The FDIC OIG’s Report on Unimplemented Recommendations, provided below, contains information about recommendations from our audits, evaluations, and reviews that the OIG has not closed because our office has not determined that the FDIC has fully implemented recommended corrective actions.
The status of each recommendation is subject to change due to the FDIC’s ongoing efforts to implement them, and the OIG’s independent review of information about those efforts. Specifically, a recommendation identified as unimplemented in this report may fall into one of several categories:
- The FDIC has not completed the planned corrective action to address the recommendation,
- The FDIC has completed corrective action but has yet submitted the documentation to the OIG for review,
- The OIG is reviewing documentation submitted by the FDIC to assess whether the recommendation can be closed.
Further, the OIG may have subsequently closed a recommendation listed in this report after the date of its issuance.
For each Unimplemented Recommendation listed, we provide the report title, along with a link to the full report if available; the date of report issuance; and a brief description of the recommendation.
Our Unimplemented Recommendations listing will be updated monthly.
Status of Unimplemented Recommendations as of August 1, 2025
Unresolved Recommendations
Unimplemented Recommendations
Significant Service Provider Examination Program
Complete efforts to develop and implement program-level goals and metrics for both the Regional and Significant Service Provider Examination Programs. This should include finalizing and implementing the Inherent Risk Methodology Analysis.
The FDIC’s Procurement of Resolution and Receivership Services
Review existing financial advisory and consulting services Receivership Basic Ordering Agreements and take appropriate steps to establish an adequate supply of contractors with appropriate resources to address the FDIC’s future procurement needs in the event of financial institution failures and financial crises.
Establish a process to periodically review financial advisory and consulting services Receivership Basic Ordering Agreements to ensure sufficient contractor resources are available to meet the FDIC’s mission-critical needs.
Establish an upfront pricing framework or advanced pricing within all financial advisory and consulting service Receivership Basic Ordering Agreements.
Establish an emergency response acquisition team with appropriate FDIC personnel and ensure that a dedicated team of key individuals (including Technical Monitors) is available to carry out emergency procurement procedures.
Develop and implement periodic emergency procurement testing exercises for appropriate FDIC employees.
Establish a process for emergency procurements to document and maintain analysis, decisions, and commitments, to include, at a minimum, those identified in this report.
Develop and implement a process to analyze and determine when documented deliverables should be required on emergency service contracts to ensure contract personnel have the ability and resources to oversee contractor performance.
Perform retrospective reviews when the FDIC conducts or tests emergency acquisition procedures.
Review the work performed and information used by the four non-U.S. citizens and take appropriate action.
Provide training and guidance to its Executive Management and personnel reinforcing their roles and responsibilities in carrying out and overseeing the FDIC’s emergency acquisition procedures. This training and guidance should include, at a minimum, the following:
• understanding roles and responsibilities;
• initiating and performing emergency and expedited procedures; and
• initiating, modifying, approving, and submitting requirements packages.
Special Inquiry of the FDIC’s Workplace Culture with Respect to Harassment and Related Misconduct – Part 1
The Chairman and FDIC Board of Directors set a tone at the top where all FDIC executives model the FDIC’s core values and principles through their behaviors and attitudes. This should be assessed and measured regularly by climate surveys with appropriate actions taken.
FDIC Readiness to Resolve Large Regional Banks
Establish and implement an agency-wide resource committee to monitor and report on corporate resource needs, including existing recruiting strategies, staffing levels, and information technology resources in order to strengthen resource planning and response capabilities for large regional bank resolutions.
Establish a practice of regular interdivisional participation in the development and review of the Regional Resolution Framework procedural documents, as appropriate.
Develop and implement a resolution readiness training program for key personnel responsible for executing the Regional Resolution Framework and related procedures. The training program should address awareness, plan-specific, role-based, and functional training.
Establish and implement a process of periodic interdivisional exercises of large regional bank resolution activities, to test the ongoing effectiveness of agency-wide response and coordination.
Identify from after-action review documents the recommendations that are the most critical for large regional bank resolutions and prioritize them with formal tracking and monitoring.
Establish a plan for ensuring that CISR regularly conducts internal reviews of its large regional bank resolution planning activities, as appropriate based on risk.
Material Loss Review of Republic First Bank
Revise examiner guidance to ensure supervisory personnel consider significant delays in required financial filings and any associated perspectives of external auditors when assessing UFIRS ratings.
Revise the FDIC’s Internal Formal and Informal Actions Procedures to include specific process and documentation requirements related to circumstances in which an approved formal enforcement action is replaced with a less severe action.
Develop detailed guidance that clarifies what information should be considered when assessing whether it is appropriate to approve a brokered deposit waiver for “Adequately Capitalized” IDIs.
The FDIC's Information Security Program - 2024
Enforce existing policies and procedures to consistently perform reviews and analyze system audit records, and document and maintain those reviews and analysis for privileged users and actions taken on [redacted] devices in accordance with FDIC policy.
Conflicts of Interest in the Acquisition Process
Develop a means of identifying and documenting acquisition-specific team members from the Program Offices, Division of Administration Acquisition Services Branch, Legal Division, and Office of Minority and Women Inclusion.
