Independent Auditors’ Report, United States Department of Labor: Report on the Audit of the Financial Statements, September 30, 2025
Summary
KPMG LLP's Independent Auditors' Report, dated September 11, 2026 and printed in the Department of Labor's FY 2025 Agency Financial Report, gives a qualified opinion on DOL's consolidated financial statements as of September 30, 2025. The qualification rests on two COVID-19 unemployment insurance balances: $3.5 billion of remaining obligations from programs enacted during the pandemic, and $2.9 billion of benefit overpayments, net of allowance for uncollectible accounts. For both, KPMG says it was unable to obtain sufficient appropriate audit evidence about the methodology and certain underlying assumptions DOL used. KPMG reports a material weakness in controls over financial reporting related to Unemployment Trust Fund balances and a significant deficiency in information technology segregation of duties and access controls.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Financial Section
KPMG LLP
Suite 12000
1801 K Street, NW
Washington, DC 20006
Independent Auditors’ Report
Acting Secretary and Inspector General
United States Department of Labor:
Report on the Audit of the Financial Statements
Qualified Opinion on the Consolidated Financial Statements and Opinion on the Sustainability Financial
Statements
We have audited the financial statements of the United States (U.S.) Department of Labor (DOL), which
comprise the consolidated financial statements and the sustainability financial statements. The consolidated
financial statements comprise the consolidated balance sheet as of September 30, 2025, and the related
consolidated statements of net cost, and changes in net position, and combined statement of budgetary
resources for the year then ended, and the related notes to the consolidated financial statements.
The sustainability financial statements comprise the statements of social insurance as of September 30, 2025,
2024, 2023, 2022, and 2021, the statements of changes in social insurance amounts for the years ended
September 30, 2025 and 2024, and the related notes to the sustainability financial statements.
In our opinion, except for the possible effects on the 2025 consolidated financial statements of the matters
described in the Basis for Qualified Opinion on the Consolidated Financial Statements and Basis for Opinion on
the Sustainability Financial Statements section of our report, the accompanying consolidated financial
statements present fairly, in all material respects, the financial position of the United States Department of
Labor as of September 30, 2025, and its net cost, changes in net position, and budgetary resources for the
year then ended in accordance with U.S. generally accepted accounting principles.
Also, in our opinion, the accompanying sustainability financial statements present fairly, in all material respects,
the United States Department of Labor’s social insurance information as of September 30, 2025, 2024, 2023,
2022, and 2021, and its changes in social insurance amounts for the years ended September 30, 2025 and
2024 in accordance with U.S. generally accepted accounting principles.
Basis for Qualified Opinion on the Consolidated Financial Statements and Basis for Opinion on the
Sustainability Financial Statements
For the year ended September 30, 2025, DOL reported remaining obligations from the prior year related to the
unemployment insurance programs enacted during the COVID-19 pandemic in the amount of $3.5 billion.
These remaining obligations are reflected in the unobligated balance from prior year budget authority, net,
caption in the combined statement of budgetary resources. DOL also included information related to these
obligations in notes 18.A, 18.C, 18.D, and 18.E. We were unable to obtain sufficient appropriate audit evidence
about the methodology and certain underlying assumptions used to estimate the balance in fiscal year 2025.
Consequently, we were unable to determine whether any adjustments to these amounts were necessary.
KPMG LLP, a Delaware limited liability partnership, and its subsidiaries are part of
the KPMG global organization of independent member firms affiliated with KPMG
International Limited, a private English company limited by guarantee.
FY 2025 Agency Financial Report 23
Independent Auditors’ Report
In addition, DOL reported COVID-19 related unemployment insurance benefit overpayments of $2.9 billion, net
of allowance for uncollectible accounts, in the accounts receivable, net (with the public) caption in the
consolidated balance sheet as of September 30, 2025. DOL also included information related to the accounts
receivable and the allowance for uncollectible accounts in notes 4, 15, 19, and 21. We were unable to obtain
sufficient appropriate audit evidence about the methodology and certain underlying assumptions used in
developing the estimated components of the related account balances in fiscal year 2025, including the related
bad debt and other expenses. Consequently, we were unable to determine whether any adjustments to these
amounts were necessary.
