Top Challenges Facing Federal Agencies: COVID-19 Emergency Relief and Response Efforts (June 2020)

Summary

A June 2020 report, "Top Challenges Facing Federal Agencies: COVID-19 Emergency Relief and Response Efforts," as reported by Offices of Inspector General across government. Its executive summary says the CARES Act and other related legislation provide approximately $2.4 trillion in federal spending and that the Pandemic Response Accountability Committee (PRAC) developed the report from submissions by 37 OIGs overseeing agencies involved in the pandemic response. The summary lists areas of common concern: financial management of CARES Act and other funds, grant management, information technology security and management, and protecting health and safety while maintaining effective operations. The table of contents is organized by agency, with sections including the Internal Revenue Service and the Small Business Administration.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Issuer: Source documents
Document type: Top Challenges Covid19 Emergency Relief Cross Government
Case: Top Challenges Covid19 Emergency Relief Cross Government

Cite this document

“Top Challenges Facing Federal Agencies: COVID-19 Emergency Relief and Response Efforts (June 2020).” Original at www.oversight.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/top-challenges-covid19-emergency-relief-cross-government/, SHA-256 f5bc31f8927653a68cd3289747e94424cddc4446ed587550d711cdd994c8a44f.

Full text

TOP CHALLENGES FACING
FEDERAL AGENCIES:
COVID-19 Emergency Relief and
Response Efforts
As reported by Offices of Inspector General across government

June 2020
EXECUTIVE SUMMARY
Objective The Coronavirus Aid, Relief, and Economic Security (CARES) Act and other related
legislation provide approximately $2.4 trillion in federal spending to address the public
The objective of this
health and economic crises resulting from the Coronavirus Disease 2019 (COVID-19)
report is to provide
pandemic. Given the amount of money at issue, the need to distribute aid quickly, and the
insight into the top
use of grants and loans to disburse funds, effectively managing the programs funded by
management challenges
these bills presents a significant challenge to many executive branch agencies. Moreover,
facing federal agencies
these same factors increase the risk of fraud and misuse of these funds.
that received pandemic-
related funding as To help address these concerns, the CARES Act established several oversight mechanisms,
identified by Offices of including the Pandemic Response Accountability Committee (PRAC) within the Council of
Inspector General. the Inspectors General on Integrity and Efficiency (CIGIE). The PRAC is composed of
21 Offices of Inspector General (OIG) overseeing agencies who received the bulk of the
emergency funding. The Committee will lead the efforts of CIGIE and its Inspectors
Approach General to promote transparency and support and conduct oversight of the funds provided
to address the pandemic response by the CARES Act and related legislation.
To accomplish this
objective, OIGs from Each year, OIGs identify and report on the top management and performance challenges
37 agencies receiving facing their agencies. CIGIE also issues an annual report that includes a list of the top
emergency funds or challenges faced by agencies. While not required by the CARES Act, the PRAC developed
involved in the pandemic this report on the top challenges identified by Inspectors General for the federal agencies
response developed involved in the response to the COVID-19 pandemic as part of CIGIE’s efforts to make
summaries of their the work of the federal Inspector General community more transparent and accessible to
agencies’ top challenges. the public.
The Pandemic Response
Accountability Committee Based on the PRAC’s review of submissions by 37 OIGs overseeing agencies involved in the
summarized these pandemic response, Inspectors General reported a wide range of challenges, including
challenges by broad issue many related to specific agency programs. However, the submissions also reflected areas
area to identify common of common concern among agencies of different sizes and with disparate agency missions:
themes and key areas of x Financial management of CARES Act and other funds,
concern.
x Grant management,
x Information technology security and management, and
x Protecting health and safety while maintaining effective operations.

As discussed in the Introduction, OIGs frequently cited the large amount of funds
appropriated under the CARES Act and related legislation, the need to distribute aid rapidly
under emergency conditions, and the need to maintain agency operations as factors that
For more information on impact these challenges. By identifying these top challenges across the federal
the PRAC visit government, the PRAC hopes to assist agency managers and policymakers in determining
https://pandemic. how best to address them.
oversight.gov/.

For more information on
CIGIE visit
https://www.ignet.gov/.

Executive Summary
TABLE OF CONTENTS
Introduction .................................................................................................................................................. 1
Architect of the Capitol .............................................................................................................................. 12
Board of Governors of the Federal Reserve System and Bureau of Consumer Financial Protection ..... 13
Corporation for Public Broadcasting ......................................................................................................... 15
Federal Deposit Insurance Corporation..................................................................................................... 16
General Services Administration ............................................................................................................... 19
Internal Revenue Service ........................................................................................................................... 21
Legal Services Corporation ......................................................................................................................... 23
National Aeronautics and Space Administration ...................................................................................... 25
National Archives and Records Administration ........................................................................................ 27
National Endowment for the Arts ............................................................................................................. 29
National Reconnaissance Office ................................................................................................................ 31
National Science Foundation ..................................................................................................................... 33
Nuclear Regulatory Commission................................................................................................................ 35
Peace Corps ................................................................................................................................................ 37
Railroad Retirement Board ........................................................................................................................ 39
Small Business Administration .................................................................................................................. 41
Social Security Administration ................................................................................................................... 44
U.S. Agency for International Development ............................................................................................. 45
U.S. Department of Agriculture ................................................................................................................. 47
U.S. Department of Commerce .................................................................................................................. 50
U.S. Department of Defense ...................................................................................................................... 54
U.S. Department of Education ................................................................................................................... 57
U.S. Department of Energy ........................................................................................................................ 59
U.S. Department of Health and Human Services ...................................................................................... 61
U.S. Department of Homeland Security .................................................................................................... 63
U.S. Department of Housing and Urban Development ............................................................................ 66
U.S. Department of Justice ........................................................................................................................ 68
U.S. Department of Labor .......................................................................................................................... 70
U.S. Department of State ........................................................................................................................... 72
U.S. Department of the Interior................................................................................................................. 74

Table of Contents
U.S. Department of the Treasury............cccccccccsseececsneeeceesnececeeaeeceeaeeecseaaeeecsesaeeesesaeeeseeaueeeeseaaeeeeeaeeeeseaas 76

U.S. Department of Transportation .............ceccsccccsssececeesnececessaeeeceaeeecseaaeeeceeaueeeceeaeeeceeaaeeeseeaueeeseeaeeeseeaas 78
U.S. Department of Veterans Affairs 00.0.0... ccccccccssececeesneeeceeseeeceeaeeeceeaaeeeceeaueeeceeaeeeceeaaeeeeeeaaeeeseeaaeeeeaas 80
U.S. Election Assistance COMMISSION 0.0.0.0... cecceeseceeececeeeeeesaeeeeaceeeaeeceseeesaaeeeeaaeceeeseeeeeaaeeeeaaeseeaeeeneeees 82
U.S. Environmental Protection Agency ..............ccccccccssseceessececeesneeecseaeeeseaaeeecseaeeeceeaaeeeeeaaeeeeseaaeeeeeeaaeeseeaas 84
U.S. Office of Personnel Manageme nt ...............:cccccccsssecesssececeesnececseaeeceeaeeecseaaeeeceesaeeeeeaaeeeseesaeeeseeaeeeneaas 86
United States Postal Service 00... eee ce ececeeeeenneceeaeeeeeeeceaeecsaeeeeaaeceeaeeceaeeesaeeeesaeceeaeeseseeeeaeeeaaeeeeaeeseeeeess 87

Table of Contents
INTRODUCTION

In March and April 2020, Congress passed four funding bills to address the public health and economic crises caused by
the Coronavirus Disease 2019 (COVID-19) pandemic:

e The Coronavirus Preparedness and Response Supplemental Appropriations Act, 2020, enacted March 4, 2020,
provided $8.3 billion in emergency funding for public health measures.*

e The Families First Coronavirus Response Act, enacted March 18, 2020, enhanced unemployment benefits and
required many employers to provide emergency paid sick and family leave, among other measures.”

e The Coronavirus Aid, Relief, and Economic Security Act (CARES Act), enacted March 27, 2020, provided
$2.2 trillion in federal funding, including expanded unemployment benefits; $150 billion in direct aid and grants
for state and local governments; $349 billion of forgivable loans for small businesses through the Small Business
Administration (SBA) Paycheck Protection Program (PPP); an additional $500 billion as loan guarantees and
equity investments into Federal Reserve Lending Facilities to support lending to businesses, states, and local
governments; and Economic Impact Payments of up to $1,200 for eligible taxpayers.”

e The Paycheck Protection Program and Health Care Enhancement Act, enacted April 24, 2020, increased funding
for the PPP by an additional $321 billion and provided supplemental funding for health care providers and
COVID-19 testing.*

Together, these four bills authorized approximately $2.4 trillion in federal soending. Given the amount of money at
issue, the need to distribute aid quickly, and the use of partnerships with nonfederal entities to disburse funds, the
programs created by these bills not only require significant effort by executive branch agencies during an ongoing public
health emergency, but pose an increased risk of fraud and misuse. To address these concerns, the CARES Act imposed
reporting requirements on agencies; appropriated supplemental funds to Offices of Inspector General (OIG) for
pandemic-related audit and investigative activity; and established a number of oversight mechanisms, including the
Pandemic Response Accountability Committee (PRAC).

Rather than a stand-alone organization, the PRAC is organized as a committee within the Council of the Inspectors
General on Integrity and Efficiency (CIGIE), an independent entity established by the Inspector General Act of 1978, as
amended. The PRAC consists of Inspectors General from 9 agencies specifically identified in the CARES Act, as well as
12 additional Inspectors General from agencies that receive funds or otherwise are involved in the pandemic response.

The purpose of the PRAC is to “promote transparency and conduct and support oversight” of the government’s
coronavirus response to “prevent and detect fraud, waste, abuse, and mismanagement” and “mitigate major risks
that cut across program and agency boundaries.” Essentially, the PRAC will lead the efforts of CIGIE and Inspectors
General to conduct oversight of the approximately $2.4 trillion in appropriated funds to address the pandemic, as well
as the government's efforts in response to the coronavirus pandemic.

1 Coronavirus Preparedness and Response Supplemental Appropriations Act, 2020, Pub. L. No. 116-123, 134 Stat. 146 (2020).
2 Families First Coronavirus Response Act, Pub. L. No. 116-127, 134 Stat. 178 (2020).

3 Coronavirus Aid, Relief, and Economic Security Act, Pub. L. No. 116-136, 134 Stat. 281 (2020).

4 Paycheck Protection Program and Health Care Enhancement Act, Pub. L. No. 116-139, 134 Stat. 620 (2020).

Introduction
Under the CARES Act, the PRAC is required to provide certain periodic reports:

e Management alerts to the President and Congress on management, risk, and funding issues that may require
immediate attention;

e Biannual reports to the President and Congress summarizing PRAC activity and, to the extent practicable,
quantifying the impact of tax expenditures; and

e Other reports and periodic updates to Congress as it considers appropriate.

Each year, federal OlGs issue reports analyzing the top management and performance challenges facing their individual
agencies. CIGIE also issues an Annual Report to the President and Congress that includes a list of the challenges faced by
government agencies, and previously has issued a consolidated top challenges report analyzing the issues and challenges
common to its member agencies. Although not specifically required by the CARES Act, the PRAC is issuing this top
challenges report to help raise awareness and increase transparency of the government’s pandemic response efforts.

Objective

The objective of this report is to consolidate and provide insight into the most frequently reported challenges for the
agencies involved in implementing programs under the Coronavirus Preparedness and Response Supplemental
Appropriations Act, Families First Coronavirus Response Act, CARES Act, and Paycheck Protection Program and Health
Care Enhancement Act. The PRAC hopes this information will assist policymakers in determining how best to address
these and similar challenges in the face of changing priorities and emerging risks.

Approach

To accomplish this objective, the PRAC requested OlGs to develop a summary of the top challenges facing their agencies
in the federal government’s pandemic response to identify common themes and key areas of concern. Thirty-seven
OlGs submitted summaries of their agency’s top challenges. While some of the identified concerns such as protecting
cybersecurity and conducting financial oversight fall into categories typically highlighted by Inspectors General in annual
reports, others such as protecting employees from virus transmission and managing agency operations while employees
engage in full-time telework are unique to the pandemic.

Several important challenges, such as ensuring that states can conduct elections, preventing theft of ballots and financial
payments sent by mail, and addressing staffing shortages in mission-critical positions, are not included in this overview
because only a limited number of Inspectors General identified those issues or have oversight responsibilities for
agencies engaged in those activities. The absence of these concerns in this report does not reflect a qualitative
judgment about the impact or importance of these challenges.

Introduction 2
CHALLENGE FINANCIAL MANAGEMENT

Each year, multiple OlGs identify financial management as a significant challenge facing their agencies. A primary
mission of Inspectors General is to ensure that taxpayer funds are used efficiently and effectively, and to prevent and
detect waste, fraud, and abuse. Even in non-pandemic times, issues ranging from a lack of reliable financial data to
deficiencies in agency internal controls limit the ability of Inspectors General to fulfill this mission. These concerns are
heightened by substantial increases in the amount of money allocated for certain programs and the expedited timetable
for distribution of CARES Act and other pandemic-related funds.

Key Areas of Concern

Key areas of concern include both the need for accurate information concerning pandemic-related spending and the
significant amount of money federal agencies may lose as the result of improper payments.

Improving Financial Reporting and Systems

The CARES Act and related legislation require reporting by agencies to help ensure transparency and accountability in
government spending. Even before the pandemic, OlGs reported that the ability of agencies to track and report
financial data was insufficient to meet agency needs and was a top management and performance challenge. These
insufficiencies were based on weaknesses in agency internal controls, as well as outdated financial management systems
that failed to meet federally mandated modernization requirements and lacked the capability to track and report
financial data reliably.

OlGs have identified these same factors as challenges in their reporting and oversight of CARES Act and other pandemic-
related spending. For example, the General Services Administration (GSA) OIG cited control weaknesses as a potential
impediment to accurately reporting CARES Act spending, referencing a November 2019 audit that found errors in how
GSA reports certain data to USASpending.gov. According to the GSA OIG, GSA will need to address these errors to
ensure that its CARES Act reporting is accurate.

Similarly, the U.S. Department of Homeland Security (DHS) OIG reported that key DHS financial systems do not comply
with federal requirements, and that this potentially will impact financial planning, payments, and internal controls
related to CARES Act funding.

Barriers to reporting accurate spending data impact the government’s ability to reduce improper payments, discussed in
more detail below. For example, the OIG for the National Reconnaissance Office (NRO) has cited CARES Act provisions
that govern reimbursement of government contractors, explaining that they create a significant opportunity for “double
dipping” by companies if funds are not accurately tracked across the government.

Reducing Improper Payments

In previous years, CIGIE has identified preventing and reducing improper payments as a critical issue affecting multiple
federal agencies. Improper payments are those that should not have been made or that were made in an incorrect
amount under statutory, contractual, administrative, or other legally applicable requirements, such as payments to
ineligible recipients, duplicate payments, or payments not supported by required documentation. The Office of
Management and Budget (OMB) has designated federal programs that present the highest risk of improper payments
as “high priority,” estimating that the amount of improper payments in these programs exceeds $2 billion annually.

Introduction 3
Many OlGs have identified reducing and preventing improper payments as a significant challenge under the CARES Act
and related stimulus legislation, citing the large amount of money at issue and the need to distribute funds rapidly under
emergency conditions. For example, the U.S. Department of Agriculture (USDA) OIG reported that the agency continues
to be noncompliant with federal requirements for improper payments. As a result, concerns about the existing
weaknesses in management controls for benefit distribution have been heightened by large increases in funding
provided to several high-risk programs, including the Supplemental Nutrition Assistance Program. According to the
USDA OIG, this creates the risk that the funds will not be delivered or used as intended.

Other OlGs have reported that the combination of substantial increases in funding and reduced supervision creates a
heightened risk of misuse and fraud. According to these OlGs, formal deliberative agency processes and program
integrity safeguards may be incompatible with the need to distribute funds quickly, and accountability mechanisms may
be overwhelmed. As a result, ensuring that CARES Act and other related funds are distributed and used properly will
remain a significant challenge.

CHALLENGE GRANT AND GUARANTEED LOAN MANAGEMENT

The CARES Act and related legislation rely on grants and loans to distribute assistance to state and local governments,
individuals, businesses, and other entities impacted by the pandemic. For example, the U.S. Department of Education
received more than $30 billion for formula and discretionary grants to assist states and schools in meeting the needs of
impacted students. The U.S. Department of Housing and Urban Development received more than $12 billion in CARES
Act funds, including $2.6 billion for rental subsidies and $4.1 billion for assistance to vulnerable populations through
grants to state and local governments.

One of the largest programs created by the CARES Act—and later supplemented by the Paycheck Protection Program
and Health Care Enhancement Act—is the PPP, which provides $659 billion in SBA loans to allow small businesses
impacted by the pandemic to cover payroll, rent, utility payments, and other limited uses. While not technically a grant,
PPP loans are fully guaranteed by the government and will be forgiven if the recipients follow specified guidelines. The
CARES Act also appropriated $10 billion to the SBA for Economic Injury Disaster Loans (EIDL) to provide relief to
businesses experiencing a temporary loss of revenue, including forgivable $10,000 EIDL Emergency Advances.

Although closely related to financial management, several OlGs identified grant management as a separate performance
and management challenge for their agencies even before the pandemic, citing the increasing number, size, and
complexity of grants. According to these OlGs, these factors make it more difficult for agencies to ensure grantees use
funds solely for authorized purposes and maintain documentation to support their spending, as well as to measure grant
performance. Like the challenges in financial management, the substantial increases in funding for grants under the
CARES Act and related legislation heighten the existing challenges agencies face in processing and monitoring these
payments, and in assessing their success.

Key Areas of Concern

Key areas of concern cited by OlGs are overseeing the use of grant funds, obtaining timely and accurate financial and
performance information from grantees, and assessing performance to ensure that grants achieve intended results.

Overseeing the Use of Grant Funds

Recipients of federal grants must use grant funds for the purpose identified in the grant award and within certain
parameters and guidelines. In normal times, agencies awarding large numbers of grants have found it difficult to
conduct sufficient oversight to ensure that grantees use funds solely for authorized purposes and maintain adequate

Introduction 4
resource documentation to support their spending. The large increase in grants under the CARES Act and other related
legislation magnifies this difficulty.

For example, the U.S. Department of Commerce (DOC) OIG has reported that the agency faces ongoing challenges in
effective grant administration and oversight, and that the increase in CARES Act funds may exacerbate these concerns.
According to the DOC OIG, the pandemic may create “incentives and opportunities for grant recipients to deviate from
standard practices meant to ensure effective control of U.S.-funded contracts, grants, and awards.” This will require the
agency to anticipate and address the risk that comes with the expanded funding and rapid fund deployment.

Other OlGs have reported similar issues. The U.S. Department of State OIG stated that it frequently finds deficiencies
in the agency’s grant programs and that the agency, which will expend a substantial portion of the S11 billion it received
in CARES Act funds through contracts and grants, will need to improve its oversight of these programs. The U.S. Agency
for International Development (USAID) OIG indicated that USAID will have to overcome past weaknesses in the rigor of
its award processes to provide for a timely response on the needed global scale by adjusting existing awards and
implementing new ones. The U.S. Department of Justice (DOJ) OIG also noted that recipients of $850 million in
supplemental grants appropriated by the CARES Act (generally state, local, and tribal law enforcement agencies) will be
operating under unprecedented circumstances, including reductions in administrative staff that may weaken internal
control systems.

Although not technically a grant program, SBA OIG reported that the SBA faces similar challenges in awarding and
monitoring PPP loans, which are forgivable if recipients expend the funds for specified purposes. These loans are
guaranteed by the government, and lenders may exercise less diligence in originating loans as a result. In addition,

the increased volume, loan amounts, and shortened processing times may make it more difficult for lenders and the
SBA to identify red flags in loan applications, leading to increased vulnerability to fraud and unnecessary losses.
According to the SBA OIG, a variety of actions are needed to mitigate the risk of financial loss, including establishing
proper controls in the loan approval phase, adopting a quality assurance plan to prevent and detect improper payments,
and tracking stimulus program data to support accurate program measurement and reporting.

Monitoring Grant Performance

Agencies monitor grants by requiring programmatic and financial reporting by recipients, as well as by incorporating
performance measurements into grant agreements. Generally, grant recipients are required to report financial
data (such as any expenses paid for with federal funds), information showing compliance with federal regulations,
and project data highlighting their progress or impact on the community. Agencies also may carry out site visits,
provide technical assistance, and conduct annual audits to help monitor grant performance. Agencies use the
information obtained through these efforts to gauge the success of grant programs and to identify and reduce fraud
and improper payments.

Effective grant monitoring thus requires timely receipt of accurate financial records and performance reports, and the
ability to assess which grant programs are achieving their goals and objectives. In previous years, OlGs have identified
both of these aspects as significant challenges to ensuring that grant funds are properly spent and intended results are
achieved. As with other aspects of financial management, OlGs have reported that the increase in pandemic-related
funds heightens existing concerns about grant oversight and monitoring.

Several OlGs identified concerns about receiving timely and accurate data. For example, the Department of Education
OIG stated that the agency should look for ways to improve data quality and ensure that CARES Act grant recipients and
subrecipients report data that is accurate and complete. The OIG for the U.S. Election Assistance Commission, which
received $400 million to be allocated as Election Security Grants to states and territories, cautioned that cost
information might not be available within the 20-day reporting period required by the CARES Act, because states must
first receive the information from local jurisdictions that administer elections.

Introduction 5
Other OlGs reported concerns about their ability to assess the performance of grant recipients based on the increased
number of grants or the diminished ability to conduct in person visits. For example, the Legal Services Corporation OIG
stated that it typically has used onsite visits to grantees to conduct grant monitoring, but has shifted to remote oversight
of grantees who are also operating remotely, potentially limiting access to required staff and records. The USAID OIG
has said that the agency will need to develop and validate new methods for program monitoring and evaluation, since
some traditional approaches like site visits are not feasible during the pandemic.

INFORMATION TECHNOLOGY
SECURITY AND MANAGEMENT

CHALLENGE

CIGIE previously has identified information technology (IT) security and management as a long-standing, serious, and
ubiquitous challenge that impacts agencies across the government, highlighting agencies’ dependence on reliable and
secure IT systems to perform their mission-critical functions. Key areas of concern have included safeguarding federal
systems against cyberattacks and insider threats, modernizing and managing federal IT systems, ensuring continuity of
operations, and recruiting and retaining a highly skilled cybersecurity workforce.

These concerns remain a significant challenge, but are impacted by (1) widespread reliance on maximum telework to
continue agency operations during the pandemic, which has strained agency networks and shifted IT resources, and
(2) additional opportunities and targets for cyberattacks created by remote access to networks and increases in online
financial activity.

Key Areas of Concern

Key areas of concern impacted by the pandemic include managing federal IT systems to permit maximum telework and
ensure continued agency operations and safeguarding federal systems against cyberattacks.

Information Technology Management

On March 16, 2020, the Office of Personnel Management (OPM) announced a maximum telework operating status for
federal agencies in response to the COVID-19 pandemic. While full-time telework has allowed federal agencies to
continue operations, it has created additional challenges for agency IT staff and strained agency networks.

For example, the OPM OIG stated that IT personnel initially were concerned about the ability of OPM’s aging
infrastructure to absorb the sudden workload increase in remote access to its virtual private network (VPN) and network
connections. This required OPM to manage network capacity by focusing on mission critical systems and people and
reducing unnecessary functions, such as streaming services, and to closely monitor VPN usage and network
performance. However, the shift to telework also highlighted OPM’s lack of teleconferencing software and
shortcomings in its ability to remotely administer its systems.

Other agencies have identified similar issues. According to the National Endowment for the Arts OIG, agency IT staff
have shifted their focus to keeping the network secure and operating for teleworking employees and ensuring that
the awards management system is capable of processing a large volume of CARES Act grants. The U.S. Environmental
Protection Agency (EPA) OIG also reported that the EPA has focused on adapting its network to support a virtual
workforce and provide remote employees with a reliable means to communicate and access critical applications

and data.

Introduction 6
Safeguarding Sensitive Data and Information Systems

Cyberattacks and insider threats pose a continuing threat to federal IT security, requiring that agencies focus on
ensuring that government systems are secure and that sensitive data is protected. Given the amount and type of
information that is collected and used by the government, breaches in government systems may expose individuals’
personal information and compromise national security. In the past, OlIGs have reported that agencies face deficiencies
in their ability to protect the confidentiality and integrity of their systems.

These challenges are exacerbated by the pandemic. Various OlGs have reported that the use of maximum telework
strains their ability to support operations efficiently and securely and creates additional vulnerabilities. For example,
EPA OIG stated that unprecedented levels of remote access raise the risk of security breaches of remotely stored and
transmitted data. Similarly, NRO OIG cited the risk of inadvertent spills and disclosures of classified information by
employees performing unclassified work at home using computers with weak passwords or poorly secured home Wi-Fi
routers, cell phones, free social media platforms, and other non-secure means of communication. The Peace Corps OIG
reported that the agency continues to lack an effective information security program and has significant weaknesses in
foundational IT elements, heightening concerns about its ability to maintain security during domestic and overseas
remote operations.

Other OlGs reported that the federal government’s efforts to provide financial aid to small businesses and individuals
impacted by the pandemic provide additional targets for cyberattacks and fraud. In particular, the Treasury Inspector
General for Tax Administration (TIGTA) reported that it expects to see a surge in investigative activity as bad actors
attempt to steal Economic Impact Payments from taxpayers by attacking Internal Revenue Service (IRS) systems—
including the IRS web portals used by taxpayers to check on the status of their payments and update their banking
information—and targeting taxpayers with phishing emails, impersonation phone calls, and stolen or counterfeit checks.
Similarly, the Federal Deposit Insurance Corporation OIG expressed concerns about the increased risk of cybercrimes,
such as phishing, email fraud, and cyberattacks on third-party technology service providers, as consumers use mobile
and online banking during the pandemic.

CHALLENGE PROTECTING HEALTH AND SAFETY

While federal agencies always prioritize health and safety, the COVID-19 pandemic has created a unique challenge—
namely, preventing transmission of the virus in federal facilities, among federal employees and individuals with whom
they interact, and in workers and private sector facilities regulated by the federal government.

As described above, the federal government shifted to a maximum telework operating status in March 2020 to allow
telework-eligible employees to work remotely to minimize virus transmission while maintaining agency operations. For
those federal employees who are not telework-eligible and face higher risks of virus complications, OMB has encouraged
agencies to approve leave for safety reasons.

However, not all work can be performed remotely, and employees who have been deemed mission-critical and
therefore cannot telework have continued to report for work and perform their duties during the pandemic. Such
employees include Bureau of Prisons (BOP) correctional officers and employees, U.S. Customs and Border Protection
(CBP) and Immigration and Customs Enforcement (ICE) agents, Transportation Security Administration workers,

United States Postal Service (USPS) workers, and rangers in national parks. Agencies have devoted considerable efforts
to ensuring that they can protect the health and safety of these workers and the people with whom they interact from
the virus.

Introduction 7
Key Areas of Concern

Key areas of concern within this challenge include protecting government employees and facilities; protecting inmates
and detainees in federal custody; protecting patients, consumers, and private sector workers in industries regulated by
the federal government; and maintaining effective operations.

Protecting Federal Employees and Facilities

Several OlGs identified the need to protect federal employees and facilities during the COVID 19 pandemic as a
significant challenge for their agencies, particularly for essential employees who are not eligible for telework and
interact with others in the course of their work. Concerns ranged from difficulty procuring adequate personal protective
equipment (PPE) and hand sanitizer for employees who work in public-facing jobs, to allowing public access to federal
lands, to protecting employees who work in countries with inadequate local health care systems.

For example, DOJ OIG identified issues related to protecting DOJ employees who work in prisons and correctional
systems, as described below. The DOJ OIG also reported concerns about protecting staff in DOJ’s Executive Office for
Immigration Review (EOIR), which conducts immigration court proceedings, appellate reviews, and administrative
hearings. Although EOIR has postponed some immigration hearings and allowed teleconferencing and electronic filing
in others, immigration courts have remained open for filings and detention hearings. DOJ OIG reported that EOIR has
faced challenges in mitigating health risks to its employees, including securing adequate PPE and balancing health and
safety with the need to protect the rights of detained persons.

