The Federal Information Security Modernization Act of 2014 (FISMA) provides a comprehensive framework for establishing and ensuring the effectiveness of managerial, operational, and technical controls over information technology (IT) that supports Federal operations and assets and provides a mechanism for improved oversight of Federal agency information security programs. FISMA requires the head of each agency to implement policies and procedures to cost-effectively reduce IT security risks to an acceptable level. FISMA requires agency program officials, Chief Information Officers (CIO)s, Chief Information Security Officers (CISO)s, senior agency officials for privacy, and inspectors general to conduct annual reviews of the agency’s information security program.

The U.S. President’s Emergency Plan for AIDS Relief (PEPFAR) is a multi-year U.S. Government initiative to address the HIV pandemic. The PEPFAR program is managed and overseen by the U.S. Department of State’s Office of the U.S. Global AIDS Coordinator and Health Diplomacy (OGAC). Congress appropriates PEPFAR funds to the State Department, which OGAC allocates to the Peace Corps and other participating Federal agencies. The Peace Corps Office of Global Health and HIV (OGHH) serves as the primary point of contact for Peace Corps posts, regions, and other headquarter offices regarding PEPFAR operations. The regions and posts are responsible for executing PEPFAR programs in the field, including its programmatic and administrative management. The Peace Corps Office of the Chief Financial Officer (OCFO) is responsible for providing OGHH and the posts with the necessary PEPFAR strategic, technical, and financial guidance. OCFO and OGHH issue the Peace Corps PEPFAR Financial Guidance, which posts use to document how they will request, plan, and execute PEFPAR funding and its programs. Post staff must ensure expenses are correctly applied and distributed between PEPFAR and the Peace Corps’ direct appropriations and maintain the appropriate supporting documentation.The objective of this audit was to determine the basis and justifications for allocating expenses to PEPFAR funds following the global evacuation of Volunteers in March 2020.

On March 18, 2022, the Peace Corps notified the United States Congress that Peace Corps/Morocco (hereafter referred to as “the post”) intended to resume operations in September 2022. The first intake of 51 Volunteers arrived in September 2022. On November 21, 2022, the Office of Inspector General (OIG) announced this review to assess the post’s compliance with specific agency policies and procedures related to Volunteer and trainee health and safety, and the re-entry process.