We conducted our audits in accordance with auditing standards generally accepted in the United States of
America (GAAS), the standards applicable to financial audits contained in Government Auditing Standards,
issued by the Comptroller General of the United States, and Office of Management and Budget (OMB) Bulletin
No. 24-02, Audit Requirements for Federal Financial Statements. Our responsibilities under those standards
and OMB Bulletin No. 24-02 are further described in the Auditors’ Responsibilities for the Audit of the Financial
Statements section of our report. We are required to be independent of DOL and to meet our other ethical
responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the
audit evidence we have obtained is sufficient and appropriate to provide a basis for our qualified opinion on the
consolidated financial statements and audit opinion on the sustainability financial statements.
Emphasis of Matter
As discussed in Notes 1-W and 1-Y to the financial statements, the sustainability financial statements are
based on management's assumptions. These sustainability financial statements present the present value of
DOL's estimated future income to be received, actuarial present value of future expenditures to be paid, and
present value of estimated future administrative costs using a projection period sufficient to illustrate long-term
sustainability. The sustainability financial statements are intended to aid users in assessing whether future
resources will likely be sufficient to sustain public services and to meet obligations as they come due. The
statements of social insurance and changes in social insurance amounts are based on income and benefit
formulas in current law and assume that scheduled benefits will continue after any related trust funds are
exhausted. The sustainability financial statements are not forecasts or predictions. The sustainability financial
statements are not intended to imply that current policy or law is sustainable. In preparing the sustainability
financial statements, management considers and selects assumptions and data that it believes provide a
reasonable basis to illustrate whether current policy or law is sustainable. Assumptions underlying such
sustainability information do not consider changes in policy or all potential future events that could affect future
income, future expenditures, and sustainability, for example, implementation of policy changes to avoid trust
fund exhaustion or unsustainable debt levels. Because of the large number of factors that affect the
sustainability financial statements and the fact that future events and circumstances cannot be estimated with
certainty, even if current policy is continued, there will be differences between the estimates in the sustainability
financial statements and the actual results, and those differences may be material. Our opinion on the
sustainability financial statements is not modified with respect to this matter.
Other Matter - Interactive Data
Management has elected to reference to information on websites or other forms of interactive data outside the
Agency Financial Report to provide additional information for the users of its financial statements. Such
information is not a required part of the financial statements or supplementary information required by the
Federal Accounting Standards Advisory Board. The information on these websites or the other interactive data
has not been subjected to any of our auditing procedures, and accordingly we do not express an opinion or
provide any assurance on it.
24 United Sates Department of Labor
Financial Section
Responsibilities of Management for the Financial Statements
Management is responsible for the preparation and fair presentation of the financial statements in accordance
with U.S. generally accepted accounting principles, and for the design, implementation, and maintenance of
internal control relevant to the preparation and fair presentation of financial statements that are free from
material misstatement, whether due to fraud or error.
Auditors’ Responsibilities for the Audit of the Financial Statements
Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free
from material misstatement, whether due to fraud or error, and to issue an auditors’ report that includes our
opinions. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not
a guarantee that an audit conducted in accordance with GAAS, Government Auditing Standards, and OMB
Bulletin No. 24-02 will always detect a material misstatement when it exists. The risk of not detecting a material
misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion,
forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are
considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence
the judgment made by a reasonable user based on the financial statements.
In performing an audit in accordance with GAAS, Government Auditing Standards, and OMB Bulletin
No. 24-02, we:
• Exercise professional judgment and maintain professional skepticism throughout the audit.
• Identify and assess the risks of material misstatement of the financial statements, whether due to fraud
or error, and design and perform audit procedures responsive to those risks. Such procedures include
examining, on a test basis, evidence regarding the amounts and disclosures in the financial
statements.
• Obtain an understanding of internal control relevant to the audit in order to design audit procedures that
are appropriate in the circumstances, but not for the purpose of expressing an opinion on the
effectiveness of DOL’s internal control. Accordingly, no such opinion is expressed.
• Evaluate the appropriateness of accounting policies used and the reasonableness of significant
accounting estimates made by management, as well as evaluate the overall presentation of the
financial statements.
• Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that
raise substantial doubt about DOL’s ability to continue as a going concern for a reasonable period of
time.
We are required to communicate with those charged with governance regarding, among other matters, the
planned scope and timing of the audit, significant audit findings, and certain internal control related matters that
we identified during the audit.
