 58 resulted in a material loss to the Deposit
Insurance Fund, and our office performed the required reviews of these failures.
During the period covered by this annual report, we did not perform a material loss review or
limited review of any bank failures.
39
Prompt corrective action is a framework of supervisory actions for insured institutions that are not adequately
capitalized. It was intended to ensure that action is taken when an institution becomes financially troubled in order
to prevent a failure or minimize the resulting losses. These actions become increasingly severe as the institution
falls into lower capital categories. The capital categories are well-capitalized, adequately capitalized,
undercapitalized, significantly undercapitalized, and critically undercapitalized.
Office of Inspector General Department of Treasury 77
Annual Report of the Council of Inspectors General on Financial Oversight • July 2024
OIG Investigative Accomplishments
The Office of Investigations, under the leadership of the Assistant Inspector General for
Investigations, performs investigations and conducts initiatives to detect and prevent fraud,
waste, and abuse in programs and operations within Treasury OIG’s jurisdictional boundaries,
and investigates threats against Treasury personnel and assets in designated circumstances as
authorized by the Inspector General Act. The Office of Investigations also manages the
Treasury OIG Hotline to facilitate reporting of allegations involving these programs and
operations.
Significant Investigations
Florida Resident sentenced for Wire Fraud associated with the CARES Act and Paycheck
Protection Program Loan
On August 15, 2023, the final subject in a Treasury OIG investigation was sentenced. The
subjects conspired to defraud the U.S. government by applying for Paycheck Protection
Program Loans and receiving $1.8 million in fraudulently obtained funds. Two subjects were
declined for prosecution and the final subject was sentenced to a total of 37 months
incarceration, and $1.8 million in restitution. The U.S. Attorney’s Office (USAO) for the
Eastern District of Virginia prosecuted the case.
Florida Resident Sentenced to One Count of Wire Fraud for Theft of Funds Through the
Payroll Protection Program
On April 24, 2023, a Florida bank employee was sentenced to 15 months' imprisonment and 36
months’ probation for one count of Wire Fraud. The subject was also ordered to pay
restitution in the amount of $168,000, to forfeit $243,000, and to pay a special assessment of
$100. The subject fraudulently applied for Small Business Administration Payroll Protection
Program loans, deposited the loan amounts into his bank accounts and withdrew funds for
matters unrelated to a business. The U.S. District Court for the Middle District of Florida
prosecuted the joint Treasury OIG and FDIC OIG case.
OCC Employee Impersonated a Federal Law Enforcement Officer
On January 13, 2022, the OIG completed its report of investigation for a case initiated upon
notification that a National Bank Examiner with the Office of the OCC falsely represented
themselves as a Federal Law Enforcement Officer by showing their OCC credentials and badge
to obtain special considerations within their local community. The OIG investigation
substantiated the allegation. Criminal prosecution of the OCC employee was presented and
declined by the USAO for the Middle District of Pennsylvania. A report was provided to the
OCC for its information and the employee received a 30-day suspension during this reporting
period.
78 Office of Inspector General Department of Treasury
Appendix A:
Audit of the Financial Stability Oversight Council’s Efforts
to Address Climate-Related Financial Risk
Office of Inspector General Appendix A 79
COUNCIL OF INSPECTORS GENERAL
ON FINANCIAL OVERSIGHT
Audit of the Financial Stability
Oversight Council’s Efforts to
Address Climate-Related
Financial Risk
AUGUST 2023
CIGFO-2023-001
This page is intentionally blank
Table of Contents
Message from the Acting Chair ......................................................... iii
Executive Summary .......................................................................... 1
Why and How We Conducted This Audit ..................................................................1
What We Found....................................................................................................2
FSOC Response ....................................................................................................3
CIGFO Working Group Audit .............................................................. 4
Background ..........................................................................................................4
Executive Order 14030 ..........................................................................................6
Audit Approach ....................................................................................................8
Results of Audit ............................................................................... 9
FSOC’s Actions on Climate-Related Financial Risk are Consistent with the Policy,
Objectives, and Directives Set Forth in EO 14030 ......................................................9
FSOC Implemented an Effective Process to Develop the Report on Climate-Related
Financial Risk .......................................................................................................9
FSOC’s Report on Climate-Related Financial Risk Met the Requirements of EO 14030 ... 11
FSOC Established Two Committees to Address Climate-Related Financial Risk ............. 13
Conclusion .................................................................................... 16
Appendix I: Objective, Scope, and Methodology ................................. 17
Appendix II: Prior CIGFO Working Group Reports ................................ 20
Appendix III: Results of Structured Questionnaire ............................... 21
Appendix IV: FSOC Response .......................................................... 25
Appendix V: CIGFO Working Group Members .................................... 27
Abbreviations and Acronyms ........................................................... 28
The Council of Inspectors General on Financial Oversight — August 2023 i
This page is intentionally blank
The Council of Inspectors General on Financial Oversight — August 2023 ii
Message from the Acting Chair
August 9, 2023
The Honorable Janet Yellen
Chair, Financial Stability Oversight Council
Washington, D.C. 20220
Dear Madam Chairwoman:
I am transmitting to you the Council of Inspectors General on Financial Oversight (CIGFO) report
titled, Audit of the Financial Stability Oversight Council’s Efforts to Address Climate-Related
Financial Risk.
The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) authorizes
CIGFO to convene working groups of its members to address issues within its jurisdiction.
Accordingly, in September 2021, CIGFO voted to establish a Working Group to conduct an audit to
assess the Financial Stability Oversight Council’s (FSOC) response to Executive Order (EO) 14030,
Climate-Related Financial Risk, issued in May 2021.
In this resulting audit report, we conclude that FSOC’s actions were consistent with the policy,
objectives, and directives set forth in EO 14030. Additionally, FSOC engaged with the member
agencies to assess climate-related financial risk, and implemented an effective process to develop
its Report on Climate-Related Financial Risk. We determined that the FSOC Report satisfactorily
met the requirements set forth in EO 14030. Finally, FSOC established a means to facilitate
ongoing coordination and information sharing among its member agencies on climate-related
financial risk. While we make no recommendations in this report, we encourage FSOC, through the
newly established Climate-Related Financial Risk Committee, to consider member agency
suggestions and feedback to enhance the assessment and sharing of climate-related financial risk
data and information.
