All Reports

We performed an audit of the Tennessee Valley Authority’s (TVA) Internet perimeter. Our objective was to identify cybersecurity weaknesses in TVA’s Internet perimeter through penetration testing. In summary, we identified some vulnerabilities in TVA’s internet perimeter. Specifically, we (1) downloaded files related to TVA’s disposal of coal ash that were marked as confidential, (2) accessed a Web site related to river operations that used weak authentication, and (3) found TVA’s password complexity requirements on a TVA publicly available Web site.

The Office of the Inspector General included an audit of Tennessee Valley Authority’s (TVA) corporate contributions in our annual audit plan due to the potential reputational risk associated with contributions that do not comply with TVA policies and procedures.

In response to a referral from the Office of the Inspector General (OIG), Investigations, we audited a claim for missing gas cylinders submitted to the Tennessee Valley Authority (TVA) by Airgas USA, LLC (Airgas) under Contract Nos. 5436 and 5456. Under the contracts, Airgas was to manage inventory of industrial gases for TVA, including furnishing, selling, and delivering all bulk gases and related products and services to TVA.

In response to requests from stakeholders, we scheduled an evaluation to determine if the Tennessee Valley Authority (TVA) complied with the 2016 Board Practice regarding memberships in external organizations.We found no evidence TVA was out of compliance with the TVA Memberships in External Organizations Board Practice. We did not identify any evidence of direct lobbying or litigation on behalf of TVA; however, the external organizations do not administratively segregate TVA’s funds, so we were unable to determine if the funds were used for lobbying or litigation.

The Office of the Inspector General conducted a review of the Lagoon Creek Combustion Turbine (LCCT) Plant to identify factors that could impact LCCT’s organizational effectiveness. During the course of our evaluation, we identified behaviors that had a positive impact on LCCT; however, we also identified some behavioral risks associated with team conflicts. In addition, we identified risks to operations that, if unaddressed, could hinder LCCT’s effectiveness.

The Office of the Inspector General conducted a review of the Lagoon Creek Combined Cycle (LCCC) Plant to identify factors that could impact LCCC’s organizational effectiveness. During the course of our evaluation, we identified behaviors that had a positive impact on LCCC including positive relationships between team members and most management. However, we also identified a behavioral risk related to communication with first-line management. In addition, we identified an operational risk related to training that could hinder LCCC’s effectiveness.

A TVA contractor’s employee improperly received $146,359 in Temporary Living Allowance payments by claiming a house as his personal residence in which he did not actually live. Rather, he lived in a different dwelling, in a different state, and rented-out the house he claimed as his personal residence during his absence.

A contractor employee received temporary living allowances of $80,857.70 to which he was not entitled. Contrary to what the contract employee claimed on his TLA applications, he did not have a qualifying dependent living at the claimed residence and did not incur substantially all of the expenses for the property. Moreover, he presented a false lease in support of his application.

Patching is the process for updating products and systems. Patches correct security and functionality problems in software and firmware. We performed an audit of the Tennessee Valley Authority’s (TVA) patching of Windows® desktops and laptops to determine if high-risk vulnerabilities on desktops and laptops were patched in accordance with TVA policy and best practices.

We performed an audit of the Tennessee Valley Authority’s (TVA) management of privileged accounts. Our objective was to determine if TVA's management of privileged accounts is following TVA policy and best practices. A privileged user has an account that is authorized for the performance of security-related functions that ordinary users cannot perform.