AUD-IT-17-64-12

OIG recommends that the Bureau of Information Resource Management develop and implement complete and consistent policies and procedures and supplemental guidance, such as a Submitter’s Guide, for the Information Technology Configuration Control Board process. The policies, procedures, and guidance should, at a minimum, include guidance on roles and responsibilities, detailed procedure steps for submitters, minimum testing requirements, instructions on how Technical Reviewers and Voters should conduct their review, the appropriate use of “stops,” and established timelines for the process.