I would like to take this opportunity to thank the Working Group members responsible for this
report, each of whom is listed in Appendix V. In addition, I appreciate the support of the FSOC
members, especially those Treasury officials who assisted with this effort.
CIGFO looks forward to working with you on this and other issues. In accordance with the Dodd-
Frank Act, CIGFO is also providing this report to Congress.
Sincerely,
Richard K. Delmar
Acting Chair, CIGFO
The Council of Inspectors General on Financial Oversight — August 2023 iii
This page is intentionally blank
The Council of Inspectors General on Financial Oversight — August 2023 iv
Executive Summary
Executive Summary
Why and How We Conducted This Audit
The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) 1
created regulatory and resolution frameworks designed to reduce the likelihood, and
severe economic consequences, of financial instability. The Dodd-Frank Act
established the Financial Stability Oversight Council (FSOC or Council) and charged it
with identifying risks to the nation’s financial stability, promoting market discipline,
and responding to emerging threats to the stability of the U.S. financial system. 2 It is a
collaborative body chaired by the Secretary of the Department of the Treasury
(Treasury) that leverages the expertise of federal financial regulators, an independent
insurance expert appointed by the President, and state regulators. Within Treasury, a
dedicated policy office, led by a Deputy Assistant Secretary, functions as the FSOC
Secretariat and assists in coordinating the work of the Council among its members and
member agencies. 3
The Dodd-Frank Act also created the Council of Inspectors General on Financial
Oversight (CIGFO), whose members include the Inspectors General with oversight
authority for the majority of FSOC’s member agencies. The Dodd-Frank Act authorizes
CIGFO to convene a Working Group of its members to evaluate the effectiveness and
internal operations of FSOC. 4 Appendix II provides a listing of prior CIGFO Working
Group reports.
In September 2021, CIGFO voted to establish a Working Group to conduct an audit to
assess FSOC’s response to Executive Order (EO) 14030, Climate-Related Financial
Risk, issued in May 2021. 5 EO 14030 directed the Secretary of the Treasury to
engage FSOC members to consider actions to assess, share, and report on climate-
related financial risk to the financial stability of the Federal Government and U.S.
financial system. 6 The Treasury Office of Inspector General (OIG) and the Federal
1
Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203,124 Stat 1376,
(2010).
2
12 U.S.C. §§5321(a) and 5322(a)(1).
3
As used in this report, the terms “members” and “FSOC members” mean the individual voting and
nonvoting members of the FSOC. “FSOC member agencies” are the agencies and organizations that
these individuals represent, as applicable. This structure is described further in the Background
section.
4
Section 989E(a)(3) of the Dodd-Frank Act.
5
Executive Order 14030, Climate-Related Financial Risk (May 20, 2021).
6
Section 3(a)(i) of EO 14030, Climate-Related Financial Risk (May 20, 2021).
The Council of Inspectors General on Financial Oversight — August 2023 1
Executive Summary
Housing Finance Agency (FHFA) OIG co-led the CIGFO Working Group. Appendix V
provides a listing of CIGFO Working Group members.
Our audit objective was to determine what actions FSOC had taken, or planned, in
response to EO 14030, Climate-Related Financial Risk, as of August 31, 2022, and
whether those actions were consistent with the policy, objectives, and directives set
forth in the EO.
To accomplish our objective, we reviewed relevant legislation, FSOC’s Report on
Climate-Related Financial Risk (Report or FSOC Report), 7 and FSOC’s internal
documentation. We interviewed FSOC Secretariat officials and developed a structured
questionnaire to solicit feedback from FSOC member agencies to gain a better
understanding of the effectiveness of FSOC’s processes to address climate-related
financial risk and prepare the Report. We conducted fieldwork from February 2022
through October 2022. Appendix I provides additional details about the objective,
scope, and methodology of this audit.
What We Found
We found FSOC’s actions were consistent with the policy, objectives, and directives
set forth in EO 14030, and that FSOC engaged with the member agencies to assess
climate-related financial risk. FSOC also implemented an effective process to develop
its Report on Climate-Related Financial Risk, and issued it on October 21, 2021, within
the 180 day deadline set by the EO.
Additionally, we determined the FSOC Report satisfactorily met the requirements set
forth in EO 14030; 8 was comprehensive and addressed the President’s directives; and
completely and accurately reflected the information and input that member agencies
provided to FSOC.
Finally, we determined that FSOC established a means to facilitate ongoing
coordination and information sharing among its member agencies on climate-related
financial risk. To implement recommendations in the FSOC Report, FSOC formed
committees to address the directives set forth in EO 14030, identify priority areas for
continued assessment and mitigation of climate-related risk to the financial system,
7
FSOC, Report on Climate-Related Financial Risk (October 21, 2021);
https://home.treasury.gov/system/files/261/FSOC-Climate-Report.pdf.
8
Section 3(a)(iii) of EO 14030, Climate-Related Financial Risk (May 20, 2021).
The Council of Inspectors General on Financial Oversight — August 2023 2
Executive Summary
and leverage the expertise of diverse stakeholders. We are not making any
recommendations to FSOC as a result of our audit.
FSOC Response
In a written response, FSOC acknowledged the findings and conclusions reached in
this report. FSOC also noted that they expect to build on the FSOC Report and the
work of the new committees to continue giving appropriate focus and attention to the
risks that climate change pose to the stability of our financial system.
See Appendix IV for the entirety of FSOC’s response to our audit report.
The Council of Inspectors General on Financial Oversight — August 2023 3
CIGFO Working Group Audit
CIGFO Working Group Audit
This report presents the results of the CIGFO Working Group’s audit of FSOC’s
response to EO 14030, Climate-Related Financial Risk. CIGFO is issuing this report to
FSOC and Congress as part of CIGFO’s responsibility to oversee FSOC under the
Dodd-Frank Act.
Background
The Dodd-Frank Act established FSOC to create joint accountability for identifying and
mitigating potential threats to the stability of the nation’s financial system. 9 By
creating FSOC, Congress recognized that protecting financial stability would require
the collective engagement of the entire financial regulatory community.
