Fed's IRM Program Found Lacking in Proactive Controls

The Federal Reserve Board's (Fed) Insider Risk Management (IRM) program has been found lacking in proactive and centralized controls by the Fed's Office of Inspector General (OIG).

A recent report issued on July 15 revealed that the IRM activities do not effectively identify and manage risks to the agency's information and assets, and are not consistent with leading practices.

The OIG identified several weaknesses in the Board's IRM program, including a lack of process for identifying critical assets, centralized IRM program, timely sharing of pertinent information, enterprise-level policies, and insider risk training requirements.

These weaknesses were demonstrated by recent potential insider risk incidents, including instances where insiders compromised sensitive information about the Fed's mission-related responsibilities.

The OIG issued nine recommendations to develop a more robust IRM program, including identifying critical assets, establishing a centralized hub, and requiring annual IRM training for all personnel.