GSA OIG focused on the need to protect health and safety from a broader perspective. GSA constructs and manages
federal buildings, and leases space in those buildings to federal agencies. According to the GSA OIG, as of May 7, 2020,
963 GSA owned or leased facilities reported positive or presumed COVID-19 cases. In each instance, GSA’s Public
Buildings Service must be able to identify and track the virus infection, notify building occupants and visitors of potential
exposure, and work with contractors to ensure that the space is cleaned and disinfected in accordance with Centers for
Disease Control and Prevention guidelines.

Protecting Federal Prisons and Detention Facilities

Federal prisons and detention facilities, including contract facilities, are another area where the health and safety of
federal employees is at risk, along with the health and safety of federal inmates and detainees. Although only DHS OIG
and DOJ OIG reported this specific concern, the challenge potentially impacts more than 200,000 inmates in federal
prisons and contract facilities, detainees awaiting federal trial or sentencing decisions, and immigration detainees in DHS
custody. Asa result, the potential magnitude of this concern alone warrants mention.

DHS OIG stated that tens of thousands of immigration detainees are in short- and long-term custody in CBP and ICE
facilities. These detainees, along with the federal employees and contractors who work in these facilities, face increased
risks of virus exposure. According to the DHS OIG, numerous reports and studies establish that DHS struggled to ensure
proper medical and mental health care in immigration detention centers even before the pandemic. DHS OIG stated
that the agency’s decentralized system of contractors used to manage and staff detention facilities, lack of standardized
procedures, and deficiencies in the agency’s pandemic preparedness increased the likelihood that detainees and staff
might not have sufficient PPE or access to effective treatment to minimize the spread of the virus.

DOJ OIG identified similar concerns in protecting inmates and detainees housed in BOP institutions, BOP contract
facilities, and U.S. Marshals Service detention centers, as well as the staff and contractors who work there. According to
the DOJ OIG, the most immediate and pressing concerns in this challenge include securing PPE and adequate hygiene
products; identifying, accessing, and implementing effective virus testing protocols; providing access to quality medical
care for those in custody; transferring inmates and detainees to and from facilities; and social distancing, screening,
quarantining, and otherwise mitigating the risks presented by the pandemic.

Introduction 8
Protecting Patients, Consumers, and Private Sector Workers

Similarly, OlGs reported challenges in protecting the health and safety of others who interact with the federal
government, including patients in federal health care facilities, consumers of products subject to approval by the federal
government, and private sector workers in industries regulated by the government.

The U.S. Department of Veterans Affairs (VA) OIG emphasized the need to prevent the spread of the novel coronavirus
in health care facilities, particularly in nursing homes operated by the VA. VA OIG noted that patients in nursing homes
are at higher risk for infection, and the nation’s most devastating outbreaks have occurred in long-term care settings.
However, according to the VA OIG, at the beginning of the pandemic in March 2020, facility leaders acknowledged low
inventory of PPE for staff and inefficiencies related to COVID-19 testing. The U.S. Department of Health and Human
Services (HHS) OIG has reported similar concerns about managing virus outbreaks in nursing homes that serve Medicare,
Medicaid, and other HHS beneficiaries, as well as in Indian Health Service hospitals and outpatient centers.

Meat processing plants have become virus “hotspots” as the pandemic has progressed, generating concerns about
employee safety in these facilities and security of the food production supply chain. The USDA OIG has highlighted the
role of the Food Safety and Inspection Service (FSIS) in ensuring the safety of commercial meat, poultry, and processed
egg products. According to the USDA OIG, FSIS has faced difficulties in gathering reliable data to ensure safety
verification tasks are completed, effective, and consistent, and this challenge continues as the agency responds to the
impact of the pandemic.

OlGs also expressed concerns about protecting consumers and private sector workers. In addition to regulating and
overseeing virus-related products used by consumers, such as disinfectants, tests, and potential vaccines and
treatments, federal agencies are responsible for regulating and monitoring workplace safety in private sector industries.
For example, the U.S. Department of Labor (DOL) is responsible for regulating workplace safety, including in high-risk
industries such as manufacturing and mining, and ensuring benefits are provided to address work-related disabilities.
According to the DOL OIG, the agency has faced pandemic-related challenges in fulfilling these responsibilities,
including difficulties conducting mine safety inspections and an increase in the number of virus-related workers
compensation claims.

Maintaining Effective Operations

Finally, OlIGs expressed concerns about the ability of agencies to perform essential functions during the pandemic.
TIGTA identified various essential services that the IRS has been unable to perform as the result of pandemic-related
office closures, including customer service, processing, and compliance functions. In particular, the IRS closed its toll-
free telephone call sites and tax assistance and counseling sites and has been unable to process paper-filed tax returns
or open mail. According to TIGTA, as of April 25, 2020, the IRS estimated that over 13.6 million paper-filed business and
individual tax returns remained unprocessed, 1.9 million tax returns with identified processing errors had not been
resolved, and 10 million pieces of mail at IRS processing centers remain unopened.

The USPS OIG also cited the need to maintain in-person operations to perform essential functions. According to the
USPS OIG, the Postal Service is facing labor shortages as employees get sick, fear getting sick, or need to take time off to
provide dependent care, which potentially could lead to delays in mail processing and delivery. USPS OIG stated that
over a thousand postal employees have tested positive for the virus coupled with numerous postal employee deaths.
USPS OIG has identified steps taken by the agency to keep the mail moving while keeping its employees safe, including
distribution of PPE, ensuring appropriate social distancing at retail and mail processing facilities, and giving carriers
guidance on social distancing while delivering the mail.

Introduction 9
CONCLUSION

Since the passage of the Inspector General Act in 1978, the federal Inspector General community has sought to keep
the public informed about the operations of the federal government and to promote effective and efficient government
by conducting rigorous independent oversight. Each year, as part of this effort, Inspectors General identify the top
management and performance challenges facing their individual agencies. CIGIE also issues an annual report that
includes a list of common challenges across agencies.

The PRAC is presenting this report on the challenges identified by Inspectors General for the federal agencies involved
in the response to the pandemic, and hopes that it will assist policymakers in addressing these and similar challenges
to foster improvements across government. In addition, consistent with its mission, the PRAC hopes that this report
will improve transparency and accountability by providing the public with information about the government’s
pandemic response.

Introduction

10
APPENDIX OIG TOP PANDEMIC CHALLENGES REVIEWED

To conduct its analysis, the PRAC reviewed submissions from the OlGs for the agencies listed below.

Architect of the Capitol

Board of Governors of the Federal Reserve System and Bureau of Consumer Financial Protection
Corporation for Public Broadcasting

Federal Deposit Insurance Corporation

General Services Administration

Internal Revenue Service

Legal Services Corporation

National Aeronautics and Space Administration
National Archives and Records Administration
National Endowment for the Arts

National Reconnaissance Office

National Science Foundation

Nuclear Regulatory Commission

Peace Corps

Railroad Retirement Board

Small Business Administration

Social Security Administration

U.S. Agency for International Development
U.S. Department of Agriculture

U.S. Department of Commerce

U.S. Department of Defense

U.S. Department of Education

U.S. Department of Energy

U.S. Department of Health and Human Services
U.S. Department of Homeland Security

U.S. Department of Housing and Urban Development
U.S. Department of Justice

U.S. Department of Labor

U.S. Department of State

U.S. Department of the Interior

U.S. Department of the Treasury

U.S. Department of Transportation

U.S. Department of Veterans Affairs

U.S. Election Assistance Commission

U.S. Environment Protection Agency

U.S. Office of Personnel Management

United States Postal Service

Introduction 11
ARCHITECT OF THE CAPITOL

The Architect of the Capitol (AOC) was appropriated $25 million in the CARES Act, specifically for cleaning supplies and
related expenses, for the operations and maintenance of the Capitol campus. To date, the below have been the most
significant challenges.
x The supply chain for COVID-19 supplies remains strained with shortages of personal protective equipment
including masks, disinfectant wipes, and hand sanitizer (including dispenser refills). While the AOC has been
able to source some supplies using its existing vendor relationships, many supplies are only available from
overseas sources and have not been repackaged by American companies. AOC contractors have identified an
American source for non-surgical face coverings.
x Some personal protective equipment is pilferable and difficult to inventory. In addition, taking supplies home or
hoarding supplies will create an excessive strain on the AOC’s efforts and weaken the AOC’s ability to support
the entire Capitol campus. In response, the AOC has requested congressional assistance in providing guidance
to their personnel on the appropriate use of supplies.
x CARES Act funding estimates for the AOC were limited to requirements at the time for cleaning supplies and
bulk purchasing of hand sanitizers and cleaning wipes; however, emerging requirements such as masks and
gloves are placing a considerable strain on available funding. AOC’s CARES Act funding is expected to be
exhausted by mid-June, at the latest. The AOC has asked for appropriations considerations for the continued
heightened cleaning of the Capitol campus beyond June.
x CARES Act funding did not include estimates for prolonged impacts on contracted services such as cleaning
costs, delays in service, and staffing and personnel for ongoing or planned projects (e.g., construction, cleaning
services, and food services) on the Capitol campus. The AOC has asked for congressional understanding for
COVID-19 impacts to ongoing and planned construction projects should resulting project delays or delivery
occur. The AOC may incur additional time and standards for food service contractor startup on return to full
operations, which may result in lost shared revenue depending on the contract type due to social distancing and
cleaning procedures.

For more information on the AOC
Office of Inspector General visit
https://www.aoc.gov/oig/
inspector-general.

Architect of the Capitol ͳʹ
BOARD OF GOVERNORS OF THE FEDERAL RESERVE
SYSTEM AND BUREAU OF CONSUMER FINANCIAL
PROTECTION

In mid-March, the Board of Governors of the Federal Reserve System began a complex intervention in the nation’s
economy in response to the COVID-19 pandemic. The Board adjusted target interest rates and used its emergency
lending authority under Section 13(3) of the Federal Reserve Act to ensure liquidity in financial markets and provide
lending support to various sectors of the economy.1 While some of these facilities are modeled after those created
during the 2008 financial crisis, others have been created in new and unique ways for the pandemic response. Signed
into law on March 27, 2020, the CARES Act authorized, among other things, the U.S. Department of the Treasury’s
investment in facilities established by the Board and mandated public reporting of information about the government’s
pandemic response. Significant coordination among the Board, Treasury, and numerous other federal agencies will be
necessary as the Board continues its pandemic response.

The scope of the Board’s response so far and its potential future actions must properly address the significant challenges
ahead for the broader economy as well as the statutory requirements of the CARES Act. The OIG for the Board is initially
focused on
1. governance and controls to ensure consistent execution of the Board’s programs by the Federal Reserve Banks
designated to put them into action, as well as vendor activities to execute program objectives;
2. coordination activities among the Reserve Banks or the designated program manager to execute, monitor, and
improve that execution over time;
3. data aggregation and validation, particularly before program-related information is shared with the public or
congressional stakeholders; and
4. monitoring and tracking of unique features associated with specific programs, such as
a. forgiveness of Paycheck Protection Program loans and its effect on the security interests under the
Paycheck Protection Program Liquidity Facility,
b. limits associated with the Primary and Secondary Market Corporate Credit Facilities, and
c. Treasury’s equity investments in specific CARES Act programs.

The OIG is actively collecting and analyzing information in these and other areas to identify emerging risks with a view to
initiating targeted audits or evaluations.

In addition to oversight related to the Board’s facilities and related activities directly supporting the economy, the OIG is
actively monitoring
1. measures taken to encourage financial institutions to lend consistent with the spirit and intent of specific
lending programs, such as the Paycheck Protection Program;
2. the Board’s efforts to review community banking organizations’ participation in pandemic response programs to
confirm that participation is commensurate with an institution’s governance, risk management, and internal
control capabilities;
3. the extent to which pandemic response lending efforts reach intended recipients and serve intended
communities; and
4. specific measures to encourage and foster more lending during the pandemic response.

1 Federal Reserve Act of 1913, Pub. L. No. 63-43, § 13(3) (1913) (codified at 12 U.S.C. § 343).

Board of Governors of the Federal Reserve System and Bureau of Consumer Financial Protection ͳ͵
Throughout these activities, the security of Board data, communications, networks, and systems essential to the Board’s
and the Federal Reserve System’s response to the pandemic are of paramount importance. The OIG has expanded
testing of critical information technology systems and broadened the scope of security control reviews previously
planned to meet the requirements of the Federal Information Security Modernization Act of 2014.” The OIG is also
coordinating directly with various information technology organizations throughout the System, including those Reserve
Banks that provide services to the Board and across the System.

Further, the OIG is dedicated to identifying and investigating potential fraud affecting the facilities and other Board
programs central to the pandemic response. To do so, the OIG leverages its relationships with various federal law
enforcement organizations, U.S. attorneys’ offices, and components of the U.S. Department of Justice.

Finally, the OIG is focused on additional oversight activities as the OIG for the Bureau of Consumer Financial Protection.
Although the programs and operations of the Bureau are not directly provided funding by the CARES Act or tasked with
CARES Act requirements, the agency plays a vital role in protecting consumers from pandemic-related consumer
financial fraud and abuse. In this regard, the OIG actively oversees Bureau supervisory activity and monitoring of
consumer complaints. The OIG also works closely with Bureau enforcement and law enforcement partners throughout
the country to identify, investigate, and prosecute pandemic-related fraud as it emerges.

As these oversight activities are conducted, the OIG will continue to work closely with other Inspectors General, the
Government Accountability Office, the Pandemic Response Accountability Committee, and the OIG’s congressional
committees of jurisdiction in order to efficiently deploy oversight resources where they are most needed.

For more information on the
Board Office of Inspector General
visit https://oig.federalreserve.
gov/the-inspector-general.htm.

2 Federal Information Security Modernization Act of 2014, Pub. L. No. 113-283 (2014).

Board of Governors of the Federal Reserve System and Bureau of Consumer Financial Protection 14
CORPORATION FOR PUBLIC BROADCASTING

The Corporation for Public Broadcasting (CPB) received $75 million to “prevent, prepare for, and respond to coronavirus,
including fiscal stabilization grants and to maintain local programming and services and preserve small and rural stations
threatened by declines in non-federal revenue sources” during the current economic decline triggered by COVID-19.
The legislation barred CPB from retaining any funds for administrative or other costs of CPB.

CPB consulted with the Public Broadcasting System, National Public Radio, and other system leaders to identify an
approach to distribute the funds and decided to split the funding evenly between the television and radio systems—
$37.5 million to each system.

As soon as it received the funds from the U.S. Department of the Treasury, CPB distributed the full $75 million to
556 radio and television grantees: 398 radio stations received funds of $75,000 or $112,136, and 158 television stations
received funds of $200,000 or $260,204. Small and rural stations received the larger fund amounts. CPB designated
these as unrestricted funds intended for use by stations as needed for public media to sustain operations and services
without time limits for spending.

CPB is challenged with addressing the economic impact on the public media system as a result of the COVID-19
pandemic. With growing unemployment and the downturn of the economy, stations have experienced a loss of revenue
from regular contributors and sponsors. Stations face daily issues in how to continue to produce programming and
broadcasts while protecting their staff. Both CPB and stations had not previously operated remotely and had to learn
how to do so. Yet many stations throughout the country quickly adapted to assist their communities not only with
critical health and safety information on the pandemic, but also with curriculum-based educational programming
designed to assist local school districts to provide educational content and support for teachers and parents.

CPB OIG’s challenge will be to provide oversight and ensure transparency on the spending of the $75 million. The OIG
will audit CARES Act funding in upcoming station audits.

For more information on the CPB
Office of Inspector General visit
https://www.cpb.org/oig.

Corporation for Public Broadcasting ͳͷ
FEDERAL DEPOSIT INSURANCE CORPORATION

The Federal Deposit Insurance Corporation (FDIC) plays a critical role in maintaining the stability of the nation’s financial
system and ensuring the safety and soundness of its supervised financial institutions. To accomplish its mission, the
FDIC examines most of the financial institutions in the country (approximately 3,400 of the 5,300 banks) and manages
the resolution and receivership of failed banks. The FDIC also manages the Deposit Insurance Fund (over $110 billion at
the end of December 2019) and insures approximately $7.8 trillion in customer deposit accounts.

In recent weeks (March to May 2020), more than 33 million American workers filed for unemployment compensation
(14.7 percent unemployment rate in April 2020), and more than 4 million small businesses in the United States sought
economic relief under the CARES Act. As a result, many financial experts are forecasting an economic downturn,
whereby borrowers may experience difficulty in repaying loans to banks. Such hardships may cause significant
economic pressures upon the financial institutions of this country.

Based on its oversight experience and a review of other relevant materials, the FDIC OIG identified three primary
challenges facing the FDIC:

e Ensuring the FDIC’s readiness for crises (including modeling potential effects on financial institutions and
conducting examinations remotely).

e Resolving financial institutions (including executing off-site bank resolutions and receiverships and resolving
large, complex institutions pursuant to Dodd-Frank Act responsibilities).+

e Guarding against financial fraud and cybercrimes at banks.

Ensuring the FDIC’s Readiness for Crises

The FDIC must be prepared for a broad range of crises that could impact the banking system. In an April 2020 report on
the FDIC’s readiness for crises, the OIG identified seven best practices that could be used by the FDIC in its crisis
readiness framework: (1) Policy and Procedures, (2) Plans, (3) Training, (4) Exercises, (5) Lessons Learned,

(6) Maintenance, and (7) Assessment and Reporting.”

While this report was not conducted in response to the current pandemic, the OIG found that the FDIC should fully
establish the seven elements of crisis readiness. Although the FDIC maintains certain policies and procedures, and
conducts some training and simulated exercises, the OIG found that the FDIC:

1. Did not have a documented Agency policy and did not have documented procedures to provide for a consistent
crisis readiness planning process.

2. Should develop an Agency-wide all-hazards readiness plan as well as Agency-wide hazard-specific readiness
plans, as needed.

3. Did not train personnel to understand the content of crisis readiness plans.
4. Should document the important results of all readiness plan exercises.

5. Did not have a documented process to monitor implementation of lessons learned.

1 Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203 (2010).
2 FDIC OIG, The FDIC’s Readiness for Crises (EVAL-20-004, April 7, 2020).

Federal Deposit Insurance Corporation 16
6. Should establish a central repository of plans to facilitate periodic maintenance.

7. Should regularly assess and report on Agency-wide progress on crisis readiness plans and activities to the FDIC
Chairman and senior management.

The OIG made 11 recommendations for the FDIC to improve its crisis readiness planning. The FDIC has actions underway
to address these recommendations.

With respect to the current pandemic crisis, the FDIC represented that it has supplemented its existing staff and
contractors and prioritized its workload to focus on mission-essential matters. In addition, the FDIC has reconstituted its
Resource Management Committee to focus attention on emerging needs.

Modeling Potential Effects on Financial Institutions

Given the variables and uncertainty related to the current pandemic as well as the dynamic and fluid nature of the
economic situation, the FDIC faces challenges in forecasting the economic impact of the pandemic and its financial
effects on banks. According to the FDIC, its economists and financial analysts have developed analyses to assess the
potential effects of the downturn with respect to liquidity and credit quality. Such insights into troubled or failing
institutions would help the FDIC to plan accordingly, supplement resources, and allocate supervisory staff appropriately.

Conducting Examinations Remotely

The Federal Deposit Insurance Act requires on-site, full-scope examinations of every FDIC-insured financial institution at
least once during each 12-month period (with certain limited exceptions).? In March 2020, pursuant to the presidential
declaration of a National Emergency and in accordance with mitigation guidance from federal, state, and local officials,
the FDIC mandated telework for its staff and continued all examination activities off-site. Prior to the current pandemic
crisis, the FDIC stated that it had conducted approximately 40 percent of its safety-and-soundness examinations off-site
and approximately 60 percent of its consumer-compliance examinations off-site.

Current social distancing guidelines place an unexpected reliance on information technology systems to conduct FDIC
examinations. Although the FDIC frequently swaps data with banks through file exchange systems, these systems will
come under additional stress due to the increased data flow and volume. Such dependence on remote off-site
examinations also places a greater emphasis and focus on information security protocols and the reliability of the FDIC’s
information systems.

Resolving Financial Institutions

Executing Off-Site Bank Resolutions and Receiverships

When a financial institution fails, the FDIC is responsible for facilitating the transfer of the institution’s insured deposits
to an assuming institution or paying insured depositors directly. The FDIC’s goal is to provide customers with access to
insured deposits within 1 or 2 days. Carrying out this responsibility during the pandemic presents challenges because
this activity requires FDIC personnel to be present at the failed bank’s offices and branches. In April 2020, the FDIC
changed its processes and now deploys a small on-site team (with a health and safety officer available for consultation)
that relies on conferencing software, scanning, and file exchange platforms. The FDIC must ensure that its on-site
employees have an adequate supply of personal protective equipment and are trained on its proper use. Also, the FDIC
will need to reevaluate such procedures in light of the current pandemic environment.

Resolving Large, Complex Institutions Pursuant to Dodd-Frank Act Responsibilities

In 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) was enacted and contained
provisions regarding the Orderly Liquidation of large, complex financial companies known as systemically important
financial institutions (SIFI). These provisions allow for liquidation of a bank where its bankruptcy would have serious

3 12 C.F.R. § 337.12 (2018).

Federal Deposit Insurance Corporation 17
adverse consequences on the financial stability of the United States, and where there is no private-sector alternative to
prevent default.

Pursuant to this Dodd-Frank Act authority, the FDIC is appointed as a receiver to carry out the liquidation of SIFls. As
receiver, the FDIC may take steps to transfer or sell assets, create bridge financial organizations to assume assets or
liabilities, and approve claims against the company to be paid. To help fund this liquidation process, the Dodd-Frank Act
includes a separate fund created by the U.S. Department of the Treasury to cover administrative costs of liquidation.
Because the federal government has never invoked these Orderly Liquidation provisions, the FDIC may face challenges in
executing the novel provisions of Orderly Liquidation under the Dodd-Frank Act. Further, social distancing guidelines
may hinder the FDIC’s coordination and execution of the Orderly Liquidation processes.

Guarding against Financial Fraud and Cybercrimes at Banks

The economic shocks associated with the Savings and Loan crisis (late 1980s to early 1990s) and the recent financial
crisis (2008 to 2013) uncovered certain fraudulent activity committed by banks, bankers, customers, and other related
parties, such as bank fraud, bribery, embezzlement, investment schemes, obstruction of bank examinations, and
falsification of bank records and reports.

Financial institutions may face a recurrence of such threats and risks to their operations. Through the CARES Act and
subsequent law, the federal government, at present, has injected more than $2.4 trillion in stimulus funding into the
economy, including approximately $670 billion in guaranteed loans to small businesses under the Paycheck Protection
Program. Of this amount, approximately $30 billion is set aside for mid-sized banks and credit unions, and another
$30 billion is set aside for small banks and credit unions. Based on our prior experience, we have seen that the
guaranteed-loan programs (such as the Paycheck Protection Program) may lead to an increased risk of financial fraud
and criminal activity, because the fraudsters know that such loans are backed by the U.S. government. The FDIC may
face challenges in ensuring the proper level of supervision and examination scrutiny for guaranteed loan portfolios at
supervised institutions.

In addition, during this pandemic crisis, customers and financial institutions are increasingly dependent on remote
mobile and online banking services, which may increase the risk of cybercrimes, such as phishing and email fraud. The
FDIC has issued publications to assist consumers in using mobile and online banking services and to raise awareness
regarding such threats. Further, banks’ use of third-party service providers to support technology systems may increase
cybersecurity risk at institutions. The FDIC must ensure that banks secure and protect multiple avenues of digital
interconnections, because a cyber incident at one digital juncture has the potential to infect other institutions in the
banking system.

The OIG notes that these challenges will require continued attention and vigilance by the FDIC for the foreseeable
future, and hopes that this document will be informative for the American people to learn about the operations of the
FDIC and understand the challenges it faces.

For more information on the FDIC
Office of Inspector General visit
https: //www.fdicoig.gov/.

Federal Deposit Insurance Corporation 18
GENERAL SERVICES ADMINISTRATION

On March 27, 2020, Congress passed and the President signed the CARES Act. The CARES Act included $295 million for
the General Services Administration (GSA) to prevent, prepare for, and respond to COVID-19 domestically or
internationally.
According to GSA’s Communicable Disease Pandemic Plan, GSA has four primary responsibilities during a pandemic
emergency: (1) protecting the health and safety of GSA employees, contractors, vendors, and visiting public;
(2) maintaining mission essential functions; (3) supporting federal response efforts; and (4) communicating with
employees, tenants, and other stakeholders.
This summary identifies what the GSA OIG considers to be the most significant challenges facing GSA as the Agency
seeks to meet the goals of the emergency pandemic response legislation.

Protecting the Health and Safety of Building Occupants
As of May 7, 2020, 963 GSA owned or leased facilities have reported COVID-19 positive or presumed cases. To ensure
the health and safety of building occupants and visitors, the Public Buildings Service (PBS) must be able to timely identify
and track positive or presumed cases, and notify building occupants of any potential exposure. Once positive or
presumed cases are reported, PBS must execute contract actions to ensure that space is cleaned and disinfected in
accordance with Centers for Disease Control and Prevention guidelines.

PBS received $275 million through the Federal Buildings Fund to fund, among other things, deep cleaning actions due to
COVID-19. Effectively administering cleaning contracts to ensure the health and safety of building occupants will pose a
challenge. GSA’s Communicable Disease Pandemic Plan notes that in-person inspections of this space would be
impossible and imprudent, given the health and safety risks involved. Therefore, the plan states that it is important that
PBS work with contractors to review, enhance, and modify as appropriate, contract Quality Control Plans and PBS
Quality Assurance Surveillance Plans to ensure that adequate safeguards provide for the delivery of safe, efficient, and
effective custodial services.

However, the OIG’s audit work has found issues with PBS’s oversight of its cleaning contracts. The OIG found contracts
where the contractor Quality Control Plans and PBS Quality Assurance Surveillance Plans were either missing or
inadequate, leading to ineffective contract oversight.1 PBS must provide effective oversight of the applicable quality
control processes to limit and reduce the spread of COVID-19. This will be of considerable importance as federal
employees begin to return from extended telework and buildings reopen to the general public.

Accurate Reporting of CARES Act Spending
To accurately report CARES Act obligations and commitments, the GSA Office of the Chief Financial Officer must ensure
that CARES Act spending is properly identified, and that reporting errors and omissions are eliminated or minimized.
The OIG’s recent audit of GSA’s DATA Act submission found that the Agency did not accurately report obligations due to

1 GSA OIG, GSA’s PBS Northwest/Artic Region Service Center Does Not Effectively Administer Lease and Service Contracts (A180053/P/4/R20002,
February 20, 2020) and Award and Administration Issues on Task Order GS-P-02-1 0-PC5025 for Construction Services on the Recovery Act Project
at the Joseph P. Addabbo Federal Office Building in Jamaica, New York (A090184-78, January 8, 2015).

General Services Administration ͳͻ
control weaknesses.* GSA must ensure that steps it has taken to address these control weaknesses are effective and
ensure accurate CARES Act reporting.

Providing Effective Contract Administration for Emergency
Procurements

The CARES Act does not provide direct funding to the Federal Acquisition Service (FAS); however, FAS’s Emergency
Management Program Office and Office of Assisted Acquisitions may execute contract actions using CARES Act funding
on behalf of customer agencies. Past audit work of GSA’s emergency contracting for other agencies has identified
deficiencies in contract administration resulting in wasteful spending and negative impacts to federal response efforts.?
FAS must ensure contract administration responsibilities are appropriately delegated and formalized to ensure proper
monitoring of contractor performance.

Safeguarding Federal Facilities and Providing a Secure Work
Environment

In multiple audits, the OIG reported that GSA did not ensure that contract employees received favorable background
investigation determinations before providing them with access to sensitive government information, systems, and
facilities.* As a result, GSA assumed unnecessary risk for itself and its customer agencies.

GSA’s Office of Government-wide Policy issued guidance that allows for flexibilities related to standard face-to-face
credentialing, termination of credentials and building access, and issuance and collection of government supplied
equipment for contractors.° While these allowances may be necessary in the short-term, GSA must ensure sufficient
controls remain. In addition, in cases where contractors use their own information technology (IT) equipment, GSA
must ensure it is in compliance with the GSA Office of the Chief Information Officer's IT security policy and technical
security guidelines. Failure to do so exposes GSA to potential attacks that could lead to the disruption of Agency
operations and the unauthorized disclosure of sensitive information.

For more information on the GSA
Office of Inspector General visit
https://www.gsaig.gov/.

2 GSA OIG, Audit of the Completeness, Accuracy, Timeliness and Quality of GSA’s 2019 DATA Act Submission ( A190040/B/R/F20001,
November 1, 2019).