As shown in the Table on the following page, the Council consists of 10 voting
members and 5 non-voting members and brings together the expertise of federal
financial regulators, state regulators, an insurance expert appointed by the President,
by and with the advice and consent of the Senate, and others. 10 The voting members
of FSOC provide a federal financial regulatory perspective as well as an independent
insurance expert’s view. The non-voting members offer different insights as state-level
representatives from bank, securities, and insurance regulators or as the Directors of
offices within Treasury — the Office of Financial Research (OFR) and the Federal
Insurance Office, established in Titles I and V of the Dodd-Frank Act, respectively.
A dedicated policy office within Treasury, led by a Deputy Assistant Secretary,
functions as the FSOC Secretariat. The FSOC Secretariat facilitates collaboration and
assists in coordinating the work of the Council among its members.
9
12 U.S.C. §§ 5321(a) and 5322(a)(1).
10
12 U.S.C. § 5321(b).
The Council of Inspectors General on Financial Oversight — August 2023 4
CIGFO Working Group Audit
Table - FSOC Council Membership
Federal and Independent Members State Members
Secretary of the Treasury, Chairperson (v) State Insurance Commissioner (National
Association of Insurance Commissioners)
Chair of the Board of Governors of the Federal State Banking Supervisor (Conference of
Reserve System (v) State Bank Supervisors)
State Securities Commissioner (North
Comptroller of the Currency (v) American Securities Administrators
Association)
Director of the Consumer Financial Protection
Bureau (v)
Chairman of the Securities and Exchange
Commission (v)
Chairperson of the Federal Deposit Insurance
Corporation (v)
Chairman of the Commodity Futures Trading
Commission (v)
Director of the Federal Housing Finance Agency
(v)
Chairman of the National Credit Union
Administration Board (v)
Director of the Office of Financial Research
Director of the Federal Insurance Office
Independent member with insurance expertise
(v)
(v) Indicates Voting Member
The Council of Inspectors General on Financial Oversight — August 2023 5
CIGFO Working Group Audit
The statutory purposes of FSOC are to:
• identify risks to the financial stability of the United States that could arise from
the material financial distress or failure, or ongoing activities, of large,
interconnected bank holding companies or nonbank financial companies, or that
could arise outside the financial services marketplace;
• promote market discipline, by eliminating expectations on the part of
shareholders, creditors, and counterparties of such companies that the
Government will shield them from losses in the event of failure; and
• respond to emerging threats to the stability of the U.S. financial system. 11
Among other statutory duties, FSOC is required to:
• facilitate information sharing and coordination among the member agencies and
other Federal and State agencies regarding domestic financial services policy
development, rulemaking, examinations, reporting requirements, and
enforcement actions; and
• report annually to Congress on the activities of the Council, significant financial
market and regulatory developments, potential emerging threats, and its
recommendations regarding various topics. 12
Executive Order 14030
In May 2021, the President issued EO 14030, Climate-Related Financial Risk, which
states that the impacts of climate change present physical risks to assets, publicly
traded securities, private investments, and companies. 13 Furthermore, a shift away
from carbon-intensive energy sources and industrial processes presents transition risks
to companies, communities, and workers. 14 The EO stresses that the failure of
11
12 U.S.C. § 5322(a)(1).
12
12 U.S.C. § 5322(a)(2).
13
Physical risk refers to the harm to people and property arising from acute, climate-related disaster
events such as hurricanes, wildfires, and floods as well as longer-term chronic phenomena such as
higher average temperatures.
14
Transition risk refers to stresses to certain institutions or sectors arising from the shifts in policy,
consumer and business sentiment, or technologies associated with the changes necessary to limit
climate change.
The Council of Inspectors General on Financial Oversight — August 2023 6
CIGFO Working Group Audit
financial institutions to account for climate-related financial risk threatens the
competitiveness of U.S. companies and markets, negatively impacts consumers, and
hinders the ability of financial institutions to serve their community.
EO 14030 lays out a policy intended to advance consistent, clear, intelligible,
comparable, and accurate disclosure of climate-related financial risk, including both
physical and transition risks. This policy is meant to mitigate climate-related financial
risk and its drivers, while accounting for and addressing disparate impacts on
disadvantaged communities and communities of color and spurring the creation of
well-paying jobs. Additionally, the EO intends to achieve a target of a net-zero
emissions economy by 2050.
Among several actions designed to further this policy, EO 14030 directs the Secretary
of the Treasury, as the Chair of FSOC, to engage with FSOC members to consider: 15
• assessing, in a detailed and comprehensive manner, the climate-related financial
risk, including both physical and transition risks, to the financial stability of the
Federal Government and the stability of the U.S. financial system;
• facilitating the sharing of climate-related financial risk data and information
among FSOC member agencies and other executive departments and agencies
as appropriate;
• issuing a report to the President within 180 days of the date of the EO on any
efforts by FSOC member agencies to integrate consideration of climate-related
financial risk in their policies and programs; 16 and
• including an assessment of climate-related financial risk in FSOC’s annual report
to Congress.
Further, the EO specified that the FSOC Report include a discussion of: 17
• the necessity of any actions to enhance climate-related disclosures by regulated
entities to mitigate climate-related financial risk to the financial system or assets
15
Section 3(a) of EO 14030, Climate-Related Financial Risk.
16
The report to the President is FSOC’s Report on Climate-Related Financial Risk (Report or FSOC
Report).
17
Section 3(a)(iii) of EO 14030, Climate-Related Financial Risk.
The Council of Inspectors General on Financial Oversight — August 2023 7
CIGFO Working Group Audit
and a recommended implementation plan for taking those actions;
• any current approaches to incorporating the consideration of climate-related
financial risk into the member agencies’ respective regulatory and supervisory
activities and any impediments they faced in adopting those approaches;
• recommended processes to identify climate-related financial risk to the financial
stability of the United States; and
• any other recommendations on how identified climate-related financial risk can
be mitigated, including through new or revised regulatory standards as
appropriate.
Audit Approach
Our audit objective was to determine what actions FSOC had taken, or planned, in
response to EO 14030 as of August 31, 2022, and whether those actions were
consistent with the policy, objectives, and directives set forth in the EO.
