Bureaucracy Times

All the news fit to be declassified.

Category: Bureaucracy in Focus

  • The $21 Billion Contract That Was Worth $74 Million

    Somewhere in the Department of Veterans Affairs, a dashboard once displayed a number so large it should have triggered an alarm rather than a press release. A single contract action, the VA told Congress in May 2025, had a value north of $21 billion.

    The actual figure, according to the VA Office of Inspector General, was just over $74 million. That is not a rounding error. That is a factor of roughly 284, the kind of gap you get when nobody checks the math before it goes to the Hill.

    The OIG’s new review of “contracts terminated for convenience” was requested by Senators Richard Blumenthal and Angus King, who wanted to know what happened when the Department of Government Efficiency, VA senior advisers, and the General Services Administration went hunting through VA’s contract portfolio in early 2025.

    The answer, once you strip away the chest-thumping, is that VA terminated 435 contracts worth about $1.1 billion, out of 2,210 contract actions the OIG reviewed. Everything else on the lists VA sent to Congress was either reinstated, never terminated at all, or simply wrong.

    Efficiency, Measured in Wheelchair Ramps

    The most instructive failure here is not the math. It is what got swept into the “terminated” pile in the first place. VA’s July 2025 submission to Congress claimed 1,667 contracts had been terminated or were being terminated. The OIG found the real number was 366, and 17 of those were later reinstated.

    The other roughly 1,300 actions on that list had nothing to do with termination; they were supply contracts that had simply run their course, including orders for prosthetics, surgical implants, and wheelchair ramps, plus more than 150 healthcare contract actions such as nursing home service orders.

    A Category Management Support Office official told the OIG that DOGE representatives “wanted to claim credit for any contracts that ended,” whether or not the government actually ended them. That is a remarkable sentence to find in a federal audit. It means the savings narrative being fed to Congress was padded with equipment orders for amputee veterans that had simply finished delivering, filed under the same banner as genuine cost-cutting.

    The distinction between “we canceled this” and “this was already over” apparently did not matter much to whoever was compiling the list.

    The Eleven-Hour Review

    To be fair to VA’s rank-and-file contracting staff, the OIG’s account of how this played out reads less like malice and more like triage under fire.

    From February through June 2025, OALC and VA senior advisers issued at least 47 orders demanding that contracting officials justify, terminate, pause, or reinstate contracts, on top of a running stream of follow-up emails from GSA and DOGE representatives. On February 21, 2025, officials were handed 1,049 contract actions to review, get approved by deputy under secretaries, and report back on, all within less than 11 hours.

    Some offices did not finish in time. The CMSO director told the OIG that VA senior advisers and DOGE representatives ordered the terminations to proceed regardless. VA had built a questionnaire asking whether each contract provided direct veteran care, required specialized skills VA could not hire for, or was merely administrative support like scheduling; the tool existed, the deadlines simply did not leave room to use it properly.

    Officials, VHA staff among them, told the OIG that instructions arrived from OALC, VA senior advisers, and DOGE representatives simultaneously, on inconsistently formatted lists that sometimes duplicated the same contract action twice. VA did not build a database to track the churn until April 2025, months after the worst of the chaos had already passed.

    Nobody Spoke Federal Acquisition

    The OIG’s explanation for the inflated dollar figures is almost charming in its bluntness. The officials assembling the lists sent to Congress “were unfamiliar with contracting and acquisition terminology.” VA had built a tracking dashboard to monitor the terminations, and that dashboard miscalculated contract values, apparently without anyone downstream noticing that a single contract does not typically run twenty times the annual budget of a mid-sized federal agency.

    This is the recurring shape of the DOGE-era efficiency push across the government; fast, politically driven demands for numbers, staffed by people with strong opinions about waste and thin knowledge of how contracts actually work, producing figures that collapse the moment an inspector general opens the file.

    VA’s own contracting officers, notably, come out of this review relatively well; the OIG found they generally complied with Federal Acquisition Regulation requirements even while being ordered around by people who did not know what a settlement cost was.

    Of the 267 terminated contracts that reached a settlement agreement, 150 cost the government nothing at all, and the remaining 117 cost about $10.6 million combined, a figure that would have looked almost quaint next to the phantom $21 billion the dashboard once reported.

    The Cleanup, Eventually

    VA has since sent Congress a corrected list, submitted April 13, 2026, after the OIG briefed OALC officials in January. The OIG did not audit that list’s accuracy. It also declined to make any recommendations, since VA’s own procurement leadership simply concurred with the draft report and offered no comment, the bureaucratic equivalent of a shrug.

    What remains is a case study in how “government efficiency” gets manufactured for public consumption. Real terminations, genuinely worth $1.1 billion, buried under a much larger pile of expired supply orders and inflated dashboards, sent to Congress by people who could not tell a completed prosthetics contract from a canceled one.

    The veterans who needed those wheelchair ramps got them either way. The number on the press release did not.

    Fediverse Reactions

  • The Postal Service Passed Its Pay Audit. The Bill Just Got Postponed.

    Credit where it is due. The Postal Service Office of Inspector General reviewed the compensation, benefits, and bonus authority of 158 postal officers and executives for calendar year 2025 and found nothing to flag. No one exceeded the Executive Schedule Level 1 salary cap of $250,600. None of the eleven employees the Board designated as “critical senior executive” positions cleared 120 percent of the Vice President’s compensation, the $347,280 ceiling PAEA allows for a maximum of twelve such slots. The auditors made zero recommendations. Management, for its part, declined to comment, which in bureaucratic terms is the sound of an agency that has nothing to argue about.

    A Rare Clean Bill

    This is not nothing. The OIG’s CY2020 audit found a $5,833 monetary impact from noncompliance, a rounding error by federal standards but a finding nonetheless. This year there is no finding at all. The Postal Service is, in the narrow and specific sense that this audit measures, playing by its own rules. A watchdog publication built on the premise that institutions rarely get audited into a compliment owes it to its readers to say so when one does.

    But an audit that measures compliance with a cap is not the same as an audit that asks whether the cap means anything. It measures whether water stayed inside the container. It does not ask what happens to the water that would have overflowed.

    The Account That Never Closes

    Buried in Table 2 of the report, well past the highlight box that most readers will stop at, is the answer. When an executive’s earned compensation would push them over their statutory ceiling, the Postal Service does not simply withhold it. It defers it into an interest bearing account and pays it out later, in whatever future year the executive’s total compensation happens to sit below the cap.

    Deputy Postmaster General Douglas Tulino, who also holds the titles of Chief Operating Officer and Chief Human Resources Officer, a three hat arrangement that ought to raise its own eyebrows, deferred $198,650 in calendar year 2025 alone. His running balance sits at $515,462.18. Joseph Corbett is carrying a deferred balance of $538,887.66. David Steiner, the Postmaster General, has $86,695 sitting in the same holding pattern. This is not back pay owed for work not yet done. It is compensation already earned, already valued, simply held in escrow until the calendar catches up to the paycheck.

    The Office of Legal Counsel blessed this arrangement back in 2013, and the Postal Service formalized it in an August 2023 pay policy. It is legal in the fullest sense of the word. It is also, functionally, a way of making a hard salary cap into a soft one. The cap does not limit what an executive is paid. It limits when.