Required Supplementary Information
U.S. generally accepted accounting principles require that the information in the Management’s Discussion and
Analysis and Required Supplementary Information sections be presented to supplement the basic financial
statements. Such information is the responsibility of management and, although not a part of the basic financial
statements, is required by the Federal Accounting Standards Advisory Board who considers it to be an
essential part of financial reporting for placing the basic financial statements in an appropriate operational,
economic, or historical context. We have applied certain limited procedures to the required supplementary
FY 2025 Agency Financial Report 25
Independent Auditors’ Report
information in accordance with GAAS, which consisted of inquiries of management about the methods of
preparing the information and comparing the information for consistency with management’s responses to our
inquiries, the basic financial statements, and other knowledge we obtained during our audits of the basic
financial statements. We do not express an opinion or provide any assurance on the information because the
limited procedures do not provide us with sufficient evidence to express an opinion or provide any assurance.
Other Information
Management is responsible for the other information included in the Agency Financial Report. The other
information comprises the Message from the Acting Secretary of Labor, Message from the Chief Financial
Officer, and Other Information sections but does not include the financial statements and our auditors’ report
thereon. Our opinions on the financial statements do not cover the other information, and we do not express an
opinion or any form of assurance thereon.
In connection with our audit of the financial statements, our responsibility is to read the other information and
consider whether a material inconsistency exists between the other information and the financial statements, or
the other information otherwise appears to be materially misstated. If, based on the work performed, we
conclude that an uncorrected material misstatement of the other information exists, we are required to describe
it in our report.
Other Reporting Required by Government Auditing Standards
Report on Internal Control Over Financial Reporting
In planning and performing our audit of the financial statements as of and for the year ended September 30,
2025, we considered DOL’s internal control over financial reporting (internal control) as a basis for designing
audit procedures that are appropriate in the circumstances for the purpose of expressing our opinions on the
financial statements, but not for the purpose of expressing an opinion on the effectiveness of DOL’s internal
control. Accordingly, we do not express an opinion on the effectiveness of DOL’s internal control. We did not
test all internal controls relevant to operating objectives as broadly defined by the Federal Managers’ Financial
Integrity Act of 1982.
Our consideration of internal control was for the limited purpose described in the preceding paragraph and was
not designed to identify all deficiencies in internal control that might be material weaknesses or significant
deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified.
However, as described in Exhibits I and II, we identified certain deficiencies in internal control that we consider
to be a material weakness and a significant deficiency.
A deficiency in internal control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent, or detect and correct,
misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in
internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies
described in Exhibit I to be a material weakness.
A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe
than a material weakness, yet important enough to merit attention by those charged with governance. We
consider the deficiencies described in Exhibit II to be a significant deficiency.
26 United Sates Department of Labor
Financial Section
Report on Compliance and Other Matters
As part of obtaining reasonable assurance about whether DOL’s financial statements as of and for the year
ended September 30, 2025 are free from material misstatement, we performed tests of its compliance with
certain provisions of laws, regulations, contracts, and grant agreements, noncompliance with which could have
a direct and material effect on the financial statements. However, providing an opinion on compliance with
those provisions was not an objective of our audit, and accordingly, we do not express such an opinion. The
results of our tests disclosed no instances of noncompliance or other matters that are required to be reported
under Government Auditing Standards or OMB Bulletin No. 24-02.
We also performed tests of DOL’s compliance with certain provisions referred to in Section 803(a) of the
Federal Financial Management Improvement Act of 1996 (FFMIA). Providing an opinion on compliance with
FFMIA was not an objective of our audit, and accordingly, we do not express such an opinion. The results of
our tests disclosed no instances in which DOL’s financial management systems did not substantially comply
with the (1) Federal financial management systems requirements, (2) applicable Federal accounting standards,
and (3) the United States Government Standard General Ledger at the transaction level.
DOL’s Responses to Findings
Government Auditing Standards requires the auditor to perform limited procedures on DOL's responses to the
findings identified in our audit and described in Exhibit III. DOL’s responses were not subjected to the other
auditing procedures applied in the audit of the financial statements and, accordingly, we express no opinion on
the responses.
Purpose of the Other Reporting Required by Government Auditing Standards
The purpose of the communication described in the Report on Internal Control Over Financial Reporting and
the Report on Compliance and Other Matters sections is solely to describe the scope of our testing of internal
control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of
DOL’s internal control or compliance. This communication is an integral part of an audit performed in
accordance with Government Auditing Standards in considering DOL’s internal control and compliance.