3 GSA OIG, Audit of GSA’s Response to Hurricane Katrina (A060055/A/R/FO7009, February 26, 2007).

4 GSA OIG, FAS Did Not Ensure That Contract Employees Had Background Investigations Before Providing Support to Agencies Transitioning to
Enterprise Infrastructure Solutions (A170103-4, June 29, 2018) and PBS is Not Enforcing Contract Security Clearance Requirements on a Project at
the Keating Federal Building ( A150120/P/2/R16002, March 17, 2016).

> Acquisition Letter MV-202-07, Temporary Policy for Contractor Onboarding and Offboarding During Novel Coronavirus Disease (COVID-19)
(April 21, 2020).

General Services Administration 20
INTERNAL REVENUE SERVICE

Federal Tax Administration has been severely impacted by COVID-19. This public health emergency has resulted in the
prolonged closure of most Internal Revenue Service (IRS) offices and processing centers. Individual and business
taxpayers have experienced severe financial hardships. To help people facing challenges related to COVID-19, the
federal government has taken a sweeping series of steps to assist taxpayers by providing relief on a variety of issues
ranging from extending tax return filing and payment deadlines to postponing compliance actions. The IRS also
developed online assistance tools, developed a dedicated webpage, and expedited analysis and reprogramming of
systems needed to provide economic impact payments to taxpayers. The following information details some of the
most significant challenges facing the IRS.

Providing Tax Relief to Offset Economic Hardship
The IRS must implement many tax provisions in the CARES Act intended to provide relief to those experiencing financial
hardship. As the IRS implements the individual and business tax relief provisions, it will face challenges to ensure that
only eligible taxpayers are receiving financial relief and that the amount of relief is correct. The IRS will also need to
recover improper payments made to ineligible taxpayers.

The largest relief measure for individual taxpayers is the issuance of recovery rebates, also known as economic impact
payments. These payments are advance credits from the IRS of up to $1,200 per qualifying individual (up to $2,400 to
couples filing a joint return), and $500 for each qualifying dependent. The IRS faced an enormous challenge in
expediting the issuance of these payments. Payments were issued to 80 million Americans within 3 weeks of the
passage of the CARES Act. As of April 23, 2020, the IRS has issued payments totaling $191.1 billion to 113 million
Americans and plans to continue to issue the remaining 37 million payments through September 2020.

To assist the many businesses impacted by COVID-19, business tax relief provisions in the law include the deferral of
employment tax deposits and payments through December 31, 2020; the Credit for Sick and Family Leave; and the
Employee Retention Credit. Employers claim the credits on their federal employment tax returns (e.g., Form 941,
Employer's Quarterly Federal Tax Return), but they can benefit more quickly from the credits by reducing their federal
employment tax deposits. If there are insufficient federal employment taxes to cover the amount of the credits, an
employer may request an advance payment of the credits. This required the IRS to develop a new tax form and
processes and procedures to enable employers to submit these requests beginning on April 1, 2020.

Continuity of Operations
Inability to Perform Essential Functions
The IRS has not been able to perform many of its essential customer service, processing, and compliance functions as a
result of the pandemic and the need to close offices. To help taxpayers facing the challenges of COVID-19, the IRS
unveiled a new People First Initiative in March 2020. The initiative temporarily adjusted or suspended key IRS
compliance programs from April 1 through July 15, 2020. The changes included postponing certain payments related to
installment agreements and offers in compromise; suspending liens and levies; suspending passport certifications of
seriously delinquent taxpayers; not referring new delinquent accounts to private debt collection; and delaying new field,
office, or correspondence examinations. The suspension of these compliance activities will require the IRS to modify its
compliance processes to provide taxpayers relief during the pandemic.

Internal Revenue Service ʹͳ
Decline in Customer Service and Tax Return Processing

During this tax filing season, the IRS took unprecedented and drastic actions to prevent the spread of COVID-19 in order
to protect the health and safety of its employees and taxpayers. These actions included closing its toll-free telephone
call sites, Taxpayer Assistance Centers, Tax Processing Centers, Volunteer Income Tax Assistance, and Tax Counseling for
the Elderly sites. The IRS directed most employees to work from home (or an alternate location) which presented other
challenges for the IRS. For example, moving its toll-free telephone operation to a telework environment required the
IRS to provide the necessary equipment and training to teleworking employees.

The actions that the IRS found necessary to take in response to this pandemic have affected and will continue to affect
its ability to provide timely customer service and tax return processing. For example, as of April 25, 2020, the IRS
estimates that over 13.6 million paper-filed business and individual tax returns remain unprocessed and 1.9 million tax
returns with identified processing errors that have not been resolved. In addition, the IRS estimates it has received

10 million pieces of mail at its processing centers since these sites have been closed, which includes 17 tractor-trailers
located at two processing centers that contain unopened mail.

Health and Safety Concerns

As the IRS slowly reopens it sites, it must continually assess the personal safety of its workers. This may require the
IRS to continue offering telework flexibilities, place limits on the number of staff allowed in offices, and increase
the procurement of personal protective equipment. Trying to balance restarting operations with employee safety
will challenge the IRS’s ability to provide quality customer service, process tax returns, and enforce compliance with
tax laws.

Preventing Scams

The tax system has routinely been targeted by scammers and used as a lure to conduct illicit cyber campaigns ranging
from attempts to infect taxpayer systems with malicious software, to stealing personally identifiable information and
utilizing IRS web portals to monetize their activity through the filing of fraudulent tax returns. The Treasury Inspector
General for Tax Administration (TIGTA) expects to see a surge in investigative activity related to the CARES Act, as bad
actors resort to new scams and cyberattacks against IRS systems in an attempt to steal economic impact payments from
taxpayers through various methods, including impersonation phone calls, email phishing attempts, and stolen or
counterfeit Treasury checks.

The IRS will also be challenged to ensure adequate measures are taken to prevent the continually evolving threats
against its operations, to include cyberattacks against new IRS web portals used by taxpayers to check on the status of
economic impact payments and to update their banking information in order to receive these payments. Illicit actors
are frequently resourceful and significantly outnumber those combating them. The normal cycle of activity includes an
intense amount of attention paid to new government programs by scammers who are intent on exploiting them to their
advantage. The implementation of the CARES Act has not only started this cycle of activity on a significant scale
involving many areas, but has also brought IRS programs back into focus for scammers familiar with IRS operations, as
well as likely motivating a new generation of scammers who are chasing what they believe to be “free money.” Victims
of IRS-related scams are frequently retargeted for victimization and may be victimized repeatedly over a significant
period of time.

For more information on TIGTA
visit https://www.treasury.gov/
tigta/.

Internal Revenue Service 22
LEGAL SERVICES CORPORATION

The Legal Services Corporation (LSC) OIG identified what it believes to be the top challenges the LSC faces in handling
pandemic-related responsibilities or any emergency funds.1 Under the CARES Act, the purpose of LSC’s COVID-19
supplemental funding is to prevent, prepare for, and respond to the coronavirus, domestically or internationally.

Resources
Worsening Shortfall in Legal Services Delivery System
Before the COVID-19 pandemic, the shortfall in legal aid delivery system capacity was the most critical challenge to
program effectiveness facing LSC. A 2019 LSC intake census showed that 42 percent of the eligible legal problems
presented to the grantee services network received no service of any kind. As a result of the COVID-19 pandemic and
the resulting spike in unemployment, the large shortfall between the provision of legal aid services and the
overwhelming demand by eligible low-income persons for legal services will get substantially worse. LSC must work to
continue to facilitate and fund the efficient and effective delivery of legal aid services during a substantial increase in
demand for services, while taking into account differing grantee delivery capacities throughout the country.

Distribution of Funding
LSC must determine the most effective and equitable distribution of the funds to achieve the authorized purpose of the
funding. It must determine the most effective funding mechanism, while getting the funding to its grantees expediently.
At the same time, LSC must ensure it provides an appropriate level of effective guidance on use of special grants, such as
pandemic-related grants, and ensure there is appropriate accountability for the use of the funds. LSC likely will need to
respond promptly to questions from grantees on the proper use of and accountability for the funds. Potential
subsequent rounds of funding will allow LSC to apply lessons learned and improve its process of awarding and
overseeing pandemic funds.

Operations
The imperative under the pandemic to provide legal services on a remote basis has revealed inadequate telework
readiness in parts of the legal aid delivery system. LSC has identified this challenge and provided special funding for
information technology system investments to enhance grantees telework capacity and improve their ability to provide
essential legal aid services remotely.

Oversight
Grants Oversight
Leadership capabilities and experience levels vary throughout the LSC-funded network. Grants management at the
grantee level is challenged by an increasingly complex portfolio of recurring and special grant programs requiring skilled
oversight and adequate staffing (e.g., a grantee can receive funding through the following LSC grant programs: Basic

1 The practice of OIGs independently assessing the top management and performance challenges facing their agency is required at major
executive agencies by the Reports Consolidation Act of 2000, 31 USC §3516(d). While LSC is not an executive agency and is not subject to this
requirement, the LSC OIG periodically identifies LSC’s top management challenges.

Legal Services Corporation ʹ͵
Field, Pro bono, Technology Innovation Grants, Disaster Relief, CARES Act, Veterans Grants, subgrants, and private fund
research projects).

Control Systems

LSC must maintain a sound system of controls to manage its programs and operations, and administer and oversee
pandemic-related grants. LSC controls will be tested, especially considering new or modified systems for tracking and
accounting for this funding and differing terms and conditions between the emergency funding and basic field grants.
Traditional fraud concerns at the grantees regarding acquisition management, conflicts of interest, sole-sourcing, and
information technology security are likely to be heightened under the current exigent circumstances.

Monitoring

Challenges to monitoring the timely and appropriate expenditure of pandemic-related funds are presented in the
traditional manner with which LSC oversight is conducted. LSC grantee monitoring is undertaken largely with on-site
visits to grantees. In the current environment, LSC understandably is planning to shift to remote oversight of grantees
who are also functioning remotely, with potential limitations of access to required staff and records. This shift in
monitoring approach will create new challenges for LSC’s ability to conduct necessary oversight. Additionally, CARES Act
funding will require a reprioritization, additional training, and/or increased numbers of LSC staff to oversee the fiscal and
regulatory processes and guidance that 132 grant recipients use to expend emergency grant funding.

Data Challenges

To determine the effectiveness of the LSC CARES Act implementation and to ensure the timely and appropriate
expenditure of pandemic-related funds, LSC must institute systems to monitor the use of funds and ensure responsive
and accurate reporting by LSC grantees. LSC is not subject to the Digital Accountability and Transparency Act of 2014

(or the Federal Funding Accountability and Transparency Act and its amendments) and does not participate in
USASpending.gov.* As such, LSC’s ongoing reporting requirements may vary in form and substance from traditional
federal grantee reporting requirements. LSC’s collection (and grantees’ reporting) of data required under the CARES Act,
and required for effective and timely oversight of CARES Act funding, therefore, presents a challenge. This is further
complicated by the fact that LSC is in the process of implementing a new grants management system, including the
oversight module that is not yet fully operational.

For more information on the LSC
Office of Inspector General visit
https://www.oig.Isc.gov/.

2 Digital Accountability and Transparency Act of 2014, Pub. L. No. 113-101f (2014) and Federal Funding Accountability and Transparency Act of
2006, Pub. L. No. 109-282 (2006).

Legal Services Corporation 24
NATIONAL AERONAUTICS AND SPACE
ADMINISTRATION

The CARES Act was enacted in March 2020 to address the COVID-19 outbreak and, in part, provided funding for federal
agencies to respond to the pandemic and fund loans, grants, and other forms of assistance for businesses and state and
local governments. The National Aeronautics and Space Administration (NASA) received $60 million in CARES Act
funding within its Safety, Security, and Mission Services appropriation to prevent, prepare for, and respond to the
coronavirus domestically or internationally. In addition, Section 3610 of the Act allows agencies to reimburse
contractors for any paid leave caused by the pandemic, and to keep employees and subcontractors in a ready state,
including to protect the life and safety of government and contractor personnel. This provision is particularly relevant
to an agency like NASA that relies so heavily on private contractors for its science and space exploration projects.
NASA, along with multiple other federal agencies, modified
operations in response to the coronavirus pandemic
following guidance established by the Centers for Disease
Control and Prevention. This included mandating telework
for federal and contractor workforces, closing facilities, and
canceling all non-essential travel. By mid-April 2020, 12 of
the Agency’s 18 major facilities across the country were
closed to all employees except those necessary to protect
life and critical infrastructure. The remaining 6 facilities
remained open for work designated “mission critical” that
could not be accomplished remotely.
As of May 5, 2020, NASA has committed approximately
$8.5 million of the $60 million in emergency funding. The
majority of the committed funds relate to contractor impact
claims, information technology services, and cleaning
supplies. Future use of the remaining funds are expected to
include increased cleaning efforts at each NASA facility as
well as purchases of personal protective equipment.
In addition to the CARES Act funds, NASA has launched
multiple initiatives to respond to the pandemic. The Agency started an employee crowdsourcing initiative to solicit new
ideas focused on developing personal protective equipment; developing new ventilation devices; and using NASA data,
data analytics, high performance computing, artificial intelligence, and other capabilities to predict the spread of
COVID-19 and address its environmental, economic, and societal impacts. Agency engineers have also designed a new
ventilator and oxygen helmet specifically for coronavirus patients with milder symptoms. Both items are under review
by the Food and Drug Administration for emergency-use authorization.

Oversight of Contracts, Grants, and Cooperative Agreements
Typically, NASA spends approximately 80 percent or more of its available resources on contracts, grants, and
cooperative agreements to fund research and development, and purchase supplies, services, and equipment to fulfill
the Agency’s mission. With the implementation of the CARES Act, the NASA OIG anticipates an increase in these
procurement actions. Moving quickly to use these funds effectively while avoiding fraud, waste, and abuse is a critical
but challenging task. Additionally, for reimbursement of Section 3610 funds, it is imperative for NASA to ensure these
funds are appropriately identified, recorded, and segregated, since the reimbursement may be paid not only from

National Aeronautics and Space Administration ʹͷ
NASA’s CARES Act funding but from its annual appropriations. Furthermore, it will be incumbent upon contracting
officers to communicate and oversee contractor activity and obtain appropriate documentation to identify contractors
that qualify for this relief. Based on the results of ongoing and previous work, the OIG believes this oversight to be the
top challenge facing the Agency in administering CARES Act and Agency funds related to the pandemic.

NASA’s challenges with contracting and acquisition oversight are long-standing and have been reported on the
Government Accountability Office’s (GAO) High-Risk list and as a top management challenge by the OIG for the

past 14 years. The Agency has been responsive to recommendations; however, continued improvement in this area
is needed.

Collectively, the OIG’s audit and investigative work has consistently shown that NASA’s poor management and oversight
of contracts, grants, and cooperative agreements has resulted in inappropriate expenditures, wasted taxpayer dollars,
and negative impacts to the Agency’s mission. Specifically, some of the OIG’s most recent audit reports have identified
that NASA lacks visibility into contract costs; contracting officers approved contract modifications and issued task orders
to contracts without proper authority; and NASA lacked an appointed on-site technical monitor, which contributed to
issues with monitoring contractor performance.! Both the NASA OIG and GAO have also reported on issues with NASA’s
use of service contracts, specifically related to improvements needed for collecting data, streamlining requirements, and
utilizing independent government cost estimates—the government’s best estimate of a contract’s potential costs.

The same concerns hold true regarding NASA’s oversight of grants and cooperative agreements. Past OIG audits have
reported instances where NASA and award recipients did not ensure proper administration and management of awards,
as well as grant funds that were not used for their intended purpose. The OIG’s investigative work for both contracts
and grants also identified fraud and misconduct related to collusion among bidders, employers, and contractors; bribes
and kickbacks; use of counterfeit and defective parts; and conflicts of interest.

Finally, the OIG’s prior oversight activities of NASA’s Recovery Act funding in 2009 identified that generally the Agency
used funds in accordance with the requirements and goals of the Act; however, the OIG identified $2 million in
questioned costs, internal control weakness, and poor project oversight.* Protecting NASA’s investments is of the
utmost importance, and Agency contracting personnel need to be attentive to fraud indicators and be proactive in their
efforts to prevent such fraud before it occurs. Moving forward, the OIG will continue to provide oversight of NASA’s
procurement activities and tracking of pandemic funding.

For more information on the NASA
Office of Inspector General visit

http://oig.nasa.gov/.

1 NASA OIG, NASA’s Management of Space Launch System Program Costs and Contracts (IG-20-012, March 10, 2020) and NASA’s Management of
the Space Launch System Stages Contract (IG-19-001, October 10, 2018).

2 American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5 (2009).

National Aeronautics and Space Administration 26
NATIONAL ARCHIVES AND RECORDS
ADMINISTRATION

The National Archives and Records Administration (NARA) received an additional $8.1 million to prevent, prepare for,
and respond to the COVID-19 pandemic under the CARES Act. These funds are available until September 30, 2021, and
may be used to provide for coronavirus-related expenses of NARA’s appropriated activities as well as the reimbursable
Federal Records Centers Program. NARA has stated this funding will be used to expand remote access for NARA
employees to maximize telework during the COVID-19 pandemic. Specifically, NARA plans to provide a laptop or tablet
to every employee, accelerating migration of shared drives to Google Drive and improving cybersecurity. Laptops and
tablets have already been ordered. Further, some of the funds were provided to cover cost-saving initiatives that have
been delayed due to the COVID-19 pandemic, including classified consolidation, information system decommissioning,
and reductions in building services.

NARA will be challenged to handle these additional funds in an efficient and effective manner. The bulk of these funds
will be used to increase NARA’s information technology (IT) equipment and infrastructure to promote telework, which
will require contracting for goods and services. Accordingly, NARA may be hampered by long-standing challenges in
IT security and contract management. How these management challenges may affect spending CARES Act funds is
summarized below. Management challenges are further detailed in the NARA OIG’s Semiannual Report to Congress,
which can be found at www.archives.gov/oig/reports.

Information Technology Security
As the OIG has reported over the past decade, annual Federal Information Security Modernization Act assessments have
consistently identified areas in need of significant improvement.1 This led to NARA labeling IT security a “material
weakness” under the Federal Managers’ Financial Integrity Act from 2007 to 2019, with exceptions in 2013 and 2014
when it was considered a “reportable issue.”2 NARA has developed an action plan to resolve identified control
deficiencies, but does not expect to implement it fully until fiscal year 2023. Therefore, all of the CARES Act funds used
for IT equipment and issues will be expended before NARA fully implements its action plan to address IT security.
Currently there are control weaknesses and structural challenges (such as the fact that the Chief Information Officer
does not report directly to the Agency head) that contribute to underdeveloped or ineffectively implemented policies
which may affect NARA’s ability to efficiently and effectively use this additional funding in the IT realm.

While NARA has introduced initiatives to promote a mature program, real progress will not be made until NARA
establishes an effective system of internal control for information security. This will not be completed before NARA
expends the CARES Act funds, and NARA must work to ensure that any of these funds spent on IT do not exacerbate
current security issues.

Improving Project and Contract Management
NARA has stated the Agency will procure new IT equipment with CARES Act funds, and has historically used contractors
to do significant work and maintenance on NARA’s IT systems. However, NARA has faced significant challenges
concerning project and contract management. In the past there have been cost and schedule overruns, contract
requirements were not always well-defined, large dollar IT contracts lacked adequate oversight, contractor performance

1 Federal Information Security Modernization Act of 2014, Pub. L. No. 113-283 (2014).
2 Federal Managers Financial Integrity Act of 1982, Pub. L. No. 97-255 (1982).

National Archives and Records Administration ʹ͹
was not consistently evaluated and reported, and most relevant to the current situation, IT projects were not always
carried out in accordance with guidelines.

Part of this challenge is NARA’s acquisition workforce. Strengthening the acquisition workforce is essential to improving
contractor management and oversight. However, NARA does not effectively identify and track the agency’s acquisition
workforce, or coordinate with program areas when designating contracting officer representatives (COR). This has led to
using CORs without proper certifications. NARA must work to strengthen internal controls over acquisition activities
associated with CARES Act funding, and provide better oversight and management of any related procurement activities.

For more information on the NARA
Office of Inspector General visit
https://www.archives.gov/ oig.

National Archives and Records Administration 28
NATIONAL ENDOWMENT FOR THE ARTS

The CARES Act provided the National Endowment for the Arts (NEA) an additional $75 million to remain available until
September 30, 2021, to prevent, prepare for, and respond to COVID-19, domestically or internationally, to be distributed
in grants. The Reports Consolidated Act of 2000 and Office of Management and Budget (OMB) Circular A-136, Financial
Reporting Requirements, require that the OIG provide the agency head with a summary of the top management and
performance challenges facing the agency.1 This summary is an update of the top management challenges the NEA OIG
provided to the Agency in November 2019 to summarize how the challenges may affect the management of the
additional funding provided by the CARES Act.

It is the OIG’s assessment that the areas of financial management, human capital, information technology, and awardee
accountability represent the top management and performance challenges for the NEA. Following is a discussion of
each challenge area.

Financial Management
This is one of the key areas where the NEA works to continuously improve each year. Thus, it remains one of the top
challenges for fiscal year 2020. The challenge is continuous because the Agency is required to keep pace with
government-wide financial systems modernization efforts and regulatory changes. At the same time, the Agency
continues to focus on improving efficiency and effectiveness of its accounting and finance policy and procedures,
systems, and staff cross-training. While this is a top challenge, a positive indicator in the financial management area is
that the Agency consistently receives unmodified opinions on its financial statement audits and has a high level of
compliance with DATA Act requirements.2 During 2020 and beyond, under the CARES Act, the Agency will be challenged
with timely disbursement of CARES Act funds through its financial management system and reporting the funding
awards to the appropriate U.S. Department of the Treasury and OMB systems.

Human Capital
The NEA considers its people to be its most valuable asset in achieving its mission. Thus, it works to continuously
improve its people program policies and procedures consistent with its human capital strategy. The top human capital
challenge includes ensuring an effective strategy to work with hiring managers to attract and retain candidates with the
right skills, ability, and knowledge to fill vacant positions due to normal attrition and retirements. This needs to be done
while maintaining high quality service in other human capital areas, such as training and development, and performance
management and recognition. In 2019, the Agency filled a number of key leadership and staff positions, including the
Senior Deputy Chairman, to address mission delivery challenges. For 2020, the CARES Act funding will require a
significantly increased number of volunteers and staff time devoted to the award of this funding while continuing to
oversee the award of award funds appropriated prior to the CARES Act.

Information Technology
The NEA began addressing this area by transitioning to a new, more robust electronic grants management system
(eGMS) in fiscal year 2018. This new system was built on a more flexible, operationally efficient platform. The initial

1 Reports Consolidation Act of 2000, Pub. L. No. 106-531 (2000) and OMB Circular A-136, Financial Reporting Requirements (June 28, 2019).
2 Digital Accountability and Transparency Act of 2014, Pub. L. No. 113-101 (2014).

National Endowment for the Arts ʹͻ
version of the eGMS was fully connected to the Grants.gov website. In 2018 and 2019, the Agency has been working to
fully integrate eGMS with its internal financial systems and the financial systems operated by external service providers.
These updates should prove helpful, yet still challenging due to the significant increase in the volume of transactions due
to the CARES Act.

Another challenge for the NEA is the Federal Information Security Modernization Act of 2014 (FISMA) that requires each
federal agency to develop, document, and implement an agency-wide information security program to provide
information security over the operations and assets of the agency.*? Through annual reviews of the NEA's compliance
with FISMA, the OIG continuously identifies ways for the Agency to enhance security, and the Agency continually makes
progress each year in complying with increasing information system security requirements. The coronavirus pandemic
requirement to telework has made it much more challenging for the Agency to continue improving information security.
Information technology staff have shifted their focus on keeping the network secure and operational for all teleworking
staff and ensuring the awards management system is maintained in top condition to process the increased volume of
awards under the CARES Act.

Awardee Accountability

The Arts Endowment Grants and Program Management Offices face the challenge, along with the rest of the federal
community, to help awardees fully implement and comply with the requirements of 2 CFR Part 200.* These offices must
also help awardees comply with Agency General Terms and Conditions for grant awards. This challenge area also apply
to CARES Act funding awardees.

The OIG’s audits continue to identify awardees that have not complied with all applicable federal award requirements.
These awardees are typically identified through our risk-based annual audit planning, hotline allegations and complaints,
or referrals from the Agency's Grants Office. Based on audits of these awardees, below are the five most common
findings:

1. Failing to ensure that contractors and sub-award recipients have not been debarred or suspended from
receiving federal assistance prior to paying or awarding them federal funds.

2. No written policies and procedures for managing federal awards.

3. Not reporting accurate and allowable costs incurred on the Federal Financial Report.
4. Not maintaining supporting documentation for costs charged to Agency grants.
5

Not maintaining a Section 504 self-evaluation at the organization.

The OIG acknowledges and encourages the NEA’s continuous efforts to identify ways to improve awardee compliance
with federal requirements. Continued development and implementation of web-based tools and technical assistance
efforts by the Agency, along with the results of OIG audits will, in the OIG’s opinion, help to improve awardee
compliance. As grant making is the primary mission of the NEA, this area will continue to be an important challenge.

The OIG has received strong support from NEA management in identifying and tracking these top management
challenges, and looks forward to continuing to help the Agency deliver its mission with excellence and integrity.

For more information on the NEA
Office of Inspector General visit
https://www.arts.gov/oig.

3 Federal Information Security Modernization Act of 2014, Pub. L. No. 113-283 (2014).

4 2C.F.R Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2014).

National Endowment for the Arts 30
NATIONAL RECONNAISSANCE OFFICE

The key areas of concern for the National Reconnaissance Office (NRO) are related to reimbursements under
Section 3610 of the CARES Act and unclassified communications in the Intelligence Community.

Procurement Management
Key procurement management challenges include the NRO’s ability to properly assess contractor reimbursement under
Section 3610 of the CARES Act, properly fund mission requirements, and effectively manage and oversee contractor
performance. In addition, telework and unclassified communication capabilities pose unique challenges for Intelligence
Community agencies.

Proper Assessment for Reimbursement under Section 3610
Section 3610 does not compel reimbursements of paid costs but rather authorizes payment if the agency determines
that making such payments are in the best interest of the government. A contract population in excess of a thousand
and a reduced government workforce hinders NRO from conducting a proper assessment, while the current
circumstances increase the pressure to reimburse contractors for paid leave. As a result, NRO is using enterprise-wide
notices to industry to minimize individual contract actions, as opposed to conducting individual contract assessments
regarding the necessity of using Section 3610 reimbursements to keep contractors in a ready state to meet current and
future Agency needs.

Underfunded Mission Requirements
No organization received separate appropriations to reimburse government contractors for paid leave under
Section 3610. As a result, existing appropriations will be used to reimburse contractors for paid leave. This reduces
NRO’s available program budget for producing and delivering contracted requirements. If future appropriations do not
“back fill” the amounts expended to reimburse for COVID-19 leave, these expenditures will impact mission requirements
and the contractor’s ability to deliver, which could result in cost overruns, program delays, and reduction in mission
capabilities. If cost and schedule are not appropriately adjusted, contractors may minimize efforts in critical areas, such
as security and quality assurance.

Ability to Effectively Manage and Oversee Contractor Performance
The NRO has been operating with a reduced workforce and travel restrictions that limit on-site reviews of contractor
progress. In addition, limited time to implement new controls and procedures and to train contracting officials impacts
NRO’s ability to assess contract performance and properly review invoices and payments.

Financial Management
Key financial management challenges include the increased risk of improper payments. For reimbursements under
Section 3610, NRO requires contractors to submit a separate invoice with detailed spreadsheets containing key data
elements. This separate invoicing requirement will significantly increase the workload of the financial and contracting
workforce whose staffing has been significantly reduced due to the COVID-19 pandemic. Invoice rejection rates will
likely increase as contractors adjust to the new reporting process. The detailed spreadsheet supplementing the invoice
may not provide sufficient information on the contractor rate calculations to enable NRO to verify that fee and profit

National Reconnaissance Office ͵ͳ
were correctly excluded. The supplement to the invoice will require additional scrutiny; however, the increased
pressure to pay invoices timely coupled with the reduced workforce could negatively impact NRO’s ability to ensure
invoices are adequately reviewed and properly supported.

Fraud Detection across the Government

The Pandemic Response Accountability Committee is focused on preventing and detecting fraud, waste, abuse, and
mismanagement, as well as mitigating major risks that cut across program and agency boundaries for the funds provided
by the CARES Act and related emergency spending bills. While reimbursement under Section 3610 will be small in
comparison to other COVID-19 relief, the opportunity for some companies to “double dip” is significant if these funds
are not appropriately tracked across the government, to include the classified arena. The importance of implementing
robust, uniform data collection with unique and consistent identifiers for people, companies, and pay periods (using
CAGE Codes, employee numbers, pull down menus to minimize data variation, etc.) will be critical to identifying those
contractors attempting to obtain multiple credits or reimbursements for the same expenses.