Update the Acquisition Procedures and Guidance Manual to (1) define “reasonable planning,” (2) require the documentation of “reasonable planning” for all acquisitions, and (3) require a written description of potential or actual acquisition-specific conflict of interest-related risks in planning documentation.
Develop procedures requiring acquisition team members, as defined in response to Recommendation 1, to complete a conflict of interest certification in which each team member is to assess and document that they do not have a potential or actual conflict of interest related to the specific acquisition prior to participating in any phase of the acquisition lifecycle (from planning to closeout). These procedures should require that evidence of acquisition team members’ conflict of interest certifications is maintained in accordance with requisite FDIC records retention schedule requirements.
Develop procedures requiring acquisition team members, as defined in response to Recommendation 1, to re-certify annually that they remain free of actual or potential conflicts of interest as long as the acquisition is in place.
Develop and deliver specialized acquisition-related conflict of interest training on at least an annual basis to all acquisition team members to strengthen employee knowledge and skills related to ethics laws and regulations.
Evaluate whether there should be minimum qualifications and requirements for appointed Deputy Ethics Counselors (DEC), a desired ratio of DECs to filers across FDIC Divisions and Offices, and whether DEC duties should be incorporated into FDIC employee position descriptions to better equip DECs to monitor and respond to employees’ potential and actual conflicts of interest.
Develop and implement an action plan utilizing Deputy Ethics Counselor survey results and other relevant information to help identify strengths and opportunities for continuous improvement in the FDIC’s financial disclosure review program.
Audit of Security Controls for the FDIC's Cloud Computing Environment
Remediate the 7 findings and 19 associated recommendations identified in Cloud Platform #1 and the applications built on Cloud Platform #1
Remediate the 8 findings and 11 associated recommendations identified in Cloud Platform #2 and the applications built on Cloud Platform #2
Remediate the 4 findings and 5 associated recommendations identified in the applications built on Cloud Platform #3
Remediate the 3 findings and 6 associated recommendations identified in Cloud Platform #4
Remediate the 4 findings and 7 associated recommendations identified in Cloud Platform #5.
This recommendation is redacted.
Design and implement a plan to prevent, detect, and remediate security weaknesses on FDIC cloud platforms and applications related to insecure coding practices, misconfigured security settings, least privilege violations, outdated software versions, and ineffective monitoring.
The FDIC’s Sexual Harassment Prevention Program
We recommend that the Chairman: (a) incorporate a specific harassment-free culture standard into the Performance Management Program and Bonus Criteria for all staff; (b) incorporate harassment prevention into the bonus criteria for managers and executives; (c) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee should serve in a supervisory or managerial capacity; and (d) develop and implement a process that considers violations of the anti-harassment policy when determining whether an employee is eligible to receive a bonus.
We recommend that the Chairman/COO develop and implement a mechanism to ensure that corrective actions used to close recommendations related to the sexual harassment prevention program are sustained.
We recommend the Director, Division of Administration, develop and implement quality control procedures to ensure the FDIC maintains an accurate and complete population of sexual harassment misconduct allegations and related records.
We recommend the Director, Division of Administration, conduct a review of prior allegations to ensure that it has an accurate and complete population of sexual harassment allegations and that it has maintained all allegation records in accordance with the FDIC record retention schedule, which requires that all records be maintained for 7 years.
We recommend the Directors, Office of Minority and Women Inclusion and Division of Administration, develop and implement standard operating procedures for case file records management, including where to securely maintain files, what to maintain, and how long to retain records.
We recommend the Director, Division of Administration, update and implement investigation standard operating procedures to clearly guide investigations by ensuring that investigations are: conducted appropriately and consistently; convey the outcome of the investigation, including a Report of Investigation; and are well-documented.
We recommend the Director, Division of Administration, provide regular investigation training to the LERS Specialists conducting investigations under the Anti-Harassment Program.
We recommend the Director, Division of Administration, develop a centralized disciplinary action tracking system or tool and related procedures for what information should be captured in the tool and in support of the disciplinary decision.
We recommend the Chairman consider developing and implementing Agency-wide, consistent penalties or recommended penalty ranges to be used in disciplinary actions for harassing conduct, in accordance with applicable laws and regulations, and, as necessary and appropriate, incorporate the consistent penalties and recommended penalty ranges into policy and procedures.
We recommend that the Chairman develop and implement regular, comprehensive, and effective required training on preventing and reporting sexual harassment for all non-supervisory employees that incorporates elements from the EEOC 2023 Promising Practices, including a larger emphasis on the Agency’s prohibition for retaliation of any kind.
We recommend that the Chairman develop and implement regular, comprehensive, and effective required training for all supervisors and executives on preventing and reporting sexual harassment that incorporates elements from the EEOC’s 2023 Promising Practices, including a larger emphasis on the Agency’s prohibition for retaliation of any kind.
We recommend that the Chairman develop and implement a plan to routinely analyze the FDIC’s sexual harassment training, ensure that it is current, and measure the impact that training is having on reducing harassment and retaliation in the Agency.