Accordingly, this communication is not suitable for any other purpose.
Washington, DC
September 11, 2026
FY 2025 Agency Financial Report 27
Independent Auditors’ Report
Material Weakness
Exhibit I
Improvements Needed in Controls Over Financial Reporting Related to Unemployment Trust Fund
(UTF) Balances and Activity
The United States Department of Labor (DOL) operates the Unemployment Insurance (UI) program
which provides benefit payments, including enhanced UI benefits in response to COVID-19, to eligible
individuals. Consistent with prior years, the preparation of DOL’s financial statements requires
management to make certain estimates and assumptions related to the UI programs that affect the
reported amounts of assets, liabilities, and obligations as of September 30, 2025, and the associated
expenses for the year then ended. These estimates include the UTF obligations of COVID-19 funding,
the UTF COVID-19 benefit overpayment receivables, net, and a portion of the UTF expenses, among
others.
In fiscal year (FY) 2024, we found management’s controls over the estimates related to the obligation
of UTF COVID-19 funding and the UTF COVID-19 benefit overpayment accounts receivable were not
sufficiently designed and documented to support the methodology, assumptions, and data used to
develop these estimates. We also found that management did not have sufficient controls in place
over the UTF expenses to ensure that benefit expenses reported in DOL’s financial statements were
reconciled timely at an appropriate level of precision to the state workforce agencies’ (SWA) expense
information.
Although DOL developed new policies and procedures in FY 2025 in an effort to remediate the FY
2024 findings, such new procedures were not sufficient to fully address the prior year’s findings. The
deficiencies noted in FY 2025 continued to increase the risk that material misstatements in DOL’s
financial statements could occur and not be prevented or detected and corrected in a timely manner.
A summary of the specific issues noted follows:
UTF Obligation of COVID-19 Funding
Management did not have sufficient processes and controls in place to properly validate the
reasonableness of the methodology and assumptions, and the relevance and reliability of the
underlying data used to develop the estimate of the remaining obligated amounts for UTF COVID-19
programs.
This resulted in management’s inability to properly support the completeness, existence, and
accuracy of the $3.5 billion in remaining obligations reflected in the unobligated balance from prior
year authority, net, reported in the combined statement of budgetary resources for the fiscal year
ended September 30, 2025, and the related information in notes 18.A, 18.C, 18.D, and 18.E.
UTF COVID-19 Benefit Overpayment Accounts Receivables and Related Allowances
Management did not have sufficient processes and controls in place to validate the relevance and
reliability of the data and assumptions used in developing the benefit overpayment accounts
receivable estimate and the related allowances. For example, in performing its outreach to SWAs to
validate the reliability of the SWA established overpayments, management excluded from their
outreach efforts SWAs with a total benefit overpayment accounts receivable of $7 billion.
28 United Sates Department of Labor
Financial Section
Material Weakness
Exhibit I
These matters resulted in management’s inability to properly support the completeness, existence,
and accuracy of accounts receivable, net, reported in the consolidated balance sheet as of
September 30, 2025, and the related information disclosed in notes 4, 15, 19, and 21.
Although management took certain steps in FY 2025 to develop corrective action plans to address
prior year findings, the deficiencies related to the UTF obligation of funding and benefit overpayment
accounts receivables continued to exist because management was not able to fully complete the
analyses and procedures to validate the relevance and reliability of certain assumptions and
underlying data used in the estimates.
The following criteria are relevant to the conditions noted above:
The Government Accountability Office’s Standards for Internal Control in the Federal
Government (the Standards), Section 7.04 states:
Management considers all significant interactions within the entity and with external parties,
changes within the entity’s internal and external environment, and other internal and external
factors to identify risks throughout the entity. Internal risk factors may include the complex
nature of an entity’s programs, its organizational structure, or the use of new technology in
operational processes. External risk factors may include new or amended laws, regulations, or
professional standards; economic instability; or potential natural disasters. Management
considers these factors at both the entity and transaction levels to comprehensively identify
risks that affect defined objectives. Risk identification methods may include qualitative and
quantitative ranking activities, forecasting and strategic planning, and consideration of
deficiencies identified through audits and other assessments.
Section 10.02 of the Standards states:
Management designs control activities in response to the entity’s objectives and risks to achieve
an effective internal control system. Control activities are the policies, procedures, techniques,
and mechanisms that enforce management’s directives to achieve the entity’s objectives and
address related risks.
