U.S. RAILROAD RETIREMENT BOARD

OFFICE OF INSPECTOR GENERAL 

This report summary presents the abbreviated results of 

the subject audit. The full report includes information 

protected from disclosure and has been designated for 

limited distribution pursuant to 5 U. S. C. § 552.

Selected General Information 

System Controls at the Railroad 

Retirement Board Were Not 

Always Adequate

Report No. 19-07 May 14, 2019
OFFICE OF INSPECTOR GENERAL

U.S. RAILROAD RETIREMENT BOARD

Selected General Information System Controls at the Railroad 

Retirement Board Were Not Always Adequate

Report Summary May 14, 2019 Report No. 19-07

What We Found

Our audit determined that the selected information system controls were 

not always adequate. We determined that the agency did not update all 

management control review documentation for the change to the 

Headquarters (HQ) Voice over Internet Protocol (VoIP) system, controls did 

not ensure that the assessable unit documentation was updated timely, 

budget allocation prevented necessary reinvestigations, and personal 

identity verification replacement policy and procedures were not 

comprehensive and were not implemented. The agency employed a field 

VoIP system that had vendor support limited after fiscal year 2018.

What We Recommend

In total, we made four detailed recommendations to Railroad Retirement 

Board (RRB) management related to:

 updating the management control review documentation for the 

headquarters voice telecommunications assessable unit to ensure it 

accurately reflects the RRB's current Headquarters Voice over 

Internet Protocol environment;

 implementing controls to ensure that assessable unit 

documentation is updated timely when changes occur and consider 

whether an acceleration of the assessable unit’s control test should 

be performed;

 reallocating budget dollars to implement reinvestigations based on 

Title 5, Code of Federal Regulations, Part 731, Suitability;1 and

 documenting and implementing personal identity verification 

replacement card policies and procedures that have been approved 

by management to address control weaknesses that were 

identified.

Management concurred with two recommendations, to update HQ voice 

telecommunications documentation, and to document policy and 

procedures for personal identity verification card replacement. They did not 

concur with two recommendations. They stated that due to revised agency 

policy, controls on assessable unit documentation updates were not 

necessary. For our recommendation regarding reinvestigations, they stated 

that these responsibilities will be transferred to another agency.

 

1 5 Code of Federal Regulations (C.F.R.) § 731.

What We Did 

The Federal Information System 

Controls Audit Manual (FISCAM) 

provides guidance to auditors in 

evaluating internal controls over 

the integrity, confidentiality, and 

availability of data maintained in 

information systems. 

The objective of this audit was to

assess the adequacy of selected 

information system controls using 

audit procedures from the 

Government Accountability Office 

FISCAM. The FISCAM control areas 

assessed were security 

management, access controls, 

configuration management, and 

segregation of duties, with 

selected controls identified from 

each area. The selected controls 

were assessed in regards to four

technology systems at RRB that 

include wireless, HQ VoIP, Field 

VoIP, and virtual private network.

The scope of the audit was control 

information that was in effect for 

the four technology systems during 

fiscal year 2018.