Description of document: Report on Program Risks prepared for the Defense Nuclear Facilities Safety Board (DNFSB) by Mosley & Associates, 2012

Requested date: 07-July-2014 Released date: 31-July-2014 Posted date: 28-December-2015 Source of document: Information/FOIA Officer

Defense Nuclear Facilities Safety Board 625 Indiana Avenue NW, Suite 700 Washington, DC 20004 Email: FOIA@dnfsb.gov

The governmentattic.org web site (“the site”) is noncommercial and free to the public. The site and materials made available on the site, such as this file, are for reference only. The governmentattic.org web site and its principals have made every effort to make this information as complete and as accurate as possible, however, there may be mistakes and omissions, both typographical and in content. The governmentattic.org web site and its principals shall have neither liability nor responsibility to any person or entity with respect to any loss or damage caused, or alleged to have been caused, directly or indirectly, by the information provided on the governmentattic.org web site or in this file. The public records published on the site were obtained from government agencies using proper legal channels. Each document is identified as to the source. Any concerns about the contents of the site should be directed to the agency originating the document in question. GovernmentAttic.org is not responsible for the contents of documents published on the website.

From: Andrew Thibadeau Date: Jul 31, 2014 11:33:43 AM Subject: Your FOIA Request (DNFSB 14-19) This letter responds to your Freedom of Information Act (FOIA) request (assigned tracking number 14-19) dated July 7, 2014, and received in this office on July 7, 2014, in which you requested a copy of the “Mosley Report.” The responsive records contained in the 56 page report prepared for the Defense Nuclear Facilities Safety Board (Board) by Mosley & Associates are exempt from mandatory public disclosure, and are being withheld, in part, under Freedom of Information Act (FOIA) Exemption 5 (5 U.S.C. 552(b)(5)) (“consultant corollary”). The records consist of opinions, findings and recommendations of Mosley & Associates that are integral to the Board’s pre-decisional, deliberative processes. Factual excerpts that can be segregated from those opinions, findings and recommendations in the report are not exempt from disclosure. We have identified twenty-six pages containing excerpts of responsive records. I am granting partial access to, and am attaching a copy of those records to you. Since the bulk of the report falls within the exemption, we are only providing those factual excerpts that are not exempt, including those minor excerpts which were disclosed in the Board’s FY 2012 Performance Accountability Act Report. Based on the above information, this constitutes a partial denial of your request. You have the right to appeal this partial denial of the FOIA request. Your appeal must be received within 30 calendar days of the partial denial determination. The Board appeal procedures are found at 10 C.F.R. Part 1703. There are no fees associated with this request. If you have any questions, please do not hesitate to call me. Sincerely, Andrew Thibadeau FOIA Officer Defense Nuclear Facilities Safety Board

MOSLEY . & .. A$®0C1A'l11S

The Honorable Peter S. Winokur Chairman Defense Nuclear Facilities Safety Board 625 Indiana Avenue NW, Suite 700 Washington, DC 20004

Dear Mr. Chairman:

gf\M, tnc, 1~9$1ev&.A-s$iC)ci~tes P.O. Box506 PH: 703,5.139.3176 Springfield, Virginia 22150 TF: $6&.n0.12.55

FX: 103.569.9666 www.MosleyA(idAssoc.com

November 8, 2012

In accordance with our Task Order, we have completed worlc on our risk assessment of the operations of the Defense Nuclear Facilities Safety Board (DNFSB). In this letter, we have summarized the results of our work. More detailed summaries are also attached for your information and use.

Standards Followed

We performed our risk assessment as directed in the Task Order in accordance with Generally Accepted Government Auditing Standards (GAGAS}, the gt1idance provided in the Govemm~nt Accountability Office's (GAO}, Standards jot lntenial Control in the Federal Government, GAO!AJMD-00-21.3.1, and guidance provided in GAO' s Internal Control Management and Evaluation Tool, GA0-01-JV08G.

In performing our work, weinterviewed each member of the DNFSB Board, the Deputy General Counsel, the Deputy General Manager, the Technical Directgr and the Deputy TechniGal Director, each Division Director within the Qffke-of the General Manager, and each Group Leader within the'-Office___ _ ____ _

--· ·-·of.the Te--O;funi<?al4Moot:.et,As"Part ef~ur re¥is:w,were:vi0Wc€0 and analy~d .. c, - ·· ·---··---­

DNFSB enabling legislation, the Board;s Operating fractic_'!s and Procedures, DNFSB Directives, Policy and Guidance Memo's; and any--~-==- ~-policy or guidance documents or directives we were provided by the Office of the technical Director. ·------ ----

[1]

What are Internal Controls?