To accomplish our objective, we:
• reviewed the Dodd-Frank Act and EO 14030 to gain an understanding of
FSOC’s statutory authorities and responsibilities;
• interviewed FSOC Secretariat officials, reviewed the FSOC Report, and reviewed
FSOC documentation to gain an understanding of actions taken by the Council
in response to the EO; and
• developed a structured questionnaire to obtain member agencies’ perspectives
on FSOC’s effectiveness in developing the Report and meeting its
responsibilities under EO 14030. Appendix III details the results of the
questionnaire.
We conducted fieldwork from February 2022 through October 2022. Appendix I
provides additional details about the objective, scope, and methodology of this audit.
The Council of Inspectors General on Financial Oversight — August 2023 8
Results of Audit
Results of Audit
FSOC’s Actions on Climate-Related Financial Risk are Consistent
with the Policy, Objectives, and Directives Set Forth in EO
14030
We found FSOC’s actions were consistent with the policy, objectives, and directives
set forth in EO 14030. Specifically, we determined that FSOC:
• engaged its member agencies in a collaborative process to develop the FSOC
Report;
• issued the FSOC Report containing the elements set forth in section 3(a)(iii) of
EO 14030 within 180 days of the date of the EO; and
• established, based on the recommendations included in the FSOC Report, two
committees designed to assess and mitigate climate-related financial risk,
facilitate the sharing of climate-related financial risk data and information, and
leverage the expertise of diverse stakeholders.
FSOC Implemented an Effective Process to Develop the Report on
Climate-Related Financial Risk
FSOC established the Climate Working Group, a temporary, staff-level working group
comprised of representatives from each member agency to facilitate engagement on
climate-related financial risks and develop the Report. The Climate Working Group met
biweekly from July 2021 through October 2021, when FSOC published the Report.
FSOC provided us with briefing materials that demonstrated discussions of a work
plan, including the reporting timeline and report structure, and member agency
initiatives to address climate-related financial risks. Climate Working Group meetings
provided FSOC member agencies with opportunities for information sharing and input
at different stages of the report preparation process. The Climate Working Group
provided updates to the Council during the July 16, 2021 and September 9, 2021
FSOC meetings.
Through our structured questionnaire, we gained an understanding of member
agencies’ perspectives on FSOC’s reporting process. The results of the member
The Council of Inspectors General on Financial Oversight — August 2023 9
Results of Audit
agency responses to the questionnaire disclose that overall: FSOC clearly
communicated and defined the objectives of the Report to include guidance on the
Report’s scope and format; and FSOC engaged the member agencies in developing the
Report’s assessment of climate-related financial risk, including physical and transition
risks. 18
All 13 respondents to our structured questionnaire indicated that FSOC implemented
an effective process to prepare the FSOC Report. Further, the majority of respondents
agreed that FSOC effectively facilitated the sharing of climate-related financial risk
data and information. However, Federal Deposit Insurance Corporation (FDIC) senior
officials stated that while FSOC was effective in facilitating discussions about the
types of data available and the data needs, FSOC was limited in its ability to
effectively facilitate the sharing of actual climate-related financial risk data and results,
because there was not much data available at that time.
Further, FDIC OIG identified one instance in which FSOC did not disseminate a non-
public study prepared by FDIC's Division of Insurance and Research, which was
referenced in the FSOC Report. 19 FSOC Secretariat officials acknowledged that they
did not request the study from FDIC or share it with the other FSOC member agencies.
Further, FDIC did not offer the study to FSOC or the other member agencies. With that
said, we reviewed Climate Working Group documentation and noted that a July 2021
Climate Working Group meeting presentation included a summary of all agency
initiatives pertinent to climate-related financial risk and identified FDIC research being
conducted that related to the study referenced in the FSOC Report. We also noted that
subsequent to the issuance of the FSOC Report in October 2021, the FDIC study was
publicly released in June 2022. 20
Consistent with structured questionnaire responses indicating that FSOC implemented
an effective process to prepare the Report, most respondents did not cite areas for
improvement regarding FSOC’s assessment and sharing of information related to
climate-related financial risk. FHFA officials did note, however, that the process could
18
Appendix III provides the results of the structured questionnaire.
19
FDIC’s Climate Change Event Analysis was a study on the effects of climate events on local
economic and banking conditions, including the impact on low and moderate-income areas before
and after each climate event.
20
Federal Deposit Insurance Corporation Staff Studies, Report No. 2022-03, Severe Weather Events
and Local Economic and Banking Conditions (June 2022); Severe Weather Events and Local
Economic and Banking Conditions (fdic.gov).
The Council of Inspectors General on Financial Oversight — August 2023 10
Results of Audit
be improved and that they provided FSOC with suggestions that could help with the
sharing of data, scenario analyses, and concerns with protecting vulnerable
communities.
That said, FHFA, along with the independent member with insurance expertise, opined
that the establishment of FSOC’s Climate-Related Financial Risk Committee (CFRC)
would improve ongoing assessment of climate-related financial risk and information
sharing. 21 We encourage FSOC to consider the suggestions provided and to solicit
feedback from all members to enhance the assessment and sharing of climate-related
financial risk data and information.
FSOC’s Report on Climate-Related Financial Risk Met the Requirements of
EO 14030
FSOC issued its Report on Climate-Related Financial Risk on October 21, 2021, within
the 180 day deadline set by EO 14030. 22 We determined that the contents of the
FSOC Report satisfied the requirements set forth in section 3(a)(iii) of EO 14030.
Specifically, the Report discussed:
• The need to enhance entities’ climate-related disclosures, which inform
investors and market participants about the climate-related risks to those
entities. The FSOC Report acknowledged that FSOC member agencies are at
different stages in the development of disclosure requirements concerning
regulated entities but stated that existing climate-related disclosures lack the
consistency, comparability, and decision-usefulness for which investors have
expressed a need. FSOC made 11 recommendations in the Report to enhance
public climate-related disclosures.
• Approaches and actions that each member agency had undertaken to
incorporate consideration of climate-related financial risk into its respective
regulatory and supervisory activities. Further, the Report presented five general
impediments that agencies face in incorporating the consideration of climate-
related financial risk into their activities. These impediments are: (1) data
21
The CFRC was established in December 2021 to support the Council in identifying climate-related
risks, and in responding to climate-related emerging threats, to the financial system, consistent with
the Council’s purposes and duties under the Dodd-Frank Act.
