FAQs

Audits are reviews of an agency's programs and operations to ensure that the agency is efficiently and effectively performing its work. Audits are objective, fact based, and performed in accordance with the U.S. Government Accountability Office's Government Auditing Standards.

We generally conduct performance audits, which provide findings and recommendations based on an assessment of sufficient, appropriate evidence against criteria like laws, regulations, contracts, or other benchmarks. Performance audits aim to improve program performance and operations, reduce costs, facilitate corrective action, and contribute to public accountability.

We also oversee independent audits of the financial statements of the Board and the Federal Financial Institutions Examination Council. The CFPB's financial statements are audited by the U.S. Government Accountability Office, as required by law.

Evaluations are systematic and independent assessments of the design, implementation, or results of an agency’s operations, programs, or policies. They often recommend improvements and identify where agency action is necessary to increase efficiency and effectiveness.

Our evaluations are performed in accordance with the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation.

We base our decisions on risk and focus on areas that we see as major management challenges for the Board and the CFPB. We also consider input from our agency and congressional stakeholders. We look to improve the economy, efficiency, and effectiveness of Board and CFPB programs and operations. We maintain a Work Plan, updated quarterly, that describes our ongoing and planned work.

Audits and evaluations have three phases:

Planning

• We announce to the agency the proposed scope and objectives of the project.
• We meet with the agency staff to discuss our scope and objectives, information needs, and key milestones.

Fieldwork

• We gather and analyze information.
• We develop findings and recommendations based on relevant criteria or benchmarking.
• We meet with agency stakeholders to update them on our work, ask for more information, and get feedback on our findings and recommendations as we develop them.

Reporting

• We provide a discussion draft report for agency comment during an exit meeting.
• We provide an official draft report and ask for an official written response to it.
• We issue a final report to the agency that includes the official written response. We provide the report to Congress and post it to our website.

We report the status of our recommendations in our semiannual reports to Congress and in our open recommendations lists. We ask that each agency provide us documentation to show that it has implemented our recommendations. We may also perform an in-depth follow-up review to assess the effectiveness of their implementation.

Audit reports provide our findings and recommendations based on an assessment of sufficient, appropriate evidence against criteria like laws, regulations, contracts, or other benchmarks.

Evaluation reports summarize our systematic and independent assessments of the design, implementation, or results of agency operations, programs, or policies.

Security control reviews evaluate the effectiveness of the information security for a subset of the Board's or the CFPB's information systems, including those provided or managed by another agency, a contractor, or another organization.

IT audits review Board and CFPB IT systems as well as management and operational controls within their IT infrastructures. These audits focus on such areas as information security controls, systems development, operations, investment, and contractor support. Recommendations are aimed at improving the efficiency and effectiveness of IT systems and protecting data. IT audits usually result in a report, but these reports may be restricted due to the sensitivity of the information they contain.

The Federal Information Security Modernization Act of 2014 (FISMA) requires us to perform annual independent audits of the information security program and practices of the Board and the CFPB to determine their effectiveness. FISMA also requires us to perform information security control reviews for subsets of the agencies' information systems. In addition, each year we review the Board's and the CFPB's IT systems and challenges to determine the highest risks to their mission functions, which includes a focus on information security.

IT audits follow the guidelines in the U.S. Government Accountability Office's Government Auditing Standards. For our annual FISMA audit work, we comply with guidance provided by the National Institute for Standards and Technology and follow direction from the U.S. Department of Homeland Security.

We start with a brief survey of the system or IT area and assess potential risks or vulnerabilities that warrant further analysis. We then formulate an audit approach.

If the audit involves reviewing information security controls, we also determine which controls we will examine to best analyze major risks and vulnerabilities. We incorporate agency officials' formal comments in our final report.

Investigations look into possible violations of law, regulation, or policy. The results may be used for administrative action by the Board or the CFPB (for example, taking personnel action against the offender) and for criminal or civil action by the U.S. Department of Justice.

Investigations come from complaints we receive from Board and CFPB employees and contractors and, in some cases, from the general public. We also may open investigations based on information we receive from the Board or the CFPB, the U.S. Department of Justice, other agencies, or Congress.

To file a complaint, contact the OIG Hotline.