    Twelve Chairs, One Very Full Ledger

    The PAEA’s critical positions exception exists for a defensible reason, the argument that the Postal Service competes for executive talent against private logistics firms that pay considerably more than the federal government ever will. Fair enough. But the mechanism built to enforce a ceiling on that competition has, in practice, become a mechanism for deferring rather than denying the money that would breach it.

    Consider the company those eleven names keep. Chief Retail and Delivery Officer. Chief Logistics and Infrastructure Officer. Chief Technology Officer. Chief Information Officer. General Counsel. These are, by any measure, executive suite jobs at a nine figure operating budget, and the audit confirms their occupants are being compensated like it, just with the accounting spread across tax years instead of concentrated into one that would trip the wire.

    None of this requires a conspiracy. It requires only that a statutory salary cap, once it collides with an actual executive compensation market, gets engineered around rather than enforced. The engineering happens to be perfectly legal, transparently disclosed in an annual report, and blessed by the Justice Department. That is precisely what makes it a story rather than a scandal. Scandals get investigated and end. This just continues, one interest bearing dollar at a time.

    Solvency for Me, Not for Thee

    Here is the number that belongs next to Table 2, and does not appear anywhere in the OIG’s report because it was outside the audit’s scope. The Postal Service closed fiscal year 2025 with a net loss of $9.0 billion under GAAP, an improvement over the $9.5 billion loss the year before only in the sense that a slower car crash is still a car crash. Controllable loss, the figure USPS itself prefers because it excludes costs management says it cannot influence, still came in at $2.7 billion, up nearly a billion dollars from the prior year. Compensation and benefits expense across the organization rose $1.7 billion year over year, the single largest driver working against the modest revenue gains from Ground Advantage and stamp price increases.

    Postmaster General Steiner told the public in November that “the occasional appearance of financial progress is far outweighed by the reality of our significant systemic annual revenue and cost imbalance,” and asked Congress for changes to pension funding rules, the statutory debt ceiling, and workers’ compensation administration. He is not wrong that the agency’s finances are structurally broken. It is worth noting, in the same breath, that while the institution pleads for relief from Congress, its own compensation ledger keeps a small number of executives’ pay intact, merely rescheduled, interest accruing the whole time.

    The Postal Service passed its compliance audit. It deserves to be told so plainly. But compliance with a cap that bends rather than breaks is a different achievement than the audit’s clean headline suggests, and an agency nine billion dollars in the red is not obviously the place where “we will pay you later, with interest” should be standard operating procedure for the corner office.

    For more USPS OIG coverage, see Nashville’s Postal Honor System Just Failed an Audit — on four OIG reports finding that the compliance data Nashville reported to USPS headquarters bore little relationship to what auditors found on the floor — and The Pantry That Held a Federal Problem, on a joint OIG-DEA investigation that dismantled a drug distribution network running through the postal system.

  • The Fund That Worked Until It Almost Didn’t: FDIC, 2023, and the Return of the Bank Run

    The Slogan With an Asterisk

    The FDIC’s marketing has one genuinely remarkable claim behind it: since the agency opened its doors in 1934, no depositor has ever lost a penny of insured deposits. It is the rare piece of government messaging that happens to be true. It is also, on its own, a slightly misleading way to describe what actually happened in March 2023, when the failure of three regional banks forced federal regulators to quietly abandon the very insurance limit the FDIC exists to enforce.

    Of the entities covered so far in this series, the FDIC comes closest to the textbook version of a government corporation Congress imagined when it wrote the 1945 Government Corporation Control Act: funded entirely by risk based premiums on the industry it regulates, receiving no annual appropriations, and repaying its initial seed capital rather than leaning on the kind of soft, interest free financing that let TVA and the RFC balloon into open ended liabilities. That design held up for ninety years. Then three banks failed inside two weeks, and the difference between “the FDIC works” and “the FDIC has discretion to decide who actually gets protected” became very hard to ignore.

    The Cleanest Design in the Series, Almost

    The FDIC was created by the Banking Act of 1933 after more than 9,000 banks failed between the 1929 crash and 1933, wiping out roughly 1.3 billion dollars in depositor losses, according to the FDIC’s own institutional history. Congress gave it an initial 289 million dollar loan from the Treasury to get started, a debt the agency subsequently repaid in full. Since then, the FDIC has funded its operations entirely through insurance premiums charged to member banks and earnings on its Treasury securities holdings, a structure the Federal Reserve Bank of Minneapolis has noted receives no congressional appropriations at all, which puts the FDIC closer to actually behaving like the self-sustaining commercial entity every government corporation is nominally supposed to be.

    That design worked exactly as intended for eight decades, through the savings and loan crisis and the 2008 financial crisis alike. Then, on March 10, 2023, Silicon Valley Bank failed, followed within days by Signature Bank and, weeks later, First Republic, together the second, third, and fourth worst bank failures in American history, according to reporting on the FDIC’s own inspector general findings. GAO later found that the Federal Reserve and FDIC had identified concerns about both SVB and Signature Bank as far back as 2018, but neither regulator escalated those concerns into formal enforcement action in time to force a fix before the banks collapsed. The FDIC itself estimated the failures would cost the Deposit Insurance Fund roughly 18.7 billion dollars, the bulk of it tied not to ordinary insured deposits but to the decision to protect deposits above the standard 250,000 dollar insurance limit entirely.

    The Limit That Got Overridden Anyway

    That decision is the part worth sitting with. Federal law lets Treasury invoke a systemic risk exception, on the joint recommendation of the FDIC and the Federal Reserve, to cover deposits beyond the statutory cap when a bank failure threatens the wider financial system. GAO reviewed the invocation for SVB and Signature Bank and concluded the decision likely helped prevent broader instability, noting that deposit outflows from smaller banks slowed within a week of the emergency action. In other words, the mechanism worked. But the mechanism only exists because the ordinary insurance limit, the thing depositors are told to rely on and the thing the premium structure is actually priced around, turned out not to be sufficient the moment a bank run could happen at the speed of a group chat rather than a physical line outside a branch.

    The FDIC’s own inspector general did not let the agency off easy afterward. A review released in December 2024 found the FDIC’s readiness to resolve large regional bank failures was, in the OIG’s words, not sufficiently mature to facilitate a consistently efficient crisis response, citing gaps in staffing, technology, and coordination across divisions. The OIG issued eleven recommendations, and the same reporting noted GAO’s own parallel review found FDIC lacked even a centralized system for tracking supervisory recommendations across its own examiners, meaning emerging risks at supervised banks could fall through cracks nobody was specifically watching for.

    Deregulating the Morning After

    Here is where the story takes a turn that fits uncomfortably well with the rest of this series. Rather than responding to that OIG report with a tightening of supervisory practice, the FDIC’s new leadership moved in the opposite direction. Travis Hill, installed as acting chairman on January 20, 2025, moved quickly to reshape the agency’s regulatory posture. Within weeks, he rescinded the FDIC’s 2024 Statement of Policy on Bank Merger Transactions and withdrew four other pending regulatory proposals, part of what one law firm’s analysis described as a wholesale regulatory purge. The stated goal was making merger review faster and more predictable for the banking industry. The practical effect was that the same agency whose own watchdog had just flagged coordination and readiness failures in the run up to 2023 spent its next chapter loosening the review process for the kind of consolidation that produces exactly the large, complex institutions whose failures are hardest to manage. Hill, confirmed by the Senate as the agency’s 23rd chairman in December 2025 and sworn in the following January, had by then already set the agency’s direction.