EAM; lac: I MC!Sleyj; Ass®latElS P.O. Boit506 Pit 703.569.3176 Springfield, Virginia 22150 TF: 806.n0.1255

FX: 703.569.9666 www.Mo$leyAridAss0c.com

Office of Management Budget Circular A-123 defines internal controls as follows:

,/ Internal control, in the broadest sense, includes the plan of organization, methods and procedures adopted by management to meet its goals. Internal control includes processes for planning, organizing, directing, controlling, and reporting on agency operations .

./ The three objectives of internal control are: 11 Effectiveness and efficiency of operatlons, • Reliability of financial reporting, and • Compliance with applicable laws and regulations

GAO's statement regarding Management's responsibility for Internal Controls

GAO in their Internal Control Management and Evaluation Tool notes that:

,/ "As federal managers strive to achieve their agency's missions and goals and provide accountability for their operatio~. they need to continually assess and evaluate their internal coritrol structure to assure that it is well designed and operated, appropriately updated to meet changing canditions, and prov.ides reasonable assurance that the objectives of the agency are being achieved. Specifically; managers need to examine internal control to detemtine how well it is peiforflilng, how it may be improved, and the degree to which __

"=~'::i::::::::J:!.'if!l~S ":'_!O~~~o','f!f11l11,11,as:_~~~' ~~ ,. • ·. ··----· Summary of our work and our 3$sessnumt of 4;Urrent risks for DNFSB

[2]

eAM, Inc. I Mosley & Associates P.Q. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703569.9666 www.MosleyAndAssoc.com

; well thought out policies and procedures in place for a number of activities to help them achieve their goals and objectives · · · · · ·

1 We stress that in our discussi-0ns with an Official at the Department of Energy. the DNFSB technical reports _were _ highly regarded.

[3]

EAf.4; locJM\1~ley ~ ASS<ieiStes P_Q_ Bax 506 PH: 703,SS\}.3176 Springfield, Virginia 2215D TP: 866. 77<)_ 1255

www..MosleyAndASsoe.com

OMB Clrcufat A-123, Management's Responsibility for the Establishment of Internal Controls

FX: 703.66!r9666

A-123 provides that ·~Managers should define the control environment (e.g., programs-; operratiOns,arfinancial.reporti!ig) andthen.perfonn risk

-assessments-to-Ulentijiy-the-111l:J8t-signijfoant:areas-within-th{Jt-e.flviromnentin----- ---------­whi9h_ttxptace or enhance in7enmtcvntrot-'fluf rlsfnissess.me-nri--su-ctitft:at-- --~-- -·

c~.step in the process to determine the extent of contriJls. Once signific&tt -areas have been identified, control activities should be implemented. Continuous monitoring and testing sfululd help to identify poorly designed

[4]

MOSLEY & ASSOCIATES

EAM; (OC,. I Mostey & Al>mat~ P.O. Box 506 . PH: 703569.3116 Springfield, Virginia 22150 TF:866.170.1255

FX: 703569.9666 www.MosleyAndAs.socccom

or ineffective controls and should be reported upon periodically. Management is then responsible for redesigning or improving upon those controls. Management is also responsible for communicating the objectives of internal control and ensuring the organization is committed to sustaining an effective internal control environment. "

DNFSB has established an Executive Committee on Internal Controls (ECIC). In the past couple of years, the ECIC has designated over 23 assessment areas to include a number of specific issues, such as: tirne and attendance records, purchase and travel credit cards, metro transit subsidies, ethics and financial disclosures, security clearances, EEO and alternative dispute resolution, the Continuity of operations plan (COOP), recruitment, retention and relocation programs, and other areas which generally have to do with the administn"tive operations of the Board's activities. Each DNFSB unit reviewed these areas as they pertain to their operations and reported back to the ECIC. Based on these

I Fl . . ~::;i I l l i ~

The ECIC meets twice a year I l . ! I I to plan the intern_-al con1rols I !

assessment and review the !

