How to evaluate audit and investigation case management software for Inspectors General

What this software does

Case management software for an Office of Inspector General (OIG) records the office’s work from the first complaint to the last closed recommendation. Hotline complaints are logged and assessed, audits and evaluations keep their workpapers and supervisory review, investigations keep subjects, allegations, interviews and evidence, and issued reports carry their recommendations until the agency acts on them. The same records supply the counts for the office’s semiannual report to Congress.

Many offices run these pieces in separate tools, spreadsheets and shared drives. Products differ most in how many of them they replace, and in how well they keep audit and investigative work apart while sharing one record of complaints, reports and recommendations. Decide early which directorates the system must serve.

The rules that shape the work

The Inspector General Act of 1978 is now codified at 5 U.S.C. 401 to 424. Together with the professional standards OIGs follow, it sets much of what case management has to record:

• Complainant identity. Under 5 U.S.C. 407, an Inspector General may not disclose the identity of an employee who makes a complaint or provides information without that employee’s consent, unless the Inspector General determines disclosure is unavoidable during the investigation.
• Semiannual reports. 5 U.S.C. 405 requires reports by April 30 and October 31 covering the six months ending March 31 and September 30. Among other things they include significant recommendations from earlier reports on which corrective action is not complete, audit, inspection and evaluation reports with questioned costs and funds put to better use, statistical tables of investigative reports, referrals to federal, state and local prosecutors and resulting indictments and criminal informations, a description of the metrics used for those tables, peer review results, and substantiated misconduct investigations involving senior government employees.
• Investigations. The CIGIE Quality Standards for Investigations (2011) call for a management information system with defined data elements, documented decisions not to investigate, evidence collected so that the chain of custody is preserved, a procedure for disposal of physical evidence by an independent party, periodic supervisory review of cases, timely work, and findings supported by documentation kept in the case file. Requests for witness confidentiality are honored in accordance with the IG Act and to the extent legally permissible.
• Audits. Audits follow GAO’s Government Auditing Standards (the Yellow Book). The 2024 revision applies to performance audits beginning on or after December 15, 2025, and to financial audits, attestation engagements and reviews of financial statements for periods beginning on or after that date, and replaces quality control with a system of quality management.
• Privacy and records. Case files retrieved by a person’s name or identifier are a system of records under the Privacy Act, which requires a published notice when a system is established or revised and appropriate safeguards. Under the Federal Records Act, federal records may be destroyed only under its procedures, in practice your approved records schedules.

Who should be on the evaluation team

• The Deputy or Assistant Inspectors General for audit, evaluations and investigations, who own the processes.
• Auditors, evaluators and special agents, who will keep workpapers and case files in the system every day.
• Hotline staff, who handle complainant identities first.
• Counsel, for confidentiality, restricted cases and referrals.
• Quality assurance staff, who prepare for peer reviews.
• The records officer and privacy officer, for retention schedules and the system of records notice.
• The chief information security officer, for the system’s authorization to operate.

Questions to ask and things to test

• Log a sample hotline complaint with a confidentiality request and check who can see the complainant’s identity, and whether every view of it is recorded.
• Take a past audit and trace a finding back to its signed-off workpapers and the supervisor’s review.
• Record an evidence item through collection, transfer, storage and disposition, then read the custody report. Can a custody entry be edited or deleted?
• Restrict a test case to named people, as you would for a matter involving a senior official or OIG staff, and confirm others cannot find it in search or reports.
• Produce semiannual report counts for a sample period and compare them with your last report. Can you see which records each count came from?
• Confirm role separation. Who can open, refer and close a case, and who can sign off a workpaper?
• Ask how you would leave. Can cases, workpapers, custody histories and recommendations be exported in a usable form?

Common limits to probe

• Decisions stay with your staff. Software records audit, investigative, referral and closure decisions; it does not make them.
• Standards compliance. A product can record the evidence peer reviewers look for. Whether your office meets the Yellow Book or CIGIE standards is for your office and its reviewers to assess.
• Criminal justice systems. Check whether the product connects to criminal justice information systems, or whether agents record results under your policies.
• Forensics. Device examination usually happens in specialist tools; ask whether images and reports are stored or referenced.
• Physical evidence. Software tracks records and labels; handling and storage remain your custodians’ responsibility.
• Authorization and classification. Ask which federal cloud authorization the service holds, if any, and whether classified matters must stay in separate systems.

Implementation risks

• Migrating custody history. Open cases moved without their full chain of custody can weaken evidence. Check a sample of migrated items against the source records.
• Access model. Separation between audit and investigations, restricted cases and complainant confidentiality need to be agreed with leadership and counsel before configuration, not after.
• Counting rules. If statistics are defined differently from your last semiannual report, period-to-period figures will not compare. Agree definitions before go-live.
• Privacy Act notice. A new or changed system may require a revised system of records notice. Involve your privacy officer early.
• Retention. Configure records schedules for each record type, with holds that stop disposal during litigation or review.
• Peer review timing. Avoid switching systems in the middle of a peer review period without a plan to show reviewers both.

Related reading on this site

Requirement pages: Privacy Act of 1974, Federal Records Act, FedRAMP.

In the glossary: Privacy Act of 1974, Federal Records Act, FedRAMP, Audit trail.

This guide describes the category, not any one product. It is general information, not legal advice: for what a rule requires of your organization, read the rule itself or ask your counsel.