Audit Division 20-060 May 2020

Office of the Inspector General

U.S. Department of Justice

OVERSIGHT ★ INTEGRITY ★ GUIDANCE

Audit of the Office of Justice 

Programs’ Denial of Federal 

Benefits and Defense Procurement 

Fraud Debarment Clearinghouse 

System Pursuant to the Federal 

Information Security Modernization 

Act of 2014 Fiscal Year 2019
i 

Commentary and Summary

Audit of the Office of Justice Programs’ Denial of Federal Benefits and 

Defense Procurement Fraud Debarment Clearinghouse System Pursuant to 

the Federal Information Security Modernization Act of 2014 Fiscal Year 2019

Objectives

The objectives of this audit were to determine whether 

the Office of the Justice Programs’ (OJP) Denial of 

Federal Benefits and Defense Procurement Fraud 

Debarment Clearinghouse (DFB/DPFD) system program

and practices were consistent with the requirements of 

the Federal Information Security Modernization Act 

(FISMA). In addition, the audit was designed to perform 

a vulnerability assessment of the DFB/DPFD and 

evaluate selected system security controls.

Results in Brief

The audit identified weakness in one of the six control 

areas that need to be strengthened to ensure OJP’s 

DFB/DPFD and data are adequately protected. In 

addition, we identified control deficiencies in six of the 

eight domain areas of OJP’s Information Security 

Program. These findings and subsequent 

recommendations are reported in the Audit of the OJP’s 

Information Security Program Pursuant to the FISMA of 

2014, Fiscal Year 2019.

Recommendations

This audit provides four recommendations for improving 

OJP’s DFB/DPFD system. 

To ensure OJP was immediately aware of the deficiencies 

identified during this audit, the auditors presented the 

finding to OJP management prior to the issuance of this 

report. OJP management concurred with the identified 

weaknesses.

Public Release

The OIG is publicly releasing this Commentary and 

Summary of the report rather than the full report itself 

because Inspectors General are required by FISMA to 

take appropriate steps to ensure the protection of 

information that, if disclosed, may adversely affect 

information security. Such protections shall be 

commensurate with the risk.

Audit Approach

KPMG LLP conducted this performance audit of OJP’s 

DFB/DPFD system under the direction of the Department 

of Justice Office of the Inspector General (OIG) and in 

accordance with Generally Accepted Government 

Auditing Standards (GAGAS) and the Office of 

Management and Budget (OMB) reporting requirements. 

The OIG reviewed KPMG LLP's report and related 

documentation for compliance with GAGAS. The OIG’s 

review was not intended to enable the OIG to make a 

conclusion about the effectiveness of OJP’s information 

security controls. KPMG LLP is responsible for the 

attached auditors' report dated October 17, 2019, and 

the conclusions expressed in the report. The OIG’s 

review disclosed no instances where KPMG LLP did not 

comply, in all material respects, with GAGAS and OMB 

reporting requirements.

Background

FISMA was passed by Congress and signed into law by 

the President in 2014. FISMA assigns responsibilities to 

federal agencies, the National Institute of Standards and 

Technology (NIST), and OMB to strengthen federal 

information system security. This includes directing 

NIST to develop standards and guidelines for ensuring 

the effectiveness of information security controls over 

information systems that support federal agencies’ 

operations and assets, and requiring the head of each 

agency to implement policies and procedures to costeffectively reduce risks to an acceptable level.

Annually, agency Inspectors General are required to 

either perform an independent evaluation or contract an 

independent external auditor to perform an evaluation of 

the agency’s information security program and practices 

to ensure the effectiveness of the program and 

practices. Each evaluation must include: (1) testing the 

effectiveness of information security policies, 

procedures, and practices of a representative subset of 

the agency’s information systems; (2) an assessment 

(based on the results of the testing) of compliance with 

FISMA; and (3) separate representations, as 

appropriate, regarding information security related to 

national security systems.
U.S. DEPARTMENT OF JUSTICE OFFICE OF THE INSPECTOR GENERAL

950 Pennsylvania Avenue, NW

Washington, DC 20530-0001

 

Also at Oversight.gov

The Department of Justice Office of the Inspector General (DOJ OIG) is a 

statutorily created independent entity whose mission is to detect and deter 

waste, fraud, abuse, and misconduct in the Department of Justice, and to 

promote economy and efficiency in the Department’s operations.

To report allegations of waste, fraud, abuse, or misconduct regarding DOJ 

programs, employees, contractors, grants, or contracts please visit or call the

DOJ OIG Hotline at oig.justice.gov/hotline or (800) 869-4499.

Website Twitter YouTube

oig.justice.gov @JusticeOIG JusticeOIG