I Ii· I 1 results. I : !'--~~~~~~~~~-~:r

assessments, the General Counsel, General Manager, and Technical Director, then provided an "assurance statement" to the Chairman which stated:

-,,--------------- ---- --------- ------ ----- ---------- ---- --~------- ---- ------------

[5]

DNFSB Implementation of GPRA and GPRMA

EAM, Inc, J Mosley & ASsociates p.o_ Box5o6 PH: 703569.3176 Springfi'"ld, Virgini<.\ 22150 TF: 866.770.1255

FX: 703-569.9666 www, MosleyAnctAssoc.com

TheD.NFSJ3 Stnt_tegic Plan provides general information aqout mission and goals. It contains much of the same _ _

~;~:;:~1;?i!?E~~~s---,,..;,_--~-~~~~--~----_"'""-____ .... __ ~-----~~ .. ··-~--··•·-_=~-.:~-.. ·•.----~ •. ->--.ii-'= ··•·· '~-and outcomes to be achieved during the 5__.year period it covers.

[6]

MOSLEY EAM, Inc. I MosJey & As$Qci!ltas P.O. Box 506 PH: 703.56lf.3116 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703 569.9666 & ASSOCIATES

bt' ( ... .. . ···· 1

www.Mos!eyAndAssoc.corn

We noted that:

The GPRA Modernization Act requires agencies to establish a balanced set of performance indicators to be used in measuring or assessing progress toward each performance goal; I!J_<.::luding, as appropriate, customer service, efficiency, output, and outcome indicators. ~~T~~ •

[7]

MOSLEY & ASSOCIATES

EAM, IM. /Mosley & A$Sociates P. 0: Box 506 PH: 703. 569 .3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666

WNW. MosleyAndAssoc.com

Office of the General Counsel We reviewed the following activities of the Office of the General Counsel:

Office of the Technical Director We reviewed the following activities of the Office of the Technical Director:

[s]

MOSLEY . & ASSOCIATES

[9]

EAM, Inc. r~tey&.ASsOclate5 P.O. Box 506 PH: 703.569.3176 Springfield. Vi(ginia 221.50 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAss_oc:com

M·o· 0.·; •.· .. E· :.y .. .... &Ass~o'tArEs

[10]

E~i Inc, I Mosley & Associ(ltes f>a Box 506 PH: 703.569.3176 Springfield. Vir91nia 22150 TF: 866.n0.1255

FX: 703.569.9668 www.MosleyAndAssoc.com

~ ..+~~~~~~~~~~~~~,,,__, i

11 11

I. ,1 DNFSB!OTD needs to better I I document its assessment of

1 I •I 1' • ', technical mission activities in H d

its annual review of internal 11 controls under A-123. , I

!

MOSLEY & ASSOCIATES

[ 11]

EAIIA, Inc. 1 Mosley & Associat.;s P.O. Box 506 PH 703.569.3176 Springfield. Virginia 22150 TF: 866.770 1255

FX 703 569 9666

www. MosleyAndAssoc corn

MOS.LEY & ASSOCIATES

EAM, Inc./ Mosley & Associates P 0 Box 506 PH 703.569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of DNFSB Implementation of A-123

Purpose: To assess how DNFSB has implemented OMB Circular A-123, Management Accountability and Control 1.

1 OMB Circular A-123,RevisedJune21, 1995.

Summary 1-A-123 Page 1

MOSLEY & ASSOCIATES

Summary 1 - A-123

EAM, Inc. I Mosley & Associates P 0 Box 506 PH: 703.569.3176 Springfield. Vi!!Jinia 22150 TF 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Page2

MOSLEY & ASSOCJATES

Summary 1 - A-123

EAM, Inc. f Mosley & Associates P.O. Box 500 PH: 703.569 3176 Springfield. Virginia 22150 TF: 866.770.1255

FX 703.569.9666 www.MosleyAndAssoc.com

Page 3

MOSLEY &AssdCIATES

Summary 1-A-123

EAM, Inc./ Mosley & Asscx:iates p_o_ Box 506 PH: 703.569.3176 Springfieki, Virginia 22150 TF: 866. 770.1255

FX: 703.569.9666 www.MosteyAndAssoc.com

Page4

MOSLEY & ASSOCIATES

EAM, Inc. I Mosley & Associates P 0 Box 506 PH 703.569.3176 Springfield. Virginia 22150 TF 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

In the FY 2011 Performance and Accountability Report, the DNFSB Chairman reported that" ___ the Board is able to provide an unqualified statement of assurance that the internal controls meet the objectives of FA1FIA."

