We have determined that the Corporation for National and Community Service’s (CNCS’s) information security program is NOT EFFECTIVE. CNCS has in place the basic information technology policies, procedures and system security documentation needed for effective cybersecurity. To progress beyond the current maturity level, the Corporation must consistently implement and monitor security controls. We continued to find severe vulnerabilities on the network. CNCS has still not fully implemented baseline security configuration settings specific to the existing information technology environment.

From August 2014 to June 2017, the North Carolina Commission on Volunteerism and Community Service (Commission) and two of its larger subgrantees claimed $16,132,771 in federal and match expenditures under the AmeriCorps State and National program.

The agreed-upon procedures (AUP) review of AmeriCorps grant funds to Serve Indiana and two subgrantees, the Boys and Girls Club of Wayne County Indiana (BGCWCI) and the American Red Cross of Indiana (ARCI), identified questioned Federal costs totaling $127,090, questioned matching costs of $82,157, questioned Education Awards of $20,055 and compliance findings. Most of the questioned costs identified were caused by inadequate financial management by BGCWCI and deficiencies with the National Service Criminal History Checks (NSCHC) by ARCI.

We engaged a contract audit firm to conduct an Agreed-Upon Procedures review of selected AmeriCorps grant awards issued to Conservation Legacy, to include AmeriCorps Grants awarded by CNCS and the Corps Network, a nonprofit entity that received grant awards through CNCS. The auditors did not question any claimed Federal costs, match costs, or member education awards, or identify any compliance findings. In its response to the draft report, Conservation Legacy stated that it concurred with the AUP scope, accepted the report, and took pride in its management of Federal funds.