Section 13.04 of the Standards states:
Management obtains relevant data from reliable internal and external sources in a timely
manner based on the identified information requirements. Relevant data have a logical
connection with, or bearing upon, the identified information requirements. Reliable internal and
external sources provide data that are reasonably free from error and bias and faithfully
represent what they purport to represent. Management evaluates both internal and external
sources of data for reliability. Sources of data can be operational, financial, or compliance
related. Management obtains data on a timely basis so that they can be used for effective
monitoring.
To address the deficiencies noted above, we continue to recommend that the Chief Financial Officer
and the Assistant Secretary for Employment and Training:
1. Design and implement sufficient controls over the respective estimates to ensure
management’s review of the estimates are performed at a sufficient level of detail, and
include the review of the methodology, relevance and reliability of the underlying data, and
assumptions used to develop the estimates.
FY 2025 Agency Financial Report 29
Independent Auditors’ Report
Material Weakness
Exhibit I
2. Maintain documentation of the reviews performed to assess the reasonableness of the
methodology, underlying data, and assumptions used to develop the estimates that is
sufficiently detailed to evidence the specific items reviewed, analysis performed, and
conclusions reached.
Management’s Response:
See Exhibit III for management’s response.
Auditors’ Response
We will conduct follow-up procedures in FY 2026 to determine whether corrective actions have been
developed and implemented.
30 United Sates Department of Labor
Financial Section
Significant Deficiency
Exhibit II
Improvements Needed in Information Technology Segregation of Duties and Access Controls
DOL utilizes information technology (IT) to support its mission and its internal controls over financial
reporting. IT systems are comprised of four layers of technology – application, database, operating
system, and network. IT general controls (ITGCs) provide the foundation for the integrity of systems
including applications and the system software that comprise the general support systems for the major
applications. ITGCs, combined with IT application-level and manual controls, are critical to ensure
accurate and complete processing of transactions and integrity of stored data. ITGCs address risks
arising from IT in the key control areas of access to programs and data, program changes, program
acquisition and development, and computer operations.
In FY 2025, we noted certain control deficiencies in the areas of segregation of duties and logical access
controls. Specifically, we noted the following:
• Deficiencies in IT Controls Related to Segregation of Duties: For two in-scope financial systems,
users with developer access also had access to the production environments.
• Deficiencies in System Access Controls: For three in-scope financial systems, certain users were
able to recertify their own system access. In addition, for four in-scope financial systems, certain
users who no longer needed system access were not removed in a timely manner.
These deficiencies occurred as a result of ineffective risk assessments and monitoring of the internal
control environment. Specifically, DOL did not perform appropriate risk assessments to effectively design
and implement segregation of duties controls within the IT systems. Additionally, DOL did not sufficiently
monitor the effectiveness of segregation of duties and system access controls that were suitably
designed. The deficiencies increase the risk of unauthorized access to information systems or data.
The following criteria are relevant to the conditions noted above.
The Government Accountability Office’s Standards for Internal Control in the Federal
Government (the Standards), Section 7.01 states:
Management considers all significant interactions within the entity and with external parties,
changes within the entity’s internal and external environment, and other internal and external
factors to identify risks throughout the entity. Internal risk factors may include the complex
nature of an entity’s programs, its organizational structure, or the use of new technology in
operational processes. External risk factors may include new or amended laws, regulations,
or professional standards; economic instability; or potential natural disasters. Management
considers these factors at both the entity and transaction levels to comprehensively identify
risks that affect defined objectives. Risk identification methods may include qualitative and
quantitative ranking activities, forecasting and strategic planning, and consideration of
deficiencies identified through audits and other assessments.
Section 11.09 of the Standard states:
Management designs control activities over the information technology infrastructure to
support the completeness, accuracy, and validity of information processing by information
technology. Information technology requires an infrastructure in which to operate, including
communication networks for linking information technologies, computing resources for
applications to operate, and electricity to power the information technology. An entity’s
information technology infrastructure can be complex. It may be shared by different units
within the entity or outsourced either to service organizations or to location-independent
technology services. Management evaluates the objectives of the entity and related risks in
designing control activities for the information technology infrastructure.
