The CFPB's information security program is "not effective" under federal metrics, the inspector general for the Federal Reserve Board and the CFPB said Tuesday, and the bureau had not verified whether equipment left at regional offices it vacated in 2025 was secure. The audit says the bureau's data inventory team was down to one person and critical software flaws went unfixed past the 30-day limit.