    This is not corruption or mismanagement in the way the RFC’s cronyism was, and it is not the multi-decade debt spiral TVA has been running twice now. It is something quieter: a genuinely well designed, self-funded government corporation discovering that even its cleanest structural feature, premium funded insurance with a hard dollar cap, still depends on a discretionary political judgment call about who gets bailed out beyond that cap when the alternative looks worse. The FDIC did not need a conservatorship. It needed an emergency exception to its own rules within days of a crisis starting, which is a smaller version of the same problem.

    Why It Matters

    Every entity in this series so far has hit the same wall from a different direction. The RFC discovered that market discretion without oversight curdles into cronyism. Fannie and Freddie discovered that dodging the 1945 Act’s accountability regime just moves the risk somewhere less visible until it detonates. TVA discovered that a debt ceiling only constrains behavior for as long as Congress declines to raise it, which turns out to be not very long at all. The FDIC, built about as well as a government corporation can be built, discovered that the line between “self-funded insurance program” and “implicit federal guarantee” gets redrawn the moment enough money is at stake, and that the agency meant to price and contain that risk can still be caught flat footed by how fast it moves in an era of instant digital withdrawals.

    None of this means deposit insurance is a bad idea, any more than TVA’s debt history means public power is a bad idea. It means the closest thing this series has found to a genuine success story still needed an emergency override within its first real stress test in fifteen years, and that the policy response since has been to loosen the very oversight machinery that watchdog after watchdog just said was not ready. Whichever government corporation this series covers next, that is the question worth asking of it: not whether the design looks sound on paper, but what happens the first week the design gets tested for real.

    Next in the series: Amtrak, the only government corporation here whose founding fiction was written into the planning documents on day one — by the same planners who privately doubted it.

    Fediverse Reactions

  • The Department of Veterans Affairs Discovers a New Definition of “Still Under Review”

    Somewhere in the sprawling apparatus of the Veterans Health Administration, a manager looked at a growing backlog of unreviewed medical requests and arrived at an elegant solution. Rather than review them, VHA staff would simply tell providers the request was still being reviewed, close it, and move on. A new inspector general audit confirms the practice was still running as recently as April 2026, which is the kind of detail that should end careers and will instead end up in a corrective action plan with a target completion date sometime next year.

    The VA Office of Inspector General‘s audit of “requests for services,” the mechanism by which community providers ask VHA to approve additional care beyond what a veteran was originally authorized to receive, examined 2.6 million such requests filed between October 2024 and January 2026. The Community Care Field Guidebook requires a decision and notification within three business days. Nationally, that standard was met 17 percent of the time. At one facility the OIG visited, the compliance rate was 5 percent.

    Numbers like that are what happens when an institution optimizes for the appearance of a metric instead of the substance behind it, and nowhere in this report is that clearer than in what OIG politely calls “inappropriate processing.”

    A Denial Dressed Up as Patience

    At one of the four medical facilities the OIG team visited on site, community care staff told investigators that managers had instructed them to close out requests for services on the fourth day after they entered the system, whether or not a delegated clinician had actually reviewed the case. The kicker is what staff were told to send the provider: a letter stating the request was still under review, even as the system recorded it as denied.

    According to a community care nurse interviewed for the audit, the Consult Toolbox used to once offer a “needs more time” option for exactly this situation. That option disappeared. Two staff members told OIG that once it vanished, only “approval” and “denial” remained, so staff began selecting denial and appending a note reading “still under provider review” before sending it out on schedule, day four, like clockwork.

    This is not a backlog. A backlog is what happens when demand outpaces capacity and a queue grows. What OIG documented is a workaround built specifically to generate compliant looking output while the underlying clinical decision never happened. The community care chief at that facility confirmed to investigators that the practice was still in effect as of April 2026, months after the audit period covered by the report had already closed, which suggests this was not a temporary emergency measure but a standing operating procedure.

    The Fourth Day Ritual

    Understanding why this matters requires understanding what a “request for services” actually is. It is not the initial referral to a community provider; it is what happens when that provider, mid treatment, determines the veteran needs more care than was originally authorized, additional visits, an extended course of therapy, a follow up procedure. Until VHA approves it, per the agency’s own guidebook, no additional care is supposed to be provided or paid for.

    So a denial letter that falsely claims the request is “still under review” does not just misinform a provider about paperwork status. It leaves the provider in the position of having to guess whether to continue treating the veteran without authorization, at the provider’s own financial risk, or to halt care and wait for a decision that, per this scheme, was never coming through proper channels in the first place. OIG’s report notes elsewhere that when denials go undocumented or improperly communicated, providers may keep delivering care that ultimately goes unauthorized and unpaid, leaving either the veteran or the provider holding the bill.

    None of this is incidental to the broader findings. Across the full 2.6 million request sample, only about 1.4 million, 54 percent, had any documented notification at all. The other 46 percent simply vanished into the record with no evidence anyone was ever told anything. The fabricated “still under review” letters are simply the one facility where investigators caught the mechanism in the act rather than inferring it from an empty data field.

    Nobody Is Watching the Watchmen, Because the Watchmen Quit

    How does a practice like this survive long enough for a federal auditor to walk in and document it in real time. The answer, per OIG, is that VHA’s oversight of this process is close to nonexistent. The agency’s own national performance report, the one tool that might have flagged a facility with a 95 percent noncompliance rate, was quietly discontinued in February 2025 after officials decided the underlying data could not be trusted. As of this audit, seventeen months later, no replacement had been implemented; VHA’s projected launch date is September 2026, which by pure coincidence is also the publication date stamped on this report.

    In the interim, community care staff at another facility resorted to tracking their caseloads the old fashioned way, with thirty separate nurses keeping thirty separate spreadsheets, no shared system, and no way to know whether a request assigned to one nurse’s tracker had already been resolved somewhere else. This is what institutional oversight looks like when the institution has given up on building oversight and left it to individual employees armed with Excel.

    The Under Secretary’s Concurrence, and Other Bureaucratic Absolutions

    VHA’s response to all six of OIG’s recommendations was concurrence, which in federal audit parlance means agreement in principle and very little else in practice. The acting under secretary for health promised to reinforce training on notification procedures, evaluate system capabilities, and eventually build a functioning national report. Every action item carries the same target completion date, July 2027, nearly a full year from now, for a scheme that OIG confirmed was actively deceiving veterans and providers as of this spring.

    There is no recommendation addressing accountability for the manager who ordered the practice, no mention of referral for discipline, no acknowledgment that what happened at that facility was not a process failure but a decision, made by someone, to fabricate the appearance of compliance rather than deliver it. The report notes that three cases uncovered during this audit were serious enough to be referred to OIG’s Office of Healthcare Inspections for review of potential clinical harm. One of those was referred to the local medical facility itself for further review, which is a bit like asking the fox to audit the henhouse’s security footage.

    VHA will spend the next several months evaluating, assessing, and reinforcing its way toward compliance with a three-day standard it already had, has had for years, and simply chose not to follow. The veterans waiting on denial letters that arrived dressed as patience were, in the meantime, the only ones actually kept honestly informed. Informed, that is, of the wrong thing, on schedule, every single time.

    Sources: VA Office of Inspector General, Audit of VHA’s Processing of Requests for Services for Community Care (Report No. 25-03946-211, September 2026).

