Security, data and compliance in OIG Audit Case Management

How OIG Audit Case Management protects data and supports your compliance obligations.

Security controls

Records kept in the United States

Complaints, workpapers, cases and evidence are hosted in the United States region.

Need-to-know access

Access follows the role and the assignment; complainant identities and restricted cases are visible only to the people your office names.

Encryption under controlled keys

Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every view, change, approval, custody transfer and export is recorded with the user and time, and cannot be edited.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Requirements it supports

• Inspector General Act of 1978, as amended (5 U.S.C. 401-424)
• Government Auditing Standards (GAO Yellow Book)
• CIGIE Quality Standards for Investigations
• CIGIE Quality Standards for Inspection and Evaluation
• Privacy Act of 1974 (5 U.S.C. 552a)
• Federal Records Act (44 U.S.C. Chapters 29, 31 and 33)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with all records kept in the US.
• Dedicated environment: A single-tenant environment for offices that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, template maintenance and integration support.

Limitations

• It does not make audit, investigative, referral or closure decisions. Every decision is made and approved by your staff.
• It does not connect to NCIC or other criminal justice information systems; results from those systems are recorded by agents under your office's policies.
• It does not perform forensic examination of devices. Forensic images and tool reports are stored or referenced in the case.
• Physical evidence is tracked by record and label; storage and handling remain your evidence custodians' responsibility.
• Semiannual report data is compiled from what is recorded; writing and issuing the report remains with your office.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your office's own authorization decision.
• It does not certify compliance with Government Auditing Standards or CIGIE standards. It records the evidence your office and peer reviewers use to assess compliance.
• Classified information is not supported. Classified matters stay in your office's classified systems.