Open Recommendations

We recommend the Vice President, Generation Tech Support, revise Generation’s Standard Operating Procedure 12.871, Cyber Security – Backup and Recovery, to address encryption to align with federal guidance and communicate the standard operating procedure requirements to plant personnel.

We recommend the Vice President, Generation Tech Support, develop backup and recovery plans for each plant in accordance with Generation’s Standard Operating Procedure 12.871, Cyber Security – Backup and Recovery.

Finalize implementation of controls within the new Automated Transaction Manager system to require all forms and supporting documentation associated with purchase card transactions be properly completed, verified, and retained in accordance with policy.

Identify and review recurring payments and assess whether establishing a contract would better serve the Postal Regulatory Commission.

Include controls within the Automated Transaction Manager system that requires the purchaser to submit justification if a non-preferred vendor is used, and requires the Credit Card Authorizing Official to conduct a formal evaluation of purchases when this occurs.

Reiterate guidelines and policies to approving officials for proper management oversight and approval of officers', limited-term contract employees', and executive directors' travel and expense reimbursements to promote adherence to policies and verify reimbursement requests are properly supported.

Review and update applicable guidelines, as needed, to reflect policy exceptions, when appropriate, or document approved exceptions within the eTravel system.

Reconsider implementing the seat upgrade draft policy, and instead, reinforce current seat upgrade policy.

Create a process to periodically verify limited-term contract employees are included in the officer group within the eTravel system.

We recommend that the Office of Information Technology update training for all employees on identifying and reporting suspected phishing emails, and establish a process to periodically remind employees of these responsibilities.

Develop and implement an agency-wide IP risk assessment standard operating procedures
(SOP). This SOP should include risk assessment procedures to be performed by each
identified significant program. These procedures should be based on OMB Circular A-123
guidance found in Appendix C.

For each identified significant program, the responsible program official (or office) should
review and approve the program-specific risk assessment. This review and approval should
be documented.

Leverage the existing risk-assessment tool and add FLRA specific reviews, as well as the
above-mentioned employee pay and benefits section.

Revise policies and procedures for financial reporting to ensure costs are tracked and reported accurately and timely.

Work with ARC to resolve the questioned cost of $36,547 for non-ARC matching equipment cost.

Work with ARC to resolve the questioned cost of $276 of ARC funded equipment cost.

Establish and implement internal controls to review expenditures for allowability in accordance with the Uniform Guidance and exclude unallowable cost from the amounts reported.

Work with ARC to resolve the questioned cost totaling $1,060 of ARC funded equipment cost.

Facility leaders direct staff to conduct a risk assessment on liquid nitrogen storage, to include the small devices stored in examination rooms, and implement changes if needed.

Facility leaders determine appropriate supply storage locations and, for any supplies stored outside of the defined locations, implement a process to ensure staff identify and remove expired supplies.

Facility leaders ensure staff label opened multidose medications with expiration dates.

Facility leaders ensure staff store clean and dirty items separately.

The Director ensures staff implement processes to prevent repeat environment of care findings.

The OIG recommends facility leaders ensure the facility has a policy for the communication of test results and staff develop service-level workflows that align with VHA requirements.

Veterans Integrated Service Network 19 leaders assess the staffing needs for the facility’s radiology service and provide additional resources to ensure services are readily available to patients.