    Fediverse Reactions

  • The $1.4 Billion HUD Couldn’t Be Bothered to Count

    For nine consecutive years, the Department of Housing and Urban Development has known, by its own admission, that its largest rental subsidy program is “susceptible to significant improper payments.” For nine consecutive years, it has declined to say by how much. Not because the number is unknowable. Because in 2017 HUD fired the contractor whose job it was to know, and simply never got around to hiring a replacement.

    That is the opening fact of HUD OIG Report 2026-FO-0006, and it is worth sitting with before the number arrives, because the number is the least interesting part. Any auditor can find a bad statistic. What OIG actually documented is an agency that spent nearly a decade in willful, well-funded ignorance of its own $38.4 billion program, then disputed the homework once someone else finally did it.

    An Agency That Outsourced Its Own Curiosity

    The Public and Indian Housing Tenant-Based Rental Assistance program, known more casually as Section 8 or the Housing Choice Voucher program, is the federal government’s largest direct rental subsidy. It moved $38.4 billion in fiscal 2025, 43 percent of HUD’s entire budget, through roughly 2,200 local Public Housing Agencies that calculate each household’s subsidy using a formula built from income, deductions, rent reasonableness, and utility allowances. It is, by design, decentralized, manual, and dense with judgment calls, which is precisely why the Payment Integrity Information Act requires HUD to estimate how often the formula gets applied wrong.

    HUD used to pay a contractor to run that estimate every year. It discontinued the contract in 2017 and has not produced a figure since, citing “decentralized payment processes, dated and disparate systems” and a familiar chorus of complexity. OIG did not accept complexity as an excuse; it built the estimate HUD wouldn’t. Auditors pulled a stratified sample of 300 payments from the 2.3 million monthly housing assistance payments on the books in March 2025 and checked each one against the underlying documentation.

    Seventy-four were wrong. That is 25 percent, one in four, extrapolated to a projected $1.43 billion a year in improper payments, a number OIG discounted downward for statistical caution before publishing it, meaning the real figure is probably higher, not lower.

    Where the Money Actually Leaks

    The errors sort into a fairly mundane taxonomy, which is itself the point; nothing here required fraud, only inattention. Income miscalculations accounted for the largest share (PHAs entering figures that didn’t match pay stubs, relying on stale documentation, or simply skipping verification against HUD’s own income-matching system). Utility allowance errors came next, PHAs applying the wrong schedule or the wrong unit size to a calculation most of them still do by hand. Then there is a category OIG calls “program compliance,” meaning the PHA skipped a required step entirely, no annual reexamination, no rent reasonableness analysis, no verified immigration status, and got the whole payment marked improper as a result, not because the dollar amount was necessarily wrong but because nobody could prove it wasn’t.

    That distinction matters more than it sounds. OIG also logged 13 “technically improper” payments, cases where the PHA broke a rule but the dollar amount happened to land correctly anyway, pure luck rather than diligence. The audit treats those as a warning sign rather than a reprieve; the same shortcuts that produced a correct number this month are exactly the shortcuts that will produce a wrong one next month.

    Then there is HOTMA, the Housing Opportunity Through Modernization Act, signed in 2016 with instructions to raise the medical and disability expense deduction threshold and the elderly and disabled household allowance. Ten years later, HUD’s own system still runs the old, lower thresholds, because the software meant to replace HUD’s aging PIC system, itself a replacement project HUD started in 2021, still has no launch date. A statute a decade old, unenforced, because the agency’s internal IT timeline has quietly outlived the urgency that produced the law in the first place.

    The Monitoring That Wasn’t

    If the errors were merely common, that would be one story. What makes it worse is how little anyone at HUD was watching for them. The agency ran 19 targeted “Calculation of HAP, Adjusted Income, and Rent” reviews in fiscal 2023 and has run zero since. In fiscal 2025, HUD completed 14 total Compliance Monitoring Reviews, covering nine separate program areas, for a portfolio of 2,200 housing agencies and 2.3 million households. That is not oversight so much as its rumor.

    PHAs, for their part, were not shy about explaining why, once OIG actually asked. Understaffed offices process tens of thousands of annual reexaminations with no time to verify small, fluctuating income sources like child support or unemployment benefits. HUD’s own income-verification tool, the Enterprise Income Verification system, updates quarterly and simply doesn’t capture pensions, TANF, or state benefit income at all, meaning the tool HUD requires PHAs to use cannot see a meaningful share of the income it’s supposed to catch. Guidebooks on calculating rent and running reexaminations haven’t been updated since 2019 and 2020 respectively, years before several of the rule changes they’re supposed to explain.

    The Part Where HUD Argues With the Math

    Faced with all this, the Office of Public and Indian Housing did what agencies under audit reliably do, agreed with the spirit and quibbled with the specifics. PIH accepted the recommendation to work on simplifying HAP calculations and to develop better monitoring. It rejected the recommendation to embed a mandatory documentation checklist into its own system, for the reasonable-sounding but conveniently timed reason that its legacy IT platform can’t support it. And it declined to concur with the $1.43 billion figure itself, saying it was still waiting on additional information from OIG.

    OIG’s rebuttal, printed in the report without much editorializing needed, lays out a timeline; final results shared with PIH in March 2026, three follow-up meetings in April to walk through methodology sample by sample, and no further request for information from PIH until July, three months after the walkthroughs concluded. The agency that spent nine years unable to produce its own improper payment estimate spent another four months sitting on someone else’s before deciding it needed more homework.

    PIH’s written response includes one more line worth quoting in spirit if not verbatim, namely that the risk of error is “largely outside of PIH’s direct control,” a structural feature of a complex, decentralized statute rather than a management failure. That may even be half true. It is also the sentence every agency reaches for once the number gets big enough to need one, and it is a strange thing to say about a program HUD chose, for nine years running, not to measure at all.

    Source: HUD Office of Inspector General, Report 2026-FO-0006, “HUD’s Public and Indian Housing Tenant-Based Rental Assistance Program Had Significant Improper Payments,” September 17, 2026.

  • The Million Dollar Door FEMA Never Bothered to Guard

    The Threshold Was the Point

    In 1988 Congress decided that FEMA’s disaster recovery apparatus was too slow, so it built a shortcut. Section 422 of the Stafford Act let the agency skip the paperwork for any “small project,” accepting an applicant’s own cost estimate instead of demanding receipts, inspections, or anything resembling scrutiny. The threshold started at $35,000. It has been raised six times since, most recently in 2022, when FEMA lifted the small project ceiling to a full $1 million, a number that would have seemed unthinkable to whoever wrote the original rule.

    The logic was always the same; move fast, trust the applicant, save the field inspections for the projects big enough to matter. What nobody seems to have asked is what happens when a project is engineered to sit precisely at the line that separates “trust me” from “prove it.”

    The DHS Office of Inspector General just answered that question in OIG-26-25, and the answer is not flattering. Auditors sampled 20 small projects across every FEMA region and found problems in 12 of them, questioning $3.1 million of the $8.9 million obligated (a rate that would get a private contractor blacklisted). Two projects in the sample deserve special attention, not because they were caught doing anything as crude as inventing storm damage, but because they expose the threshold itself as the vulnerability.