22
All but one FSOC (voting) member voted in favor of issuing the FSOC Report and its
recommendations. The former FDIC Chairman abstained from the vote.
The Council of Inspectors General on Financial Oversight — August 2023 11
Results of Audit
limitations, 23 (2) time horizon, 24 (3) complexity and uncertainty of climate risk, 25
(4) policy and economic uncertainty, 26 and (5) trade-offs. 27 FSOC made nine
recommendations to build capacity and expand efforts to address climate-
related financial risk.
• Processes to identify, and assess climate-related financial risk. FSOC made six
recommendations to fill climate-related data and methodological gaps.
• Processes to mitigate climate-related financial risk. FSOC made nine
recommendations regarding processes to mitigate climate-related financial risk
to the financial stability of the United States, including recommendations to
assess regulatory standards.
Our structured questionnaire corroborated the quality of information contained in the
FSOC Report. Member agency responses demonstrated that information, including the
input and viewpoints of their agencies, was complete and accurately reflected.
Member agencies also felt that the recommendations contained in the FSOC Report
would be useful for their agencies. Most agencies did not have concerns regarding the
scope, the overall data, or the conclusions reached in the Report. Although, the
National Association of Insurance Commissioners did express a general concern with
the degree of work and resources needed to implement some of the recommendations
in the Report.
All respondents confirmed that they were either in the process of implementing, or
planned to implement, the applicable recommendations in the FSOC Report. An FSOC
Secretariat official stated that future CFRC discussions could include timeframes for
CFRC-related activities to help advance agency actions related to the Report
recommendations.
23
Data limitations refer to the gaps in connecting the science of climate change to financial risk
assessments and real-world economic impacts.
24
Time horizon refers to the fact that some impacts of climate change have already materialized, while
others will manifest over a longer time horizon than businesses traditionally consider.
25
Complexity and uncertainty of climate risk refer to how the impacts of climate change, and
accordingly climate-related risk, are non-linear and complex.
26
Policy and economic uncertainty refer to instability surrounding future potential policy changes,
which can impede progress in understanding, assessing, and managing the financial risks of climate
change.
27
Trade-offs refer to the fact that some FSOC members may face trade-offs between climate-related
financial risk mitigation measures and their other mandated objectives.
The Council of Inspectors General on Financial Oversight — August 2023 12
Results of Audit
FSOC Established Two Committees to Address Climate-Related Financial
Risk
The Report on Climate-Related Financial Risk made two recommendations specific to
FSOC in an effort to build capacity and expand efforts to address climate-related
financial risks. These recommendations were for FSOC to:
• form a new staff-level committee, the CFRC, within 60 days to identify priority
areas for assessing and mitigating climate-related risks to the financial system
and serve as a coordinating body, where appropriate, to share information,
facilitate the development of common approaches and standards, and facilitate
communication across FSOC members and interested parties; 28 and
• form a Climate-Related Financial Risk Advisory Committee (CFRAC). This
advisory committee, reporting to the CFRC, will help the Council gather
information on and analysis of climate-related financial risks from a broad array
of stakeholders. 29
The Climate-Related Financial Risk Committee (CFRC)
FSOC approved the establishment of the CFRC in December 2021, 30 within the 60 day
timeframe stipulated in the FSOC Report. It issued a charter for the CFRC, 31 detailing
its purpose, duties, and oversight responsibilities. Per its charter, the CFRC’s duties
include identifying priority areas for assessing and mitigating climate-related financial
risk to the financial system and facilitating information sharing and coordination among
staff of member agencies relating to climate-related risks to the financial system.
The CFRC charter also allows the CFRC to create working groups, as appropriate,
composed of staff of member agencies to perform specific functions of the CFRC, and
any such working group is subject to the direction and oversight of the CFRC and
28
FSOC, Report on Climate-Related Financial Risk (May 20, 2021), Recommendation 1.1, p. 5.
29
FSOC, Report on Climate-Related Financial Risk (May 20, 2021), Recommendation 1.2, p. 5.
30
FSOC Meeting Minutes (December 2021);
https://home.treasury.gov/system/files/261/December_17_2021.pdf.
31
The Council’s Committee Charters;
https://home.treasury.gov/system/files/261/The_Councils_Committee_Charters_2021-12-17.pdf.
The Council of Inspectors General on Financial Oversight — August 2023 13
Results of Audit
Deputies Committee. 32 As of August 2022, the CFRC established four working groups.
The working groups and the objectives of each are:
• Data Requirements – to build an inventory of data that is of interest to each
FSOC member agency for climate-related financial risk analysis and to identify
data gaps.
• Data Infrastructure – to facilitate the establishment of new infrastructure for
FSOC member agencies to find, obtain, share, and analyze data on climate-
related financial risk, including coordination with OFR on its pilot centralized,
cloud based data and analytics hub to support FSOC in researching climate-
related financial risk.
• Risk Assessments – to develop a more robust framework around identifying and
prioritizing risks and vulnerabilities, building from best practices.
• Scenario Analysis – to share information among member agencies and facilitate
common approaches to climate scenario analysis. This scenario analysis relates
to the exposure of regulated entities to climate-related risks and how those risks
translate into economic and financial impacts.
We found that the CFRC held regular meetings beginning February 2022 through
August 2022.33 We reviewed meeting records and work plans and found that each of
the CFRC’s working groups had developed work streams, established milestones, and
defined deliverables related to their objectives. The working groups also provided
progress updates to the CFRC toward meeting their objectives. CFRC meeting
materials also contain a standing agenda item for member agencies to provide short
updates on their respective priorities for any climate-related work, any significant
developments since the publication of the FSOC Report, and how the CFRC can help
support member agency initiatives.
The CFRC charter requires updates to the Council at least twice a year on the status
of efforts by Council members and member agencies to identify and address climate-
related financial risks. In response to this requirement, the CFRC reported on its efforts
at the July 2022 FSOC meeting, sharing that OFR had launched its Climate Data and
32
The Deputies Committee coordinates and oversees the work of the interagency staff committees and
is made up of a senior official from each FSOC member agency.