FY 2025 Agency Financial Report 31
Independent Auditors’ Report
Significant Deficiency
Exhibit II
Section 11.14 of the Standard states:
Management designs control activities to limit user access to information technology through
authorization control activities such as providing a unique user identification or token to
authorized users. These control activities may restrict authorized users to the applications or
functions commensurate with their assigned responsibilities, supporting an appropriate
segregation of duties. Management designs other control activities to promptly update access
rights when employees change job functions or leave the entity. Management also designs
control activities for access rights when different information technology elements are
connected to each other.
Section 12.05 of the Standard states:
Management periodically reviews policies, procedures, and related control activities for
continued relevance and effectiveness in achieving the entity’s objectives or addressing
related risks.
Section 16.05 of the Standard states:
Management performs ongoing monitoring of the design and operating effectiveness of the
internal control system as part of the normal course of operations. Ongoing monitoring
includes regular management and supervisory activities, comparisons, reconciliations, and
other routine actions. Ongoing monitoring may include automated tools, which can increase
objectivity and efficiency by electronically compiling evaluations of controls and transactions.
To address these deficiencies, we recommend that the Chief Information Officer and Chief Financial
Officer:
1. Perform risk assessments to determine the sufficiency of segregation of duties controls
over the IT development and production environments.
2. Perform risk assessments to determine the sufficiency of controls related to system
access recertification.
3. Develop and implement monitoring controls to ensure compliance with DOL’s policies
related to segregation of duties and the timely removal of unauthorized users’ system
access.
Management’s Response:
See Exhibit III for management’s response.
Auditors’ Response
We considered management’s partial concurrence with the first finding and continue to believe that while
management provided access to the production environment for a developer during a transition for one
system, management did not fully document the risks and implement sufficient monitoring controls to
detect unauthorized changes to production data and computing resources. We will conduct follow-up
procedures in FY 2026 to determine whether corrective actions have been developed and implemented.
32 United Sates Department of Labor
Financial Section
Management’s Response
Exhibit III
U.S. Department of Labor Office of the Chief Financial Officer
Washington, D.C. 20210
MEMORANDUM FOR: LAURA B. NICOLOSI
Assistant Inspector General for Audit
FROM: DAVID B. CASTILLO
Chief Financial Officer
SUBJECT: FY 2025 Independent Auditors’ on DOL’s Consolidated Financial
Statements Report # No. 22-26-002-13-001
Please find the attached management’s response to FY 2025 Independent Auditors’ on DOL’s
Consolidated Financial Statements Report # 22-25-002-13-001.
We appreciate the opportunity to provide input and look forward to continued collaboration with
the OIG audit team.
Please contact me if you have any questions.
cc: Marek Laco, Acting Assistant Secretary, Employment and Training Administration
Michelle Bebee, Administrator, Unemployment Insurance
Dean Heyl, Assistant Secretary for Administration and
Management Mangala Kuppa, Chief Information Officer
FY 2025 Agency Financial Report 33
Independent Auditors’ Report
Management’s Response
Exhibit III
Management’s Response
Fiscal Year 2025 Independent Auditors’ Report
Improvements Needed in Controls Over Financial Reporting Related to Unemployment
Trust Fund (UTF) Balances and Activity
We agree with the finding and that improvements are needed to the Department of Labor’s (the
Department) controls over the estimates related to the UTF balances and activities. The
Department offers the following in response to the two key areas identified in this finding:
UTF Obligation of COVID-19 Funding
With respect to the obligation of COVID-19 funding, management concurs with the finding and
notes that the majority of the $3.5 billion in open obligations are primarily due to reporting
challenges from the 53 states and territories rather than estimation errors. States record draws
from the trust fund for various programs and report expenditures on the monthly ETA-2112
report. When discrepancies occur between reported expenses and draws, undelivered obligations
remain open. The Department has made significant efforts to identify and address these reporting
issues, reducing the amount by nearly $4 billion in FY 2025.
UTF COVID-19 Benefit Overpayment Accounts Receivables and Related Allowances
During FY 2025, the Department conducted targeted outreach to 25 State Workforce Agencies
(SWAs) to obtain data on established overpayments and continued engagement with key states
to address reporting limitations. This outreach provided valuable feedback, with most states
supplying or confirming overpayment estimates. These efforts represent an important initial step
toward improving the estimation methodology. However, the newly implemented policies and
procedures were not sufficient to fully resolve deficiencies in the estimation processes related to
the Unemployment Trust Fund (UTF) COVID-19 obligations and benefit overpayment accounts
receivable.