    Exhibit One, the Bridge Built to Spec

    Project number 240045, “Repair Bridge on Roy Brown Lane,” sits in FEMA Region 4. Its total project cost, as recorded in the OIG’s own appendix, is exactly $1,000,000. Not $998,000. Not $1,004,000. One million dollars, on the nose, the precise figure that separates a small project (light documentation, applicant estimates accepted at face value) from a large project (the kind that gets an actual FEMA cost review before the check is cut).

    Maybe that number is coincidence. Bridges are expensive and round figures happen. But an applicant that lands its total cost exactly on a regulatory cliff edge is the textbook profile auditors call “structuring,” the same behavior banks flag when someone deposits $9,900 in cash nine days running to stay under the $10,000 reporting requirement. It does not prove intent. It does prove that the threshold, not the damage, may be doing the engineering.

    Exhibit Two, the School That Cost Almost Twice the Cap

    Project 173233, the Southwest Louisiana Charter College Prep site, tells a stranger story. Its total project cost was $1,873,814, comfortably inside “large project” territory. Yet it received small project treatment, and its federal cost share came out to $733,109, a reimbursement rate of roughly 39 percent. Every other project in the OIG’s twenty-project sample lands on the Stafford Act’s standard 75 or 90 percent cost share; this one does not, and nothing in the public record explains why.

    Put the two exhibits together and you get a threshold operating in both directions at once. One applicant appears to have shaped its numbers downward to stay inside the light-touch lane. Another sailed nearly double the small project cap and still got waved through the same lane, at a reimbursement rate nobody else in the sample received. A door built to keep large, complicated projects out let a $1.87 million project walk straight past the guard.

    The same undocumented trust shows up elsewhere in the sample, just in smaller dollar amounts. In Alabama, an applicant got $40,000 approved to install a pitched metal roof, then installed a cheaper flat, silicone-coated roof instead, after FEMA had already paid separately to remove the original roof under a different project. In New Hampshire, a town claimed storm damage to two miles of road and nine culverts; satellite imagery and an on-site inspection found damage to about a third of a mile and three culverts, a gap FEMA’s own simplified procedures were never built to catch, because simplified procedures do not ask for satellite imagery, they ask for a signature. None of that required a project engineered to a dollar figure. It only required an agency that had already decided, by policy, not to look.

    It is worth noting where that guard was standing. Five of the twenty sampled projects, a quarter of the entire sample, came out of FEMA Region 6 (Louisiana and Texas), more than any other region, and Region 6 also produced three of the sample’s four utility projects, plus the levee case the OIG highlighted separately, in which a town’s claimed disaster damage predated the actual disaster by six months. A regional oversight gap is a management problem. A regional oversight gap sitting directly under the sample’s two biggest financial anomalies is a pattern.

    What Twenty Projects Are Supposed to Tell Washington

    The OIG’s sample was not a full census; it was 20 projects out of what is presumably thousands processed under simplified procedures since 2022. Auditors found trouble in 60 percent of what they looked at and said plainly that the full scope of wasted funds almost certainly is higher. That is not a rounding error in an otherwise sound program; that is an agency admitting its own sample size was too small to know how bad the problem actually is.

    FEMA’s defenders will say the small project threshold exists because disaster survivors cannot wait for a bureaucrat to drive out and inspect a culvert while their town is still underwater, and they are not wrong. Speed matters after a hurricane. But speed and zero verification are not the same policy choice, and Congress did not authorize FEMA to accept an applicant’s word up to $1 million so that a charter school renovation could be waved through at a discount reimbursement rate nobody can explain, or so that a bridge repair could land, suspiciously, on the exact dollar that keeps it out of real review.

    The OIG’s recommendations, as usual, will ask FEMA to tighten documentation requirements and improve its tracking systems. Tightened documentation is a fine start. It does not answer the harder question buried in this appendix, which is whether the $1 million line itself, the one Congress kept raising in the name of efficiency, has become less a speed limit than a target to aim for.

    There is also the matter of what happens after the money is found to be wrong. FEMA has three years after a project’s completion to claw back improper payments administratively, absent evidence of fraud. That clock does not stop for a system migration, yet the same OIG report notes that FEMA closed 20 of 30 already-flagged de-obligation cases during a data migration without recovering the funds, only correcting most of them after auditors came looking, with three still unresolved as of last June. A three-year recovery window managed by an agency that loses track of its own flagged cases during a software update is not an oversight regime; it is a countdown timer nobody is watching.

    None of this requires a villain. It requires only an incentive structure where the safest place for a project to live is just inside a line nobody checks, and the OIG’s twenty-project sample suggests applicants, whether by design or by drift, have found that address. Congress built the door to move money fast to towns that needed it. It did not ask what happens when the door itself becomes the destination.

    Bureaucracies rarely get caught lying. They get caught doing exactly what the rules permit, at exactly the moment the rules stop looking.

  • The FAA Knows Someone Could Fake Its Air Traffic Instructions. It’s Still Working On That.

    Somewhere within range of a major airport, a person with a software-defined radio that costs less than a nice dinner could transmit a message that looks, to a pilot’s instruments, exactly like a legitimate clearance from air traffic control. There is currently no reliable way for that pilot to know the difference. This is not the premise of a thriller; it is the finding of a Government Accountability Office report released September 21, 2026, on the cybersecurity of the systems that keep more than 44,000 daily flights and 3 million passengers from colliding. The FAA has known about this class of problem for years. It has, by GAO’s account, mostly gotten around to writing memos about it.

    The ghosts in the frequency

    The National Airspace System runs on radio frequency signals, the same physical medium used for GPS, radar, and every other invisible thread holding modern aviation together. GAO catalogs three ways to attack it (interference, spoofing, and jamming), each capable of degrading, faking, or simply killing the signals aircraft and controllers depend on. None of this is theoretical. In 2012, an individual jamming GPS transmissions near Newark Airport degraded a landing-approach system during pre-deployment testing. In 2022, GPS interference with signs of spoofing near a Dallas airport caused controller confusion and more than 230 departure delays; the same year, an unauthorized transmitter near Denver International disrupted navigation accuracy for civil flights. GAO also notes, in the driest possible register, that a December 2024 Azerbaijan Airlines flight was shot down amid GPS disruptions linked to the Russia-Ukraine conflict, an approach GAO describes as having “become more complex than usual” due to pilot and controller miscommunications. International GNSS interference is now concentrated enough to have hotspots, mapped in the report like weather systems, radiating out of the Middle East, Eastern Europe, Southeast Asia, and the Baltic region.

    FAA is well aware of all this. Awareness, GAO’s report makes clear, is where the agency’s competence currently ends. This is also the third GAO aviation cybersecurity report in as many years; a September 2024 report found 51 of FAA’s 138 air traffic control systems outright unsustainable, and a July 2026 report found FAA had fully implemented only two of its own seven cybersecurity strategy goals.

    Assessed, in a general sort of way

    Federal information security law requires agencies to run risk assessments for individual systems, evaluating specific threats, vulnerabilities, and likely impact under NIST Special Publication 800-53 Rev. 5, and FAA’s own internal order requires the same. For seven of the eight spectrum-dependent NAS systems GAO reviewed, FAA had not done this. Instead it points to one general spectrum risk assessment covering everything at once, which GAO politely observes “does not satisfy the NIST recommendation” because it treats every system’s exposure as roughly identical rather than evaluating each one’s actual architecture and controls.

