Library of Congress OIG Withheld 3 of 9 Reports From the Public

The Library of Congress's own Office of Inspector General⧉ issued nine audits, evaluations, and reviews in the six months ending September 30, 2025 -- and withheld three of them from the public entirely.▸ One evaluated the Library's readiness for a physical attack on the Thomas Jefferson, James Madison, and John Adams buildings. A second tested whether the Library could recover its IT systems after a disaster. A third flagged a heightened theft risk in the Asian Division's gold collections. OIG's own report gives the recommendation counts and says management agreed to fix all of them -- but declines to say what, specifically, is broken.

OIG's semiannual report to Congress lists all nine reports its Office of Audits issued in the period, each with a report number, an issue date, and a paragraph describing what was tested.▸ Six read like any other inspector-general finding -- a leave-tracking system with data-variance controls, a teaching program's cooperative-agreement paperwork, a fiduciary-fund audit -- because six are public. The other three each end in the identical line: '[w]e are not providing specific information about the findings because of the sensitive nature of the information contained in the report. The report was not issued for public release.'

On the physical-attack review (Report No. 2024-SP-103, completed July 2025), OIG says the Library's preparedness 'is heavily dependent on the United States Capitol Police, which is responsible for protecting Library entrances and assuming overall incident command during an emergency' -- and that management concurred with all six of the report's recommendations.▸ On the disaster-recovery review (Report No. 2024-IT-103, completed August 2025), OIG names IT Modernization as a standing top management challenge and says management concurred with all four recommendations for recovering Library IT systems and meeting related NIST controls. Neither report says what the recommendations actually call for.

The third withheld item isn't even a full report -- it's a Management Advisory Memorandum, a faster-track OIG tool for flagging urgent risks outside the normal audit cycle.▸ OIG issued it in April 2025 'to notify management of a heightened risk of theft in the Asian Division as part of our ongoing evaluation of the Library's gold collections' -- items the report defines elsewhere as holdings 'that have significant value, are rare, or are unique.' The advisory carries no recommendation count and, like the other two, was never issued for public release.

The Library's own FY2025 OIG reports index⧉, a page maintained separately from the semiannual report PDF, corroborates the split: the same three titles appear there tagged 'Not for Public Release' with no document link, while the other six reports the semiannual report names from the same window each carry a working PDF.

OIG's semiannual report includes a standing 'Unimplemented Recommendations' table that tracks, report by report, whether Library management has closed out prior findings.▸ But OIG says plainly that the table covers only 'recommendations made in our publicly released reports.' The six recommendations from the withheld physical-attack review and the four from the withheld disaster-recovery review are not eligible for that table -- meaning there is no public record, now or in a future semiannual report, that would tell Congress or the public whether the Library's Capitol Police coordination gaps or IT recovery gaps ever get closed. OIG's own introduction states its general practice is that '[r]eports are available at www.loc.gov/about/oig' -- making these three the exception, not the rule.