33
Records we reviewed showed meetings were held in February, March, June, and August of 2022.
The Council of Inspectors General on Financial Oversight — August 2023 14
Results of Audit
Analytics Hub with the Federal Reserve, among other activities. 34 Additionally, the
FSOC Report recommended that the FSOC annual report detail the CFRC’s progress in
addressing climate-related financial risks.
The Climate-Related Financial Risk Advisory Committee (CFRAC)
FSOC approved the establishment of the CFRAC in October 2022 and issued a charter
for the committee detailing its purpose, duties, and oversight responsibilities. The
CFRAC, to be composed of up to 30 members, will meet at least twice a year and
report to the CFRC. It is intended to leverage the expertise of diverse stakeholders;
including climate science experts, non-governmental research institutions, academia,
commercial businesses, the financial services industry, and special government
employees. The climate data and analytical expertise of CFRAC members will support
regulators’ efforts to translate climate-related risks into economic and financial
impacts.
Because the establishment of the CFRAC was outside of our audit scope, we did not
review the actions and plans of this committee.
34
FSOC Meeting Minutes (July 2022);
https://home.treasury.gov/system/files/256/FSOC_20220728_Minutes.pdf.
The Council of Inspectors General on Financial Oversight — August 2023 15
Conclusion
Conclusion
We found FSOC’s actions were consistent with the policy, objectives, and directives
set forth in EO 14030, and FSOC engaged with the member agencies to assess
climate-related financial risk. FSOC also implemented an effective process to develop
its Report on Climate-Related Financial Risk.
Additionally, we determined the FSOC Report satisfactorily met the requirements set
forth in EO 14030; was comprehensive and addressed the President’s directives; and
completely and accurately reflected the information and input provided to FSOC by its
member agencies.
Finally, we determined that, subsequent to report issuance, FSOC established a means
to facilitate ongoing coordination and information sharing among its member agencies
on climate-related financial risk. FSOC formed committees to address the directives set
forth in EO 14030, identify priority areas for continued assessment and mitigation of
climate-related risk to the financial system, and leverage the expertise of diverse
stakeholders.
FSOC incorporated into the CFRC charter an explicit duty for the CFRC to “facilitate
information sharing and coordination among staff of Council members and member
agencies relating to climate-related risks to the financial system.” Certain responses to
our structured questionnaire indicate that member agencies have suggestions on how
to improve this information sharing. While we make no recommendations in this
report, we encourage FSOC, through the CFRC, to consider member agency
suggestions and feedback to enhance the assessment and sharing of climate-related
financial risk data and information.
FSOC Response
In a written response, FSOC acknowledged the findings and conclusions reached in
this report. FSOC also noted that they expect to build on the FSOC Report and the
work of the new committees to continue giving appropriate focus and attention to the
risks that climate change pose to the stability of our financial system.
The Council of Inspectors General on Financial Oversight — August 2023 16
Appendix I
Appendix I: Objective, Scope, and Methodology
Objective
Our audit objective was to determine what actions the Financial Stability Oversight
Council (FSOC or Council) had taken, or planned, in response to Executive Order (EO)
14030, Climate-Related Financial Risk, as of August 31, 2022, and whether those
actions were consistent with the policy, objectives, and directives set forth in the EO.
Scope and Methodology
The scope of this audit included FSOC’s actions and planned initiatives in response to
EO 14030, Climate-Related Financial Risk, as of August 31, 2022.
The Council of Inspectors General on Financial Oversight (CIGFO) convened a Working
Group to review FSOC’s response to EO 14030 and assess whether those actions
were consistent with the policy, objectives, and directives set forth in the EO. The
Working Group was co-led by the Department of the Treasury (Treasury) Office of
Inspector General and the Federal Housing Finance Agency Office of Inspector
General. We conducted fieldwork from February 2022 through October 2022.
To accomplish our audit objective, we:
• reviewed the Dodd-Frank Wall Street Reform and Consumer Protection Act and
EO 14030 to determine FSOC’s statutory authorities and duties;
• interviewed FSOC Secretariat officials to gain an understanding of FSOC’s
governance and committee structure, processes for coordination and
information sharing among FSOC member agencies, and process developed for
issuing the Report on Climate-Related Financial Risk (Report or FSOC Report);
• reviewed the FSOC Report to determine whether it met the requirements of EO
14030;
• reviewed FSOC’s internal documents, annual reports, and Council meeting
minutes, 35 to determine whether FSOC developed plans, methodologies,
35
FSOC members are required by the Dodd-Frank Wall Street Reform and Consumer Protection Act to
meet no less than quarterly, but the Council has historically convened on a more frequent basis.
12 U.S.C. § 5321(e)(1).
The Council of Inspectors General on Financial Oversight — August 2023 17
Appendix I
milestones, and deliverables needed to define and guide its work to identify and
address climate-related financial risk;
• created a structured questionnaire designed to obtain FSOC member agencies’
and the independent member’s perspectives on the process FSOC implemented
to develop the Report and the accuracy and completeness of information
contained in the Report. This questionnaire was used by each of the CIGFO
Working Group members to facilitate the consistent collection of information
from the FSOC member agencies. In addition to obtaining responses from FSOC
members, CIGFO Working Group members performed additional procedures as
necessary to substantiate FSOC member agency responses. We received
responses from 13 of the 15 FSOC members; 36 and
• obtained the statuses of actions taken by FSOC member agencies in response
to the recommendations in the FSOC Report, including any planned actions.
CIGFO Working Group members obtained FSOC member responses to the structured
questionnaire and statuses of actions taken, and planned, in response to the Report
recommendations. CIGFO Working Group members had discretion to obtain the
information through meetings or receipt of written responses to the structured
questionnaire.
We assessed internal control necessary to satisfy our audit objective. In particular, we
identified the following U.S. Government Accountability Office’s Standards for Internal
Control in the Federal Government components and principles as significant to our
objective: 37 1) control environment and the underlying principle - Establish Structure,
Responsibility, and Authority, 2) risk assessment and the underlying principle - Define
Objectives and Risk Tolerances, and 3) information and communication and the
underlying principle - Use Quality Information. Because our review was limited to these
aspects of internal control, it may not have disclosed all internal control deficiencies
that may have existed at the time of this audit.