    The paperwork underneath these systems is not in better shape. Four of the eight still cite a NIST standard that was superseded in 2021. Five are missing required security controls for high-impact systems, including contingency planning and denial-of-service protection. One system’s documents cannot agree with each other on whether the system is high impact or merely moderate. One had not had its required annual security assessment done since 2023. A separate DOT Inspector General audit, cited in the report, found the same pattern of stale NIST standards and missing controls across FAA’s high-impact systems.

    Real-time monitoring, the thing that would actually let FAA notice an attack while it is happening rather than reconstructing it afterward, does not fully exist. FAA’s Spectrum Engineering office told GAO it has no 24/7 monitoring capability and lacks the specialized tools to detect interference or spoofing as it occurs; instead it investigates after someone reports a problem. The agency’s own Wide Area Augmentation System can flag degraded GPS performance but cannot detect spoofing or identify where it came from. FAA officials cited funding constraints as the reason certain monitoring tools have not been deployed to high-risk sites. It is worth sitting with that sentence; the nation’s air traffic infrastructure lacks live detection for signal spoofing because of a budget line item.

    A coalition of the partially willing

    FAA does talk to other agencies about all this, and GAO gives it credit for two of the eight leading interagency collaboration practices it measured against, defining common outcomes and leveraging shared resources, chiefly through the Aviation Cyber Initiative, the Purposeful Interference Response Team, and the Interdepartmental Radio Advisory Committee. The other six practices were only partially met, and the gap has a consistent shape. Inside the formal interagency groups, FAA has charters, bylaws, and defined roles. Outside them, it has almost nothing. FCC and DOD officials told GAO they routinely share information with FAA through informal channels with no documented policy governing how or when. Some aviation industry stakeholders told GAO they were unsure which FAA office to even contact about a spectrum issue, and some reported wanting more access to the incident coordination calls that already exist. FCC itself was apparently dropped from continued participation in the Aviation Cyber Initiative after an earlier interagency taskforce wound down in 2021, and nobody seems to have noticed enough to fix it.

    Clearance to land, or so says somebody

    The most concrete vulnerability in the report involves two applications that pilots and controllers actually use every day, ACARS, which handles operational messaging between aircraft and airlines, and CPDLC, which lets controllers send digital text clearances as an alternative to voice. Both predate modern cryptography as a design assumption. Neither is encrypted. Neither authenticates the sender. GAO walks through, with illustrated step-by-step diagrams, how a malicious actor could pull public flight-tracking data, transmit a spoofed clearance cancellation over VHF using nothing more exotic than a software-defined radio, and force a pilot into a verbal shouting match with real air traffic control to sort out which instruction is genuine. Do that to several aircraft at once and you have delayed departures, an overloaded controller workload, and, in a worse version of the same scenario, a pilot who follows a fabricated altitude or route change believing it came from ATC.

    FAA’s defense against all this is essentially procedural rather than technical: message-format standardization, mandatory acknowledgments, and the expectation that a suspicious pilot will simply pick up a voice radio and ask. These are reasonable stopgaps. They are also, as GAO notes, “not designed to provide the same level of protection as modern cryptographic controls,” which is a generous way of saying the agency is trusting human vigilance to compensate for a protocol built before anyone thought to secure it. A next-generation replacement, built on standard internet protocols, is in testing at select locations. FAA has not given GAO a timeline for when, or whether, it will actually replace the systems currently in use.

    GAO issued nine recommendations, covering system-specific risk assessments, consistent categorization, real-time monitoring, interagency accountability, sustained leadership, formal information-sharing agreements outside the existing clubs, broader stakeholder inclusion, and a plan to actually authenticate ACARS and CPDLC traffic. The Department of Transportation, replying on FAA’s behalf, concurred with all nine and promised a detailed response within 180 days, the standard federal-agency interval for “we will get back to you, eventually, with something.” Bureaucracy Times will be checking the calendar.

  • Deja Vu on the Clinch River: TVA’s New Nuclear Bet Looks a Lot Like Its Last One

    The Success Story With an Asterisk

    Two articles into this series (introduced in Meet the Fourth Branch)—one on the RFC and one on Fannie Mae and Freddie Mac—both anchored on entities that blew up spectacularly, it seemed only fair to promise readers one that actually worked.

    The Tennessee Valley Authority was supposed to be that entity: a New Deal creation from May 18, 1933, still delivering power to more than nine million people across seven states, still self-financing off electricity sales rather than congressional appropriations, still standing while the Reconstruction Finance Corporation and the RFC’s mortgage-guaranteeing offspring both required federal intervention to survive their own ambitions.

    Here is the asterisk. TVA’s own regulator has spent the better part of four decades documenting a debt history that looks less like a success story and more like a rehearsal for one, and TVA is currently in the middle of placing the exact same kind of bet that got it into trouble the first time, on the exact same patch of land.

    Forty Times the Original Debt Ceiling

    TVA’s early financing was almost absurdly generous by modern standards. Congress appropriated roughly a billion dollars to the agency between 1933 and 1959, charged no interest on any of it, and ultimately treated more than a fifth of that money, 258.3 million dollars, as a straightforward taxpayer equity contribution that was never expected to be repaid at all, according to a Heritage Foundation institutional history of the agency. In 1959, Congress restructured TVA to finance itself through power revenues and its own bond issuance rather than direct appropriations, and set a statutory debt ceiling to keep the new arrangement disciplined.

    That ceiling did not hold the line for long. By 1979 Congress had raised it to 30 billion dollars, forty times the amount originally authorized twenty years earlier, driven almost entirely by TVA’s nuclear construction program. TVA started seventeen nuclear generating units during the 1960s and 1970s and completed only seven of them, according to GAO’s own account of the agency’s finances, a failure rate that turned billions of dollars of half built reactors into pure liability with no offsetting electricity to sell. By 1995, GAO reported that TVA carried 26 billion dollars in debt, with 14 billion dollars of that sunk into nonproducing nuclear assets that were not even included in the rates TVA charged customers, and warned in plain language that if TVA could not compete effectively as electricity markets opened up, the federal government might end up covering TVA’s debt itself.

    The debt problem eventually stabilized. The pension problem did not. By fiscal year 2016, GAO found TVA’s pension plan was only 54 percent funded, with unfunded liabilities that had grown steadily for a decade, and TVA had not even been reporting the shortfall in its own required performance plans. It got worse before it got better: TVA’s own numbers, reported by the Chattanooga Times Free Press, showed the plan falling to roughly 60 percent funded in 2019 and the underfunding widening to 5.6 billion dollars in 2020, driven largely by falling interest rate assumptions rather than any single management failure. Since then the pension picture has improved materially: according to the White House FY2026 Budget Appendix, as of September 30, 2024, the TVA Retirement System reported an estimated seventy-nine percent funding ratio and an unfunded liability of roughly 2.3 billion dollars—better than a decade ago, though still a meaningful gap on TVA’s balance sheet.

    Same River, New Reactor

    Here is where the story loops back on itself in a way that would be hard to invent. One of the reactors TVA never finished during its 1970s nuclear buildout was the Clinch River Breeder Reactor, a federally funded prototype fast breeder sited on TVA owned land near Oak Ridge, Tennessee, with TVA slated to buy its output. Congress killed the project in October 1983 after roughly 1.7 billion dollars had already been spent, amid years of cost estimates that kept sliding further out of reach no matter when anyone checked them.

