​​Findings from the Audit of the Board’s Offboarding Process​

During our audit of the Board’s offboarding controls, we found gaps in the Board’s ability to identify and respond effectively to the removal of information by a departing employee. Because of our concerns about the Board’s diligence in resolving this potential incident, we are issuing a management alert before completing our planned audit. 

Specifically, this alert focuses on a departing Board employee who potentially removed Federal Open Market Committee classified and other sensitive information. The employee had a prior information security incident involving Federal Open Market Committee classified information, heightening our concerns. This potential incident highlights information security risks and control breakdowns and deficiencies that we believe require the Board’s immediate attention.

We have nine recommendations to strengthen controls to prevent, detect, and resolve potential information security incidents.