The Board Needs a More Robust Insider Risk Management Program

The Board's proprietary economic information is of great interest to foreign adversaries who seek to undermine U.S. competitiveness and weaken national security. Risks can also occur from within—for example, an employee who, knowingly or unknowingly, shares sensitive information with foreign operatives.

We found that the Board's insider risk management activities do not proactively or effectively identify and manage insider risks to its information and assets. The Board lacks (1) a process to identify its critical assets, (2) a centralized program to proactively identify and manage insider risks at an enterprise level, (3) procedures for the timely sharing of pertinent information internally and with the Federal Reserve System, (4) enterprise-level policies and procedures establishing consistent incident response and reporting practices, and (5) insider risk training requirements for all Board staff.

We have nine recommendations that will contribute to developing a more robust insider risk management program.