Summary 1-A-123 Pages

MOSLEY & ASSOCIATES

EAM, Inc. I Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255·

FX: 703.569.9666 www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of DNFSB's Implementation of The Government Performance and Results Act

Purpose: To assess how DNFSB has implemented the Government Petformance and Results Act.

DNFSB Implementing Guidance: DNFSB utilizes the following legislation and OMB guidance: Government Petformance and Results Act (1993) and the Government Petformance and Results Modernization Act (2010) O!v!B Circular A-11.

Summary 2 - GPRA Page 1

MOSLEY & ASSOCIATES

EAM, Inc. I Mosley & Associates P 0 Box 506 PH: 703.569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc_com

, It appears that DNSFB has an Qpportunity to improve their performance planning and measurement processes as they adjust activities to comply with the GPRA Modernization Act:

Summary 2 - GPRA Page 2

MOSLEY &ASSOCIATES

Performance and Accountability Report (PAR)

Documents Reviewed:

DNFSB Strategic Plan20ll-2016 DNFSB FY 2011 Performance and Accountability Report

EAM, Inc. I Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

DNFSB Budget Justifications Fiscal Years, 2010, 2011, 2012, 2013 Ol'vfB Circular A-11

- - -- GERA ---- .- _ GPRA Modernization Act __ ~~~-------~~ __ . __ ·

·-.·-GAO Internal Control Evaluation-Tool----~--,, ·-= -- = = -=::-:: ~ - --

Summary 2 - GPRA Page3

IVIU:llt: Y &ASSOCIATES

P 0 Box 506 PH 703.569.3176 Springfield, Virginia 22150 TF 866.770 1255

FX 703 569.9666 wwwMosleyAndAssoc.com

November 8, 2012

Risk Assessment of the Activities of the DNFSB Office of General Counsel

Purpose: To summarize our risk assessment of the activities performed by the DNFSB Office of General Cmmsel.

Summary 3 - Office of the General Counsel Page 1

'

I

i ,

MOSLEY & ASSOCIATES

- - ------- --~-~-

EAM, Inc. I Mosley & Associates P 0 Box 506 PH 703.569.3176 Springfield. Virginia 22150 TF 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 3 - Office of the General Counsel Page 2

MOSLEY & ASSOCIATES

EAM, Inc./ Mosley & Associates P 0 Box 506 PH 703 569.3176 Springfield. Virginia 22150 TF: 866 770.1255

FX 703.569.9666 www.MosleyAndAssoc com

November 8, 2012

\

Risk Assessment of the Policies and Procedures Governing operations at DNFSB

Purpose: To summarize our risk assessment of the policies and procedures utilized by DNFSB in their daily operations.

__.. .

Summary 4 - D NFSB Policies and Procedures Page 1

MOSLEY & ASSOCIATES

EAM, Inc./ Mosley & Associates P 0 Box 506 PH 703.569 3176 Springfield, Virginia 22150 TF 866 770.1255

FX 703.569 9666 www. Mosley And Assoc .com

Summary 4 - DNFSB Policies and Procedures Page 2

MOSLEY & ASSOCJATES

EAM, Inc. f Mosley & Associates P 0. Box 506 PH: 703.569.3176 Springfield. Virginia 22150 TF: 866.770 1255

FX 703 569.9666 www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of DNFSB Succession Planning

Purpose: To summarize our risk assessment of DNFSB succession planning.

Office of Personnel Management (OPI\1) Guidance: OPM has a number of guides to assist Executive Branch agencies. These guides emphasize that:

1. Succession planning is a systematic approach to: • Building a leadership pipeline pool to ensure leadership continuity • Developing potential successors in ways that best fit their strengths • Identifying the best candidates for categories of positions

Concentrating resources on talent development yields a greater return on investment

2. Succession planning recognizes that some jobs are the lifeblood of the organization and too critical to be left vacant or filled by any but the best qualified persons. Effectively done, succession planning is critical to mission success and creates an effective process for recognizing, developing, and retaining top leadership talent

Summary 5 - DNFSB Succession Planning Page 1

MOSLEY & ASSOCIATES

Eligible to Retire in CY 2012

EAM, Inc. f Mosley & Associates P 0 Box 506 PH 703 569.3176 Springfield. Virginia 22150 TF 866770.1255

