An audit by DOE???s Office of the Inspector General (OIG) found Bonneville did not implemented controls designed to address known IT system vulnerabilities. ???Specifically, technical vulnerability scanning conducted on nine applications used to support business functions such as financial management, human resources, and security management identified a significant number of high-risk weaknesses