The independent public accounting (IPA) firm KPMG LLP conducted this audit on behalf of the U.S. Environmental Protection Agency's (EPA's) Office of Inspector General (OIG). This is the IPA's report on the subject audit conducted on behalf of the OIG. This report contains findings that describe the problems the IPA identified and corrective actions the IPA recommends. The Senior Agency Information Security Officer is the primary official responsible for the agency program that KPMG reviewed during this audit. This report represents the opinion of the IPA and does not necessarily represent the final EPA position. The agency concurred with all the report's recommendations and provided high-level planned corrective actions with milestone dates, which KPMG found acceptable.