FX 703.569 9666 www.MosleyAndAssoc.com

Nuclear Materials Processing & Stabilization group Nuclear Facility Design & Infrastructure group Nuclear Weapons Programs group

36% 29% 9% 7% Nuclear Programs Analysis

New Employees Hired in FY201 l/EY2012

Nuclear Materials Processing'& Stabilization group 36% Nuclear Facility Design & Infrastructure group 19% Nuclear Weapons Programs group 18% Nuclear Programs Analysis 20%

Summary 5 - DNFSB Succession Planning Page2

MOSLEY & ASSOCIATES

EAM, Inc. I Mosley & Associates P 0 Box 506 PH 703.569.3176 Springfield. Virginia 22150 TF 866 770.1255

FX 703 569.9666 www.MosleyAndAssoc com

Summary 5 - D NFSB Succession Planning Page 3

MOSLEY & ASSOCIATES

EAM, Inc./ Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 _ www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of DNFSB Workload Planning Office of the Technical Director

Purpose: To summarize our 1isk assessment of the DNFSB's technical workload planning process.

--

Summary 6 -Technical Workload Planning Page 1

MOSLEY & ASSOCIATES

EAM, Inc. f Mosley & Associates P 0 Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF 866770.1255

FX: 703 569.9666 www.MosleyAndAssoc.com

Summary 6 -Technical Workload Planning Page 2

MOSLEY & ASSOCIATES

EAM, Inc. f Mosley & Associates P 0 Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF 866.770.1255

FX 703.569.9666 www.MosleyAndAssoc.com

Summary 6 - Technical Workload Planning Page 3

MOSLEY &ASSOCIATES

EAM, Inc. I Mosley & Associates P.O Box 506 PH: 703.5693176 Springfield. Virginia 22150 TF: 866.770.1255

FX 703.569 9666 www.MosleyAndAssoc.com

Summary 6 -Technical Workload Planning Page4

•••• •

MOSLEY & ASSOCIATES

EAM, Inc. I Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 6 - Technical Workload Planning Page 5

MOSLEY EAM, Inc. I Mosley & Associates P.O. Box 506 PH 703.5693176 •••••

. & ASSOCIAiES Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569 9666 www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of the Recommendation and Commitment Tracking Systems QfDNFSB

Purpose: To summarize our risk assessment of the recommendation and commitment tracking systems of DNFSB.

Summary 7 Commitment Tracking System Page 1

• MOSLEY & ASSOCIATES

EM'I, Inc. f Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 7 Commitment Tracking System Page 2

EAM, Inc./ Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 7 Commitment Tracking System Page 3

• MOSLEY . & ASSOCIATES

EAM, Inc./ Mosley & Asso<:iates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

November 8, 2012

RiskAssessment of the DNFSB Technical Information Management Systems

Purpose: To summarize our risk assessment of the DNFSB's information management activities in support of the Office of Technical Director.

GAO Standards of Internal Control:

• For an entity to run and control its operations, it must have relevant, reliable, and timely communications relating to internal as well as external events.

• Program managers need both operational and financial data to determine whether they are meeting their agencies' strategic and annual performance plans and meeting their goals for accountability for effective and efficient use of resources.

Summary 8 - Information Management Page 1

••••

MOSLEY &ASSOCIAlES

Summary 8 - Information Management

EAM, Inc. I Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Page 2

Summary 8 - Information Management

EAM, Inc./ Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Page3

EAM, Inc. I Mosley & Associates P.O. Box 506 PH: 703569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703 569.9666 www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of the Timeliness of DNFSB Technical Reports

Purpose: To summarize our risk assessment of the timeliness of issuing technical reports.

Summary 9 - Timeliness of Technical Reports Page 1

EAM, Inc./ Mosley & Associates p_o_ Box 505 PH: 703.569.3176 Springfield, Virginia 22150 TF 866-770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 9 - Timeliness of Technical Reports Page 2

•• ••••

"MOSLEY & ASSOCIATES

EAM, Inc. I Mosley & Associates p_o_ Box 506 PH: 703.569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of the Activities of the DNFSB Office of the General Manager

Human Resources

Purpose: To summarize our risk assessment of the activities performed by the DNFSB Office of the General Manager-Human Resources

Summary 10 - Human Resources Page 1

• MOSLEY & ASSOCIATES

Summary 10 - Human Resources

EAM, Inc. I Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703.569.9666

www.MosleyAndAssoc.com

Page 2

• MOSLEY . & ASSOCIATES

Summary 10 - Human Resources

EAM, Inc. I Mosley & Associates p_o_ Box 506 PH 703_569_3176 Springfield, Virginia 22150 TF_ 866.770.1255

