Appendices

Returned Peace Corps Volunteer Tumanah Wulukau served in South Africa within the Health sector as a Community HIV outreach specialist. On this day we visited her at worksite for a day of GrassRoots Soccer with local students ranging in age from 13-17 years old.

STATUS OF AUDIT WEAKNESSES

PART I - SIGNIFICANT DEFICIENCY FINDINGS STATUS AS OF FY 2021

PROJECTED RESOLUTION DATE INFORMATION TECHNOLOGY SECURITY DELAYED RESOLUTION SEPTEMBER 2022 FY 2021 Completed Corrective Actions

• Updated and implemented the Peace Corps Information Security Policy and Continuous Monitoring Strategy. • Implemented Risk Management Strategy, detailing both the information security architecture and its integration into the agency’s overall risk management strategy.

FY 2022 Planned Corrective Actions

• Continue performing Continuous Monitoring Strategy; integrate Continuous Monitoring into agency’s risk management strategy. • Update agency policy over “Managing IT Risk” to detail process for communicating IT risk to the organization, business process and system levels via the ERM process. • Commit additional resources to the ERM program to complete information security risk register, tolerance, and profle; identify procedures for the measurement of risk tolerance and risk profle.

INADEQUATE INTERNAL CONTROLS OVER PROPERTY, PLANT, AND EQUIPMENT (PP&E) DELAYED SEPTEMBER 2022 FY 2021 Completed Corrective Actions

• Updated policy and procedures for the recording and capitalization of fxed assets. • Strengthened training for property owners over personal property and efective use of the property management system software.

FY 2022 Planned Corrective Actions

• Update policies and procedures to ensure that roles and responsibilities between responsible ofces are clearly defned and assets’ status are accurately refected between Sunfower, the agency’s property management system and Odyssey, the agency’s fnancial system of record. • Ensure reconciliations between the two systems, Sunfower and Odyssey, are performed on a regularly basis; reconciliation diferences should addressed timely. • Ensure capital assets are recorded within the timelines established within agency policy and procedures. • Continue to provide the necessary training to those responsible for accounting for property in Sunfower; require annual training on Sunfower process and procedures.

PART II - NONCOMPLIANCE FINDINGS

STATUS AS OF FY 2021

PROJECTED RESOLUTION DATE FEDERAL INFORMATION SECURITY MODERNIZATION ACT (FISMA) OF 2014 DELAYED RESOLUTION SEPTEMBER 2022 FY 2021 Completed Corrective Actions

• Updated agency policy over Information Security Program, InfoSec Program Requirements, and Continuous Monitoring Strategy. • Completed updates to contingency plans. • Implemented Risk Management Strategy detailing both information security architecture and its integration into overall risk management strategy.

FY 2022 Planned Corrective Actions

• Update Continuous Monitoring Strategy to identify control weaknesses. • Further defne and implement the agency ERM program to ensure information security risks are communicated and monitored at the system, business process, and entity levels. • Improve business process over the inventory of its IT management processes.

GLOSSARY OF ACRONYMS

AF Africa Region AFR Agency Financial Report ATDA Accountability of Tax Dollars Act of 2002 CARES Act Coronavirus Aid, Relief, and Economic Security Act CDM Continuous Diagnostic Monitoring CIP Construction in Progress CHCO Chief Human Capital Ofcer CISO Chief Information Security Ofcer COVID-19 Coronavirus Disease 2019 CREG Country Re-Entry Guide DATA Act Digital Accountability and Transparency Act DOL Department of Labor DOS Department of State EEOC Equal Employment Opportunity Commission EMA Europe, Mediterranean, and Asia Region EO Executive Order ERM Enterprise Risk Management ERMC Enterprise Risk Management Council FASAB Federal Accounting Standards Advisory Board FBwT Fund Balance with Treasury FECA Federal Employees Compensation Act FEMA Federal Emergency Management Agency FEVS Federal Employment Viewpoint Survey FISMA Federal Information Security Management Act FMFIA Federal Managers’ Financial Integrity Act FSN Foreign Service National FY Fiscal Year FYR Five-Year Rule GAGAS Generally Accepted Government Auditing Standards GAO Government Accounting Ofce GSA General Services Administration GSS General Support System HCC Host Country Contribution HR Ofce of Human Resources IAP

ICDEIA

IG ISCM

IT MD M/AS

OCIO OCFO OCFO/AFR

OCRD OIG OMB OPM PEPFAR

PCMO PMSS

PP&E PSC PT&E

RPCV RSI SBR USAID

U.S.C. USDH VMIS

VSP VSPP Inter-America and the Pacifc Region Intercultural Competence, Diversity, Equity, Inclusion, and Accessibility Inspector General Information Security Continuous Monitoring Information Technology Management Directive Management/Administrative Services Ofce of Chief Information Ofcer Ofce of Chief Financial Ofcer Ofce of Chief Financial Ofcer/ Accounting and Financial Reporting Ofce of Civil Rights and Diversity Ofce of Inspector General Ofce of Management and Budget Ofce of Personnel Management President’s Emergency Plan for AIDS Relief Peace Corps Medical Ofcer Property Management System Software Property, Plant, and Equipment Personal Services Contractor Programming, Training, and Evaluation Returned Peace Corps Volunteer Required Supplemental Information Statement of Budgetary Resources U.S. Agency for International Development United States Code U.S. Direct Hire Vehicle Management Information System Virtual Service Pilot Virtual Service Pilot Participant

In March 2021, the Peace Corps and FEMA announced a historic partnership to combat the COVID-19 pandemic. For the second time in the agency’s history, Peace Corps volunteers will serve a domestic deployment, at FEMA’s request – the frst following Hurricane Katrina and now at federally supported Community Vaccination Centers across the country.