We conducted this performance audit in accordance with generally accepted
government auditing standards. Those standards require that we plan and perform the
36
Questionnaire responses were not obtained from the Secretary of the Treasury or the Conference of
State Bank Supervisors (CSBS). CSBS was unable to respond to the questionnaire, because the
individuals working at CSBS during our audit did not have a role in the FSOC Report.
37
U.S. Government Accountability Office, Standards for Internal Control in the Federal Government
(Sep. 2014).
The Council of Inspectors General on Financial Oversight — August 2023 18
Appendix I
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objective. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on our
audit objective.
The Council of Inspectors General on Financial Oversight — August 2023 19
Appendix II
Appendix II: Prior CIGFO Working Group Reports
The Council of Inspectors General on Financial Oversight has issued the following
working group reports:
• Audit of the Financial Stability Oversight Council’s Controls over Non-public
Information, June 2012
• Audit of the Financial Stability Oversight Council’s Designation of Financial
Market Utilities, July 2013
• Audit of the Financial Stability Oversight Council’s Compliance with Its
Transparency Policy, July 2014
• Audit of the Financial Stability Oversight Council’s Monitoring of Interest
Rate Risk to the Financial System, July 2015
• Audit of the Financial Stability Oversight Council’s Efforts to Promote
Market Discipline, February 2017
• CIGFO’s Corrective Verification Action on the Audit of the Financial
Stability Oversight Council’s Designation of Financial Market Utilities, May
2017
• Top Management and Performance Challenges Facing Financial Regulatory
Organizations, September 2018
• Audit of the Financial Stability Oversight Council’s Monitoring of
International Financial Regulatory Proposals and Developments, May 2019
• Top Management and Performance Challenges Facing Financial-Sector
Regulatory Organizations, July 2019
• Survey of FSOC and its Federal Member Agencies’ Efforts to Implement
the Cybersecurity Act of 2015, January 2020
• CIGFO Guidance in Preparing for and Managing Crises, June 2022
The Council of Inspectors General on Financial Oversight — August 2023 20
Appendix III
Appendix III: Results of Structured Questionnaire
We developed a structured questionnaire to obtain responses from Financial Stability
Oversight Council (FSOC) members to assist us in determining whether FSOC
implemented an effective process to develop the Report on Climate-Related Financial
Risk (Report or FSOC Report) and respond to the requirements set forth in Executive
Order (EO) 14030, Climate-Related Financial Risk.
The Council of Inspectors General on Financial Oversight Working Group members
obtained FSOC member agency responses through interviews or requesting written
responses to the questionnaire. FSOC member agencies answered “Yes”, “No” or “Not
Applicable” to each question and provided a description or explanation of their
response. As detailed in Appendix I, we received responses from 13 of the 15 FSOC
members.
Question 1 - Did FSOC clearly communicate and define the objectives of the Report
and provide your agency with guidance on the scope and format of the Report?
All 13 respondents confirmed that FSOC clearly communicated and defined the
objectives of the Report as well as provided guidance on the scope and format of
the Report. Per the responses, FSOC held various meetings regarding the content
of the Report and agencies had the opportunity to provide feedback.
Question 2 - Did FSOC engage your agency in developing the Report’s assessment of
climate-related financial risk, including both physical and transition risks? How?
All 13 respondents affirmed that FSOC engaged their agency in developing the
Report’s assessment of climate-related financial risk. Multiple agencies commented
that FSOC held one-on-one meetings with their agencies, and they were given
many opportunities to contribute to, and comment on, the draft report.
Question 3 - Did FSOC effectively facilitate the sharing of climate-related financial risk
data and information among the FSOC member agencies when preparing the Report?
How?
According to 11 of the 13 respondents, FSOC effectively facilitated the sharing of
climate-related financial risk data and information among the FSOC member
agencies when preparing the Report. Commenters stated that FSOC accomplished
The Council of Inspectors General on Financial Oversight — August 2023 21
Appendix III
this through the regular distribution of the draft report language, including sources,
at frequent intervals.
However, the National Association of Insurance Commissioners (NAIC) responded
“No” to this question and commented that sharing climate data was not necessary
during the drafting of the Report. NAIC explained that the Report helped identify
relevant data, but the type of sharing necessary to coordinate across the agencies
was a recommendation of the Report, not a prerequisite of drafting the Report.
Additionally, Federal Deposit Insurance Corporation (FDIC) senior officials stated
that while FSOC was effective in facilitating discussions about the types of data
available and the data needs, it was limited in its ability to effectively facilitate the
sharing of actual climate-related financial risk data and results, because there was
not much data available at that time.
Further, FDIC Office of Inspector General identified one instance in which FSOC did
not disseminate a non-public study prepared by FDIC's Division of Insurance and
Research, which was referenced in the FSOC Report.
Question 4 - Has your agency identified any areas in which FSOC’s assessment and
sharing of information regarding climate-related financial risk can be improved?
Two respondents identified areas in which FSOC’s assessment and sharing of
information regarding climate-related financial risk could be potentially improved.
Federal Housing Finance Agency (FHFA) officials stated that they provided FSOC
with suggestions that would help with the sharing of data, scenario analyses, and
concerns with protecting vulnerable communities. FHFA officials explained that
scenario analysis regarding climate risk was a new field, and translating climate
changes into economic variables was a new concept.
Both FHFA and the independent member with insurance expertise communicated
that they believe that the Climate-Related Financial Risk Committee could help to
improve the assessment and sharing of climate-related risk information.
Although the Office of the Comptroller of the Currency did not identify any areas
for improvement, it commented that FSOC is getting more responsibility in the
climate area, and it would be helpful if FSOC had more staff to work on this area.
The Council of Inspectors General on Financial Oversight — August 2023 22
Appendix III
Question 5 - Was the input and/or viewpoints of your agency accurately reflected in
the Report?
All 13 respondents stated that their input and/or viewpoints were accurately
reflected in the Report.
Question 6 - Was your agency provided a draft of the Report for review and comment?
All 13 respondents stated they had opportunities to review and comment on draft
versions of the Report.
