Practical guidance on federal acquisition policy, PPBE, audit remediation, and program management from the team supporting TSA and DHS components.
GSA’s Oct 5 GSAR proposal relocates utility-services procedures from FAR 41 to GSAR 541—contact GSA first, favor areawide contracts, and remap 552.241 clauses.
GAO’s Oct 7 IT Dashboard review: 24 of 53 CIO risk ratings understated risk and 21 were stale—data-quality lessons for portfolio oversight.
GAO’s Oct 7 PNT review: fragmented service efforts strain schedules and funding alignment—portfolio consolidation lessons for program managers.
On October 5, 2026, the General Services Administration published a proposed rule in the Federal Register (91 FR 63243; GSAR Case 2026-G502) to amend GSAR part 541, Acquisition of Utility Services. It pairs with the FAR Council’s Revolutionary FAR Overhaul rule for FAR part 41 (FAR Case 2026-002), which would keep in the FAR only the utility rules that apply when the Department of Defense and Department of Energy use their special statutory authorities, and would direct all other buys to follow procedures and guidance established by GSA. Comments are due November 4, 2026.
Under proposed GSAR 541.501, agencies must follow GSA’s utility procedures and guidance posted at gsa.gov/utilities, and the rule directs agencies to contact GSA before making a utility-related acquisition so GSA can recommend the most efficient vehicle—typically a GSA areawide contract. Proposed GSAR 541.502 sets up an email-based path for requesting GSA contracting assistance or a delegation of contracting authority. The familiar FAR part 41 provisions and clauses would move into the GSAR as 552.241-1 through 552.241-15, still prescribed on a “substantially the same as” basis, covering items such as electric service territory compliance, connection charges, termination liability, cooperative membership, and economic price adjustment for deregulated electric supply. GSA estimates only minimal familiarization costs.
What it means for acquisition and facilities teams: treat this as a relocation plus a new front door, not a new policy regime. Inventory your current utility contracts and areawide authorizations, then map every FAR 52.241 clause in your templates and contract-writing system to its proposed GSAR 552.241 counterpart so the changeover does not leave clause gaps at the next modification or renewal. Build the “contact GSA first” step into your acquisition planning timeline and document it in the file, and if your component relies on its own utility-contracting authority, confirm now whether that authority is one of the FAR 41.103 special authorities or whether you will need to request a GSA delegation.
Source: General Services Administration, “General Services Administration Acquisition Regulation; GSAR Implementation of Executive Order 14275, Acquisition of Utility Services,” proposed rule, Federal Register, October 5, 2026 (91 FR 63243; GSAR Case 2026-G502), federalregister.gov.
On October 7, 2026, the Government Accountability Office issued GAO-27-108416, IT Dashboard: Selected Agencies’ Investment Ratings Fail to Fully Consider Risks. The Federal IT Dashboard is meant to show how likely each major IT investment is to accomplish its goals, using Chief Information Officer (CIO) risk ratings. GAO selected 53 major investments with at least $35 million in development activity across 12 agencies, built its own risk assessments from investment documentation, and compared them with the published CIO ratings.
GAO’s assessments matched the CIO rating 27 times, showed more risk 24 times, and showed less risk only twice. Two causes drove the gaps: 21 of the 53 ratings were not updated on time under the agencies’ own processes, and two agencies ran rating cycles longer than the quarterly cadence OMB guidance calls for. GAO also noted that OMB announced in April 2026 that it would sunset the Dashboard in favor of a new streamlined system, without a release timeframe. GAO made 17 recommendations to nine agencies—including DHS, DOD, Treasury, and GSA—to correct understated ratings, update them on schedule, and align rating frequency with OMB guidance.
What it means for data and portfolio teams: a risk rating is a data element, and it needs the same governance as any other—an owner, a refresh standard, source evidence, and a quality check. Define the factors behind each rating (cost, schedule, performance, and risk-register status), tie each refresh to an evidence date, and flag any rating older than its required cycle as a data-quality exception rather than letting it default to its last value. If your agency is preparing for the Dashboard’s replacement, clean up rating lineage and timeliness now so the new system inherits trustworthy data instead of carrying stale “green” forward.
Source: U.S. Government Accountability Office, GAO-27-108416, “IT Dashboard: Selected Agencies’ Investment Ratings Fail to Fully Consider Risks,” October 7, 2026, gao.gov.