Telework and Unclassified Communications

The Intelligence Community is facing new challenges in the wake of COVID-19 as portions of the cleared government and
contractor workforces remain at home. In addition to the obvious mission challenges caused by a reduced government
and contractor workforce, Intelligence Community organizations often lack the appropriate mechanisms to facilitate
communication with personnel who are no longer on-site and may lack access to government networks (classified and
unclassified). Further, the nature of work performed, contract terms, and information technology system often do not
provide telework options, which impacts Intelligence Community organizations’ ability to maximize the productivity of
its workforce.

For the portion of the workforce that is able to conduct unclassified work from home, there is a risk of inadvertent spills
of classified information or disclosures through an adversary’s ability to aggregate information as this workforce uses
computers with potentially weak passwords or poorly secured home Wi-Fi routers, cell phones, free social media
platforms, and other non-secure means of communication.

For more information on the NRO
Office of Inspector General visit
https://www.nro.gov/Offices/
Office-of-Inspector-General/.

National Reconnaissance Office 32
NATIONAL SCIENCE FOUNDATION

The CARES Act provided the National Science Foundation (NSF) with $75 million to support its ongoing grant response,
including funds for Rapid Response Research, to COVID-19 and $1 million to assist in the administration of those grants.
These funds are in addition to NSF’s portfolio of open awards, which currently totals more than $33 billion. Given the
extent of this funding, pandemic-related risks to the integrity of NSF funds must be assessed.

With respect to its CARES Act funding, NSF developed a plan for spending those funds using its existing processes and
funding mechanisms. The NSF OIG conducted a review of that plan and found it to be reasonable, prudent, and
consistent with the intent of CARES Act funding objectives.1

The pandemic also poses risks to the expenditure of NSF’s non-pandemic funding. The Foundation relies on the
recipient community to ensure award funds are spent in accordance with federal requirements. Many institutions
funded by NSF are facing financial challenges driven by the pandemic, including the need to refund portions of spring
2020 tuition; lower than anticipated tuition revenue in 2021; and declining support from state governments,
endowments, or other sources of funding. If those fiscal constraints lead to staff cuts in sponsored research offices or
offices responsible for identifying and managing scientists’ conflicts of interest and commitment, recipients’ ability to
ensure compliance with NSF award terms and conditions could be undermined, potentially putting NSF funds at risk.
Finally, in response to COVID-19, the Office of Management and Budget and NSF issued interim guidance to the award
recipient community for managing award funds during the pandemic, which broadened allowable activities for grant
funds. Accordingly, the OIG will adapt audit procedures to reflect the new guidance and update risk models to
incorporate newly identified risks. Additionally, this guidance impacts the submission, processing, and results of Single
Audits across the recipient community, which may impact how the OIG approaches work in this area.

The pandemic is also likely to have an effect on some of NSF’s preexisting management challenges, including:
x Managing major multi-user research facilities. COVID-19 has directly impacted the work conducted at
NSF-funded major multi-user research facilities, which include telescopes, ships, and observatories. NSF
currently supports the operation of many major multi-user research facilities and the construction of others.
In response to COVID-19, many existing facilities have been closed or forced to operate with minimal staff.
This has led to disruptions in data gathering and routine maintenance, and has forced the postponement or
canceling of planned scientific campaigns. The pandemic response has also disrupted the construction of new
facilities. Beyond undermining the science that was to be supported by these facilities, these effects have
financial consequences that NSF will have to address when it is possible to return to normal operations.
x Managing the Antarctic Infrastructure Modernization for Science (AIMS) project. NSF was in the early stages
of modernizing facilities at McMurdo Station, the largest research station it supports in Antarctica, when the
pandemic struck. As a result, NSF has had to slow planned construction activities for an undetermined period.
NSF will have to address the impact of this pause on the AIMS project’s schedule and cost when construction
can resume.
x Navigating threats posed by foreign government talent programs. Many institutions funded by NSF could be
affected by financial constraints driven by the pandemic. Recognizing the impact of such fiscal constraints on
university researchers, entities leading foreign government talent plans might increase their efforts to recruit
U.S. scientists to participate in their programs. In addition, staff cuts resulting from pandemic-driven fiscal

1 NSF OIG, Review of the National Science Foundation CARES Act Spending Plan (OIG 20-6-001, May 21, 2020).

National Science Foundation ͵͵
constraints could undermine institutions’ ability to identify and manage conflicts of interests, commitment,
and affiliation created by researchers’ involvement with foreign government talent programs. NSF will need
to consider these risks and how they might factor into its response to this existing management challenge.

The Foundation has already begun efforts to identify risk areas, develop mitigation strategies, and determine financial
impacts. The OIG is coordinating closely with NSF to ensure that its strategies for mitigating impacts are fully developed
and address the areas of greatest concern. The OIG will design the fiscal year 2021 audit work plan with enough
flexibility to address the evolving health, economic, and societal impacts of COVID-19 on NSF and its award recipients.

The OIG will also consider effects of COVID-19 when developing its report on management challenges for the
Foundation in fiscal year 2021.

For more information on the NSF
Office of Inspector General visit
https://www.nsf.gov/oig/.

National Science Foundation 34
NUCLEAR REGULATORY COMMISSION

The Nuclear Regulatory Commission (NRC) requested supplemental appropriations under the CARES Act to support
remote access, teleworking, and operational and security activities related to coronavirus prevention, preparation, and
response. These funds can be grouped into four categories: licenses, commodity information technology (IT), expanded
contractor support, and reengineering systems and work process. For licensing, additional funds were requested to
support increases in mobile and collaboration licensing as well as telecommunications services (e.g., increasing internet
bandwidth) resulting from expanded telework. NRC remote work technologies have been in place for a number of
years. The NRC pressure-tested remote capabilities with nearly all Agency staff teleworking the week before moving to
mandatory telework. Challenges during the testing helped the NRC ensure remote access during the ensuing mandatory
telework phase. In terms of commodity IT, additional funds were requested to provide IT commodities to optimize staff
productivity (e.g., audio headsets) and replacement parts (e.g., PIV card readers, laptop batteries) while employees work
remotely. For expanded contractor support, additional funds were requested to support increased operational and
security activities (e.g., patch management) due to expanded telework. Finally, in terms of reengineering systems and
work processes, additional funds were requested to modify solutions and processes to expand the use of and optimize
electronic solutions that replace in-person processes to conduct Agency work (e.g., electronic concurrence, automated
workflows).

While the NRC has taken steps to increase remote IT capabilities in response to COVID-19, the following areas should
continue to be monitored moving forward.

Patch Management in the Face of Increased Demand for Bandwidth
Shifting from on-site operations to mandatory telework dramatically increased demand for bandwidth, which increased
by 350 percent. The deployment of applications, patches, and updates using the existing on-premise configuration
management tools was very bandwidth intensive and competed with increased end-user use of collaboration tools
(e.g., voice, video, and Instant Messages). In mid-April 2020, the NRC transitioned to a cloud-based configuration
management solution so Agency-managed IT end-points would download applications, patches, and updates directly
from a cloud-based environment. The new cloud-based configuration management implementation architecture is
designed to provide timely and quality workstation release management support for end users and better utilization of
the NRC’s internet bandwidth. Continued monitoring of bandwidth needs is in place to help ensure availability and limit
operational mission risks moving forward.

Manual Processes Are Automated and Go Online to Support and Optimize
Remote Work
A challenge that emerged when the Agency shifted to mandatory telework was supporting a remote workforce handling
an increase in industry requests for regulatory exemptions. In early April, the Office of Nuclear Reactor Regulation came
to the Office of the Chief Information Officer with an urgent request to create an online mechanism to accept and
process exemption requests resulting from the impacts of COVID-19. The joint team developed an automated process
and online web form to streamline the submission and processing of exemption requests from nuclear power
generators in only 8 days. Shortly thereafter, the Office of Nuclear Material Safety and Safeguards worked with the
Office of the Chief Information Officer to develop an automated process and online web form for exemption requests
covering medical, industrial, and academic uses of nuclear materials; the storage and transportation of spent nuclear

Nuclear Regulatory Commission ͵ͷ
fuel; and the decommissioning of nuclear facilities and uranium recovery. Continued monitoring of the new
functionality is in place to monitor safety and security impacts in this most important mission area.

Future Challenges

Continued monitoring of issues related to IT to support Agency operations in a pandemic response environment is in
place to help detect issues earlier, respond with necessary actions, and proactively request additional resources and
initiate procurement processes.

For more information on the NRC
Office of Inspector General visit
https://www.nrc.gov/insp-
gen.html.

Nuclear Regulatory Commission 36
PEACE CORPS

In March 2020, the Peace Corps responded to the COVID-19 pandemic by suspending all Volunteer activities and
evacuating nearly 6,900 Volunteers from approximately 60 countries of service. In a matter of a few weeks, the
Agency brought all of its Volunteers back to the United States. Evacuating all of its Volunteers at the same time was
unprecedented and required the Agency to take extraordinary steps, including the chartering of international flights,
to complete the task. For the first time since its establishment in 1961, the Peace Corps is currently without a single
active Volunteer. The Agency currently faces the tremendous challenge of planning for the resumption of its overseas
Volunteer programs in the environment of uncertainty that the COVID-19 pandemic has created. The CARES Act
provided the Agency with $88 million of supplemental funding to prevent, prepare for, and respond to COVID-19 or a
similar pandemic. Importantly, the law also allows the Agency to use the supplemental funding to reimburse accounts
already used for costs related to COVID-19, such as costs associated with transporting all Volunteers back to the United
States during the evacuation process in March.

Because the Peace Corps OIG has not yet formally reviewed or audited the Agency’s response to the COVID-19 pandemic
and its related expenditures, the OIG can not specify in this document any particular concern, risk, or finding related to
the Peace Corps’ use of CARES Act monies. However, in 2019 the OIG identified management challenges that are likely
to be relevant to how the Agency plans to spend the CARES Act funding and how it intends to handle its pandemic-
related responsibilities and the return of Volunteer operations. Below summarizes these challenges and risks.

Planning and Implementation
The Peace Corps’ plans to resume its overseas programs, and operations will need to be informed by how the pandemic
has affected each of the Peace Corps countries and an assessment of the impact of COVID-19 on communities where
Volunteers may serve. The Agency’s reentry plans will need to be informed by an understanding of the wide-ranging
response to COVID-19 of governments and peoples, as well as the economic, health, safety, and social infrastructure in
each country it plans to reenter. Planning for the reentry of Volunteers based on a country-by-country assessment may
prove to be a larger challenge than the global evacuation. As the OIG has reported, the Peace Corps struggles to plan for
the long-term impacts of risk and capital needs of the entire organization. Specifically, the OIG has highlighted areas of
concern where the Agency did not apply sufficient time and resources to document decisions, ensure the appropriate
resources are assigned, and review lessons learned. The lack of an enterprise risk management (ERM) program hampers
the Agency’s ability to successfully plan and implement new programs or initiatives. A comprehensive ERM program
would identify risks and their potential outcomes, initiate mitigating strategies, ensure appropriate people are involved
throughout the planning and implementation process, and pinpoint the most impactful areas in which to invest
resources. Overall, it would help the Agency to ensure that decisions made align with or ultimately benefit the Peace
Corps’ overall mission and priorities.

Volunteer Health and Safety
The health and safety of its Volunteers are the Agency’s top priorities. As the Agency prepares to restart its overseas
programs it will face new challenges, as well as some of the same challenges related to Volunteer health and safety that
the OIG has identified through evaluations and audits of those programs. The Peace Corps will need to assess the health
care staffing, resources, and facilities in each country where Volunteers are to be placed and review the sufficiency of its
medical action plans for responding to Volunteer health emergencies. Given the expected impact of the pandemic on
health care infrastructure, these core tasks will take on greater importance. In addition, the OIG has identified in its

Peace Corps ͵͹
evaluations of overseas programs that the Agency frequently struggled to place Volunteers in sites that met all of its
standards for health and safety. These challenges have been due to a range of factors, such as insufficient oversight and
coordination of staff’s site development activities, lack of proper documentation of staff’s selection and approval of
Volunteer housing, or vague and unclear criteria related to a site’s health or safety criteria. Therefore, the Agency’s
planning efforts related to the return to service of thousands of Volunteers will need to encompass a review and
consideration of the sufficiency—in light of what the Agency continues to learn about the risks associated with COVID-19
and how to mitigate them—of the health and safety criteria for each Volunteer site in each country of service. To then
implement and document adequate site identification and approval processes based on these criteria, prior to the
arrival of Volunteers, represents another significant challenge facing the Peace Corps in the months and years ahead.

Compliance

While the Peace Corps has shaped its core values around Volunteer well-being, commitment to national service, and
other areas related to quality programming, diversity, and innovation, the Agency has not prioritized compliance with
federal laws, regulations, and other requirements. Compliance is essential to the proper management of CARES Act
supplemental funding and to effective operations. The Agency lacks a system that ensures policies and procedures align
with federal and other requirements. Specifically, in auditing the Agency’s compliance with the Improper Payments
Elimination and Recovery Act of 2010, the OIG found that the Agency does not have a system to track or analyze
payment errors.’ This prevents the Agency from being able to improve their operations and prevent these errors from
happening again. Additionally, while the Agency had established procedures to validate credit card payments, these
monitoring activities were not being conducted.

Information Technology Security Management

An effective information technology (IT) security program helps protect Agency data from being misused by both
internal and external actors and minimizes the risk of threats to sensitive data. Given that during the COVID-19
emergency, core Agency business both domestic and overseas, will be done remotely, IT security is a key pillar to
effective operations. The Peace Corps continues to lack an effective information security program and has made
minimal improvement over the last 10 years. Foundational IT elements, such as having clearly defined boundaries and
a complete listing of hardware, are missing. Weaknesses across all the Federal Information Security Modernization Act
reportable areas exist because the Agency has taken a predominately passive approach to compliance and has not
integrated information security into business operations.”

For more information on the
Peace Corps Office of Inspector
General visit
https://www.peacecorps.gov/
about/inspector-general/.

1 Improper Payments Elimination and Recovery Act of 2010, Pub. L. No. 111-204 (2010).
2 Federal Information Security Modernization Act of 2014, Pub. L. No. 113-283 (2014).

Peace Corps 38
RAILROAD RETIREMENT BOARD

The Railroad Retirement Board (RRB) is an independent agency in the executive branch of the federal government.
The RRB’s primary function is to administer comprehensive retirement-survivor and unemployment-sickness benefit
programs for the nation’s railroad workers and their families, under the Railroad Retirement Act and the Railroad
Unemployment Insurance Act (RUIA).1 In fiscal year 2019, the RRB paid net unemployment-sickness benefits of
$88 million to approximately 23,000 claimants.

The CARES Act was signed into law on March 27, 2020. Under CARES Act provisions, railroad workers with less than
10 years of service may be eligible for up to 65 days of extended benefits within 7 consecutive 2-week registration
periods. Railroad workers with 10 or more years of railroad service, who were previously eligible for up to 65 days in
extended benefits, may now receive benefits for up to 130 days within 13 consecutive 2-week registration periods.
The CARES Act provided the following funds for the RRB:
x $425 million for extended unemployment benefits.
x Approximately $140 million of previous Recovery Act funds remains available for CARES Act utilization as
permitted by Section 2114.2
x $50 million to cover the cost of eliminating the required waiting period for unemployment benefits.
x $5 million to prepare for, and respond to the coronavirus, including the purchase of information technology (IT)
equipment to improve the mobility of the workforce, and provide for additional hiring or overtime hours as
needed to administer the RUIA.

The RRB OIG has identified the top challenges the Agency faces in handling pandemic-related responsibilities and
emergency funds.

Modifying Information Technology Systems While Completing System
Modernization
The RRB was already in the process of modernizing antiquated systems prior to CARES Act legislation. CARES Act
provisions will require the RRB to modify its systems to issue extended unemployment benefits and remove the waiting
period. However, prioritizing system updates to pay CARES Act benefits delays Agency plans to move its server-based
and mainframe-based systems to the cloud; upgrade the RRB’s mainframe to the cloud and the RRB’s access points to
the Azure stack; upgrade to Windows 10 modernization; and address improvements resulting from the RRB’s fiscal year
2019 Federal Information Security Modernization Act (FISMA) rating of Ad Hoc and ineffective information security
policy and procedures.3
This also presents resource constraints for Agency IT staff to address concurrent project and reviews—such as
modernization of antiquated Agency systems, reprogramming antiquated agency systems to issue extended
unemployment benefits in accordance with CARES Act provisions, and making resources available to respond to the
mandated FISMA audit—and to Agency claims examiners to process an increased volume of unemployment benefit
claims. Further IT challenges include rehiring programmers proficient in existing computer languages to meet CARES Act

1
The Railroad Retirement Act is codified at 45 U.S.C. Sections 231-231v and RUIA is codified at 45 U.S.C. Sections 351-369 and 401-404.
2
American Recovery and Reinvestment Act (2009), Pub. L. No. 111-5 (2009).
3 Federal Information Security Modernization Act of 2014, Pub. L. No. 113-283 (2014).

Railroad Retirement Board ͵ͻ
requirements and receiving IT actions under the direction of a Chief Information Officer who has only been in place for
approximately 8 months and may have less knowledge of historic RRB IT systems.

Additional Responsibilities for Payment Accuracy and Transparency

Additional reporting requirements have been put in place to help ensure transparent reporting on the USASpending.gov
website for payments authorized by the CARES Act. The RRB must improve transparency by publishing accurate data,
which has been a challenge for the Agency as reported in the OIG’s prior audits on the Digital Accountability and
Transparency Act, improper payments, and acquisition management.*

There is an urgent need for the RRB to revise existing policies and procedures to address extended unemployment
benefits for railroad workers with regard to CARES Act provisions. Time constraints could result in errors in revised
policies and procedures. If this is not addressed in a timely manner, issuance of extended unemployment benefits under
the CARES Act could be delayed. In addition, payment errors could result from pressure to process unemployment
claims prior to the end of the RUIA benefit year on June 30, 2020.

Internal Controls and Improper Payments

The OIG has previously raised numerous concerns regarding the RRB’s internal controls concerning the stewardship of
benefit payments. Increased RRB unemployment payments, both in amount and quantity, heightens the risk for
improper payments stemming from fraudulent activities. Given this increased risk, the RRB must work to ensure robust
prepayment internal controls to prevent improper payments.

For more information on the RRB
Office of Inspector General visit
https: //www.rrb.gov/OurAgenc
InspectorGeneral.

RRB OIG, Audit of Railroad Retirement Board’s Digital Accountability and Transparency Act of 2014 Submission for First Quarter of Fiscal Year
2019 (20-01, November 6, 2019); Audit of Railroad Retirement Board’s Compliance with Improper Payments Elimination and Recovery Act in the
Fiscal Year 2018 Performance and Accountability Report (19-09, May 30, 2019); and The Acquisition Management Function at the Railroad
Retirement Board was not Fully Adequate or Effective (19-14, September 27, 2019).

Railroad Retirement Board 40
SMALL BUSINESS ADMINISTRATION

The Small Business Administration (SBA) has a significant role in the country’s economic recovery as specified in the
various legislation passed by Congress and signed into law by the President. Below is a summary of the top challenges
facing SBA as it carries out the various mandates.

Paycheck Protection Program

The President signed the CARES Act into law on March 27, 2020, to provide economic relief to our nation's small
businesses. One of the CARES Act’s largest provisions created the Paycheck Protection Program (PPP) under section 7(a)
of the Small Business Act.’ This program provided $349 billion in fully guaranteed SBA loans, which can be forgiven if
used properly, for small businesses to cover payroll, rent, utility payments, and other limited uses. Another significant
provision provides $17 billion for SBA to pay 6 months of principal, interest, and any associated fees for existing 7(a),
504, and 7(m) loans. On April 24, 2020, the President signed the Paycheck Protection Program and Health Care
Enhancement Act to provide an additional $310 billion to the PPP, for a total of $659 billion.

Increased guaranties from SBA reduces the risk to lenders, who, as a result, may not exercise due diligence in originating
loans, thereby increasing the risk of potential financial losses to SBA. In addition, increased loan volume, loan amounts,
and expedited loan processing timeframes may make it more difficult for SBA to identify red flags in loan applications.
Without sufficient controls in place, SBA programs suffer increased vulnerability to fraud and unnecessary losses when
SBA and its lending partners expedite loan transactions to provide quick relief.

Top Challenges

To ensure program integrity, the timeliness of loans to eligible small businesses, and to mitigate the risk of financial loss
SBA should:

e Issue clear requirements and ensure timely communication to lending partners.
e Establish and monitor specific outcome-oriented performance measures.

e Ensure public communication from SBA officials is appropriate and consistent with the established
requirements.

e Establish proper controls in the loan approval phase to ensure eligibility of participants and to mitigate the risk
of loan default.

e Establish a quality assurance plan to prevent and detect improper payments.
e Oversee the program to ensure it is implemented as intended and that program goals and objectives are met.

e Modify existing loan systems to track stimulus program data to support accurate program measurement and
reporting.

Economic Injury Disaster Loans

The Coronavirus Preparedness and Response Supplemental Appropriations Act was signed into law March 6, 2020,
and deemed the COVID-19 pandemic a disaster. The disaster declaration made economic injury from the COVID-19

1 Small Business Act, Pub. L. No. 85-536 (1958), as amended.

Small Business Administration 41
pandemic an eligible Economic Injury Disaster Loan (EIDL) expense. The CARES Act provided an additional $10 billion to
SBA to provide Emergency EIDLs (COVID-19 EIDLs). EIDLs and COVID-19 EIDLs for up to $2 million are to help small
businesses, small agricultural cooperatives, and most nonprofit organizations recover from substantial economic injury.
The CARES Act also expands access to EIDLs under Section 7(b)(2) of the Small Business Act to include sole proprietors,
independent contractors, and employee stock ownership plans. In addition, the Paycheck Protection Program and
Health Care Enhancement Act provided $50 billion for EIDLs, $10 billion for Economic Injury Disaster grants, and
expanded eligibility for farmers.

SBA’s disaster loan programs suffer increased vulnerability to fraud and unnecessary losses when loan transactions are
expedited to provide quick relief and sufficient controls are not in place. The expected increase in loan volume and
amounts, and expedited processing timeframes will place additional stress on existing controls.

Top Challenges

To ensure program integrity and mitigate the risk of financial loss, SBA should:
e Ensure loans are timely provided to eligible applicants.
e Ensure borrowers meet all eligibility requirements.

e Ensure it has experienced and/or well-trained personnel to provide appropriate assistance and handle the
increased loan volume and expedited processing timeframes.

e Appropriately staff call centers to include addressing language needs of its customers.

Entrepreneurial Development Programs

One of the CARES Act’s provisions provided $265 million for entrepreneurial development programs, which resulted in
$192 million to Small Business Development Centers (SBDC) and $48 million to Women’s Business Centers (WBC), to
offer counseling, training, and related assistance to small businesses affected by COVID-19. The CARES Act also provided
$25 million to resource partner associations to establish a single centralized hub for information related to COVID-19,
including a training program to educate resource partner counselors and mentors on the COVID-19 information available
to effectively assist affected small businesses.”

SBA’s entrepreneurial development programs provide technical and counseling assistance to small businesses through
cooperative agreements awarded annually to its nationwide network of resource partners, including SBDCs and WBCs.
In addition to the CARES Act funding, in fiscal year 2020, Congress had already appropriated $149.5 million in funding for
SBDC and WBC entrepreneurial development programs.

Top Challenges

To ensure integrity in entrepreneurial development programs and mitigate greater risk associated with CARES Act
spending, SBA should:

e Establish clear oversight requirements in the notice of awards and ensure program officials and grant recipients
implement increased internal controls timely.

e Establish outcome-oriented performance measures specific to entrepreneurial development COVID-19
priorities.

e Track program data to adequately monitor and validate the performance of COVID-19 grant assistance.

2 SBA collaborates with resource partner associations for many of its entrepreneurial development initiatives. The America’s SBDC and the
Association of WBC support the nationwide networks of SBDCs and WBCs, respectively. These nonprofit organizations promote, inform,
support, continuously improve, and represent the interest of their members.

Small Business Administration 42
e Provide appropriate training to all grant officers and program personnel responsible for monitoring grant
recipients’ response to COVID-19.

e Establish a methodology to ensure funds are appropriately allocated to resource partners.

e Establish a quality assurance plan to prevent and detect improper payments.

Information Technology Controls and Security

SBA OIG prior audits and evaluations of SBA’s systems and networks indicated the Agency has expended significant
effort to formalize and document policies, procedures, and strategies in the area of information technology (IT) controls
and security. However, SBA has experienced serious IT challenges implementing the programs associated with
COVID-19 funding. The unprecedented exponential increase in participation across SBA’s lending programs has
expanded the potential risk of security breaches and misuse of Personally Identifiable Information, as well as stressed its
IT systems capacity.

To ensure program integrity and mitigate the risk of IT system failures and security breaches, SBA should:

e Deploy appropriate security protocols to minimize the risk of data breaches or misuse of Personally Identifiable
Information.

e Develop and maintain effective risk management, contingency planning, and incident response practices to
minimize vulnerabilities.

For more information on the SBA
Office of Inspector General visit
https: //www.sba.gov/about-
sba/oversight-advocacy/office-

inspector-general.

Small Business Administration 43
SOCIAL SECURITY ADMINISTRATION

Under the CARES Act, the Social Security Administration (SSA) received a supplemental appropriation of $38 million to
remain available through September 30, 2021, to carry out the economic impact payments. The CARES Act specifically
required that the Commissioner of SSA coordinate with the Secretary of the Treasury on a public awareness campaign
to provide information regarding the availability of the payments. The SSA OIG understands that the required
coordination between SSA and the Secretary of the Treasury for the public awareness campaign regarding these
payments has largely occurred. Additionally, SSA has provided the Internal Revenue Service with information regarding
Social Security beneficiaries and Supplemental Security Income recipients for their issuance of the economic impact
payments. Therefore, at this time it appears SSA, for the most part, has accomplished its role in the process of the
economic impact payments; however, the OIG is reviewing SSA’s role in this process and will take appropriation action if
any issues are identified.

SSA also received a supplemental appropriation of $300 million under the CARES Act to remain available through
September 30, 2021, to prevent, prepare for, and respond to the COVID-19 pandemic, domestically or internationally,
including paying the salaries and benefits of all employees affected as a result of office closures, telework, phone and
communication services for employees, overtime costs, and supplies, and for resources necessary for processing
disability and retirement workloads and backlogs. At this time, the OIG does not foresee any unique COVID-19 response
challenges related to the Agency’s use of CARES Act funding apart from Agency challenges previously identified, such as
the need to improve service delivery, modernize information technology, and improve administration of the disability
programs. The OIG understands that SSA is still determining its plans for utilizing the CARES Act funding, and will
therefore continue to monitor the outcome of SSA’s planning and take appropriate action to the extent new workloads
are identified.

For more information on the SSA
Office of Inspector General visit
https://oig.ssa.gov/.

Social Security Administration ͶͶ
U.S. AGENCY FOR INTERNATIONAL
DEVELOPMENT

As the U.S. government’s international development lead, the U.S. Agency for International Development (USAID)
received access to almost $2 billion for international COVID-19-related programs and operations as of May 2020.
USAID’s response strategy is multifaceted and aims to protect the safety and health security of its global workforce,
ensure continuation of its mission across the world, and support partner countries in their COVID-19 response. In
implementing these response efforts, USAID faces several significant anticipated challenges that the OIG has organized
into four categories that align with the fiscal year 2020 top management challenges statement for the Agency.

Managing Risks to Humanitarian Assistance amid a Public Health
Emergency
Recognizing the potential humanitarian impacts of the pandemic, USAID’s Administrator issued a global disaster
declaration to permit the use of humanitarian assistance for COVID-19 relief. The Agency plans to prioritize these funds
for its ongoing humanitarian assistance programs, which will be adapted for the pandemic, as well as for programs in
fragile settings that the pandemic could tip into a full-blown crisis. OIG audits and investigations have identified
significant risks that USAID encounters in crisis environments. The COVID-19 pandemic may exacerbate these risks and
keep aid from reaching beneficiaries as intended. For example:
x Assessing and responding to conditions. USAID needs access to reliable information to make timely, well-
considered decisions to prioritize, adapt, and contextualize its humanitarian assistance programs and choose
appropriate interventions. Obtaining such information is a challenge when traditional information sources face
travel and visibility restrictions.
x Fraud and diversion risks. USAID emergency food, health, shelter, and livelihood assistance for those in most
acute need has been subject to diversions, product substitution, and other malicious schemes. Practices and
procedures to ensure appropriate aid reaches intended beneficiaries is a challenge that may grow as global
demand for life-saving goods and services creates new incentives for bad actors.

