OIG Audit Case Management

Principal workflows

• Intake: Hotline complaints and referrals arrive through web forms, email, phone and mail, are logged with the complainant's identity protected, and are assessed and routed to audit, investigations, agency management or closure.
• Audit: Audits and evaluations move through planning, fieldwork and reporting with workpapers, supervisory review and indexing to the findings, so the report can be traced back to its evidence.
• Investigate: Investigative cases hold subjects, allegations, interview records, investigative activity and evidence, with each item of evidence tracked from collection to disposition.
• Report and follow up: Reports go through review and approval before issue. Recommendations are tracked with the agency's response until closure, and the data your office needs for its semiannual report to Congress is kept as you go.

Who uses it

• Offices of Inspector General at federal agencies
• Audit and evaluation staff who prepare workpapers and reports
• Special agents and investigators who manage cases and evidence
• Hotline staff who receive and route complaints
• OIG leadership and counsel who approve reports and referrals

Reporting

• Hotline complaints by source, type, age and disposition
• Audit and evaluation projects by stage and directorate
• Investigative cases due for supervisory review
• Evidence inventory and chain of custody
• Open recommendations and agency corrective actions
• Semiannual report data by period

Features

• Hotline intake: Complaints from every channel logged in one place, with confidentiality requests recorded and identities visible only to the roles you choose.
• Audit workpapers: Workpapers organized by objective, with preparer and reviewer sign-off, review notes and indexing to report findings.
• Independence and quality control: Independence statements, supervisory review and quality control checks recorded per project for internal and peer review.
• Investigative case files: Subjects, allegations, activities, interview records and referrals kept in one case, with access limited to the assigned team.
• Chain of custody: Each item of evidence logged at collection, with every transfer, storage location, examination and disposition recorded with the person and time.
• Digital evidence: Files stored with a hash taken at intake, so later copies can be checked against the original.
• Interview records: Memoranda of interview drafted, reviewed and finalized in the case, with drafts kept separate from approved records.
• Report review: Draft reports routed through supervisory, quality control and legal review, with agency comments recorded before issue.
• Recommendation tracking: Each recommendation tracked with the agency's corrective action plan, target dates set by the agency, and the OIG's decision to close.
• Semiannual report data: Reports issued, recommendations open and closed, investigative outcomes and referrals counted by period for your semiannual report.
• Restricted access: Cases can be restricted to named people, for example when the subject is a senior official or an OIG employee.
• Records retention: Retention schedules applied by record type, with holds that prevent disposal while litigation or review is pending.

Integrations

• Hotline web form: A public complaint form hosted for your OIG, with optional anonymous submission and file upload, feeding the hotline queue.
• Email intake: A hotline mailbox monitored so complaints received by email are logged with their attachments.
• Document and evidence storage: Digital evidence and documents stored with the case, with hashes recorded at intake. Large forensic images can stay in your forensic storage with a reference in the case.
• Agency data: Extracts from agency financial, grant or program systems loaded into a project for audit analysis, where the agency provides them.
• Single sign-on: Staff sign in through your identity provider (SAML or OpenID Connect), including PIV-based sign-in.
• Work API: Project, case, report and recommendation data available to your data warehouse and reporting tools through the Moraph Work API.
• Records management: Records at the end of their retention period exported with their metadata to your records management system or for transfer under your schedules.

Deployment

• Moraph cloud, United States: Hosted in the United States region, with all records kept in the US.
• Dedicated environment: A single-tenant environment for offices that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, template maintenance and integration support.

Security and privacy

• Records kept in the United States: Complaints, workpapers, cases and evidence are hosted in the United States region.
• Need-to-know access: Access follows the role and the assignment; complainant identities and restricted cases are visible only to the people your office names.
• Encryption under controlled keys: Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.
• Complete audit trail: Every view, change, approval, custody transfer and export is recorded with the user and time, and cannot be edited.
• Cleared support lane: Support tickets from federal clients are routed only to US citizens with active security clearances.
• Independent audits: Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Limitations

• It does not make audit, investigative, referral or closure decisions. Every decision is made and approved by your staff.
• It does not connect to NCIC or other criminal justice information systems; results from those systems are recorded by agents under your office's policies.
• It does not perform forensic examination of devices. Forensic images and tool reports are stored or referenced in the case.
• Physical evidence is tracked by record and label; storage and handling remain your evidence custodians' responsibility.
• Semiannual report data is compiled from what is recorded; writing and issuing the report remains with your office.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your office's own authorization decision.
• It does not certify compliance with Government Auditing Standards or CIGIE standards. It records the evidence your office and peer reviewers use to assess compliance.
• Classified information is not supported. Classified matters stay in your office's classified systems.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/oig-audit-case-management. Purchasing routes and company information: www.moraph.com/how-to-buy.