On October 7, 2026, the Government Accountability Office issued GAO-27-107676, Precision Navigation Systems: Challenges Remain with Fielding New Capabilities, a congressionally mandated review of the Department of Defense’s GPS modernization and complementary positioning, navigation, and timing (PNT) efforts. GAO reported that GPS modernization continues to face delays; in 2026, after years of delays, DOD canceled the Next Generation Operational Control System and began modernizing the existing GPS Operational Control Segment instead, which GAO says creates risks for launching, checking out, and operating new GPS satellites.
GAO found the Air Force is making progress on modernized military-code (M-code) receiver cards, but aviation receiver programs continue to encounter development and integration challenges, prompting the Navy to develop an interim solution for its aircraft. The Army and Navy are fielding M-code capable and multi-PNT receivers in ground vehicles, ships, and Army aircraft. The larger issue is portfolio fragmentation: a congressionally mandated PNT Oversight Council can recommend budget actions, but each service controls its own budget. GAO pointed to the Air Force’s M-code Aviation Receiver Joint Program Office—which combined aircraft PNT receiver and M-code receiver card efforts—as a model, and made three recommendations, with which DOD concurred, for the Army, Navy, and Air Force to assess where consolidation would improve strategic alignment and to develop consolidation plans.
What it means for program management teams: when several programs chase the same capability, an oversight council without budget authority cannot by itself synchronize schedules. Build a portfolio view that shows shared dependencies—such as common receivers, ground systems, and integration windows—alongside each program’s baseline, and make interface and integration milestones joint commitments rather than separate dates. Where consolidation is on the table, prepare the decision package early: overlapping requirements, funding lines, contract vehicles, and workforce impacts, so leaders can weigh a joint program office against coordinated but separate efforts.
Source: U.S. Government Accountability Office, GAO-27-107676, “Precision Navigation Systems: Challenges Remain with Fielding New Capabilities,” October 7, 2026, gao.gov.
On September 22, 2026, the General Services Administration published a proposed rule in the Federal Register (91 FR 60063; GSAR Case 2026-G501) to amend the General Services Administration Acquisition Regulation by moving Federal Supply Schedule (FSS) ordering procedures from FAR subpart 8.4 into a new GSAR subpart 538.71. The change aligns with the Revolutionary FAR Overhaul: FAR Case 2026-003 revises FAR part 8 and directs ordering activities to use FSS procedures established by GSA rather than keeping those procedures in the FAR.
GSA describes a single, dollar-threshold-based approach to order placement instead of today’s three-way split across FAR 8.405-1, 8.405-2, and 8.405-3. The proposal reorganizes blanket purchase agreement (BPA) content, relocates order-level materials (OLM) requirements from GSAR clause 552.238-115 into the ordering procedures subpart, and restates that FAR parts 5, 6, 14, 15, 16, and 19 generally do not apply unless otherwise prescribed. Comments are due October 22, 2026.
What it means for program and contracting teams: treat this as a desk-guide refresh, not a new Schedule program. Before the final rule lands, map your component’s FSS RFQ templates, BPA ordering procedures, sole-source justification packages, and OLM checklists to the proposed GSAR 538.71 structure. Confirm COR and ordering-officer training covers the clarified points that responsibility and fair-and-reasonable pricing are established at the FSS contract level, that FAR part 15 source-selection rituals are not required for Schedule orders, and that OLM use must remain secondary to the order’s primary purpose.
Source: General Services Administration, “General Services Administration Acquisition Regulation; GSAR Implementation of Executive Order 14275, Federal Supply Schedule Ordering Procedures,” proposed rule, Federal Register, September 22, 2026 (91 FR 60063; GSAR Case 2026-G501), federalregister.gov.
On September 24, 2026, the U.S. Postal Service Office of Inspector General issued audit report 25-139-R26, Postal Service Contract Practices and Oversight. Against more than $15 billion in FY 2025 managed spend, OIG found the Postal Service does not consistently collect and maintain required information to support informed contract decisions—raising exposure to improper payments and fraud. OIG identified $271,916,465 of monetary impact where required processes were not followed in FYs 2024–2025.