Maintaining Responsibilities for Planning, Monitoring, and Sustaining
Development
USAID’s international development programs aim to help countries become self-reliant while advancing U.S. national
security and economic prosperity. Careful planning and monitoring are essential to sustaining development outcomes
and achieving USAID’s goal of ending the need for foreign assistance. The COVID-19 pandemic changes the landscape
for USAID’s ongoing and planned programming, creating new challenges to achieve and sustain development outcomes,
hold implementers accountable for results, and make effective and efficient use of taxpayer funds. For example:
x Strategy and planning. Pandemic health, demographic, social, and economic effects on recipient countries may
affect the suitability of USAID’s plans—from corporate-level strategies to award-specific critical assumptions.
Revisiting and quickly updating and adapting these plans, some of which have been years in the making, may
present a challenge especially where assistance strategies no longer fit the COVID-19 context.
x Implementation, monitoring, and evaluation. USAID will need to account for the impact of the pandemic on
implementer staff and the ability to carry out projects, programs, and activities as initially designed. Changes to
work plans and other critical award files must be appropriately documented to hold implementers accountable,

U.S. Agency for International Development Ͷͷ
an ongoing challenge for USAID. As it does, the Agency must also develop and validate new methods for
program monitoring and evaluation, since some traditional approaches like site visits are not feasible at
this time.

e Supply chains. Global supply chains play a central role in the COVID-19 response as well as in ongoing programs
for HIV/AIDS, malaria, and other diseases. Risks that the Agency is working to correct—including warehouse
leakage and black-market sales—may increase if host governments and USAID’s local partners struggle to cope
with the outbreak and face difficulty maintaining inventory controls.

Maximizing Stakeholder Coordination for a Global COVID-19 Response

The global reach of the COVID-19 pandemic, with lives at stake and resources limited both at home and abroad, requires
unprecedented coordination between a broad range of stakeholders worldwide. Balancing the complementary yet
distinct missions of U.S. government agencies and other stakeholders is a challenge for USAID that is likely to translate
to the global COVID-19 response and recovery effort, particularly when roles and responsibilities are not clearly defined
and the ability to act is beyond USAID’s immediate control. For example:

e Interagency coordination. In responding to the pandemic, USAID must ensure that its efforts are well
coordinated with those of other federal actors and that it has the top-line guidance that it needs to move
forward. Clarity around agency roles and responsibilities and alignment of effort across agency lines, items that
have been problematic in past responses, need to be clearly established if USAID’s response efforts are to be
efficient and effective.

e External engagement. U.S. government response and recovery efforts play out alongside those of other
national governments, public international organizations, and the private sector. Ensuring effective
coordination of efforts across donors, leveraging the work of international organizations, and tapping private
sector resources and expertise is critical in the face of aims to promote burden sharing while projecting
U.S. leadership.

Addressing Vulnerabilities and Implementing Needed Controls in Core
Agency Management Functions

USAID’s ability to carry out its mission and safeguard federal funds depends on the integrity and reliability of its core
business practices and systems. The COVID-19 pandemic adds strain to the Agency’s award, financial, and personnel
management, and information technology systems and security. In delivering on the imperative for swift action in
response to the pandemic, USAID must also meet taxpayer expectations that its efforts are managed through effective
systems and subject to prudent controls. For example:

e Institutional capacity. USAID operations have been strained and disrupted, while staff have been enlisted
to perform new functions against the backdrop of an ongoing organizational transformation. Ensuring that
critical functions are backed by staff with clearly delineated responsibilities and authorities and that these
personnel have requisite training, bandwidth, and supervision to execute on them effectively may be a
significant challenge.

e Grant and contract management. To provide for a timely response on the needed scale, USAID must act quickly
to adjust some existing awards and implement new ones. Award processes that may have lacked rigor under
normal conditions will have to be shored up while being stretched to meet new demands. Ensuring that
programming and funding decisions and award management activities meet government acquisition standards
will be integral to success.

For more information on the
USAID Office of Inspector General

visit https://oig.usaid.gov/.

U.S. Agency for International Development 46
U.S. DEPARTMENT OF AGRICULTURE

The OIG provides oversight to U.S. Department of Agriculture (USDA) programs and operations to help ensure that USDA
is able to provide the best possible service to the public and American agriculture. The OIG focuses its efforts to
advance the value, safety and security, and integrity of USDA programs. In providing such oversight, the OIG makes
recommendations to address agency programs and core management functions that may be vulnerable to waste, fraud,
abuse, and mismanagement.

Annually, the OIG issues a report on the top management challenges facing USDA based on completed OIG work.

The most recent of these reports, issued in September 2019 prior to the widespread appearance of COVID-19 in the
United States, lists seven challenges that have broad application to USDA programs.’ Since the issuance of this report,
Congress has provided over $35.8 billion to USDA for pandemic relief activities. The OIG plans to provide appropriate
audit and investigative oversight for these funds.2 As a proactive measure, this document frames the seven
management challenges previously reported in the context of current and future USDA pandemic response activities,
with a focus on preventing potential waste, fraud, abuse, and mismanagement. The OIG looks forward to working with
the Department and its agencies to further address these challenges.

USDA Needs to Improve Accountability and Oversight of Its Programs

As one of the federal government’s largest departments, USDA faces the challenge of managing a wide range of
programs. To implement relief efforts, USDA plans to use a combination of new and existing programs to distribute
COVID-19 funding and must ensure proper oversight of the programs. USDA’s publicly reported data on COVID-19 funds
will be based, in part, on the Digital Accountability and Transparency Act of 2014 (DATA Act) reporting model.’ In
November 2019, the OIG reported that USDA’s DATA Act submission was not complete and contained records that were
not accurate, timely, or of good quality. USDA should closely monitor the implementation of COVID-19 funding and
programs to comply with the DATA Act.

Information Technology Needs Continuous Improvement

Like other Departments, USDA faces threats to its information technology (IT) security from adversarial nations, hostile
non-state actors, and criminals seeking to exploit vulnerabilities. As federal agencies rely more on data stored using IT,
the risk of a security breach increases. USDA will need to ensure that the IT systems the Department uses to distribute
the COVID-19 relief funds are adequately secured.

1 USDA OIG, USDA Management Challenges (September 2019).

2 USDA OIG, OIG Plan—Oversight of COVID19 Funding (April 2020, which is available at https://www.usda.gov/oig/webdocs/OIG_COVID19
OversightPlan.pdf (last accessed May 22, 2020).

3 Digital Accountability and Transparency Act of 2014, Pub. L. No. 113-101 (2014).
4 USDA OIG, USDA’s Fiscal Year 2019, First Quarter DATA Act Submission (11601-0001-12, November 2019).

U.S. Department of Agriculture 47
USDA Needs to Strengthen Program Performance and Performance
Measures

Designing, developing, and implementing programs that reliably achieve their intended results has been a recurring
challenge for the Department. The OIG has found that USDA agencies do not have adequate reviews or controls in place
to supply the metrics necessary to evaluate program performance. As USDA implements its pandemic-related
responsibilities, the Department should concentrate its efforts to ensure programs operate as designed and provide
impactful outcomes.

USDA Needs to Strengthen Controls over Improper Payments and
Financial Management

USDA continues to be noncompliant with federal requirements for improper payments, particularly with respect to
several high-risk programs (as designated by the Office of Management and Budget) that have received COVID-19 funds.
Also, the Department needs to address internal control deficiencies to resolve ongoing problems with financial
management and reporting. As the Department implements its pandemic-related responsibilities, USDA should focus its
efforts to minimize improper payments.

USDA Needs to Improve Outreach Efforts

The Secretary of Agriculture has stressed the importance of civil rights and equitable treatment in the Department’s
outreach efforts. Now more than ever, in a time of heightened sensitivity and cultural awareness of discrimination and
sexual misconduct, USDA needs to make efforts to reach out to—and ensure equal treatment of—minorities, women,
and veterans as well as new and beginning farmers and ranchers. Due to a history of public attention concerning how
USDA has treated members of socially-disadvantaged groups—including both USDA employees and program
recipients—the Department faces challenges in earning those groups’ trust. As USDA implements relief efforts related
to the pandemic, it should ensure assistance is provided to all of those in need, including socially-disadvantaged groups,
to further build trust with those groups.

Food Safety Inspections Need Improved Controls

The Food Safety and Inspection Service (FSIS) is responsible for protecting the public health by ensuring the safety of the
nation’s commercial supply of meat, poultry, and processed egg products. FSIS is tasked with reducing contamination
and limiting illnesses through the regulation of agricultural food products. The OIG has found that the agency continues
to face challenges, including gathering reliable data to help ensure safety verification tasks are completed, effective, and
consistent. The agency should compile reliable data to verify the protection and safety of products inspected by FSIS.
This challenge continues as USDA and FSIS respond to the reported impact of the pandemic on FSIS inspectors,
employees at meat and poultry slaughter and processing plants, and the food production supply chain.

Food and Nutrition Service Needs to Strengthen Supplemental Nutrition
Assistance Program Management Controls

Although the Food and Nutrition Service has endeavored to improve management controls for the Supplemental
Nutrition Assistance Program (SNAP), weaknesses continue to exist in controls over benefit distribution and quality
control processes. The potential exists for taxpayer-funded assistance not to be delivered or used as intended. This

U.S. Department of Agriculture 48
challenge is heightened by the large increase in funding provided to SNAP, as well as other USDA nutrition programs,
through COVID-19 funding. Given that USDA relies on states to implement and deliver these programs, the Department
needs to provide effective oversight to the states to ensure that funding is used as intended.

For more information on the USDA
Office of Inspector General visit
https://www.usda.gov/oig/.

U.S. Department of Agriculture Ͷͻ
U.S. DEPARTMENT OF COMMERCE

The CARES Act was signed into law on March 27, 2020, to respond to the COVID-19 outbreak and its impact on the
economy, public health, state and local governments, individuals, and businesses. This law contains several provisions
related to the U.S. Department of Commerce, including appropriations to the following Departmental bureaus:

Funds Available for Use
Until

Department of Commerce Bureaus Receiving CARES Act Funding Funding Amount

Economic Development Administration (EDA)

Economic Assistance Development Programs | $1,500,000,000? | September 30, 2022
National Oceanic and Atmospheric Administration (NOAA)
National Marine Fisheries Service 300,000,000
: vss September 30, 2021
Operations, Research, and Facilities 20,000,000
National Institute of Standards and Technology (NIST)
Industrial Technology Services 60,000,000‘
September 30, 2021
Scientific and Technical Research and Services 6,000,000
Minority Business Development Administration (MBDA)
Minority Business Centers (Technical Assistance to Small Business Concerns) 10,000,000 | September 30, 2021
Minority Business Centers (Grants) 10,000,000 | (no-year funds)

Source: Department of Commerce OIG.

2 Includes $3 million to the Department of Commerce OIG.
> Includes up to $6 million for administration and oversight.

© Includes $50 million for the Hollings Manufacturing Extension Partnership and $10 million for the National Network for Manufacturing
Innovation.

Responding to the CARES Act is certainly among the Department’s highest priorities during this international emergency.
The OIG acknowledges the inherent challenges in overseeing unprecedented funding amounts that require highly
expedited distribution timeframes. A continuing challenge for the federal government generally, and the Department
specifically, is spending taxpayer dollars wisely and protecting them from waste and abuse. The volume of CARES Act
funds—and the need to provide assistance quickly while implementing sound controls—puts these funds at a higher risk
for fraud, waste, and abuse. All federal agencies are responsible for implementing management practices, through the
establishment of internal controls that identify, assess, respond, and report on risks.? Additionally, a significant increase
in spending and related activities increases demands on the workforce, oversight processes, business practices, and
financial management systems.

As the OIG emphasized following the passage of the American Recovery and Reinvestment Act of 2009, the Department
must ensure that program oversight over the use of the stimulus funding is sufficiently designed and executed—and
benefit outlays are accurately tracked and reported.” Without this critical oversight and transparency, the Department
and its bureaus cannot be certain that its management of the billions of dollars in supplemental program funding has
achieved the desired outcome and sufficiently met the requirements of the CARES Act.

1 Office of Management and Budget Circular No. A-123, Management’s Responsibility for Enterprise Risk Management and Internal Control
(July 15, 2016).

2 American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5 (2009). Commerce OIG, Commerce Has Implemented Operations to
Promote Accurate Recipient Reporting, but Improvements Are Needed (ARR-19847, October 30, 2009).

U.S. Department of Commerce 50
A great sense of urgency has arisen in response to the COVID-19 outbreak. However, as its past work responding to
stimulus and recovery programs has done, the OIG advises that—in the rush to disseminate stimulus funding—the
Department provide necessary, additional guidance to direct spending more effectively and to track and report more
meaningful results.?

For this summary, the OIG leveraged key insights from its long-standing body of work to bolster the Department’s
oversight of CARES Act grantees and contractors. The OIG has published several audit reports identifying areas for
improvement and fraud prevention within the Department’s grant and contract programs. Based on these reports,
the OIG identified five challenges or initial areas of concern that the Department should consider as it implements
the provisions included in the CARES Act, which are discussed below.

Addressing Ongoing Disaster Relief Fund Oversight Challenges Facing
the Economic Development Administration and National Oceanic
and Atmospheric Administration National Marine Fisheries Service

The Bipartisan Budget Act of 2018 designated $600 million in disaster relief funds to the Economic Development
Administration (EDA) in the wake of 16 separate billion-dollar weather-related disaster events, including severe weather,
hurricanes, flooding, and wildfires.* The Act provided disaster relief funds for recipients’ expenses related to flood
mitigation, disaster relief, long-term recovery, and restoration of infrastructure. The OIG has reported on the various
management challenges this post-disaster recovery environment presents for EDA. Such challenges include awarding
funds to recipients that might not be familiar with federal requirements or that do not have prior experience
administering federal funds. The significant increase in funding that EDA is responsible for under the Act and the need
to ensure that these funds are distributed in a prompt, fair manner and for authorized purposes will place increased
demands on EDA’s workforce, oversight processes, business practices, and financial management systems.

OIG grant audit work on National Oceanic and Atmospheric Administration National Marine Fisheries Service awardees
has consistently found related issues for funds disbursed to address environmental concerns, including man-made
disasters. In prior audits, the OIG found instances where Commissions claimed costs that were either unallowable, not
allocable, or unsupported.°®

Developing and Maintaining a Competent Acquisition and Grants
Workforce to Support the Implementation and Oversight of CARES Act
Funds

With the significant increase in spending and related activities comes a corresponding increase in the number of staff
that agencies may need to work effectively. Since 2011, the OIG has reported that the Department continues to face
challenges regarding its workforce. For example, in the most recent top management and performance challenges
report, the OIG advised that the Department continues to face workforce challenges such as its inability to (1) attract
and retain experienced professionals to work in locations outside the Washington, D.C., metropolitan area; (2) fill vacant

Commerce OIG, Commerce Experience with Past Relief and Recovery Initiatives Provides Best Practices and Lessons Learned on How to Balance
Expediency with Accountability (ARR-19692, May 8, 2009).

4 Bipartisan Budget Act of 2018, Pub. L. No. 115-123 (2018).

Commerce OIG, Bipartisan Budget Act of 2018: Oversight Challenges Facing the Economic Development Administration (OIG-18-022,
June 4, 2018).

& Commerce OIG, Supplemental Memorandum on Report No. OIG-19-021-A, Audit of NOAA Financial Assistance Awards to the Gulf States Marine
Fisheries Commission (OlG-20-007-A, November 12, 2019); Audit of NOAA Pacific Coastal Salmon Recovery Fund Grants to the Washington State
Recreation and Conservation Office (December 20, 2018, OIG-19-006-A); and Audit of NOAA Pacific Coastal Salmon Recovery Fund Grants to the
Northwest Indian Fisheries Commission (OIG-18-026-A, September 24, 2018).

U.S. Department of Commerce 51
positions timely; (3) compete against the private sector for talent; and (4) hire due to budget cuts, a legislative hiring
cap, and limited career development and advancement opportunities.”

While the Department has continued its efforts to address this issue, agencies need to ensure that they have the ability
to provide oversight with limited time and staff. This is especially crucial for EDA, where a significant level of oversight is
needed to administer, manage, and monitor both CARES Act funding and disaster relief funding. The OIG reported that
(1) EDA had not developed and implemented a comprehensive workforce plan to meet current and future staffing needs
and (2) EDA’s recruitment efforts were significantly behind established milestones set to ensure adequate staffing to
handle the increased workload.®

Improving Processes to Award and Monitor Contracts and Grants

The Department faces challenges in effective contract and grant administration and oversight. Although the
Department is taking steps to improve its administration and oversight of contracts and grants, the reported deficiencies
in these areas present significant fraud and mismanagement risks. Through its audit work, the OIG has identified certain
issues indicating that Department components need to be more attentive in complying with Federal Acquisition
Regulations and grant policy. The OIG reported that inadequate controls led to deficiencies in grant award
administration, such as grant funds being improperly released without securing the government’s interest, and an
ineffective process for detecting and following up on deficiencies noted during site visits.? The OIG also reported on
deficiencies in contract award and procedures and inadequate oversight practices.’°

Improving Control of Contract and Grant File Management

The Department continues to face challenges in improving controls over contract and grant file management. In the
OIG’s most recent top management and performance challenges report—and in audits issued in recent years—the OIG
identified significant vulnerabilities in the management of contract and grant file documentation that could expose the
Department to substantial financial losses.*? The failure to adequately maintain contract and grant files creates
significant financial risk and demonstrates a lack of internal control over the Department's contract and grant actions.
In addition, it generates conditions conducive to fraud and impairs the Department’s ability to take effective and timely
action to protect its interests and in turn, those of taxpayers.

Mitigating the Risk of Fraud, Waste, and Abuse Created By the Significant
Influx of Funds That Need to Be Distributed Quickly

The emergency and disaster relief environment can create incentives and opportunities for grant recipients to deviate
from standard practices meant to ensure effective control of U.S.-funded contracts, grants, and awards. Agencies
should tailor their efforts to adapt to the increased funding associated with the emergency relief funds; target outreach
efforts at deterring fraud schemes; and ensure that state and local grantees understand how to detect, deter, and report
suspicious activities or fraud to the appropriate authorities.

7 Commerce OIG, Top Management and Performance Challenges Facing the Department of Commerce (OIG-20-001, October 16, 2019).

Commerce OIG, EDA Should Develop a Workforce Plan and Improve its Hiring Accountability to Successfully Award and Administer the Disaster
Supplemental Funds Appropriated by the Bipartisan Budget Act of 2018 (OIG-20-014-A, January 27, 2020).

Commerce OIG, Oversight Activities of NIST’s Recovery Act Construction Grant Awards Are Generally Effective but Need Improvements
(OIG-12-020-A, February 14, 2012) and MBDA Can Improve Processes to More Effectively Monitor Cooperative Agreements (OIG-17-029-A,
September 5, 2017).

10 Commerce OIG, Significant Firm-Fixed-Price (FFP) Contract Actions in Fiscal Years (FYs) 2011-2013 Cannot Be Verified from Documentation in
NIST Contract Files (OlG-16-001-A, October 2, 2015).

11 OIG-20-001.

U.S. Department of Commerce 52
The rapid deployment of CARES Act funding is critical to help mitigate the impact of the COVID-19 pandemic. However,
anticipating and addressing the increased risk that comes with the expanded funding is vital to meeting the intent of the
Act. The OIG’s prior work can help the Department effectively and efficiently respond to COVID-19—and minimize the
shortcomings in stimulus program implementation and possible misuse of funds resulting from rapid fund deployment.
To meet the requirements of the CARES Act, the OIG stresses that the Department must have sufficient staffing and
system resources to manage the extraordinary increases in the number of grants and contracts.

For more information on the
Commerce Office of Inspector
General visit https://www.oig.

doc.gov/Pages/default.aspx.

U.S. Department of Commerce 53
U.S. DEPARTMENT OF DEFENSE

The U.S. Department of Defense (DoD) received more than $10.5 billion in appropriated funds in the Families First
Coronavirus Response Act and the CARES Act to prevent, prepare for, and respond to COVID-19, domestically and
internationally.

The DoD faces management and performance challenges as it seeks to ensure pandemic funds are timely and
appropriately spent to meet the goals of the emergency legislation. The DoD OIG has proactively engaged with the
Department to provide insights from prior oversight projects during contingencies. On April 6, 2020, the OIG provided the
DoD a memorandum on these best practices and lessons learned raising awareness of potential risk for fraud, waste, and
abuse.? Additionally, on April 23, 2020, the OIG released a special report addressing the importance of protecting
patient health information during the pandemic.” Most recently, on June 2, 2020, the OIG issued a special report
providing DoD contracting officials best practices, lessons learned, and fraud awareness identified in 36 audit reports
related to disaster response.* The OIG also publicized the DoD Hotline to encourage individuals to report concerns or
complaints related to DoD’s COVID-19 response and use of funding.

Secretary of Defense Mark Esper stated that his top three priorities during the COVID-19 pandemic are protecting the
DoD’s people, maintaining military readiness, and supporting the whole-of-government interagency response. The DoD
OIG sees the top challenges facing the Department in performing pandemic-related responsibilities and spending any
response funds as maintaining readiness and conducting ongoing operations while adhering to COVID-19 restrictions,
ensuring access and quality of health care to service members and their families, and ensuring appropriate financial
management and accountability of COVID-19 spending.

Maintaining Readiness and Ongoing Operations While Adhering to
COVID-19 Restrictions

The DoD’s enduring mission is to provide combat-credible military forces to deter war and protect the security of the
United States. COVID-19 impacts individual and unit readiness when service members or their families are infected with
the coronavirus. The virus’s high transmission rate increases risk to unit readiness, especially when an infected member
is stationed overseas or in a deployed environment. For example, ships, aircraft, and barracks are not designed to
accommodate social distancing. If service members and their units are unable to train for operations, then overall
readiness may decline, reducing the DoD’s ability to respond to threats and defend the United States.

The long-term health impacts for COVID-19 survivors also remain unknown. If COVID-19 survivors experience significant
long-term health conditions, then the DoD must be prepared to address potential impacts on the recruitment,
accession, training, and retention of service members.

COVID-19 also impacts the research, development, testing, acquisition, and procurement of military platforms and
weapons. On April 30, 2020, the Under Secretary of Defense for Acquisition and Sustainment acknowledged that the
DoD continues to “assess the impact of a potential 3-month slowdown,” noting that “COVID-19 is temporarily shutting
down defense manufacturing facilities and production lines, disrupting supply chains, and distressing the financial

1 DoD OIG, COVID-19 Expenditures—Lessons Learned Regarding Awareness of Potential Fraud, Waste, and Abuse Risk (April 6, 2020).
2 DoD OIG, Special Report on Protecting Patient Health Information During the COVID-19 Pandemic (DODIG-2020-080, April 23, 2020).

3 DoD OIG, Special Report on Best Practices and Lessons Learned for DoD Contracting Officials in the Pandemic Environment (DODIG-2020-085,
June 2, 2020).

U.S. Department of Defense 54
stability of the companies DoD relies on to protect the nation.” The COVID-19 pandemic presents risks to the defense
industrial base and supply chain ranging from project slowdowns and cost overruns to fraud, introduction of counterfeit
parts, and closures of small and mid-sized suppliers that cannot withstand facility shutdowns or decreased production.

Finally, while the DoD has demonstrated agility in supporting and implementing telework solutions for its workforce, not
all of DoD’s missions can be conducted remotely. Remote access and virtual workplace solutions stress aging
information technology infrastructure and impose a new set of security concerns. The DoD must continue to deploy
secure capabilities and expand capacity for systems and networks to enable its workforce to execute its mission.

Ensuring Access and Quality of Health Care to Service Members and
Their Families

Secretary Esper’s top priority is “protecting our people.” Protecting the health and welfare of service members and
their families requires access to high quality health care. COVID-19 places additional pressure on hospitals and their
staff. The Military Health System is not immune to this pressure. Service members’ and their families’ access to health
care and dental providers could be impacted if medical and dental services are limited due to government-mandated,
stay-at-home orders or if base access is restricted.

The DoD must maintain sufficient levels of personal protective equipment for medical personnel; testing kits, including
reagents, swabs, and various collection devices; and medication to treat service members and their families who test
positive for COVID-19. For example, access to testing kits is necessary to make an accurate diagnosis, determine
appropriate treatment in a timely manner, limit further transmission, and ensure health and safety.

Ensuring Appropriate Financial Management and Accountability of
COVID-19 Spending

Properly tracking, reporting, and auditing the additional funds provided to the DoD to respond to COVID-19 is a
challenge. The DoD must develop alternative ways to accomplish its expanded mission while continuing to support the
DoD-wide financial statement audits. The Acting DoD Inspector General and Acting Under Secretary of Defense
(Comptroller)/Chief Financial Officer issued a joint memorandum on May 1, 2020, to DoD agencies and auditors
encouraging them to work collaboratively to identify common issues and alternative ways to complete the financial
statements audit work.

The DoD must ensure it gets what it pays for in its acquisitions and contracts funded with COVID-19 response funding,
as well as guard against fraud and improper payments. The DoD should focus on properly identifying and evaluating
requirements; robustly vet contractors and vendors before awarding contracts; establish and follow well-documented
contract oversight and surveillance plans; and maintain complete, consistent, and accurate contracting documentation
and accounting records.

The DoD must also maintain its capabilities while balancing its commitments to contractors who are unable to fulfill DoD
requirements due to COVID-19 restrictions. The CARES Act authorizes DoD agencies to reimburse contractors for paid
leave under certain circumstances, potentially exposing the DoD to fraud. Contracting officers also have the discretion
to determine whether to reimburse contractors for these costs on a case-by-case basis. That discretion could create the
opportunity for inconsistent or improper implementation of these flexibilities across the DoD without the proper
internal controls or oversight.

Finally, the growing federal deficit as a result of COVID-19 response efforts could reduce future DoD budgets, impacting
readiness and slowing modernization. DoD leaders must continue to carefully examine mission sets, requirements, and
financial systems to optimize readiness and modernization with constrained resources. Appropriate financial
management and accountability strengthens the trust of Congress and the American people in the DoD’s ability to be
good stewards of taxpayer dollars.

U.S. Department of Defense 55
Conclusion

The DoD OIG is poised to oversee the Department’s COVID-19 response efforts. The OIG established working groups
across the DoD oversight community and published a COVID-19 Oversight Plan, which will be updated monthly. The
Plan identified planned and ongoing audits and evaluations to address these challenges. The DoD Hotline has received
more than 225 complaints to date, of which some were referred for further consideration and action. Additionally, the
Defense Criminal Investigative Service, the criminal investigative component of the OIG, has initiated criminal
investigations targeting fraud and corruption. The OIG will continue to monitor DoD’s efforts to respond to the
pandemic to ensure the timely and appropriate use of COVID-19 response funding.

For more information on the DoD
Office of Inspector General visit
http: //oig.nasa.gov/.

U.S. Department of Defense 56
U.S. DEPARTMENT OF EDUCATION

The CARES Act provides the U.S. Department of Education (Department) with more than $30 billion to assist states,
K–12 schools, and institutions of higher education in meeting the needs of students impacted by the pandemic.
In addition, provisions within the CARES Act related to student loans are estimated to increase direct spending by
$8.5 billion. Funds will be awarded primarily through formula grants to governors’ offices, state education agencies,
and institutions of higher education and can be used for a broad array of activities authorized under several education
laws or as specified in the CARES Act itself. The CARES Act provisions are designed to eliminate or alleviate the impact
of the pandemic on federal student loan borrowers and the schools they attend and also on state and local education
agencies, by allowing for waivers of specific statutory or regulatory requirements. The Department is also using existing
statutory authority to provide additional flexibilities to institutions of higher education specific to the pandemic.