Matters we investigate include

• violations of federal laws or agency policy
• obstruction of agency operations, such as providing false information to regulators
• ethics violations or conflicts of interest by agency officials
• employee misconduct, such as abuse of authority or misuse of position
• contract and procurement irregularities related to agency programs and operations
• theft or abuse of agency property
• travel card or purchase card fraud
• waste or mismanagement of funds or government resources

To file a complaint, contact the OIG Hotline. We are unable to intervene in or investigate consumer complaints regarding an individual's financial institution. For these complaints, please read our information on consumer complaints against financial institutions.

Our criminal investigators and analysts conduct investigations. We operate under statutory law enforcement authority granted by the U.S. Attorney General.

Employees have a duty to promptly report actual or suspected violations of law, fraud, waste, abuse, or other wrongdoing. In addition, the Board and the CFPB require all employees to cooperate with and be responsive to our investigators' information requests and questions.

Employees must fully cooperate with us, which includes being interviewed, except in circumstances when employees assert their Fifth Amendment right against self-incrimination. We cannot compel an employee to be interviewed, but agency management can direct the employee to be interviewed and can take disciplinary action if the employee declines. Employees who are bargaining-unit members may be permitted to have a union representative present during interviews.

We do not permit Board or CFPB attorneys to represent agency employees during interviews. Government attorneys represent the agency and are thus prohibited from personally representing individual agency employees.

Anyone may report fraud, waste, abuse, or mismanagement related to the programs or operations of the Board or the CFPB by contacting the OIG Hotline. Examples of the types of activities to report include

• violations of federal laws or agency policy
• obstruction of agency operations, such as providing false information to regulators
• ethics violations or conflicts of interest by agency officials
• employee misconduct, such as abuse of authority or misuse of position
• contract and procurement irregularities related to agency programs and operations
• theft or abuse of agency property
• travel card or purchase card fraud
• waste or mismanagement of funds or government resources

No. We cannot intervene in or investigate consumer complaints against individuals' financial institutions or other entities supervised by the Board or the CFPB. For these complaints, please read our information on consumer complaints against financial institutions.

Yes. Your contact information, though, will help us pursue your complaint, because we usually need more information. Please note that we will not disclose your identity except in rare circumstances when the Inspector General deems it unavoidable during the course of an investigation or if you provide your consent.

We will not disclose the identity of an individual who comes forward with a complaint or information, except in rare circumstances when the Inspector General deems it unavoidable during the course of an investigation or if you provide your consent.

Board and CFPB employees are also protected under the Inspector General Act of 1978, as amended, from reprisals or retaliation for reporting a complaint or disclosing information to us. Reserve Bank employees should refer to their Reserve Bank policy. For more information, please read about whistleblower rights and protections.

We evaluate the complaint and, if appropriate, refer our findings to the Board or the CFPB for administrative action (for example, taking personnel action against the offender) or to the U.S. Department of Justice for criminal or civil action. We typically do not provide status updates to complainants.

We are closely coordinating our oversight activities of the Board's pandemic response activities with the U.S. Government Accountability Office, the Pandemic Response Accountability Committee (PRAC), the Special Inspector General for Pandemic Recovery, the Small Business Administration Office of Inspector General, the U.S. Department of Justice, and other offices of inspector general to ensure robust oversight and to efficiently deploy resources where they are most needed.

To ensure coordinated oversight and leadership of pandemic response efforts governmentwide, Inspector General Mark Bialek serves as a member of PRAC, an oversight body established by the Coronavirus Aid, Relief, and Economic Security (CARES) Act to ensure governmentwide coordinated oversight of the federal government's COVID-19 pandemic response efforts. For more information about PRAC and its work, see the following:

• PRAC website
• Attorney General Announces Task Force to Combat COVID-19 Fraud
• Additional Inspectors General Designated as Members of CIGIE's Pandemic Response Accountability Committee
• Pandemic Response: Perspectives From the Banking Industry
• Pandemic Response: Housing Insights

• Board pandemic resources
• Board lending facilities reports to Congress

• CFPB pandemic resources

You can report fraud using the OIG Hotline. Please note that we can only investigate allegations related to the programs and operations of the Board and the CFPB. Click here for information about reporting other types of allegations.

The full text of the CARES Act is available here.