In a sample of 203 time-and-materials invoices, 151 (74 percent) lacked required descriptions or evidence of tasks performed in the contract system to justify payment; OIG projected at least $271.1 million in unsupported questioned costs for T&M invoices. Sixty percent of unauthorized contractual commitment (UCC) files lacked critical documents, and 18 percent of sampled noncompetitive purchases lacked evidence that required reviews and approvals were completed—even as the noncompetitive approval threshold had risen to $5 million. OIG also flagged decentralized oversight across portfolios and heavy reliance on manual workflows, with recommendations spanning invoice documentation standards, centralized UCC tracking, purchase-plan waiver policy, publicizing large noncompetitive awards, enterprise risk indicators, automation, and stronger excluded-supplier screening via UEI/TIN.
What it means for audit remediation and readiness teams: payment support is an audit control, not a COR convenience. Require T&M invoice packages to capture task descriptions tied to the order or PWS, sample COR invoice approvals against the clause checklist, and treat UCC and noncompetitive file completeness as continuous monitoring metrics—not once-a-year compliance sampling. When contracting authority is decentralized, stand up a short list of enterprise risk indicators (invoice support gaps, modification spikes, competitive-to-noncompetitive flips, excluded-supplier hits) that leadership can see across systems.
Source: U.S. Postal Service Office of Inspector General, Report Number 25-139-R26, “Postal Service Contract Practices and Oversight,” September 24, 2026, oversight.gov (PDF: 25-139-R26.pdf).
On September 21, 2026, the Department of Homeland Security Office of Inspector General issued OIG-26-30, CISA Enhanced Cloud Security for Federal Information but Lacks Authority to Require All Necessary Protective Actions. The audit examined how CISA’s Secure Cloud Business Applications (SCuBA) project helps Federal Civilian Executive Branch (FCEB) agencies secure cloud-stored information under Binding Operational Directive (BOD) 25-01, Implementing Secure Practices for Cloud Services.
OIG reported that CISA delivered tools, baselines, and extensive engagement—yet 88 of 102 FCEB agencies (86 percent) did not implement all mandatory SCuBA policies by the June 20, 2025 deadline, and 76 percent remained noncompliant as of February 12, 2026. Earlier milestones were also widely missed: 39 percent failed to inventory all cloud tenants by February 21, 2025, and 52 percent failed to deploy all assessment tools by April 25, 2025. OIG concluded CISA can develop and report on BOD compliance but lacks authority to compel full, timely implementation; the report contains no recommendations given that statutory limitation.
What it means for enterprise risk management teams: treat cloud-configuration baselines as residual risk you own, not as work that ends when a directive is issued. Map BOD 25-01 (and successor cloud mandates) into your A-123 / Green Book control inventory with a named accountable official, tenant inventory completeness metrics, and escalation when tool deployment or policy implementation slips. Where a central agency can only advise and report, component CISOs and program risk committees should close the gap with internal policy, continuous monitoring, and leadership dashboards that show noncompliant tenants before an OIG or FISMA cycle does.
Source: DHS Office of Inspector General, OIG-26-30, “CISA Enhanced Cloud Security for Federal Information but Lacks Authority to Require All Necessary Protective Actions,” September 21, 2026, oig.dhs.gov.
On September 4, 2026, the Department of War Office of Inspector General issued DOWIG-2026-120, a management advisory on the Defense Health Agency’s plan for a second sole-source bridge contract for Technology Lifecycle Support (TLS) services. OIG cautioned that successive bridges limit competition, constrain cost leverage and innovation, and deepen reliance on a single vendor while a follow-on acquisition is unfinished.
OIG found TLS tasks were not inherently governmental but included work closely associated with inherently governmental functions (for example, budget development and analysis informing policy), which requires heightened Government oversight and consideration of insourcing. Recommendations pressed DHA to evaluate insourcing TLS functions and pressed Acquisition & Sustainment leadership to confirm whether a second bridge is best value—or to direct an alternate strategy. Management responses described a time-limited second bridge plus a competitive follow-on path; OIG closed both recommendations based on those actions.
What it means for program and contracting teams: treat a second bridge as an exception that needs an explicit acquisition strategy, documented continuity risk, and a dated path to competition or insourcing—not a default calendar extension. Requirements packages for long-running IT services should separately identify closely associated functions, COR oversight capacity, and transition plans before option years or bridge awards.
