All Reports

As part of our annual audit plan, we audited costs billed to the Tennessee Valley Authority (TVA) by World Wide Technology, LLC (WWT) under Contract No. 10786 for Cisco hardware, maintenance, services, and support. The contract provided for TVA to compensate WWT for products and services on either a time and materials or fixed price basis. Our audit objective was to determine if costs were billed in compliance with the contract's terms.

The Office of the Inspector General OIG audited the Tennessee Valley Authority’s (TVA) use of remote application and desktop virtualization due to the risk of increased remote users during the COVID-19 pandemic and recent publicized remote access vulnerabilities. We found several areas where TVA was consistent with cybersecurity remote access best practices. However, we identified gaps in TVA’s configuration settings, architectural design, and administrative procedures.

The Office of the Inspector General conducted a review of Browns Ferry Nuclear Plant (BFN) Chemistry to identify factors that could impact BFN Chemistry’s organizational effectiveness. During the course of our evaluation, we identified behaviors that had a positive impact on BFN Chemistry, including positive relationships between team members and most management. However, we also identified a minimal behavioral risk related to communication with first-line management. In addition, we identified minimal risks to operations that, if unaddressed, could hinder BFN Chemistry’s effectiveness.

As part of our annual audit plan, we audited costs billed to the Tennessee Valley Authority (TVA) by Vega Corporation of Tennessee for general construction and modification services performed under Contract No. 14626. Our audit included approximately $8.76 million in costs billed to TVA from contract inception, November 11, 2019, through April 30, 2021. Our objective was to determine if Vega billed TVA in accordance with the contract's terms.

The Office of the Inspector General conducted a review of the Southaven Combined Cycle (SCC) Plant to identify factors that could impact SCC’s organizational effectiveness. During the course of our evaluation, we identified behaviors that had a positive impact on SCC. These were related to teamwork and interactions with others; however, we also identified risks related to employee and managerial behaviors that had a negative impact on SCC morale. In addition, we identified risks to operations that could hinder SCC’s effectiveness.

In this semiannual period, our audit, evaluation, and investigative activities identified more than $33.4 million in questioned costs, funds put to better use, recoveries, and waste, as well as opportunities for TVA to improve its programs and operations.

The Office of the Inspector General (OIG) performed the procedures, which were requested and agreed to by Tennessee Valley Authority (TVA) management solely to assist management in determining the validity of the Winning Performance/Executive Annual Incentive Plan (WP) Measures for fiscal year (FY) ending September 30, 2021. TVA management is responsible for the WP Measures data provided. In summary, procedures applied by the OIG found: • The FY 2021 WP goals for the Enterprise measures were properly approved.

In keeping with its responsibilities under the Inspector General Act of 1978, as amended, the OIG monitored the audit of TVA's fiscal year 2021 financial statements performed by Ernst and Young LLP (EY) to assure their work complied with Government Auditing Standards. Our review of EY's work disclosed no instance in which the firm did not comply in all material respects with Government Auditing Standards.

The Office of the Inspector General is required by the Federal Information Security Modernization Act of 2014 (FISMA) to conduct an annual independent evaluation that determines the effectiveness of the information security program (ISP) and practices of its respective agency. Our objective was to evaluate the Tennessee Valley Authority’s ISP and practices as defined by the FY 2021 IG FISMA Reporting Metrics Version 1.1.

We performed an audit of the Tennessee Valley Authority’s (TVA) Internet perimeter. Our objective was to identify cybersecurity weaknesses in TVA’s Internet perimeter through penetration testing. In summary, we identified some vulnerabilities in TVA’s internet perimeter. Specifically, we (1) downloaded files related to TVA’s disposal of coal ash that were marked as confidential, (2) accessed a Web site related to river operations that used weak authentication, and (3) found TVA’s password complexity requirements on a TVA publicly available Web site.