Review of the FDIC’s Ransomware Readiness
Evaluate and consider enhanced solutions to store backup data, as described in the report, and update the Storage Systems Backup Data Protection Standard Operating Procedures, as appropriate.
Conduct an analysis to identify viable alternatives for testing restoration of Active Directory from backups, or have senior management formally accept the risk of not testing these backups.
The FDIC’s Purchase and Deployment of the FDIC Acquisition Management System
Develop and provide training to Executive and Corporate Managers on the change management process and in developing and employing change management strategies and plans.
Material Loss Review of Signature Bank of New York
Emphasize to examiners in the form of training and other internal communications the requirements around timely escalation of supervisory concerns in line with the FDIC’s
forward-looking approach to supervision.
Reiterate to examiners requirements around prompt communication of risk and supervisory results to bank management, emphasizing the significance of prompt communication over linear or chronological issuance of supervisory products.
Reevaluate the FDIC's strategy to attract, retain, and allocate staffing, including how to enhance the supervision of large, complex financial institutions.
a. This evaluation should be documented and submitted to the FDIC’s Chairman for review and approval.
Implement target metrics and monitor variances for key supervisory outputs consistent with requirements contained in CEP Procedures, such as:
a. Supervisory Plan percentage completed to actual percentage completed to identify and take timely corrective action when examination teams are not on
track to achieve objectives detailed in annual supervisory plans.
b. Target review start date to actual review start date to identify and take timely corrective action when examination teams are not on track to achieve objectives
detailed in annual supervisory plans.
c. Number of days elapsed between target review start date and exit meeting to expectation to identify and take corrective action when reviews are not being completed and informal results communicated to the bank timely.
d. Number of days elapsed between target review start date and issuance of Supervisory Letter to expectation to identify and take corrective action when the results of reviews are not being completed and results communicated to the bank timely.
e. Number of days elapsed between year-end and ROE issuance to expectation to identify and take corrective action when ROEs are not being completed and
results communicated to the bank timely.
f. Number of days elapsed between quarter-end and issuance of Ongoing Monitoring Reports to expectations to identify and take corrective action when
ongoing monitoring is not being completed timely.
The FDIC’s Orderly Liquidation Authority
Develop and consistently maintain comprehensive Orderly Liquidation Authority policies and procedures for systemically important financial companies, to include:
a. Tier I policies and procedures for framework-level activities.
b. Tier II policies and procedures for operational process-level activities.
c. Tier III policies and procedures for institution-specific planning activities.
d. Other operational program policies and procedures for Orderly Liquidation Authority resolution planning activities.
Apply Tier III policies and procedures to develop and consistently maintain institution-specific resolution planning documents for all nonbank financial companies and financial market utilities designated by the Financial Stability Oversight Council as systemically important.
Establish a process for identifying and preparing staff who would be responsible for key Orderly Liquidation Authority resolution governance roles, such as the Executive Advisory and Oversight Group, the Tactical Project Manager, and the Onsite Liaison, to include:
a. Completing planned guidance and/or preparing a charter that will define in more detail the key resolution governance roles and responsibilities.
b. Maintaining a roster of potential staff for key resolution governance roles.
c. Informing potential staff for the key resolution governance roles of their respective Orderly Liquidation Authority resolution responsibilities.
Ensure the completed Tier I and II policies, procedures, and related guidance documents fully define the applicable Orderly Liquidation Authority roles and responsibilities of each FDIC Division and Office.
Ensure the FDIC establishes a timeframe to obtain, and then obtains, the staff resources needed to mature the Orderly Liquidation Authority resolution planning program.
Conduct and document a representative survey or other assessment of the Orderly Liquidation Authority-related skill sets existing or needed within the Division of Complex Institution Supervision and Resolution and ensure the Division’s Professional Development Plan incorporates the results.
Regularly conduct and document Orderly Liquidation Authority general and functional training and ensure that training is clearly linked to the key components of the systemic resolution framework and processes.
Develop an FDIC readiness plan for a financial crisis, to include a scenario that involves the resolution of multiple concurrent failures of systemically important financial companies.
The Federal Deposit Insurance Corporation's Information Security Program - 2023
Implement process improvements to ensure prompt notification and removal of user network accounts on or before the user’s separation date.
FDIC Efforts to Increase Consumer Participation in the Insured Banking System
Develop clear guidance on running business reports out of Community Affairs Reporting and Events System, including the use of filters.
Sharing of Threat and Vulnerability Information with Financial Institutions
Ensure that all data sets within the FDIC that contain relevant threat and vulnerability information are assessed and natural language processing or alternative technological capabilities are considered for enhancing threat and vulnerability information sharing operations.
FDIC Oversight of a Telecommunications Contract
Develop a strategy to periodically assess workload imbalances and implement a strategy to address such imbalances among Oversight Managers in the FDIC CIOO.
The FDIC's Security Controls Over Microsoft Windows Active Directory
Update and implement procedures to proactively update or replace operating systems before vendor support ends.