Source: Department of War Office of Inspector General, DOWIG-2026-120, “Management Advisory: Concerns Regarding the Defense Health Agency’s Second Bridge Contract for Technology Lifecycle Support Services,” September 4, 2026, oversight.gov.
On September 2, 2026, DHS OIG issued OIG-26-25, FEMA Wasted Millions of Dollars in Public Assistance Small Project Grants. After Congress raised the Small Project threshold to $1 million, OIG reviewed a sample of 20 completed/closed projects (FYs 2023–2024) and found every sampled file missing documents or information needed to support approval and oversight. OIG questioned about $3.1 million in costs and identified about $7.9 million in over-obligated funds FEMA had not properly de-obligated (about $5.8 million already paid).
Root causes cited include weak design of simplified-procedure controls, acceptance of incomplete self-certifications and sparse damage evidence, and closeouts that did not recover identified over-obligations—including migration-related closeouts. FEMA concurred with recommendations on documentation/questioned-cost resolution and de-obligation recovery, and non-concurred with mandating photographic evidence for all damages/work; that recommendation remained open and unresolved at publication.
What it means for financial management and grants teams: simplified procedures are not “no documentation.” Programs that raise thresholds or streamline estimates still need enforceable minimum file contents in the system of record, controls that block closeout while over-obligations remain, and sampling of certifications against objective evidence. Treat de-obligation workflows as funds-control controls with owner, SLA, and exception reporting—especially after system migrations.
Source: DHS Office of Inspector General, OIG-26-25, “FEMA Wasted Millions of Dollars in Public Assistance Small Project Grants,” September 2, 2026, oig.dhs.gov.
On September 3, 2026, the Department of Commerce Office of Inspector General issued OIG-26-027-A on NTIA’s Public Wireless Supply Chain Innovation Fund award process for Notice of Funding Opportunity (NOFO) 1. OIG concluded NTIA had an adequate application review and award selection process on paper, but did not always follow it and could not appropriately support award decisions for sampled applications.
Recommendations focus on completing required documents before award decisions, ensuring decision memoranda are backed by program or grant files, analyzing eligibility with retained documentation, implementing quality-assurance for each review phase, and having the COR adhere to the Quality Assurance Surveillance Plan (QASP) when contractors perform initial/merit reviews. A related recommendation addresses NIST grants-officer oversight of specialist reviews under Commerce grants manuals.
What it means for program managers and CORs: a documented NOFO process only protects the agency if the file trail matches every decision. When contractors support merit review, COR surveillance under the QASP is a core control—not optional paperwork. Before selection boards finalize awards, require a completeness check that the decision memo, eligibility analysis, and reviewer workpapers are stored where auditors can retrieve them.
Source: Department of Commerce Office of Inspector General, OIG-26-027-A, “Audit of NTIA’s Public Wireless Supply Chain Innovation Fund Award Process for Notice of Funding Opportunity 1,” September 3, 2026, oversight.gov.
On September 1, 2026, the Office of Management and Budget’s Cost Accounting Standards Board published a final rule in the Federal Register (91 FR 56056; FR Doc. 2026-17901) raising Cost Accounting Standards (CAS) monetary thresholds and clarifying how CAS applies to indefinite delivery contracts. The rule is effective October 1, 2026.
Key changes for practitioners: the basic CAS applicability threshold for negotiated contracts moves to $35 million (implementing FY 2026 NDAA direction), the $7.5 million “trigger contract” concept is eliminated, full CAS coverage and Disclosure Statement thresholds rise from $50 million to $100 million, and agency-head waiver authority increases to $100 million. The rule also clarifies that CAS exemptions for multiple-award IDCs are assessed at the task/delivery order level, while single-award IDCs are assessed at award using the ceiling value.
What this means for program and acquisition teams: re-run CAS applicability for upcoming solicitations and awards dated on or after October 1; revisit Disclosure Statement and full-versus-modified coverage for mid-tier segments near the old $50 million line; and confirm IDC strategy language with counsel so order-level versus ceiling-level determinations are documented. Contractors currently under full coverage solely because of the prior $50 million threshold may transition to modified coverage at the next cost accounting period if they have no unresolved CAS noncompliances and no longer meet the $100 million test.
Sources: Cost Accounting Standards Board / OFPP, “Increase of Monetary Thresholds and Other Matters Related to Cost Accounting Standards Program Requirements,” final rule, Federal Register, September 1, 2026, federalregister.gov. Background on the Board’s mandate: Federal News Network, April 2026 coverage of the CAS Board comment process.