Question 7 - Were the concerns of your agency satisfactorily addressed during the
report preparation process?
Twelve (12) of the 13 respondents stated that the concerns of their agencies were
satisfactorily addressed during the report preparation process.
The Board of Governors of the Federal Reserve System responded to this question
with “Not Applicable,” and stated that they were not aware of any concerns
expressed aside from the normal comments made in the drafting process.
Question 8 - Did the information specific to your agency in the Report completely and
accurately reflect the information that your agency provided?
All 13 respondents stated that the information specific to their agency in the
Report completely and accurately reflected the information that their agency
provided.
Question 9 - Does your agency have any concerns regarding the scope of the Report,
the overall data contained within the Report, or the conclusions reached in the Report?
Twelve (12) of the 13 respondents did not have any concerns regarding the scope
of the Report, the overall data contained within the Report, or the conclusions
reached in the Report.
NAIC expressed concerns with the conclusions and recommendations in the
Report. NAIC stated that the degree of data gathering and sharing necessary to
conduct scenario analysis or stress testing, particularly for insurance liabilities,
could be extensive. NAIC said that staffing and resources to perform some of the
work identified in the Report would be a challenge.
The Council of Inspectors General on Financial Oversight — August 2023 23
Appendix III
Question 10 - Are the recommendations contained in the FSOC Report useful for your
agency? Did FSOC consider your agency’s input regarding the recommendations?
All 13 respondents acknowledged that the Report recommendations were useful to
their agency and that FSOC considered their agencies’ input when developing the
Report recommendations.
Question 11 - Has your agency begun to address the Report recommendations? Please
summarize your agency’s plans for implementing the recommendations contained in
the Report.
All 13 respondents indicated that their agencies had begun to address the Report
recommendations and provided written summaries to us of their planned initiatives
to address the recommendations.
Question 12 - Overall, did FSOC implement an effective process to prepare the FSOC
Report?
All 13 respondents indicated that FSOC implemented an effective process to
prepare the FSOC Report. Various agencies acknowledged the short timeframe
FSOC was given to produce the Report, and each agency stated that it felt that the
FSOC had an effective process.
Status of Actions Taken to Address Report Recommendations
As of May 2022, all FSOC member agencies were in the process of implementing
or planned to implement all Report recommendations that were applicable to their
agency.
The Council of Inspectors General on Financial Oversight — August 2023 24
Appendix IV
Appendix IV: FSOC Response
The Council of Inspectors General on Financial Oversight — August 2023 25
Appendix IV
The Council of Inspectors General on Financial Oversight — August 2023 26
Appendix V
Appendix V: CIGFO Working Group Members
Department of the Treasury Office of Inspector General , Co-Lead
Richard Delmar, Acting Inspector General, Department of the Treasury and Acting CIGFO Chair
Deborah Harker Susan Barron Jeffrey Hawkins
Anne Halamar Katherine Draper Andrew Morgan
Tayla Haughton Jackquelynne Foley Michael Kelly
Aziza Harvey-Johnson Jenny Hu Yves Laison
Federal Housing Finance Agency Office of Inspector General, Co-Lead
Brian Tomney, Inspector General, Federal Housing Finance Agency
James Hodge Abdil Salah James Lisle
April Ellison Christopher Mattocks
Board of Governors of the Federal Reserve System and the Consumer Financial Protection Bureau
Office of Inspector General
Mark Bialek, Inspector General, Board of Governors of the Federal Reserve System and Consumer
Financial Protection Bureau
Michael VanHuysen Jason Derr Cynthia Gray
Laura Shakarji Jennifer Ksanznak Rasheem Walker-Gillis
Department of Housing and Urban Development Office of Inspector General
Rae Oliver Davis, Inspector General, Department of Housing and Urban Development
Kilah White Christopher Fontanesi Caitlin Clark
Frances Ranzie Mike Zaccaria
Federal Deposit Insurance Corporation Office of Inspector General
Tyler Smith , Acting Inspector General, Federal Deposit Insurance Corporation
Terry Gibson Cynthia Hogue Luke Itnyre
Melissa Mulhollen Wendy Alvarado Abby Woods
National Credit Union Administration Office of Inspector General
James Hagen, Inspector General, National Credit Union Administration
Marvin Stith
Special Inspector General for the Troubled Asset Relief Program
Melissa Bruce, Acting Special Inspector General, Troubled Asset Relief Program
Yusuf House
U.S. Commodity Futures Trading Commission Office of Inspector General
Dr. Brett M. Baker, Acting Inspector General, U.S. Commodity Futures Trading Commission
Branco Garcia
U.S. Securities and Exchange Commission Office of Inspector General
Deborah J. Jeffrey, Inspector General, U.S. Securities and Exchange Commission
Rebecca Sharek Colin Heffernan Kelli Brown-Barnes
The Council of Inspectors General on Financial Oversight — August 2023 27
Abbreviations and Acronyms
Abbreviations and Acronyms
Dodd-Frank Act Dodd-Frank Wall Street Reform and Consumer Protection Act
CFRAC Climate-Related Financial Risk Advisory Committee
CFRC Climate-Related Financial Risk Committee
CIGFO Council of Inspectors General on Financial Oversight
Council Financial Stability Oversight Council
CSBS Conference of State Bank Supervisors
EO Executive Order
FDIC Federal Deposit Insurance Corporation
FHFA Federal Housing Finance Agency
FSOC Financial Stability Oversight Council
FSOC Report Report on Climate-Related Financial Risks
Member Agencies FSOC Member Agencies
Members FSOC Members
NAIC National Association of Insurance Commissioners
OIG Office of Inspector General
Report Report on Climate-Related Financial Risks
Treasury Department of the Treasury
The Council of Inspectors General on Financial Oversight — August 2023 28
The Council of Inspectors General on Financial Oversight — August 2023 29
File and source
- File
- 2024-07-cigfo-annual-2024.pdf
- Size
- 1,895,238 bytes
- SHA-256
- 81a9f74d8b42d938138671f790a85a7d904444b760742e343015a3a757ef4a11
- Our copy
- 2024-07-cigfo-annual-2024.pdf
- Original
- oig.treasury.gov