    In May 2025, TVA became the first utility in the country to submit a construction permit application to the Nuclear Regulatory Commission for a new small modular reactor, specifically the BWRX-300, a boiling water small modular reactor design developed by GE Vernova and Hitachi.

    The site TVA chose is Clinch River, the same 1,200 acre property where the federal government’s last big nuclear swing already failed once. The Nuclear Regulatory Commission issued its Final Supplemental Environmental Impact Statement for the project on April 6, 2026, per the Federal Register notice, and its Final Safety Evaluation Report on June 25, 2026, finding no safety bars to issuing the construction permit, and has targeted a permit decision for the fall of 2026, meaning a yes or no could arrive shortly before or after this article appears.

    The Department of Energy has since selected TVA for up to 800 million dollars in cost shared federal funding to advance the project, on top of a separate 400 million dollar DOE grant announced in December 2025; TVA’s board has also approved up to 350 million dollars to explore small modular reactor development at Clinch River, according to the White House FY2027 Budget Appendix. TVA has additionally signed on for a 6 gigawatt small modular reactor deployment program with a private developer, framed by the current administration as central to an American nuclear renaissance and an energy dominance agenda.

    None of this is happening because nuclear has been quietly carrying TVA’s business. Local reporting in late 2025 found TVA’s nuclear generation had actually hit its lowest level since 2007 over the preceding year, even as the agency signed on for what would be the largest small modular reactor deployment commitment in the country.

    The bet is being placed on projected future demand, principally from data centers and population growth, using the identical playbook of federally backed capital investment that produced a 26 billion dollar debt pile and a decade of underfunded pensions the last time TVA tried it.

    For some background, the TVA’s total long-term debt stood at approximately twenty-three billion dollars as of June 30, 2026, according to its most recent quarterly filing with the Securities and Exchange Commission, down from the mid-1990s peak but still a substantial balance sheet obligation.

    Betting the Rate Base Again

    None of this means TVA is destined to repeat the Clinch River Breeder Reactor’s fate specifically. Small modular reactor technology is a genuinely different bet than a 1970s liquid metal fast breeder, and federal cost sharing this time is explicit up front rather than discovered after the fact.

    But the structural pattern this series keeps returning to is exactly present here, where a government corporation with an implicit federal backstop and a statutory debt ceiling that Congress has shown a consistent willingness to raise whenever the number gets inconvenient, making a decades long capital commitment to a nuclear technology that has never been built at commercial scale in the United States, funded partly by federal grants that do not show up as taxpayer risk until something goes wrong.

    TVA is not the RFC and it is not Fannie Mae. It has never needed a conservatorship or a liquidation act. But the entity billed in this series as the exception that proves government corporations can work has, on its own regulator’s paper trail, already run the exact experiment it is running again, on the same riverbank, with the same optimism about demand that never quite materialized the last time.

    Whether TVA gets to keep its status as this series’ good example may depend less on nuclear physics than on whether Congress and TVA’s own management have actually learned anything from the debt ceiling they raised forty times to pay for the last round of reactors that never got built.

    Sources: GAO, Shedding Light on Tennessee Valley Authority Debt (2017); GAO, Tennessee Valley Authority: Financial Problems Highlight Need for Long-Term Solutions (AIMD/RCED-95-134, 1995); NRC Final Supplemental Environmental Impact Statement, Clinch River SMR (Federal Register, April 6, 2026); DOE, TVA selected for up to $800 million SMR cost-sharing; TVA SEC quarterly filing (Q3 FY2026).

    Next in the series: the FDIC, the other entity in the running for the series’ success story, and what the 2023 collapse of Silicon Valley Bank revealed about how much daylight there really is between “well run” and “the last one standing.”

  • VA Pricing Problems Spread Beyond Drugs, With 11 of 12 Medical-Supply Proposals Flagged

    Earlier this month, Bureaucracy Times reported that nearly seven in ten pharmaceutical proposals examined by the Department of Veterans Affairs inspector general contained problems in the commercial pricing disclosures VA uses to negotiate federal drug prices.

    Apparently, the pharmaceuticals weren’t special.

    In a new report released Sept. 22, the VA Office of Inspector General examined 12 nonpharmaceutical Federal Supply Schedule proposals covering medical supplies and services. Eleven of the 12 proposals, or 91.7 percent, contained commercial-sales disclosures that auditors determined were not accurate, complete, or current.

    The proposals represented approximately $814 million in estimated contract value and included 12,246 offered items.

    Only one proposal passed through the review without OIG identifying disclosure deficiencies.

    That matters because VA uses commercial-sales information to determine whether prices offered to the federal government are fair and reasonable. Vendors are generally required to disclose information about their commercial pricing practices, including discounts and concessions offered to other customers.

    In other words, the government is negotiating with information supplied by the companies sitting across the negotiating table.

    And, once again, OIG found problems with that information.

    A Familiar Problem

    The findings closely resemble those in the pharmaceutical pricing review Bureaucracy Times covered on Sept. 8.

    In that report, OIG examined 16 pharmaceutical proposals and found that 11 contained deficient commercial-sales disclosures.

    Taken together, the two FY2025 reviews examined 28 pharmaceutical and nonpharmaceutical proposals.

    Twenty-two of them had disclosure problems.

    That works out to approximately 79 percent.

    The scale of the purchasing system involved is considerably larger than the sample. VA’s National Acquisition Center administers nine healthcare Federal Supply Schedules. Federal agencies purchased approximately $25.7 billion in products and services through those schedules during fiscal 2025, according to OIG.

    The pharmaceutical proposals reviewed by OIG represented roughly $21 billion in estimated contract value. The latest nonpharmaceutical review adds another $814 million.

    These are not negotiations over boxes of tongue depressors in the supply closet.

    $29 Million Identified, $11.7 Million Sustained

    OIG’s review also produced measurable results.

    Auditors recommended lower prices for eight of the 12 proposals and calculated approximately $29.1 million in potential savings.

    VA ultimately sustained approximately $11.7 million of those savings.

    That is about 40 percent of what OIG identified.

    But the aggregate figure conceals substantial differences among individual negotiations.

    For one proposal, identified in the report only as Report 4, OIG calculated $10.85 million in potential savings.

    VA sustained none of it.

    Another proposal, Report 10, carried approximately $4.59 million in potential savings. Again, none was sustained.

    Report 11 produced another $987,400 in potential savings and zero sustained savings.

    The opposite happened with Report 6. OIG identified approximately $11.75 million in potential savings, and VA ultimately sustained approximately $11.55 million, or more than 98 percent.

    Why one negotiation captured nearly everything OIG identified while others captured nothing is one of the more interesting questions left by the report.

    Unfortunately, figuring out who was sitting on the other side of those negotiations is not particularly easy.

    The Vendors Without Names

    The OIG summary does not identify the companies associated with the 12 proposals.

    There is a reason for that. According to OIG, the individual preaward reports are not publicly released because they contain proprietary commercial information.

    Bureaucracy Times attempted to reconstruct several of the unnamed vendors using information that is public.

    We compared the report dates, contract award dates and other information contained in OIG’s appendix against VA’s publicly accessible Federal Supply Schedule contracting records.

    The exercise produced several plausible matches, but not enough evidence to responsibly attach an OIG finding to a specific company.

    That distinction matters.