In FY 2026, DOL plans to continue addressing these findings and align with KPMG’s
recommendations by enhancing controls over estimation processes, strengthening documentation
practices, continuing SWA engagement and data validation, and monitoring materiality
thresholds to adjust methodologies accordingly.
34 United Sates Department of Labor
Financial Section
Management’s Response
Exhibit III
Improvements Needed in Information Technology Segregation of Duties and Access
Controls
The Office of the Chief Information Officer (OCIO) management acknowledges and generally
concurs with the Office of Inspector General’s findings and recommendations regarding
deficiencies in segregation of duties controls, system access recertification, and the timely
removal of separated users’ access. OCIO will take the following actions to address the
recommendations and reinforce adherence to the DOL Cybersecurity Policy Portfolio (CPP).
Corrective actions will be tracked to completion and managed through established remediation
governance.
Recommendation 1: Perform risk assessments for segregation of duties between IT
development and production environments
Management Response:
OCIO partially concurs with recommendation. For one of the systems identified in the
related deficiency, a developer had access to the production environment as a part of a
planned and controlled activity. The access was for the explicit purpose of testing
during the transition from an on-premises instance to a cloud-based instance to ensure
a smooth migration process. Access was revoked promptly upon testing. For the
second identified system, OCIO has taken corrective actions by reviewing and
revising the developer’s access permissions. In addition, OCIO plans to take the
following corrective actions:
• For in-scope systems, perform a risk assessment across development, test,
staging, and production environments to enforce separation of duties.
• Where applicable, correct privileged role assignments to revoke direct change
and publish capabilities in production, where not expressly authorized.
• Institute recurring access reviews (bi-annual) for developers and privileged
users to detect and resolve segregation violations.
Planned Completion: FY26 Q2
Recommendation 2: Perform risk assessments for system access recertification controls
Management Response:
OCIO concurs with recommendation. For one of the systems identified in the related
deficiency, OCIO would like to acknowledge that although the certifiers may review
and certify their own access, they cannot modify their user privileges in the system.
Any changes to their accounts require review and approval by their manager or
designated approver. OCIO plans to take the following corrective actions:
• For in-scope systems, perform a risk assessment of access recertification
processes and workflows to determine whether design and frequency are
sufficient, identify gaps (including self-recertification and untimely removals),
FY 2025 Agency Financial Report 35
Independent Auditors’ Report
Management’s Response
Exhibit III
and design and implement controls to mitigate those risks—such as preventing
users from reviewing or reauthorizing their own access.
• Perform independent access reviews of individuals who previously recertified
their own access to confirm no unauthorized activities and correct any issues.
• Establish recurring privileged account reviews (bi-annual) to verify access
appropriateness and alignment with job responsibilities.
Planned Completion: FY26 Q2
Recommendation 3: Develop and implement monitoring controls to ensure policy compliance
Management Response:
OCIO concurs with recommendation and plan to take the following corrective actions:
• Identify automated and supervisory monitoring solutions to track disablement
and deprovisioning against policy timelines, with escalation and remediation
for exceptions, to ensure recertification access changes are executed promptly
and accurately.
• Update and enforce standard operating procedures to include review and
follow up on rejected or stalled access change requests and provide targeted
staff training.
Planned Completion: FY26 Q2
OCIO would also like to acknowledge the compensating access controls currently in place for
the in-scope systems, as defined and enforced in the DOL Cybersecurity Policy Portfolio
(CPP), that include immediate credential expiration for separated users restrictions and timely
network access removal pending formal personnel termination; multi-factor authentication for
system access; and, periodic account recertifications that identify orphaned or mis-
provisioned accounts.
OCIO will provide corrective action status updates through established governance forums
and will track all remediation activities to closure in accordance with DOL policy. We
appreciate the opportunity to provide input.
36 United Sates Department of Labor
File and source
- File
- 22-26-002-13-001-fy2025-independent-auditors-report-dol-consolidated-financial-statements.pdf
- Size
- 542,637 bytes
- SHA-256
- 3531b161d68335d94ae8946688b858e16ab0128ac915e00f5e4b437002430c80
- Our copy
- 22-26-002-13-001-fy2025-independent-auditors-report-dol-consolidated-financial-statements.pdf
- Original
- www.oversight.gov