The Department experienced a similarly significant increase in appropriations in 2009 with the American Recovery and
Reinvestment Act (Recovery Act).1 The Recovery Act provided the Department with more than $98 billion for existing
and new Department programs. Between 2009 and 2014, the Education OIG issued more than 50 audit reports on
Department, funding recipient, and subrecipient implementation of the Recovery Act; opened approximately
220 criminal investigations; and reviewed more than 140 allegations of whistleblower reprisal. The OIG concluded its
Recovery Act work with a 2014 report titled Lessons from Implementing the American Recovery and Reinvestment Act
of 2009. 2 The report highlighted the most significant challenges the Department faced in administering Recovery Act
programs and offered lessons and suggestions for the Department to consider in the event that emergency legislation
providing a large yet temporary funding increase were to be enacted in the future. As detailed in the report, the
Recovery Act presented several challenges for the Department, funding recipients, and subrecipients. Two of these
are long-standing challenges that have appeared repeatedly in the OIG’s annual reports on the most serious
management and performance challenges faced by the Department: (1) oversight and monitoring and (2) data quality
and reporting.3 As it implements and administers the programs and provisions authorized under the CARES Act, the
Department must remain alert and take necessary actions related to these two challenges to reduce vulnerabilities to
fraud, waste, abuse, noncompliance, and other issues that could impact a grantee’s or subgrantee’s ability to achieve
intended programmatic results.

Oversight and Monitoring
Effective oversight and monitoring of CARES Act programs and operations are critical to ensure that funds are used for
the purposes intended and that goals and objectives are achieved. This is a significant responsibility for the Department
given the vast number of entities that will receive education-related CARES Act funding, even as the Department must
continue its efforts to administer existing programs. Further, because CARES Act funding for many programs will pass
through primary recipients, such as governors’ offices and state education agencies, to subrecipients, such as local
education agencies or other entities, primary recipients have a substantial and critical role in overseeing and monitoring
subrecipients’ activities. This includes oversight and monitoring of awards made through the CARES Act Governor’s
Emergency Education Relief Fund and implementation of the CARES Act Education Stabilization Fund Discretionary
Grants. In addition, the Department must provide effective oversight and monitoring of the CARES Act provisions
related to the student financial assistance programs to ensure that the programs are not subject to fraud, waste, and

1 American Recovery and Reinvestment Act, Pub. L. No. 111-5 (2009).
2 Education OIG, Lessons from Implementing the American Recovery and Reinvestment Act of 2009 (ED-OIG/X09M0002, September 23, 2014).
3 To access the OIG’s previous management challenges reports, visit https://www2.ed.gov/about/offices/list/oig/managementchallenges.html
(last accessed June 7, 2020).

U.S. Department of Education ͷ͹
abuse. This would include the Department’s process to carry out provisions of the CARES Act specific to student
borrowers; the Department’s implementation of the CARES Act Higher Education Emergency Relief Fund, including
ensuring that schools use at least 50 percent for awards to students; and schools’ use of the CARES Act flexibility for
their campus-based programs. To this end, as highlighted in the OlG’s Recovery Act Lessons Learned report, the
Department should:

e Provide timely guidance for new programs, and conduct outreach and technical assistance for recipients to
ensure program integrity and effectiveness. Also, implement early compliance oversight and monitoring
processes for newly created or temporarily funded programs. This includes ensuring that program offices use
robust, risk-based monitoring strategies that devote available resources to the highest risk recipients and issues
and work with recipients to ensure that they are employing similar strategies when monitoring their
subrecipients.

e Enhance its audit resolution process so that compliance issues can be resolved timely, and identify trends in
audit findings across multiple recipients and subrecipients so that effective corrective actions can be employed
to resolve common issues.

e Work with the U.S. Department of the Treasury early in implementation to determine whether the programs
should be added to states’ Treasury-State Agreements for cash management purposes.

Data Quality and Reporting

Administering the programs and operations funded by the CARES Act will require the Department to collect, analyze,
and report on data for many purposes, such as evaluating programmatic performance, assessing fiscal compliance, and
informing management (including funding) decisions. The Department, its grant recipients and subrecipients, and other
program participants must have effective controls in place to ensure that CARES Act reported data are accurate and
complete given the Department’s reliance on these data as part of its operations. As highlighted in the OIG’s Recovery
Act Lessons Learned report, for CARES Act programs and funding, the Department should:

e Look for ways to improve the quality of recipient and subrecipient data, and continue to emphasize the need for
appropriate data quality reviews by state and local agencies. This includes piloting new reporting requirements
and mechanisms for new or existing programs, establishing a formal process to identify and remediate situations
where there are systemic or chronic reporting problems, ensuring that recipients implement adequate and
effective controls to ensure high-quality data for key reporting elements, and requiring reporting entities to
submit management certifications on data quality and to disclose known data limitations.

Read the OIG’s preliminary CARES Act Oversight Plan at https://www2.ed.gov/about/offices/list/oig/misc/cares-act-
plan.pdf.*

For more information on the
Education Office of Inspector
General visit https://www2.ed.gov/
about/offices/list/oig/index.html.

4 Education OIG, Coronavirus Relief Oversight Plan, view at https://www2.ed.gov/about/offices/list/oig/misc/cares-act-plan.pdf (last accessed
May 13, 2020).

U.S. Department of Education 58
U.S. DEPARTMENT OF ENERGY

The CARES Act added $99.5 million to the U.S. Department of Energy’s Science appropriation and $28 million to the
Departmental Administration appropriation. CARES Act funds address different elements of the coronavirus response,
and remain available until September 30, 2021. The Department may also unilaterally modify contracts to fund paid
leave for contractor employees in certain circumstances.

The Science appropriation relates to the Department’s 17 National Laboratories that possess state-of-the-art scientific
equipment and have leading scientists on-site. Contractors administer these facilities and manage scientific work for the
Department through management and operating contracts. This type of contract was modeled on the approach the
government used to produce the first nuclear devices.

Among other things, scientists working in the Department’s National Laboratories have already screened thousands of
drugs, modeled outbreaks, and determined the structure of key virus elements. The Department has also created a
clearinghouse for access to equipment and experts within the national laboratory system. Additionally, the Department
is contributing to the COVID-19 High Performance Computing Consortium, which is a partnership between federal
agencies, academic institutions, and industry participants that provides access to more than 330 petaflops of
supercomputing capacity.

The Departmental administration appropriation relates to virus response and has transfer authorities. Administrative
virus response work is ongoing.

The top challenges the Department faces with respect to these responsibilities and funds are: (1) contract oversight and
(2) project management and funding control.

Contract Oversight
Department of Energy leadership moved quickly to encourage the Department’s National Laboratories to begin scientific
inquiry into key areas associated with the COVID-19 pandemic. While this action enabled the Department to get an
early start on scientific projects, it introduced risks associated with the Department’s oversight over the contractors who
manage the National Laboratories. In particular, there are long-standing risks associated with the Department’s
management and operations (M&O) contract structure that may be exacerbated by the pandemic response. These risks
include inadequate technical and administrative oversight over M&O contractors. The CARES Act adds a new risk to this
challenge in the form of provisions related to funding leave for contractor employees.

Project Management and Funding Control
The speed, diffuse nature, and urgency of the Department’s COVID-19 response present inherent risks associated with
project management and funding control. In particular, the normal formal and deliberative process with which the
Department plans, funds, authorizes, and executes projects is inconsistent with the speed required by the federal
pandemic response. Key controls associated with defining project objectives, scope, budget, timeline, and critical
decision points may not receive the customary scrutiny that would normally occur. Additionally, certain scientific
activities may have started before the funding control structure was fully in place.

U.S. Department of Energy ͷͻ
The OIG plans to initiate real-time reviews and, where needed, rapid investigations or inspections of the Department’s
pandemic response activities. The OIG’s proactive strategy will seek to aid the Department in enhancing program
efficiencies and preventing or quickly detecting the misuse of funds. The OIG plans to continue providing fraud
awareness briefings throughout the Department and to M&O contractor leadership to alert officials about potential
risks. These briefings have proven to be particularly useful to Departmental management, and have enhanced their
ability to recognize fraud and bring those matters to the OIG’s attention.

For more information on the
Energy Office of Inspector General
visit https: //www.energy.gov/i
office-inspector-general.

U.S. Department of Energy 60
U.S. DEPARTMENT OF HEALTH AND
HUMAN SERVICES

The emergence of COVID-19 has created unprecedented challenges for the health and human services system. As
the lead federal agency responsible for medical support and coordination during public health emergencies, the
U.S. Department of Health and Human Services (HHS) is uniquely positioned to assist communities throughout the
United States to prepare for and respond to emerging infectious disease outbreaks, such as the COVID-19 pandemic.
The pandemic is fast-moving, and HHS is working to support substantial actions to support providers, ensure the safety
of the health care workforce, and protect millions of Americans.

Many HHS operating divisions are administering pandemic-related funding, as well as coordinating policy and
programmatic responses to address the public health crisis. HHS must implement programs under the CARES Act and
related pandemic legislation, while operating its other health and human services programs that serve providers,
patients, and others affected by the pandemic. HHS operating divisions involved in the federal response to COVID-19
include, among others, the Centers for Disease Control and Prevention (CDC), Office of the Assistant Secretary for
Preparedness and Response (ASPR), Food and Drug Administration, National Institutes of Health, Centers for Medicare &
Medicaid Services (CMS), Indian Health Service (IHS), and Health Resources & Services Administration.

Drawing on the HHS OIG’s past experience, as well as current risk-assessment and work planning, the OIG has, to date,
identified top challenges to HHS’s pandemic response in three broad categories: (1) protecting people, (2) protecting
funds, and (3) protecting infrastructure.

Protecting People
A key HHS responsibility is protecting people, including HHS employees, health care workers, and HHS beneficiaries at
risk of contracting the virus in health or human services program settings (e.g., nursing homes or child care facilities).
HHS is charged with ensuring safety and quality of care in its programs. HHS also serves the American public through
guidance on preventing the spread of COVID-19, research into potential vaccines and treatments, and oversight of the
safety and effectiveness of COVID-19 treatments and tests.

Central to protecting people is ensuring effective coordination and communication between and among federal
agencies; states, localities, and tribal organizations; providers and others in the private sector; and individuals and
families. HHS OIG studies have repeatedly identified the need for improved planning, coordination, and
communications in emergency preparedness and response, both within and outside HHS, including for example studies
of HHS's and providers’ responses to the 2009 H1N1 influenza pandemic, the 2014 Ebola outbreak, and 2012 and 2017
hurricanes.1

1 HHS OIG reports related to the 2009 H1N1 influenza pandemic include Local Pandemic Influenza Preparedness: Vaccine and Antiviral Drug
Distribution and Dispensing (OEI-04-08-00260, September 2009); State and Local Pandemic Influenza Preparedness: Medical Surge
(OEI-02-08-00210, September 2009); and 2009 H1N1 School-Located Vaccination Program Implementation (OEI-04-10-00020, June 2010).
Reports related to the 2014 Ebola outbreak include HHS Did Not Always Efficiently Plan and Coordinate Its International Ebola Response Efforts
(A-04-16-03567, August 2019) and Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola Crisis
(OEI-06-15-00230, October 2018). Reports related to the 2012 hurricane include The Response to Superstorm Sandy Highlights the Importance
of Recovery Planning for Child Care Nationwide (OEI-04-14-00410, December 2015); Superstorm Sandy Block Grants: Funds Benefited States'
Reconstruction and Social Service Efforts, Though ACF's Guidance Could be Improved (OEI-09-15-00200, September 2016); and Hospital
Emergency Preparedness and Response During Superstorm Sandy (OEI-06-13-00260, September 2014). Reports related to the 2017 hurricane
include The Health Resources and Services Administration Has Controls and Strategies To Mitigate Hurricane Preparedness and Response Risk
(A-04-18-02015, December 2018); The Administration for Children and Families Has Controls and Strategies To Mitigate Hurricane Preparedness
and Response Risk (A-04-18-02013, December 2018); and The Centers for Disease Control and Prevention Has Controls and Strategies To Mitigate
Hurricane Preparedness and Response Risk (A-04-18-02014, November 2018).

U.S. Department of Health and Human Services ͸ͳ
To protect people during the COVID-19 pandemic, HHS is developing, distributing, and authorizing tests to identify
infected individuals and working with other federal agencies to distribute protective and medical equipment from the
Strategic National Stockpile. HHS is also researching, developing, and approving medications, including vaccines, and
other preventive measures to combat the COVID-19 virus. HHS-funded providers, including hospitals, clinics, and
nursing homes serving Medicare, Medicaid, IHS, and other HHS beneficiaries, must provide safe, quality care, and many
are operating under new policy flexibilities to promote access to testing and treatment. In addition, HHS must directly
provide safe, quality care to American Indian and Alaska Native patients served by its IHS-run hospitals and outpatient
medical facilities. Further, HHS along with the OIG and its law enforcement partners, need to protect HHS beneficiaries
and the public from fraud schemes, such as the marketing of fake tests and beneficiary identity theft, and are working
closely together to do so. Administering these programs effectively and efficiently is a top challenge.

Protecting Funds

As of early May 2020, the total HHS COVID-19 appropriation was $251 billion, including $175 billion in Provider Relief
Funds, $25 billion in funding for CDC related to testing, and $8.48 billion in grants. Provider Relief Funds are for
hospitals and other health care providers on the front lines of the coronavirus response. This funding is being used to
support health care-related expenses or lost revenue attributable to COVID-19 and to ensure that all Americans who
need it can receive testing and treatment for COVID-19. To date, HHS has distributed approximately $50 billion of these
funds for general distribution to Medicare facilities and providers affected by COVID-19. As mentioned above, this is
only a portion of the HHS funding going to support the provision of health care, development of remedies and
countermeasures, and overall response to the COVID-19 pandemic. Regularly appropriated funding for HHS programs
and operations must also be considered when accounting for the funding associated with the pandemic response.

Responsible stewardship, transparency, and accountability of HHS funds are needed to ensure that HHS beneficiaries
and the American public receive the true benefit of this substantial investment. As of early May 2020, CMS had made
accelerated and advanced payments to Medicare providers totaling $100 billion and is paying providers for certain
services at enhanced rates applicable during the emergency. CMS has suspended many program integrity safeguards,
such as provider enrollment screening. While these steps may be appropriate to ensure access to care, they also raise
the risks of fraud by those seeking to exploit the emergency. HHS must effectively and efficiently manage the use of
funds internally, award and manage contracts related to COVID-19 funding in accordance with contracting requirements,
and appropriately oversee thousands of external funding recipients’ use and reporting of federal funds. HHS must
ensure that funds are paid properly to eligible recipients in correct amounts. HHS must also identify and fight fraud that
would divert funds intended for COVID-19 response and recovery. Effective internal controls and the collection,
maintenance, and analysis of relevant data are key to ensuring that funds meet their intended purposes.

For grant programs, HHS is responsible for providing up-to-date policies to grant recipients and helping states and other
grantees address their own financial management and internal control issues. Without proper internal controls, funds
may be misspent, duplication of services may occur, and subrecipients may lack adequate monitoring.

Protecting Infrastructure

HHS must support a secure, robust information technology infrastructure for both internal HHS and external programs.
Other key infrastructure for the pandemic response includes the Strategic National Stockpile, quarantine facilities, the
drug supply chain, and research and development programs, as well as other health care infrastructure, such as
telehealth platforms and devices, networked medical or laboratory equipment, and other technology that enabled
remote response to COVID-19. Cyberattacks are a serious threat during the emergency, with significant potential
negative effects on the health and welfare of the nation. Outside of HHS’s

systems, many of HHS’s partners and grantees and the health care system at nena Sattmretion am ine Le

large are subject to an increasing number of cyber threats. HHS’s actions will Office of Inspector General visit
be critical for the immediate COVID-19 response, as well as for ensuring https: //oig.hhs.gov/.

adequate preparation for future public health emergencies.

U.S. Department of Health and Human Services 62
U.S. DEPARTMENT OF HOMELAND SECURITY

Based on prior, planned, and ongoing audits, inspections, special reviews, and investigations, the U.S. Department of
Homeland Security (DHS) OIG believes the top challenges facing DHS in handling pandemic-related responsibilities and
emergency funds are the following.

Managing Programs and Operations Effectively While Experiencing
Changes in Leadership and High Vacancy Rates

Many DHS senior leadership positions continue to suffer from a lack of permanent, presidentially appointed and
Senate-confirmed officials, and they have been marked by high turnover. In the past 2 years, DHS has had three
different Secretaries and as many Acting Deputy Secretaries. As of May 1, 2020, acting officials filled almost one-third
of all DHS senior leadership positions. At the Federal Emergency Management Agency (FEMA), which bears central
responsibility for pandemic assistance, two of four lead positions are filled by acting officials: the Deputy Administrator
and the Deputy Administrator for Resilience. Certain DHS components also face high attrition, such as the
Transportation Security Administration (TSA) and U.S. Customs and Border Protection (CBP), which are both on the front
line of the COVID-19 pandemic. DHS OIG has previously noted that in fiscal year 2017, for example, TSA spent nearly
$75 million to train more than 9,000 new Transportation Security Officers, about 20 percent of whom left within

6 months.? In March 2019, the Government Accountability Office testified before Congress that CBP staffing levels for
law enforcement positions consistently fell below target levels and retaining officers in hard-to-fill locations continued
to pose a problem for CBP.* Notwithstanding recent Executive Orders requiring the Department to hire 5,000 new
Border Patrol Agents and 10,000 new Immigration Officers to expand immigration enforcement activities and programs,
DHS has struggled to onboard these new officials.?

Ensuring Proper Financial and Procurement Internal Controls Are
in Place

Many key DHS financial systems do not comply with federal financial management system requirements, as defined in
the Federal Financial Management Improvement Act of 1996.* Limitations in financial systems’ functionality add
substantially to the Department’s challenges addressing systemic internal control weaknesses and restrict its ability to
leverage information technology systems to process and report financial data efficiently and effectively. These
deficiencies may hinder DHS’s ability to ensure proper financial planning, payments, and internal controls related to
CARES Act funding. COVID-19 procurements will be wide and vast. While the DHS Joint Requirements Council and Joint
Requirements Integration and Management System provides guidance to identify required capabilities, gaps,
opportunities, and controls, at times the Department has validated noncompliant capability needs documents, not held

1 TSA Workforce Crisis: A Homeland Security Risk. Before U.S. House of Representatives Subcommittee on Transportation and Maritime Security,
Committee on Homeland Security, 116th Congress (2019) (statement of Acting Inspector General John V. Kelly).

2 U.S. Customs and Border Protection: Progress and Challenges in Recruiting, Hiring, and Retaining Law Enforcement Personnel. Before the
Subcommittee on Oversight, Management, and Accountability, Committee on Homeland Security, House of Representatives, 116th Congress
(2019) (statement of Rebecca Gambler, Director, Homeland Security and Justice).

3 DHS OIG, Major Management and Performance Challenges Facing the Department of Homeland Security (Ol|G-20-02, November 13, 2019).
4 Federal Financial Management Improvement Act of 1996, Pub. L. No. 104-208 (1996).

U.S. Department of Homeland Security 63
components accountable for failing to follow guidance, and not provided adequate direction on implementing the
guidance.° Nor have DHS components consistently solicited, awarded, and managed low value contracts according to
federal and departmental regulations.© These problems have resulted in misspent funds and impaired DHS’s ability to
take action when contractors do not comply with the procurements.

Improving FEMA’s Grant Management, Disaster Assistance, and Fraud
Prevention

In reports and congressional testimony, DHS OIG has emphasized lessons learned from natural disasters that could
serve to improve FEMA’s contracting and overall preparedness.’ More specifically, the OIG identified a pattern of

FEMA management failures in overseeing procurements and reimbursing procurement costs, and continues to observe
systemic problems and operational difficulties that contribute to FEMA not managing disaster relief grants and funds
adequately. At times, FEMA has not followed procurement laws, regulations, and procedures, nor has it ensured
disaster grant recipients and subrecipients understand and comply with these same authorities. In 2019 and 2020,

the OIG issued reports demonstrating weaknesses in FEMA’s administration of the Public Assistance grant program.®
The OIG also found FEMA’s disaster assistance programs are highly susceptible to fraud, waste, and abuse, which poses
significant risk to taxpayer investment.” In a climate where FEMA is already hard-pressed to take additional, proactive
steps to create and sustain a culture of fraud prevention and awareness, the infusion of CARES Act funding will likely
exacerbate these difficulties. Additionally, in the past 12 years, the OIG issued eight reports on FEMA’s information
technology systems capabilities for processing payments, coordinating with state and local governments, data reliability,
and vast information sharing and reporting limitations. DHS OIG ongoing work reveals significant challenges across DHS
related to cybersecurity protections, and election infrastructure protection and preparedness for the 2020 election amid
COVID-19.

Protecting the Health and Safety of Immigration Detainees, DHS
Employees, and Contract Staff

Tens of thousands of detainees are in short- and long-term custody in CBP and Immigration and Customs Enforcement
(ICE) facilities nationwide. Detainees in DHS custody, as well as CBP and ICE employees and contract staff, face amplified
risks of exposure to COVID-19. DHS has struggled for several years, as documented in numerous reports and studies, to
ensure proper medical and mental health care in immigration detention. DHS uses a wide range of contract settings for
detention, including privately owned and operated prisons, as well as state and local jails. Due to the decentralized
nature of this system and a lack of standardized procedures, DHS will face formidable challenges in identifying and
managing individuals who have been exposed to or contracted COVID-19.

5 DHS OIG, DHS Needs to Improve the Process for Identifying Acquisition Planning Capability Needs (OIG-19-19, January 30, 2019).
& DHS OIG, Inadequate Oversight of Low Value DHS Contracts (OIG-19-50, July 2, 2019).

7 FEMA Contracting: Reviewing Lessons Learned from Past Disasters to Improve Preparedness. Before U.S. House of Representatives
Subcommittee on Emergency Preparedness, Response, and Recovery and Subcommittee on Oversight, Management, and Accountability,
Committee on Homeland Security, 116th Congress (2019) (statement of Deputy Assistant Inspector General for Audits Katherine Trimble).

8 DHS OIG, FEMA's Eligibility Determination of Puerto Rico Electric Power Authority's Contract with Cobra Acquisitions LLC (OIG-19-52, July 3, 2019)
and Management of FEMA Public Assistance Grant Funds Awarded to the Sewerage and Water Board of New Orleans Related to Hurricanes
Katrina, Isaac, and Gustav (OIG-20-21, March 27, 2020).

° DHS OIG, FEMA Did Not Sufficiently Safeguard Use of Transportation Assistance Funds (O|IG-19-66, September 30, 2019); FEMA Purchased More
Manufactured Housing Units Than It Needed in Texas After Hurricane Harvey (OIG-20-15, February 26, 2020); and Additional Controls Needed to
Better Manage FEMA’s Transitional Sheltering Assistance Program (OIG-19-37, March 29, 2019).

U.S. Department of Homeland Security 64
OIG prior pandemic oversight work identified deficiencies in DHS’s needs assessment before purchasing pandemic
preparedness supplies and managing its stockpile of personal protective equipment and antiviral medical
countermeasures.’° The OIG further found that DHS could not be assured that its preparedness plan could be executed
effectively during a pandemic event." Detainees and staff in immigration detention facilities may not have sufficient
personal protective equipment or access to effective treatment to minimize the spread of the virus.

For more information on the DHS
Office of Inspector General visit
https://www.oig.dhs.gov/.

10 DHS OIG, DHS Has Not Effectively Managed Pandemic Personal Protective Equipment and Antiviral Medical Countermeasures (OIG-14-129,
August 26, 2014).

11 DHS OIG, DHS Pandemic Planning Needs Better Oversight, Training, and Execution (OlG-17-02, October 12, 2016).

U.S. Department of Homeland Security 65
U.S. DEPARTMENT OF HOUSING AND
URBAN DEVELOPMENT

The U.S. Department of Housing and Urban Development (HUD) has been provided more than $12 billion to perform its
responsibilities under the CARES Act in the following areas: (1) rental assistance, (2) mortgage loan forbearance,
(3) assistance for vulnerable populations, (4) assistance for communities’ response, and (5) continued performance of
HUD’s mission. The HUD OIG addresses the Department’s top management challenges surrounding CARES Act
implementation in this context, based on prior OIG work and ongoing conversations with HUD.

Rental Assistance
Congress provided HUD more than $2.6 billion in supplemental rental subsidies for tenants who have lost income and to
ensure that landlords who provide subsidized housing and face significant increases in costs due to the COVID-19
pandemic are not forced out of the affordable housing market. The CARES Act also protects tenants of covered
properties from eviction for 120 days.

HUD will be challenged to ensure that these grantees provide additional rental subsidies to tenants properly and in a
timely manner and accurately track and report on the expenditure of these funds. It is unclear whether HUD has the
ability to determine whether eligible renters are aware of and their landlords are complying with the moratorium. There
has also been notable media coverage of tenants being sexually harassed and assaulted by their landlords when they are
unable to meet rent obligations. These are fair housing violations, and HUD will be challenged to alert tenants as to
their rights and provide avenues for a remedy.

The pandemic also presents a challenge to the HUD-assisted rental stock. The current shelter-in-place orders prevent all
but emergency maintenance on the affordable housing portfolio. In addition, HUD allowed public housing agencies to
waive or postpone certain program safeguards, such as on-site inspections. It is unclear what the impact of deferred
inspection and maintenance will be on an already aging portfolio.

Mortgage Loan Forbearance
Congress provided borrowers with single-family mortgages insured by HUD’s Federal Housing Administration (FHA) up
to 180 days forbearance, with the right to request an additional 180 days. In addition, Congress provided up to 90 days
forbearance to apartment building owners with FHA-insured mortgages. Because the vast majority of FHA-insured
loans are securitized into mortgage-backed securities (MBS), nonpayment on FHA mortgages due to forbearance
impacts payments to MBS investors, which could have a negative impact on the residential securities market. HUD’s
Government National Mortgage Association (Ginnie Mae) guarantees payment on MBS backed by FHA mortgages.
HUD, through FHA and Ginnie Mae, is tasked with ensuring that borrowers are provided needed forbearance while also
protecting the financial system destabilized by borrower nonpayment.

HUD faces challenges on several fronts. Initially, HUD must ensure that borrowers protected by forbearance are aware
of their rights. Ginnie Mae must act to preserve the stability in the residential securities market by closely monitoring
and addressing the risk that continued forbearance creates for its counterparties. While Ginnie Mae has established a
temporary assistance program for the MBS it insures for issuers who are unable to make full payments to investors,
Ginnie Mae acknowledges that this assistance does not include taxes and insurance payments, which lenders and issuers
must advance on behalf of the nonpaying borrowers. The assistance also does not include servicer fees, which would
have been included in the borrowers’ payment. Further, Ginnie Mae has limited insight into the actions of other market

U.S. Department of Housing and Urban Development ͸͸
actors, such as government-sponsored enterprises, and credit lines used by its issuers. Prolonged forbearance may
create a risk of default of one or more of the Ginnie Mae issuers due to an inability to pay amounts due on their MBS.

As forbearances end, FHA will be required to track and monitor lender and borrower agreements to repay the forborne
amounts. In many cases, servicers will be able to file a partial claim with HUD, allowing the servicer to recoup lost funds
from HUD’s insurance funds. HUD will need to track and monitor transactions for millions of loans. Partial claims due to
forbearance will likely have a significant impact on FHA’s mortgage insurance fund. Failure of borrowers to pay
insurance premiums as part of their monthly payment will also strain the mortgage insurance fund.

Assistance for Vulnerable Populations

Congress has provided more than $4.1 billion for populations facing greater health risks from the pandemic, including
individuals experiencing homelessness, people with HIV/AIDS, and older adults. The vast majority of these funds are for
Emergency Solutions Grants—an increase of more than 1,300 percent over HUD’s fiscal year 2020 appropriation for this
program. This deluge of funding may significantly strain HUD systems and staff, as well as the state and local entities
tasked with implementing this program. HUD will be dependent on the grantees and subgrantees reporting their use of
funds to meet CARES Act reporting requirements.

Although not referenced in the CARES Act, HUD provides mortgage insurance for residential care facilities under
Section 232 of the National Housing Act.’ In its 2020 top management challenges report, the OIG specifically noted
HUD’s failure to monitor residential care facilities and take action regarding financially challenged nursing homes.”
The concentration of COVID-19 in nursing homes and senior living facilities and the financial impact on operators of
these facilities may place even more mortgages at risk of default.

Assistance for Communities’ Response

Congress provided more than $5 billion to support local communities in responding to the pandemic through the
Community Development Block Grants (CDBG) program. Communities’ pandemic response needs are new and
extremely time sensitive, requiring HUD to develop new standards and issue CDBG funds with extraordinary speed.
Further, the CARES Act more than doubles HUD’s CDBG appropriation for fiscal year 2020 and adds different criteria for
these funds. In audits dating back several years, the OIG found that HUD was already challenged with monitoring this
program and assessing risk.