On September 4, 2026, the Department of Homeland Security Office of Inspector General issued OIG-26-28, CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information. The audit found that CBP did not consistently apply IT access controls: all tested network users incorrectly had access to a highly privileged service account; privileged functions were over-granted; not all applications were enrolled in periodic privileged-account review; and separated or transferred personnel often retained access beyond required timelines.
From an Enterprise Risk Management and internal-control perspective, the report maps directly to access-management control failures under DHS 4300A and NIST-aligned baselines: least privilege, timely deprovisioning, and continuous monitoring of privileged groups. CBP concurred with all 12 recommendations; several corrective actions target supervisor and COR notification discipline for employee and contractor separations.
What it means for program, acquisition, and COR teams: treat joiner–mover–leaver workflows as a control, not an HR handoff; verify that contractor offboarding in tracking systems triggers account disablement within policy windows; and ensure application owners can evidence periodic privileged-account reviews—especially for systems holding PII, law-enforcement, or biometric data. When OIG findings cite COR notification failures, acquisition leadership should reinforce COR desk guides and sampling of separation records.
Source: DHS Office of Inspector General, OIG-26-28, “CBP’s IT Access Control Deficiencies Introduced Critical Risk to IT Systems and Sensitive Information,” September 4, 2026, oig.dhs.gov.
In September 2026, the Social Security Administration Office of the Inspector General issued an Office of Audit report on Old-Age, Survivors, and Disability Insurance (OASDI) overpayment notices (report 152407, dated September 1, 2026). The objective was to determine whether SSA issued overpayment notices and processed explanation requests according to policy.
OIG found that a large share of sampled notices omitted policy-required information explaining how and when the overpayment occurred, and that explanation requests were not always handled as required. Incomplete notices impede individuals’ ability to seek reconsideration, waiver, or repayment options—and create rework when customers re-contact the agency without clear facts.
What it means for federal financial management teams more broadly: debt and overpayment communications are a funds-control and internal-control activity, not only a customer-service script. Programs that issue recovery notices should sample for required content (cause, calculation, rights, and repayment options), track explanation-request turnaround, and tie notice quality metrics to corrective action plans—especially where improper-payment risk is already elevated.
Source: SSA Office of the Inspector General, “Old-Age, Survivors, and Disability Insurance Overpayment Notices,” Office of Audit Report 152407, September 1, 2026, available via oversight.gov.
The November 2025 revision to DHS Directive 102-01 represents one of the most significant updates to the Department’s acquisition framework in years. With four new acquisition pathways, updated risk management requirements, and revised oversight gates, program managers and contracting officers across TSA and other components must adapt quickly.
Organizations that treat this as a compliance exercise will struggle. Those that use it as an opportunity to streamline their internal processes and upskill their workforce will gain a competitive advantage in speed and mission outcomes.
M2 Torres Recommendation:
Schedule a tailored workshop on the new Directive 102-01 pathways and risk framework. We’ve already delivered this content to multiple TSA audiences with excellent feedback.
In the current fiscal environment, every program dollar is under the microscope. Congressional staff, OMB examiners, and component leadership are demanding clearer linkages between mission requirements, performance outcomes, and requested resources.
Programs that master this traceability are seeing faster approvals and fewer marks. Those that don’t are experiencing delays and reduced funding.
M2 Torres Recommendation:
We help teams build stronger PPBE artifacts and train analysts on justification techniques that resonate with reviewers. Many of our clients have used our frameworks to successfully defend resources in tight cycles.
Closing audit findings quickly is necessary but not sufficient. The agencies seeing the biggest reduction in repeat findings are those treating remediation as a strategic capability, not a compliance fire drill.
Sustainable remediation protects mission resources and builds long-term organizational resilience.
M2 Torres Recommendation:
Our audit remediation support combines hands-on corrective action planning with training that builds internal capability. Clients typically see measurable improvement in repeat finding rates within one to two cycles.
Practical frameworks and checklists you can put to work immediately. Full branded PDFs of the above articles available upon request.
Key checkpoints for new programs, PPBE alignment, and audit readiness.
Practical templates and steps for identifying gaps and preparing for successful audits.
Branded PDFs of featured articles available upon request.
Request via Contact Form →