FX 703_569_9666 www.MosleyAndAssoc.com

Page3

• MOSLEY & ASSOCIATES

EAM, Inc. I Mosley & Associates P.O Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

November 8, 2012

llisk Assessment of the Activities of the DNFSB Office of the General Manager

Division of Acquisition and Finance

Purpose: To summarize our risk assessment of the activities performed by the DNFSB Office of the General Manager-Finance

Summary 11 - Acquisition and Finance Page 1

• MOSLEY & ASSOCIATES

Summary 11-Acquisition and Finance

EAM, Inc./ Mosley & Associates P.O. Box506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 WNN.MosleyAndAssoc.com

Page2

• MOSLEY & ASSOCIATES

EAM, Inc./ Mosley & Associates P_o_ Box 506 PH: 703.569 3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.5699666 www.MosleyAndAssoc.com

November 8, 2012

Risk Assessment of the Activities of the DNFSB Office of the General Manager

Information Technology and Security

Purpose: To summarize our risk assessment of the activities performed by the DNFSB Office of the General Manager-Information Technology and Securitv

Summary 12 - Information Technology and Security Page 1

•••

MOSLEY & ASSOCIATES

EAM, Inc./ Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 12 - Information Technology and Security Page 2

•· ..... MOSLEY . & ASSOCIATES

EM"!, Inc. f Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 12 - Information Technology and Security Page 3

• MOSLEY & ASSOCIATES

I

EAM, Inc. I Mosley & Associates P.O. Box506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Summary 12 - Information Technology and Security Page 4

• MOSLEY . & ASSOCIATES

EAM, Inc. f Mosley & Associates P 0. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

November 8, 2012

Audit Plan for the Defense Nuclear Facility Safety Board

Subject: Audit Plan for the Defense Nuclear Facility Safety Board (DNFSB)

Purpose: In accordance with our Task Order, we have recently completed a risk assessment of DNFSB operations and from that risk assessment, we have developed an audit plan designed to follow up on and further evaluate issues we noted as "high", "medium", and "low" risk relative to DNFSB operations.

We performed our risk assessment in accordance with Generally Accepted Government Auditing Standards (GAGAS), the guidance provided in the Government Accountability Office's (GAO), Standards/or Internal Control in the Federal Government, GAO/AIMD-00-21.3.1, and guidance provided in GAO's Internal Control Management and Evaluation Tool, GA0-01-1008G.

In developing the audit plan, we followed procedures included in GAGAS and in OMB Circular A-11, Guidance in Preparing a Strategic Plan.

Audit Priorities: In preparing the audit plan, we have listed all areas that we believe need consideration for audit and categorized the audits as ''high", "medium" or "low" priority and the order in which we suggest the audits be conducted. Any audit plan also needs to be reactive to on-going situations that occur within DNFSB or at the Department of Energy which impact DNFSB operations, and needs to be updated as necessaiy to reflect the current situation.

- - -

Implementation of the Audit Plan: The audit plan is a road map for moving forward. It is not designed to be implemented in a single year; it may take several -years to accomplish depending on the availability of resources. That is Why we-. have listed the suggested audits in numerical order with what we believe are the most important audits first, and as shown in red highlights in the Table below.

1

•••••••••

MOSLEY & ASSOCJArES

Audit Plan

EAM, Inc./ Mosley & Associates P_O_ Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

Defense Nuclear Facility Safety Board

2

• MOSLEY . & AssocrAtEs

3

EAM, Inc./ Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

• MOSLEY & ASSOCIATES

4

EAM. Inc./ Mosley & Associates P 0. Box 506 PH: 703.569.3176 Springfield. Virginia 22150 TF: 866.770.1255

FX: 703.569.9666

WWN.MosleyAndAssoc.com

••••••••

. M . .. o··· s····· L .. E··y·. :-· - .·

·. ·. ,- . '·':.:

... &/\ssoc1A1Es

5

EAM, Inc./ Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com

•••

MOSLEY & ASSOCIATES

6

EAM, Inc. I Mosley & Associates P.O. Box 506 PH: 703.569.3176 Springfield, Virginia 22150 TF: 866.770.1255

FX: 703.569.9666 www.MosleyAndAssoc.com