    For example, multiple VA medical-supply contracts were awarded on some of the dates appearing in the OIG report. A matching award date can identify candidates, but it cannot establish that a particular vendor was the subject of a particular OIG review.

    So we aren’t going to guess.

    The result is an odd transparency gap.

    VA publicly identifies its Federal Supply Schedule contractors. OIG publicly identifies millions of dollars in potential savings associated with individual proposal reviews. But the public information does not reliably connect the two.

    The government knows which companies submitted the problematic disclosures.

    The public gets Report 4.

    And Then There Is Report 11

    One entry in OIG’s appendix raises another question.

    Report 11 was issued Sept. 2, 2025.

    The table lists the corresponding contract award date as July 30, 2025.

    That would put the award 34 days before OIG issued its preaward report.

    There may be an entirely routine explanation. The date could reflect an existing contract, a modification, an effective date or some other element of the acquisition chronology.

    Our reconstruction uncovered another reason for caution. In at least one portion of the public contracting record, dates that appear to represent contract effectiveness do not necessarily correspond neatly with the literal date on which an award was made.

    That makes the chronology difficult to reconstruct from the summary alone.

    But it also illustrates the larger problem.

    OIG is performing these reviews precisely because commercial pricing disclosures affect the government’s ability to negotiate favorable prices. Across the pharmaceutical and nonpharmaceutical reviews examined by Bureaucracy Times this month, 22 of 28 proposals contained problems with those disclosures.

    The latest audit alone identified $29.1 million in potential savings.

    VA captured $11.7 million.

    And the public still cannot readily determine which companies were responsible for the disclosures behind the remaining millions.

    For a federal purchasing system that moved $25.7 billion in healthcare products and services last year, “Report 4” leaves quite a bit to the imagination.

    Sources: VA OIG, Federal Supply Schedule Nonpharmaceutical Preaward Reviews for Fiscal Year 2025 (VAOIG-26-00128-191, September 22, 2026).

    Fediverse Reactions

  • Three Years Running, America’s Postal Watchdog Fails Its Own Report Card

    The Postal Regulatory Commission exists to keep an eye on the U.S. Postal Service. It reviews rate cases, audits service performance, and generally plays the part of the adult in a building full of trucks that don’t show up. So there is a certain poetry in the fact that, for the third consecutive year, the federal government’s own auditors have looked at the Commission’s cybersecurity and concluded, gently but repeatedly, that nobody is minding the store.

    The latest FISMA compliance audit, performed by KPMG under contract to the USPS Office of Inspector General, rates the PRC’s information security program as “Defined,” which is a polite way of saying Level 2 out of 5, which is a polite way of saying “Not Effective.” This is not a scandal in the sense of missing money or a whistleblower with a grudge. It is something more diagnostic of how the federal government actually runs, a quiet, well documented, thoroughly bureaucratic failure to do the basics, year after year, at an agency too small to notice and too obscure for anyone else to either.

    Groundhog Day in Arlington

    Start with the scorecard. In FY2024, the PRC scored Ad-hoc, the bottom rung, across all five cybersecurity functions then in use. In FY2025, it climbed to Defined, still “Not Effective,” but at least off the floor. This year, the agency improved further in three of six functions (Protect, Detect, and Recover all reached “Consistently Implemented”), while a newly added function called Govern, covering leadership and accountability for the whole program, opened at Ad-hoc, dead last, on its very first outing.

    That last detail is the one worth sitting with. The PRC has now had three straight audits, and the one category that measures whether the agency’s leadership has actually organized itself to manage cybersecurity risk is doing worse than areas the agency has had years longer to fix. Progress is real. It is also lopsided in a way that suggests the operational fixes are outrunning the institutional ones, which is what happens when an agency patches whatever the last audit complained about without building a structure to catch the next problem before an auditor finds it.

    There is also a quieter trick in the recommendation tracking. KPMG’s own appendix shows several findings “closed” in one year only to be “reissued” the next under a new recommendation number covering essentially the same gap. The FY2025 finding on cyber governance policy, for instance, gets closed in FY2026 and immediately reborn as a new recommendation about “cybersecurity current and target profiles,” a rename more than a resolution. Closure, in this accounting, means the paperwork changed forms, not that the underlying problem went away.

    The Chair Nobody Sat In

    If there is a single character in this story, it is the Chief Information Security Officer position, or rather its absence. The PRC’s first CISO departed in April 2024. The role sat vacant through the entirety of FY2025, run in the interim by the Chief Information Officer wearing a second hat, until a replacement finally started in August 2025, nearly a year and a half later. For a stretch in mid-2024, the Commission’s entire cybersecurity function, for an agency that hosts a public facing system processing regulatory filings, cost data, and PII, was staffed by one person.

    PRC management’s own explanation, offered without much embellishment across three consecutive audits, is that it is “a small agency with limited resources.” That is true as far as it goes. It also happens to be the same sentence, more or less, that management gave auditors in 2024 and again in 2025. A justification repeated for three years starts to function less like an explanation and more like a policy.

    Whose Money Is It, Anyway

    Here the story gets structurally interesting rather than merely sad, because the PRC does not control its own budget. By statute, the Commission submits its funding request to the USPS Board of Governors, which is to say, the leadership of the agency the PRC regulates, and the Governors may unilaterally cut the total by unanimous vote. The regulator’s paycheck is signed by the regulated.

    In September 2023, that is precisely what happened. The Commission requested roughly $22.6 million for FY2024; the Governors approved $21.1 million. Chairman Michael Kubayanda’s public statement on the cut warned it risked “eliminating positions in the understaffed agency” and “stopping long overdue technology upgrades,” and specified that the Commission was, at that moment, in the process of “establishing centralized databases, information management systems, and cybersecurity monitoring.” FY2024, recall, is the year the Commission’s cybersecurity program bottomed out at Ad-hoc across the board and the CISO walked out the door.

    The following year tells a more complicated story, and honesty requires including it. For FY2025, the Governors approved the Commission’s full $25.4 million request, no cut at all. Yet the CISO seat remained empty for the entire year regardless, filled only as FY2025 was closing out. So the money explains the disaster year reasonably well. It does not fully explain the second straight failing grade, which looks less like a budget problem and more like the ordinary friction of hiring a specialized federal position, a separate and more mundane kind of government dysfunction, but dysfunction all the same.

    Grading on a Curve

    None of this amounts to negligence or coverup. The PRC agreed with all nine of KPMG’s new recommendations this year, as it agreed with all of them the previous two years, and the underlying trend, Ad-hoc to Defined to a mix of Defined and Consistently Implemented, is genuine improvement by any honest reading. The agency went from a two person cybersecurity operation to six people in about two years. That is not nothing.

    What it is, instead, is a small case study in how “Not Effective” becomes a permanent institutional address rather than a temporary embarrassment. The fixes keep arriving with implementation dates a year or more out (several of this year’s nine recommendations are not due until September 2027), the governance layer keeps testing worse than the operational layers built under it, and the agency tasked with holding the Postal Service accountable spends its own compliance report explaining, once again, that it is small, understaffed, and doing its best. It probably is. The report just keeps saying so anyway.

    Sources: USPS OIG / KPMG, FY2026 Federal Information Security Modernization Act Audit of the Postal Regulatory Commission (Report 26-016-R26, September 2026); PRC Chairman Kubayanda statement on FY2024 budget cut.

    Fediverse Reactions