HUD’s efforts regarding other presidentially declared disaster relief efforts are ongoing. States are the initial grantees
for disaster funding and must develop and oversee a network of local disaster relief entities. Many states are already
severely taxed by pandemic efforts. As the United States enters hurricane season on June 1, 2020, HUD and its grantees
may be challenged to respond in a timely manner to new disasters in addition to ongoing pandemic response activities.

HUD’s Mission Performance

As of April 21, 2020, HUD reported publicly that 95 percent of its staff is working remotely to continue HUD’s mission
and implement new CARES Act responsibilities. HUD will need to ensure that it can continue to perform essential
mission functions in light of these additional program obligations and operational limitations. HUD already experiences
significant challenges in the areas of human capital and procurement, financial

management, information systems technology, and monitoring and oversight, For more information on the HUD
as outlined in the 2020 top management challenges report. All of the new Office of Inspector General visit
work required by HUD under the CARES Act will amplify these challenges. https://www.hudoig.gov/.

1 National Housing Act (1934), as amended.

2 HUD OIG, Top Management Challenges Facing the U.S. Department of Housing and Urban Development in 2020 and Beyond (December 4, 2019).

U.S. Department of Housing and Urban Development 67
U.S. DEPARTMENT OF JUSTICE

The U.S. Department of Justice (DOJ) employs over 200,000 personnel worldwide executing the federal government’s
law enforcement and national security efforts. The DOJ primarily accomplishes its critical mission through its more than
30 components, the largest of which are the Bureau of Prisons (BOP, which has nearly 40,000 employees) and the
Federal Bureau of Investigation (FBI, which has roughly 35,000 employees). Beginning in early March 2020, the OIG
promptly shifted a significant portion of its oversight toward assessing the DOJ’s readiness to respond to the rapidly
evolving COVID-19 pandemic. Through its initial assessment, the OIG determined that the most immediate challenges to
DOJ operations involved preventing the spread of the virus among its roughly 170,000 federal inmates and 61,000
detainees in BOP and U.S. Marshals Service (USMS) custody, respectively; operating its immigration courts in a manner
that minimizes the risk to participants; and ensuring robust oversight of $850 million in pandemic-related CARES Act
grant funding being disbursed by DOJ to fund state, local, and tribal efforts to combat COVID-19—all while also
protecting the health and safety of the tens of thousands of employees who oversee these particular operations. In
addition to the $850 million CARES Act grant funding, some DOJ components received supplemental funding, including
the BOP ($100 million) and USMS ($15 million), to better position their COVID-19 efforts. The OIG received $2 million,
which will be used to help support oversight of these significant and immediate challenges and others as they may arise.
Overall, DOJ’s CARES Act funding topped $1 billion.

CARES Act Grant Funding by Office of Justice Programs
The CARES Act provided the Office of Justice Programs’ (OJP) Bureau of Justice Assistance (BJA) with $850 million to fund
state, local, and tribal efforts to combat the COVID-19 pandemic. Ensuring this funding reaches its intended recipients
quickly and efficiently is paramount to the efforts of law enforcement agencies throughout the country as they strive to
protect the communities they serve. The OIG recognizes, especially based on its previous oversight Recovery Act
funding, that achieving speed and maximum efficiency in the distribution of nearly $1 billion in grant funds, while in an
emergency posture, is a challenging undertaking for OJP.1 These challenges include the increased risk of fraud and
misuse or waste of program funding. Currently, BJA is in the process of distributing CARES Act funding through the
Coronavirus Emergency Supplemental Funding (CESF) grant solicitation for recipients eligible for OJP’s Justice Assistant
Grant program. Recipients of CESF funding (generally state, local, and tribal law enforcement agencies) will be operating
under unprecedented circumstances, including reductions in administrative staff that may weaken internal control
systems. Additionally, bad actors have launched multiple fraud schemes specifically targeting COVID-19 aid, with some
illicit ploys targeting OJP award recipients, specifically. Known schemes include the sale of ineffective or unsafe
treatment options and non-delivery of needed personal protective equipment, both of which may challenge effective
grant implementation and even risk the lives of U.S. citizens. It is the responsibility of OJP to effectively oversee the
grant funds and mitigate risks that could affect the valuable and proper use of the funds to help law enforcement during
the COVID1-19 pandemic. However, the CESF solicitation represents a considerable addition to OJP’s normal
administration and oversight responsibilities, comprising approximately 20 percent of the total amount of grant funds
that will be awarded by OJP in all of 2020.

COVID-19 Challenges Related to Protecting DOJ Prison Staff and Inmates
The COVID-19 pandemic has created serious challenges for DOJ related to its responsibility to safely house over 160,000
federal inmates and over 61,000 detainees awaiting trial or sentencing decisions, while also keeping free from harm

1 American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5 (2009).

U.S. Department of Justice ͸ͺ
correctional and detention facility employees as well as the communities in which they serve. This includes the safety
and welfare of the approximately 40,000 staff and contract employees who work in BOP institutions, contract prisons,
and residential reentry centers—as well as the thousands who oversee USMS detainees in state, local, tribal, and
contract detention centers. The most immediate and pressing challenges include: securing personal protective
equipment; identifying, accessing, and implementing effective testing protocols; providing access to quality medical care
for those in custody; transferring inmates and detainees to and from facilities; and social distancing, screening,
quarantining, and otherwise mitigating the risks presented by the pandemic. Additionally, the CARES Act granted the
Attorney General authority to release inmates upon a finding of a national emergency, which complements other
preexisting release authorities in federal law, such as compassionate release provisions. The Attorney General has since
made that finding, and the DOJ is facing the difficult task of determining which inmates should be released while still
ensuring the safety of the communities where such early releases are granted. As noted, many individuals in BOP or
USMS custody are placed in correctional environments not directly controlled by the DOJ—about 60 percent of USMS
pretrial detainees are held in over 850 different state and local facilities under the terms of intergovernmental
agreements, and approximately 16 percent of BOP inmates are held in contract prisons and residential reentry centers.
This amplifies the challenge for DOJ to ensure not only that these individuals receive adequate medical care and
protection from COVID-19, but also that the DOJ properly considers the health and safety of hundreds of communities
its decisions may affect.

COVID-19 Challenges in the Immigration Courts

While DOJ does not have responsibility for housing immigration detainees (that is the responsibility of the U.S.
Department of Homeland Security), the DOJ’s Executive Office for Immigration Review (EOIR) is tasked with adjudicating
immigration cases and has faced challenges in mitigating health risks for all those involved in these immigration cases
during the COVID-19 pandemic. As it maintains certain operations, EOIR—like other DOJ components—has experienced
challenges such as securing personal protective equipment for its staff and a lack of remote options to perform some
work necessary to ongoing operations. EOIR must also balance mitigating health risks at its court facilities while
ensuring the rights of individuals subject to immigration court proceedings.

Initial DOJ OIG Oversight Efforts

In light of the BOP’s pandemic-related challenges, the OIG created skill-mixed teams—incorporating the diverse
disciplines and expertise from the OIG’s operational divisions—to perform numerous remote inspections of all types of
facilities that house BOP inmates. These remote inspections will seek to ensure facility compliance with guidance from
the Centers for Disease Control and Prevention, DOJ, and the BOP, while also identifying significant risk areas. The OIG is
also leveraging its data analytics platforms to illustrate for DOJ and BOP leadership data on at-risk inmate populations,
estimates of inmates eligible for early release and home confinement, and the BOP facilities most at risk of outbreaks.
The OIG also initiated a review intended to assess the pandemic-related risk in USMS detention operations, and another
that will address EOIR’s handling of certain challenges in conducting operations during the pandemic. Additionally, the
OIG has commenced a review of OJP’s efforts to distribute the $850 million in COVID-19 award funding in a timely and
efficient manner, as well as its pre-award activities to ensure that grant awards are made in accordance with applicable
laws, regulations, and other guidelines. Lastly, the OIG has established a dedicated COVID-19 inbox to receive
pandemic-related complaints that will be assessed by OIG investigators for criminal activity or misconduct and analyzed
by OIG auditors and analysts for trends and other risk indicators.

For more information on the DOJ
Office of Inspector General visit

https://oig.justice.gov/.

U.S. Department of Justice 69
U.S. DEPARTMENT OF LABOR

The U.S. Department of Labor (DOL) plays a vital role in the lives of workers and in the nation's economy. Now more
than ever, DOL must remain vigilant in its important stewardship of taxpayer funds, particularly in overseeing the
hundreds of billions of dollars in pandemic-related funding authorized in an effort to provide additional unemployment
benefits to those in need and ensuring the safety and health of the country’s essential workforce.

Responding Expeditiously to the COVID-19 Pandemic while Protecting
the Integrity of the Unemployment Insurance Program
DOL OIG has previously expressed concern with the Department’s ability to deploy program benefits expeditiously and
efficiently while ensuring adequate oversight, particularly in response to national emergencies and disasters. The OIG
renewed this concern in light of the coronavirus pandemic and the unprecedented increase in funds to DOL programs,
especially the Unemployment Insurance (UI) program, which has received hundreds of billions of dollars under recently
enacted legislation.

Since COVID-19 first arrived in the United States in early 2020, unemployment insurance claims have risen exponentially.
DOL reported that tens of millions of initial unemployment claims have been filed since March 2020, the largest increase
since the Department began tracking the data in 1967. The CARES Act provides major funding to the state-federal
unemployment program, including covering workers not typically covered by UI.

Challenge for the Department
For many years, the OIG has reported concerns with DOL’s ability to measure, report, and reduce improper payments
in the UI program. The OIG’s prior audit work revealed that the Department has not done enough to formally assess the
various strategies available to combat improper payments. In addition, the Department has been unable to determine
what issues persist, due in part to a lack of reliable state-reported data. Further, improper payments stemming from
fraudulent activity continue to pose a significant threat to the integrity of the UI program, as identity thieves and
organized criminal groups have found ways to exploit program weaknesses. For example, benefits paid via non-state-
issued prepaid debit cards provide anonymity to those who submit fraudulent claims. The OIG expects these issues will
be exacerbated by the significant funding increase in response to the coronavirus pandemic.

To meet the requirements of the CARES Act, states must have sufficient staffing and system resources to manage the
extraordinary increases in the number of claims and payments. The expanded coverage offered under the temporary
Pandemic Unemployment Assistance program has posed significant challenges to states as they implement processes
to determine initial and continued program eligibility. DOL must ensure states establish strong controls for determining
eligibility and consider past systemic weaknesses when developing fraud prevention measures. DOL must also ensure
states establish procedures to detect and recover any improper payments made and redirect the funding to those
eligible for the assistance.

U.S. Department of Labor ͹Ͳ
Protecting the Safety and Health of Workers

DOL has the substantial responsibility for helping ensure the safety of the country’s workforce, and ensuring benefits are
provided to address work-related disabilities. The Department’s Occupational Safety and Health Administration (OSHA)
is responsible for the safety and health of 136 million workers employed at more than 9 million establishments, while
the Department’s Mine Safety and Health Administration (MSHA) is responsible for the safety and health of
approximately 320,000 miners who work at more than 13,000 mines. The Office of Workers' Compensation Programs
(OWCP) administers disability compensation programs which provide wage replacement benefits, medical treatment,
and other benefits to federal employees and certain workers in the coal mine, energy, and longshore industries or their
dependents who experience work-related injury or occupational disease.

Challenge for the Department

OSHA and MSHA face challenges in determining how to help ensure employers protect the safety and health of the
American workforce during the coronavirus pandemic, particularly in high-risk industries such as health care, law
enforcement, meat processing, agriculture, manufacturing, delivery workers, retail, and mining. The nature of this work
and inherent barriers to social distancing make it particularly difficult to protect this essential workforce. Further, unless
proper precautions are taken, avoidable COVID-19 infections and deaths may occur as more people return to work.

OSHA is challenged in fulfilling its mission due to resource constraints and the urgency of actions required. Specifically,
OSHA must provide clear and relevant coronavirus-related guidance to help ensure worker safety during the pandemic.
OSHA must also use its limited resources to timely respond to the significant increase in worker and whistleblower
complaints to ensure workplace safety, and to protect workers that exercise their rights to report safety concerns.

MSHA is challenged to accomplish its mission during the pandemic as agency and state restrictions on travel and
workers have reduced its ability to conduct critical work. Specifically, MSHA is challenged to timely complete all
inspections and investigations, focusing its efforts on completing the four highest-risk annual mandatory inspections
of underground mines and two annual mandatory inspections of surface mines. Both mandatory and discretionary
inspections to address specific mine safety concerns are at risk of not being conducted due to COVID-19. Additionally,
miners with preexisting health issues (e.g., respiratory disease) are especially vulnerable to the coronavirus.

Finally, OWCP is challenged with timely processing compensation claims due to the pandemic. The agency has received
a significant number of coronavirus-related claims, and OWCP resources may be strained as those numbers continue to
increase. Further, claimants are experiencing difficulties obtaining the employment and medical documentation
required to adjudicate their claims due to social distancing mandates in effect across the country.

For more information on the DOL
Office of Inspector General visit
https://www.oig.dol.gov/.

U.S. Department of Labor 71
U.S. DEPARTMENT OF STATE

The U.S. Department of State OIG believes that oversight of contracts and grants, protection of personnel and Americans
abroad, workforce management, and information security are the most significant challenges the Department is facing
and will continue to face as it manages its pandemic-related responsibilities and the more than $1 billion in emergency
funds that were appropriated to it. These issues are existing challenges for the Department that the OIG have previously
noted in the Inspector General’s annual statement on major management and performance challenges. Based on
ongoing and past oversight activities, the OIG believes these same issues will continue to challenge the Department and
will likely be exacerbated by the urgent timeline and uncertain environment presented by the COVID-19 pandemic.
Importantly, this is the OIG’s assessment of pandemic-related challenges to date; the rapidly evolving nature of this
situation could change those conclusions in the short- or long-term.

Oversight of Contracts, Grants, and Foreign Assistance
Under ordinary conditions, the oversight of contracts and grants is a significant challenge for the Department. The OIG
regularly finds that, domestically and abroad, Department entities do not consistently and adequately monitor
contractor performance and oversee grants programs. Regarding contracts, the OIG’s work often highlights specific
issues, such as deficient invoice review and approval processes, inexperienced and untrained oversight personnel, lapses
in documenting contractor performance, and complex programs and contracts that are simply too large for the oversight
resources devoted to them. Regarding grants oversight, the OIG frequently finds deficiencies related to monitoring
plans and risk assessments, site visits, and program evaluation.

Because a substantial portion of the recovery and relief resources appropriated to the Department will be expended
through contracts and grants, the OIG notes that oversight of these instruments will be a top challenge facing the
Department in this context. Inadequate oversight and mismanagement of contracts and grants may pose a financial risk,
which will likely be compounded by the crisis setting. Namely, as is often necessary for emergency relief and recovery,
regulations may be waived, contract requirements may be loosened, and safeguards to ensure careful spending may be
lifted to speed relief. These circumstances make it more likely the Department will be unable to properly ensure that it
receives the intended benefits from its contracts and that grants fulfill their objectives.

Oversight and management of foreign assistance programs is another possible facet of this challenge. The Department’s
strategy to respond to the pandemic includes the use of foreign assistance to bolster health institutions and capacity;
address complex emergencies and humanitarian crises; and prepare for economic, civilian security, stabilization, and
governance challenges related to the pandemic. The Department has announced that the U.S. government has
committed more than $775 million to date in assistance to address the crisis. Oversight of these funds will likely
implicate the same pandemic-related challenges that the OIG notes regarding contracts and grants generally.

Protection of Personnel and Americans Abroad
The Department’s global presence makes the protection of its personnel a perennial challenge. Although safety and
security concerns are naturally greater in conflict areas, all U.S. diplomatic personnel and their families serving abroad
face some level of risk, including from natural disasters, environmental hazards, and ordinary crime. In the context of a
global health crisis, protecting the Department’s workforce will likely be even more difficult. The Department will likely
face challenges in establishing and enforcing policies responsive to COVID-19 issues in the workplace and ensuring
employee safety as it continues to conduct essential operations around the world. This may be particularly true for

U.S. Department of State ͹ʹ
personnel in embassies in conflict zones. More generally, Department employees who remain abroad may be located in
countries that have inadequate local health care systems. Compounding these difficulties, reductions in international
flights may affect the Department’s distribution systems, potentially hindering the shipment of supplies. Although the
OIG observed that the Department has sought to mitigate health and safety risks to its personnel, this challenge will
persist as long as the health crisis remains.

Protection of American citizens abroad is one of the Department’s most important priorities, and one made more
difficult by the current pandemic. About 6.8 million Americans live abroad and more than 65 million travel abroad each
year. The Department has already repatriated almost 80,000 American citizens, the largest exercise of its kind in its
history and a number greater than the entirety of its workforce.

Workforce Management

OIG oversight work often finds that staffing gaps, frequent turnover, and inexperienced and undertrained staff
contribute to the Department’s other management challenges. Workforce management issues such as these occur
throughout the Department, affecting programs and operations domestically and overseas and across functional areas
and geographic regions. The OIG anticipates that changes in embassy staffing as a result of the pandemic may magnify
this challenge and exacerbate other challenges.

More than one-third of Foreign Service employees are on evacuation status as of early May 2020, which may affect the
Department’s ability to carry out its pandemic-related responsibilities as well as its overall mission. Additionally, the
Department has a worldwide moratorium on permanent change of station travel through the end of May, which, if
prolonged, could affect Department operations. For example, reduced staff may pose difficulties for carrying out
emergency U.S. citizen services and for overseeing the contracts and grants through which the Department will expend
its relief funds.

Information Security and Management

The OIG has long identified information system security deficiencies at the Department. Despite some steps to address
these concerns, the IG has found the Department’s information systems and networks continue to be vulnerable. Much
like the workforce management issues noted above, OIG views this as a systemic difficulty that affects all Department
programs and operations. As such, the OIG believes it will likewise be a challenge for the Department as it seeks to fulfill
its pandemic-related responsibilities. For example, as a result of social distancing policies, the Department has
transitioned much of its workforce to telework status, which may place strains on its ability to support operations
efficiently and securely.

For more information on the State
Office of Inspector General visit
https://www:stateoig.gov/.

U.S. Department of State 73
U.S. DEPARTMENT OF THE INTERIOR

The OIG identified three broad challenges for the U.S. Department of the Interior (DOI) as it handles pandemic-related
responsibilities and emergency funds based on lessons learned from past audit and investigative work, as well as
anecdotal and publicly available information.

Financial Challenges—Providing Expedient Assistance to Vulnerable
Populations While Assuring Money Reaches Intended Recipients for
Intended Purposes
DOI received $756 million in CARES Act funding. The Bureau of Indian Affairs ($453 million), Bureau of Indian
Education ($69 million), and the Office of Insular Affairs ($55 million) together received 76.3 percent of DOI’s total
funding. The remaining funds were received by the Bureau of Reclamation ($20.6 million) and Department Operations
($158.4 million). DOI OIG also received $1 million.

The most significant challenge facing the DOI is that the majority of its funding is allocated to vulnerable populations
with a credible need for immediate assistance to combat COVID-19, but also with a history of fraud, abuse, and
mismanagement of federal funding. Additionally, the DOI generally faces challenges with emergency management
spending.

Vulnerable Populations
Indian schools and jails contain high-risk populations within a more general high-risk population—residents of Indian
Country. Specific challenges in Indian schools include ensuring student safety and health while providing educational
services, providing low-income student meal services, meeting testing and time requirements to meet legal obligations
(or obtaining waivers), and addressing the implications of closing schools through the end of the school year.

Inmates at detention centers are also at risk. The Bureau of Indian Affairs operates or funds numerous detention
centers through its Justice Services program. Challenges include monitoring for COVID-19 outbreaks; using current
funds (due to delays in CARES Act funding) to respond to COVID-19 issues such as movement of inmates, cleaning
facilities and other decontamination efforts, purchasing personal protective equipment, and overtime for staff;
overcrowding in jails, which may lead to conditions where COVID-19 can easily spread; inconsistent decisions by tribal
courts regarding early release and confinement; and not following Centers for Disease Control and Prevention
Guidelines at detention facilities.

Vulnerable Financial Management
With past disasters, the OIG has found emergency supplemental funding can face heightened risk of misuse and
vulnerability to fraud. The OIG expects this will be the case with pandemic relief as experience suggests that when
recipients face a tremendous crisis and then receive multiple sources of substantial funding, accountability mechanisms
can quickly be overwhelmed. For this pandemic, the crisis spans the nation. The OIG’s concerns likewise span all DOI
activities, but are particularly focused on the assistance flowing to Indian Country.

OIG audits and investigation have found weaknesses that leave federally-funded programs and operations in Indian
Country and the Insular Areas susceptible to fraud, waste, mismanagement, and abuse. Examples include: nepotism;
improper payments to related parties; hiring deficiencies; internal control and general financial management
deficiencies; lack of transparency, inadequate oversight, and flawed reporting systems; and for Indian Country,

U.S. Department of the Interior ͹Ͷ
inadequate employee background checks, unallowable commingling of federal funds with tribal funds, and a poor
history of Bureau of Indian Affairs oversight for funding to tribes.

Apart from weaknesses in Indian Country and the Insular Areas, the OIG has reported the challenges the DOI faces in
administering its contracts and ensuring that it receives full value for its investments. The availability of emergency
supplemental funding can lead to unwarranted price elevation (gouging), unsupported cost claims, sole source
contracting, split and duplicative purchases, contracts awarded to companies without prior federal experience,
timesheet forgery, low bids with the expectation to add funds, and the potential for breaches of ethical standards and
safeguards. Even contractors with positive intent can find themselves struggling to meet obligations due to supply
chains under stress. Current conditions impede not only contractor performance but also DOI monitoring.

Programmatic Challenges—Balancing Public and Employee Safety with
Access to Public Lands

With hundreds of millions of acres of federal land and the responsibility for offshore energy leases, the DOI is the federal
government’s largest landholder. Access to this space for recreation, water, energy production, research, or resource
management is critical to meet the DOI’s mission. Coupled with active COVID-19 transmission, this access can
jeopardize the health and safety of the public and DOI employees. Additionally, while understandable to address
employee safety, reducing active oversight by DOI employees of public lands while still allowing public access could
jeopardize the land and resources themselves.

With the DOI’s deferred maintenance needs estimated at $16 billion, it will likely see that periods of disuse, or of
unsupervised use, have led to damage. Shortcomings in preventive maintenance can lead to higher costs; unused trails
become overgrown, while trails open to an unsupervised public may be trampled and eroded; and damage to natural
and cultural resources may be irreparable.

Allowing public use now, while restricting employee monitoring to maintain employee safety, could lead to similar
resource protection and maintenance challenges as the OIG saw during the 2019 government shutdown. Difficulty
obtaining protective supplies (e.g., personal protective equipment and hand sanitizer) would exacerbate this challenge.
Additionally, the federal government does not manage some of the facilities located on public lands, further increasing
coordination and safety challenges.

Information Technology Challenges

The DOI relies on complex, interconnected information technology (IT) systems to carry out its daily operations. The DOI
spends about $1.2 billion annually on IT systems to support bureau operations and programs. The DOI continues to
struggle to implement an enterprise IT security program that balances compliance, cost, and risk while enabling bureaus
to meet their diverse missions. An increased need for remote access to IT systems under COVID-19 restrictions could
exacerbate these problems.

For more information on the DOI
Office of Inspector General visit
https://www.doioig.gov/.

U.S. Department of the Interior 75
U.S. DEPARTMENT OF THE TREASURY

Among the U.S. Department of the Treasury’s numerous responsibilities under the CARES Act are provisions specific to
providing direct financial assistance to the airline industry, as well as direct payments to state and local units of
government, U.S. territories, the District of Columbia, and tribal governments. Treasury acted swiftly to provide the
much needed assistance to support airline payrolls and expenses related to COVID-19 relief. To do this, Treasury utilized
existing resources, and in some instances, contracted for assistance.

Challenges and Risks
Reallocating existing resources poses challenges with an already predominately full-time telework workforce and
impacts other programmatic challenges that Treasury continues to address. It has been noted for several years that
Treasury continues to operate in an uncertain environment usually attributable to the debt impasse and understaffing
of key positions such as cybersecurity personnel and other specialists. This uncertainty continues with the need to
administer CARES Act programs and funding while ensuring other critical programs do not become undermanaged
and/or understaffed.

Cyber threats are also a persistent challenge government-wide. Treasury’s existing information technology (IT)
workforce had to augment its IT infrastructure to implement the CARES Act programs. That said, Treasury will need to
balance its resources and be vigilant as a full-time telework workforce during the pandemic poses additional risks to
Treasury’s security posture.

The CARES Act also has a direct impact on accountability and transparency of data reported under the Digital
Accountability and Transparency Act, as well as improper payment reporting, related to the financial assistance provided
by Air Carrier Worker Support and the Coronavirus Relief Fund.1 As described below, the Treasury OIG has implemented
audit oversight of these programs.

Air Carrier Worker Support
Title IV, Subtitle B, of the CARES Act provides up to $32 billion in payroll support to the airline industry to enable
continued payments to employees and to avoid job cuts. Support is allocated among passenger air carriers that may
receive up to $25 billion, cargo air carriers that may receive up to $4 billion, and certain contractors that may receive up
to $3 billion. The CARES Act also assigned Treasury OIG with responsibility to audit certifications of “sworn financial
statements” and/or other data from passenger air carriers, cargo air carriers, and contractors that do not report
financial data to the U.S. Department of Transportation (DOT).

Treasury quickly implemented a program to manage air carrier support payments and is developing an oversight
function to monitor recipient compliance.

The OIG has two audits underway to review Treasury’s implementation of the Air Carrier Worker Support and assess
certifications of applicable passenger and cargo air carriers and contractors that do no report financial data to DOT.

1 Digital Accountability and Transparency Act of 2014, Pub. L. No. 113-101 (2014).

U.S. Department of the Treasury ͹͸
Coronavirus Relief Fund

Title V of the CARES Act amended Title VI of the Social Security Act in establishing the Coronavirus Relief Fund.? Title V
appropriated $150 billion for making payments to states and qualifying local units of government, U.S. territories, the
District of Columbia, and tribal governments. Payments are made in accordance with requirements outlined in Title V,
of which $3 billion is allocated to the District of Columbia and U.S. territories and $8 billion is allocated to tribal
governments. No state will receive a payment of less than $1.25 billion.

The CARES Act stipulates that the recipients use the funds provided under Title V to cover only those costs that (1) are
necessary expenditures incurred due to the public health emergency with respect to COVID-19; (2) were not accounted
for in the budget most recently approved as of March 27, 2020; and (3) were incurred between March 1, 2020, and
December 30, 2020.

Similar to the Air Carrier Worker Support payments, Treasury had to work expeditiously to make direct payments to
eligible recipients in accordance with Title V. Although Treasury established some guidance on its methodology for
distributing funds as well as eligible uses of funds, Treasury does not plan to establish a program or management
oversight function after payments are made and did not establish agreements with recipients of Coronavirus Relief
Fund payments.

Title V assigned oversight and recoupment authority to the Treasury OIG. Specifically, the OIG is responsible for the
monitoring and oversight of the receipt, disbursement, and use of funds under Title V and ability to recoup funds that
are not used for purposes authorized by Title V.

In its monitoring and oversight to date, Treasury OIG noted the lack of accountability and transparency on the part of
Coronavirus Relief Fund recipients without agreements or terms and conditions establishing requirements for the use of
funds and reporting on such uses among other things. Treasury had agreed to work with the OIG to develop such
guidance, with the goal of assuring that fund applicants and recipients are in compliance with the law, and assuring that
the monitoring and oversight, in the form of downstream audit work, will have the records needed to carry out proper
audit work.

Other Oversight

The OIG is also working with Treasury’s Bureau of the Fiscal Service to identify risk points in the processes by which
disbursements of funds are made to recipients, as well as coordinating anti-fraud investigations with other OlGs, other
law enforcement agencies, and the U.S. Department of Justice.

Treasury OIG is making preliminary inquiries to determine the impact of telework and closures on bureaus’ ability to
conduct on-site reviews, such as for financial institutions regulated by the Office of the Comptroller of the Currency, and
entities subject to the oversight of the Alcohol and Tobacco Tax and Trade Bureau.

In addition, Treasury OIG has coordinated with the Federal Reserve Board OIG to assist in full oversight of the
Implementation of Emergency Economic Stabilization Funds distribution processes by Treasury and the Federal Reserve.

For more information on the
Treasury Office of Inspector General
visit https://www.treasury.gov/
about/organizational-

structure/ig/Pages/default.aspx

2 Social Security Act of 1935, as amended.

U.S. Department of the Treasury 77
U.S. DEPARTMENT OF TRANSPORTATION

The United States transportation system is central to the American economy as it facilitates the nation’s jobs,
businesses, and way of life. The transportation industry has been one of the hardest hit by the COVID-19 pandemic.
As such, implementing the CARES Act is among the U.S. Department of Transportation’s (DOT) highest priorities in this
time of national emergency.

The CARES Act provides DOT with over $36 billion to prevent, prepare for, and respond to COVID-19 across all modes of
transportation. To its credit, DOT swiftly distributed these funds and has begun implementing the Act’s requirements to
provide much-needed relief to American workers, families, and businesses.

The volume of CARES Act funds and the speed with which the funds have been disbursed creates oversight challenges.
Therefore, to aid the Department in meeting its mission while promoting effective stewardship of significant taxpayer
dollars, the DOT OIG is providing a summary of five key risk areas for DOT’s consideration in bolstering its oversight of
CARES Act grantees and contractors. These potential risk areas and the OIG’s suggested actions to mitigate those risks
are drawn largely from the OIG’s prior work assisting DOT with oversight of a large influx of funds for economic stimulus
and emergency relief. By maintaining focus on these areas early on and putting in place key internal controls, DOT can
promote efficiencies; help ensure compliance; and better prevent fraud, waste, and abuse. Meeting these goals will
maximize the efficacy of CARES Act funds in our nation’s time of crisis.

Effectively Managing Grants to Support the Nation’s Airports
In accordance with the CARES Act, the Federal Aviation Administration (FAA) awarded $10 billion to about 3,000
commercial and general aviation airports through CARES Act formula grants and the Airport Improvement Program
(AIP). These funds are intended to support airports’ continuing operations and replace lost revenue resulting from the
sharp decline in passenger traffic and other airport business due to COVID-19. To promote effective stewardship of
these grants, the Agency will need to enforce grant assurances to ensure recipient airports use the funds only for their
intended purpose and meet CARES Act and AIP requirements. Moreover, FAA will be overseeing the vast number of
grants with its limited resources. This underscores the importance of following a risk-based oversight approach,
assigning the appropriate risk level to grantees, and adjusting the Agency’s oversight accordingly.

Adapting Existing Stewardship and Oversight Approaches While Ensuring
Prudent Use of Waivers in Surface Transportation
Through the CARES Act, surface transportation agencies received an extraordinary amount of funding as well as the
authority to temporarily waive existing federal regulations in specific areas. The Federal Transit Administration (FTA)
was provided $25 billion to help the nation’s public transit systems mitigate the impacts of COVID-19. The Act provided
another approximately $1 billion to the Federal Railroad Administration to similarly support Amtrak, as well as smaller
amounts to the Maritime Administration and the Federal Motor Carrier Safety Administration. Notably, the CARES Act
authorizes using funds to support public transit agencies’ operating expenses. As a result, FTA and other CARES Act-
funded surface transportation agencies may need to adopt new or alternative approaches to ensure recipients meet
federal requirements and funds are used for eligible purposes. Further, the CARES Act requires FTA, along with other
agencies, to provide waivers to certain rules to account for conditions caused by COVID-19 and expedite the funding
process. It will be vital to monitor the impact of these waivers closely and provide transparency, including meeting
congressional reporting requirements under the Act for the use of waivers.

U.S. Department of Transportation ͹ͺ
Executing Contracts and Grants Effectively to Achieve Transportation
Program and Project Outcomes

Given the large influx of funds the CARES Act provides, DOT will need to award and administer contracts and grants
effectively, including ensuring required cost estimates and justifications are in place and fostering competition to the
extent practicable. DOT could help mitigate these cost risks and ensure more effective use of CARES funds by assessing
pricing and competition trends and sharing best practices across all Operating Administrations and their grantees.

In addition, it is vital that DOT provide clear direction to contractors and grantees on desired outcomes along with
requirements for supporting and reporting expenditures. Moreover, a major challenge underscoring all of DOT’s
CARES Act efforts will likely be ensuring that qualified, skilled, and appropriately trained personnel and support staff
are available to manage the awarded funds.

Tracking and Monitoring CARES Act Funds While Ensuring the
Availability and Integrity of DOT’s Financial Management Systems

Strong financial stewardship of CARES Act funds will depend on DOT’s ability to effectively disburse, track, and monitor
them. However, DOT may face risks in enforcing grantees to submit quality data on their spending. To help mitigate
risks and enhance accountability as DOT quickly disburses CARES Act funds, it will be critical to implement data quality
procedures for tracking and monitoring. Further, to reduce the risk of improper payments, DOT can enhance its efforts
to detect errors in tracking and monitoring grant activities. In addition, to better protect the availability, data integrity,
and confidentiality of sensitive information and mitigate risks to its financial management information technology
systems, DOT will need to effectively select, assess, and monitor its security controls and effectively detect and correct
weaknesses.

Increasing Outreach and Education to Transportation Agencies to
Prevent and Detect Fraud, Waste, and Abuse

The volume of CARES Act funds and the speed with which they must be disbursed puts them at a higher than usual risk
for fraud, waste, and abuse. DOT can help mitigate this risk by increasing its outreach and education efforts to enhance
understanding among DOT staff, grantees, and their contractors on how to recognize, prevent, and report potential
fraud to the appropriate authorities, including the OIG. It will also be essential to take timely action to suspend and/or
debar individuals or firms that have defrauded the government or are otherwise known to be irresponsible, while
enhancing efforts to ensure these parties do not receive federal contracts in the future.

For more information on the DOT
Office of Inspector General visit
https://www.oig.dot.gov/.

U.S. Department of Transportation 79
U.S. DEPARTMENT OF VETERANS AFFAIRS

The U.S. Department of Veterans Affairs (VA) has a $220.7 billion budget with nearly 390,000 employees serving an
estimated 19 million veterans for fiscal year 2020. VA maintains a presence in every state, the District of Columbia, the
Commonwealth of Puerto Rico, Guam, the Republic of the Philippines, and the U.S. Virgin Islands. VA also operates the
largest integrated health care system in the United States with over 1,200 medical facilities serving more than 9.2 million
enrolled veterans. COVID-19 has had a major impact on VA’s ability to fulfill its mission of caring for the nation’s
veterans by providing health care, benefits, and memorial services through its three administrations—the Veterans
Health Administration (VHA), the Veterans Benefits Administration (VBA), and the National Cemetery Administration—
as well as its ability to fulfill its “fourth mission” to improve the nation’s preparedness and response to disasters and
emergencies. Even before the pandemic, VA’s size and complexity of operations made it extremely challenging to
manage effectively. The pandemic is exacerbating long-standing challenges and delaying initiatives intended to
remediate these problems, including financial management and the transformation of business processes.

To assist with the response to the current crisis, the CARES Act provided $19.6 billion in supplemental funding for VA.
Because VA’s financial management system is over 25 years old and has functional limitations well documented in
OIG reports, VA may experience financial management and reporting challenges related to those supplemental funds.
In addition to continued oversight of VA’s financial management and controls, the OIG is primarily focused on four areas
of concern to assist VA during these challenging times. They are described below.

Mitigating Risks to Patients and Staff
Safeguarding health care settings is essential for preventing the spread of COVID-19, particularly in nursing homes
(referred to by VA as community living centers) because patients in these facilities are considered to be at higher risk for
infection, and the nation’s most devastating outbreaks have occurred in long-term care settings. In mid-March 2020,
VHA began implementing screening processes to assess veterans’ and visitors’ infection status at all VHA facilities. In the
OIG’s recent report on VHA’s COVID-19 screening processes and pandemic readiness, the results from an expeditious,
unannounced evaluation of these screening procedures are detailed.1 Although the OIG found that the majority of VA
facilities visited had effective screening and access control procedures, the inspection team noted deficiencies in
screening processes and access controls at multiple facilities.

In addition to securing settings, facilities must ensure key operations are running efficiently, particularly those providing
critical supplies and equipment. During a pandemic, it is especially critical that hospitals have effective core services
that promote quality care and patient safety. Access to appropriate personal protective equipment and testing kits are
essential to preventing the transmission of the virus among staff and patients. However, during the March 2020
inspections for the report mentioned above, facility leaders acknowledged low inventory of personal protective
equipment for staff and inefficiencies related to COVID-19 testing. Widespread media reports have indicated that these
types of issues have worsened because of the duration of the public health emergency and nationwide shortages of
critical supplies, leading at some point to rationing in the VA health care system.

Further, the limitations of some of VA’s other core services such as inventory control and distribution are likely to
negatively affect VA’s ability to determine which locations have excess supplies that could be routed to locations with
greater needs. VA recognizes the importance of having supplies and equipment where and when they are needed for

1 VA OIG, OIG Inspection of Veterans Health Administration’s COVID-19 Screening Processes and Pandemic Readiness (20-02221-120,
March 26, 2020).

U.S. Department of Veterans Affairs ͺͲ
staff use and patient care and has been in the process of migrating to a new inventory management system. Successful
implementation of a new inventory management system and addressing procurement issues will continue to be key
challenges moving forward.

Maintaining Access to Care

Despite concerted efforts to improve patients’ access to timely and quality care at VA facilities through increased facility
staffing, internal process improvements, and expanded community care and telehealth options, providing this access
continues to be a significant challenge for VHA. For more than a decade, the OIG, Government Accountability Office, VA,
and others have issued numerous reports regarding concerns with delays or barriers to accessing VA care. Recently,
these access issues have been exacerbated, as both VA facilities and community providers have curtailed non-urgent
and routine health care appointments to avoid placing staff and patients at unnecessary risk of contracting COVID-19
and to preserve limited supplies and equipment. To partially address these access issues, VA has reported a dramatic
uptick in the use of telehealth. However, a significant backlog for in-person appointments will likely persist for months
or longer because of the imbalance between capacity and demand for telehealth appointments, the inability to perform
many types of health care services without person-to-person contact, and information technology (IT)-related issues
that limit some patients’ abilities to obtain service via telehealth.

Providing Accurate and Timely Claims Decisions and Appeals

Starting March 19, 2020, VA regional offices were closed to the public. By leveraging telework, available IT resources,
and other strategies, VBA has been endeavoring to effectively administer nearly $125 billion in mandatory funding for
federally authorized benefits and services to eligible veterans, their dependents, and survivors. Nonetheless, published
OIG reports identified recurring deficiencies such as inadequate planning, controls, and IT functionality that contribute
to inefficiencies and inaccuracies in benefit claims and appeals processing. As a result of these recurring issues involving
VBA’s processes, COVID-19 demands will further stress attempts to maintain the accuracy and timeliness of essential
claims and appeals-related activities, such as conducting disability examinations and collecting and processing
documents that are transmitted via mail. However, the magnitude of the impact is unknown at this time.

Identifying and Mitigating the Risk of Fraud, Waste, and Abuse

VA has numerous initiatives to curb fraud, waste, and abuse. However, the pandemic is creating novel opportunities for
bad actors, particularly as financial controls are loosened to facilitate rapid purchases of essential goods and services.
On numerous recent occasions, VA has referred suspicious activity to the OIG for investigation with noteworthy
outcomes. For example, in one of the first and largest COVID-19-related fraud cases brought to date, VA OIG
investigators collaborated with other law enforcement authorities to arrest a Georgia resident for attempting to sell
millions of nonexistent respirator masks and other personal protective equipment totaling over $750 million to VA in
exchange for large upfront payments.” Continued, quick handoffs between VA and the OIG, as well as the use of the
OIG’s predictive analytics of procurement and claims data, will help address criminal activity and other misconduct
arising during the pandemic. Fully resourcing this type of work is among the OIG’s top priorities.

For more information on the VA
Office of Inspector General visit
https://www.va.gov/oig/.

2 U.S. Department of Justice, Georgia Man Arrested for Attempting to Defraud the Department of Veterans Affairs in a Multimillion-Dollar
COVD-19 Scam (April 10, 2020). View at https://www.justice.gov/opa/pr/georgia-man-arrested-attempting-defraud-department-veterans-
affairs-multimillion-dollar-covid (last accessed May 13, 2020).

U.S. Department of Veterans Affairs 81
U.S. ELECTION ASSISTANCE COMMISSION

In the CARES Act, the U.S. Election Assistance Commission (EAC) received a supplemental appropriation of $400 million
for Election Security Grants to be allocated to states and territories (hereinafter, states) using a congressionally-directed
formula “…to prevent, prepare for, and respond to coronavirus, domestically or internationally, for the 2020 Federal
election cycle.” The CARES Act also includes special reporting requirements under which states “…shall provide to the
Election Assistance Commission, within 20 days of each election in the 2020 Federal election cycle in that State, a report
that includes a full accounting of the State’s uses of the payment and an explanation of how such uses allowed the State
to prevent, prepare for, and respond to coronavirus.” EAC must transmit any such reports to designated committees in
Congress within 3 days of receipt. The fiscal year 2020 Consolidated Appropriations Act (Appropriations Act), which
provided the original $425 million for Election Security Grants supplemented by the CARES Act, requires states to match
20 percent of the federal funds with state funds over the 2-year period following passage of the Appropriations Act.1
The matching requirement from the 2020 Appropriations Act carries forward to the supplemental appropriation in the
CARES Act. EAC must provide CARES Act funds within 30 days of passage and the funds are available for the states to
obligate until December 31, 2020.

Response to the COVID-19 Pandemic Has Virtually Supplanted EAC’s
Regular Workload and EAC Received No Supplemental Funding to
Support the Extra Needs
The biggest challenge EAC currently faces is the need to redirect staffing to respond to the COVID-19 crisis. EAC’s
pandemic response involves providing resources to the states, distributing an additional $400 million in grant funds
(within approximately 1 month of distributing the original $425 million), responding to an unusually high number of
congressional and media inquiries, updating relevant best practices and research products for election officials,
establishing and maintaining a new webpage devoted to administering elections during the pandemic, scheduling
hearings, and providing video resources for election officials to assist them in making difficult decisions.2 None of the
bills that have funded the federal government’s pandemic response contained any funds for EAC salaries or
administrative costs to support or ease the resulting workload compression.

Matching Requirements Applicable to the CARES Act Supplemental
Appropriation Create a Potential Consequence Which Together with
Timing Constraints May Effectively Prevent Some States from Obtaining
and Using the Funds Fully
The CARES Act became law on March 27, 2020. Each state may use the federal funds for pandemic-related costs
incurred between January 20, 2020, and the end of the calendar year. States thus have a little less than a year to spend
the federal and state matching funds on a fairly narrow scope of activities and costs. By contrast, the Appropriations Act
gives states 2 years from passage of the law to meet the matching requirement, a provision that carries forward to the
supplemental CARES Act appropriation. However, while the Appropriations Act funds may be spent on improvement of

1 Further Consolidated Appropriations Act, 2020, Pub. L. No. 116-94 (2019).
2 The EAC’s website on administering elections during the pandemic can be found at https://www.eac.gov/election-officials/coronavirus-covid-19-
resources (last accessed on June 8, 2020).

U.S. Election Assistance Commission ͺʹ
election administration, the funds for the CARES Act supplemental appropriation must be spent only for the CARES Act
purposes, namely, prevention, preparation, and response to the coronavirus in the 2020 election cycle. Although EAC
has worked closely with the Office of Management and Budget and relevant congressional committee staffs to craft
guidance that allows as much flexibility as possible under the law, states may have difficulty identifying pandemic-
related costs on which to spend any state matching funds after the completion of the 2020 election cycle. Thus, states
effectively have only a few months in which to appropriate and expend their pandemic response funds.

States May Not Have Full and Accurate Cost Information Within the
20-day Timeframe Contained in CARES Act Reporting Requirements

Some states may not be able to obtain sufficient information on all of the costs for a given election within 20 days of the
date of the election, so reports of expenditures required by the CARES Act may not provide a fully accurate picture of
their costs. Thousands of local jurisdictions, rather than states, administer elections and report their expenditures to the
states after completing all election-related activities including counting absentee ballots, performing audits and other
processes, certifying the election, and verifying election data. Such activities at the local level may be difficult to
complete in time to identify, accumulate, summarize, verify, and prepare cost information for the states to report to the
EAC within the 20-day requirement.

A Few States’ Requirements for Legislative Action Could Delay or Prevent
Use of CARES Act Funding

All 56 eligible grantees requested and received EAC CARES Act grant funding. However, two states requested only the
amount of funding they would be able to match with the required state share, which was less than the full funding
available to them. Those states may request additional federal funding if they can secure the additional state funds
required to match their full federal allocation.

In addition, while all states requested and received funds, a few of the states that requested their full funding still need
their respective state legislatures to authorize the use of the federal funds and/or appropriate the states’ matching
funds. Many state legislatures have experienced altered schedules due to the pandemic and many state budgets are
strained by non-election costs incurred to respond to the pandemic. Thus, some state legislatures may not be able to
take action in time to allow states to use the funds during the period of availability.

For more information on the EAC
Office of Inspector General visit
https://www.eac.gov/inspector-

general.

U.S. Election Assistance Commission 83
U.S. ENVIRONMENTAL PROTECTION AGENCY

The U.S. Environmental Protection Agency’s (EPA) mission is to protect human health and the environment. During the
coronavirus pandemic, the EPA has made many adjustments to programs and operations by, for example, issuing
regulatory waivers and making exceptions to regulatory requirements, policy, and internal controls. The EPA’s most
immediate response to the coronavirus pandemic has involved approving disinfectants to kill the SARS-CoV-2 virus,
which causes the COVID-19 virus, on surfaces. The EPA has also developed a list of products that are registered to
destroy viruses known to be as difficult—if not more difficult—to kill than SARS-CoV-2. In addition, to address pesticide
supply chain shortages, the EPA is temporarily allowing companies to change—without prior EPA approval, as is typically
required—the suppliers of certain active ingredients in approved products.
The OIG is tracking and reviewing EPA responses to the coronavirus pandemic. The OIG also plans to assess the risks of
the EPA’s emerging and existing activities to address the pandemic. To guide the OIG’s work, the OIG has identified
some initial challenges to the EPA’s ability to achieve its mission, as well as to the EPA’s internal operations. These
challenges, and some of their associated risks, are detailed below.

Risks to EPA’s Mission Achievement—Successful Implementation of
EPA Programs
Enforcement and Fraud Risks
Effective enforcement is key to combating and deterring violations of law, including fraud. Inspections of recent
imports have identified products marketed with unsubstantiated and potentially dangerous claims of protection against
SARS-CoV-2. Companies are also fraudulently claiming that their products are approved or endorsed by the EPA or
contain EPA-approved disinfectants for use against SARS-CoV-2. The prevalence of fraud related to EPA programs and
operations will most likely increase as fraudsters identify new ways to exploit consumers frightened by the coronavirus
pandemic.

The EPA has also implemented a temporary environmental enforcement policy that curtails several routine regulatory
monitoring and enforcement activities. The EPA must maintain a robust enforcement program to address
environmental violations and promote deterrence. The OIG recently reported that the EPA’s enforcement activities and
its resources for conducting routine regulatory enforcement work have declined over time.1 Additional reduction in
enforcement activity places the EPA’s regulatory mission at greater risk and threatens the Agency’s overall mission to
protect human health and the environment.

State, Tribe, and Territory Program Implementation
States, tribes, and territories often act as the frontline implementers of federal environmental laws on the EPA’s behalf.
As a result of the coronavirus pandemic, these groups face financial and personnel challenges that further limit their
ability to adequately implement federal requirements. Similar challenges face the nation’s drinking water and
wastewater utilities. Tribal drinking water and wastewater treatment operations have been particularly impacted by
personnel shortages. Additional planning, assistance, and oversight by the EPA may be necessary to support states,
tribes, territories, and local utilities facing resource strain under the coronavirus pandemic.

1 EPA OIG, EPA’s Compliance Monitoring Activities, Enforcement Actions, and Enforcement Results Generally Declined from Fiscal Years 2006
Through 2018 (20-P-0131, March 31, 2020).

U.S. Environmental Protection Agency ͺͶ
Risk Communication to the Public

Recent OIG reports have identified risk communication as an Agency challenge, including a March 2020 management
alert on ethylene oxide-emitting facilities.? The issues identified in that alert may persist or increase in severity as some
of these facilities—particularly those that provide medical sterilization services—are further strained to address
pandemic-related issues. Also, the lessened regulatory oversight noted above may produce environmental or public
health risks requiring additional communication to affected communities.

Risks to EPA’s Operations—Maintaining a Safe and Productive EPA
Workforce

Returning to Work Safely

The Agency must ensure that its field employees—inspectors, educators, on-scene coordinators, and others—can
protect their own safety and the safety of those with whom they interact. This requires the EPA to procure additional
personal protective equipment and adapt existing protocols. As the coronavirus pandemic persists, the EPA faces the
challenge of eventually returning its 15,000-member workforce to federal office spaces. This requires successful
implementation of cleaning, social distancing, and continued protection protocols across more than 150 EPA facilities.

Effective Remote Technology

The OIG previously identified the need for the EPA to enhance information security. This challenge has become more
critical in the current environment. Continuing EPA operations in the face of the coronavirus pandemic has required the
Agency to adapt its network to support a now primarily virtual workforce and provide an unprecedented number of
remote employees with a reliable, stable means to communicate and access critical applications and data. Information
technology (IT) helpdesk functions could be delayed by an overtaxed IT staff, who also must now deploy and manage
new tools and technology. Unprecedented levels of remote access also raise the risk of security breaches of remotely
stored and transmitted data.

Understanding Organizational Risk

The EPA does not have complete information about the preexisting organizational risks it faces in its programs and
operations. This is exacerbated by the unprecedented crisis impacting EPA programs agency-wide. Furthermore, EPA
has not received an increase in full-time equivalent positions or budget to address this significant regulatory workload.
Without prior risk assessments, the EPA faces additional hurdles to adapt to the new risks presented by the coronavirus
pandemic. For example, the OIG previously identified the EPA’s lack of a workload-needs assessment as a top
management challenge. The absence of a robust workload analysis may affect the EPA’s ability to remain resilient in the
face of illnesses or other limitations to existing program staffing.

Financially Sound Contract Oversight

The OIG has consistently raised concerns about the EPA’s oversight of contracts. The EPA faces a new challenge in
contract management as a result of Section 3610 of the CARES Act, which authorizes agencies to reimburse contractors
for the costs of paid leave for their personnel who are unable to both access a government-approved facility and
telework because their jobs cannot be performed remotely. The EPA has advised that funds for Section 3610 will come
from program offices, which would impact program funding. However, the EPA has not yet established guidance for
implementing this section.

For more information on the EPA

Office of Inspector General visit

https://www.epa.gov/office-

inspector-general.

2 EPA OIG, Management Alert: Prompt Action Needed to Inform Residents Living Near Ethylene Oxide-Emitting Facilities About Health Concerns
and Actions to Address Those Concerns (20-N-0128, March 31, 2020).

U.S. Environmental Protection Agency 85
U.S. OFFICE OF PERSONNEL MANAGEMENT

The U.S. Office of Personnel Management (OPM) OIG identified the top challenges the Agency faces to ensure COVID-19
response and recovery funds received are appropriately spent.

In March 2020, OPM, along with the rest of the federal government, experienced a sudden and dramatic shift to a
maximum telework operational status because of COVID-19. OPM’s Chief Information Officer expressed concerns about
the ability of OPM’s aging information technology (IT) infrastructure to absorb this sudden workload increase in remote
access to its virtual private network (VPN) and network connections.

OPM’s Office of the Chief Information Officer developed a strategy to manage capacity by focusing on mission critical
systems and people, and reducing unnecessary “bandwidth hogs” like streaming video services, such as YouTube. OPM
has a second but smaller VPN that backs up the larger VPN enclave that is envisioned for use by executive-level and
other mission critical communications, if needed.

As OPM’s maximum telework operations continued through March and April 2020, the Agency’s network operations
center (NOC) closely monitored VPN usage and network performance. The NOC observed that OPM’s VPN and network
were generally stable and fully operational. However, it also became clear that OPM lacks a suitable enterprise solution
for video web conferencing, which limits effective and secure remote collaboration. The increased telework has also
highlighted shortcomings in OPM’s ability to remotely administer its systems, as well as aging hardware supporting VPN
and network connections. In addition, many OPM processes are paper-based and reliant on human interaction, like
processing federal retirement applications or routing executive correspondence.

OPM’s supplemental COVID-19 funding of $12 million is focused on improved collaboration and conferencing tools,
workflow management, remote administration, and the software and hardware needed to support a majority telework
environment for the foreseeable future. OPM has established an integrated project team to manage the acquisition of
the necessary tools to support these needs. At this time, other than the normal procurement constraints, the OIG does
not see any major challenges facing OPM as it seeks to effectively spend its emergency supplemental funds.

For more information on the OPM
Office of Inspector General visit
https://www.opm.gov/our-
inspector-general/.

U.S. Office of Personnel Management ͺ͸
UNITED STATES POSTAL SERVICE

The United States Postal Service faces several significant challenges in response to the COVID-19 pandemic.
Summarized below are three challenges either brought on or exacerbated by the pandemic.

Managing a Large, Essential Workforce with Limited Telework Options
First and foremost, the majority of the 630,000 postal employees are essential workers, who are in plants or out on the
street daily to meet the mission of delivering critical items to America. Postal employees need to continue working to
ensure mail and packages are processed and delivered, especially as stay-at-home orders and concerns about the virus
have created more demand for delivery services. The Postal Service has had to find ways to continue to keep the mail
moving while keeping its employees safe. This includes distribution of personal protective equipment, implementing
measures at retail and mail processing facilities to ensure appropriate social distancing, and giving carriers guidance on
social distancing and changing work practices and processes while delivering the mail.

In addition, the impacts of the pandemic have been felt on the workforce and on mail flows. The Postal Service is facing
labor shortages as employees become sick, fear getting sick, or need to take time off to provide dependent care. Over a
thousand postal employees have tested positive for the virus, and there have been numerous postal employee deaths.
Managing postal operations with an insufficient number of workers could potentially lead to delays in mail processing
and delivery in some instances.

Mail Volume Declines Associated with the Economic Crisis
Another critical uncertainty faced by the Postal Service is the impact of the COVID-19 crisis on its financial health.
The Postal Service is expected to fund its operations through the revenues it earns from the sale of postal products and
services, and it was already facing significant financial problems prior to the pandemic, with cumulative net losses of
$83.1 billion from 2007 through mid-2020. The financial challenge pre-pandemic is driven by the loss in letter mail,
and the pandemic has worsened this decline. However, the pandemic has also resulted in a surge in parcel volumes for
the Postal Service. It is unclear whether this parcel growth is temporary or more long-lasting, and it is difficult to
determine how much of the revenue gap from the significant mail volume loss will be compensated for by this surge in
parcel revenue.

The CARES Act expanded the Postal Service’s total borrowing authority from $15 billion to $25 billion, and the Postal
Service has stated that this continued borrowing authority will allow it to have sufficient liquidity to continue operations
until at least May 2021. However, to maintain sufficient liquidity, the Postal Service will likely continue to defer its
end-of-the-year retirement benefit-related payments. The combination of additional debt and deferred payments could
lead to deeper financial concerns in the long term.

Critical National Infrastructure Impacts
In addition to these broader issues, the Postal Service faces two specific national infrastructure challenges that have
arisen due to the COVID-19 pandemic—distribution of the economic impact payments and broader voting by mail.
Supporting the U.S. Department of the Treasury in the issuance of billions of dollars in stimulus funding directly to
individuals is a critical role of the Postal Service in the response to this pandemic. Ensuring timely and accurate delivery
of these payments is a current challenge that the Postal Service is focusing significant attention towards. The Postal

United States Postal Service ͺ͹
Service is also having to address the risk of increased theft of the mail as thieves may target postal carriers that are
delivering these checks.

Finally, this election season, the number of voters who request and return ballots via the mail in local, state, and
national elections is expected to increase significantly due to the COVID-19 pandemic. This presents several unique
challenges for the Postal Service as the Agency must ensure the timely processing and delivery of increased ballot
volumes. It also must handle likely increases in political campaign mail associated with these elections. In addition,
the Postal Service will have to collaborate more closely with elections officials whose familiarity with postal processes
may be limited, and who may not fully understand how to use the Postal Service effectively to mail and receive ballots.

For more information on the
Postal Service Office of
Inspector General visit
https://www.uspsoig.gov/.

United States Postal Service 88

File and source

File: top-challenges-covid19-emergency-relief-cross-government.pdf
Size: 2,887,401 bytes
SHA-256: f5bc31f8927653a68cd3289747e94424cddc4446ed587550d711cdd994c8a44f
Our copy: top-challenges-covid19-emergency-relief-cross-government.pdf
Original: www.oversight.gov