Open Recommendations

Evaluate which staff should have access to and should update the Consult Toolbox when records are requested or received and update the “Consult Business Rules and Uses of the Consult Package Standard Operating Procedure” to reflect necessary changes.

Include controls within the Consult Toolbox to prevent errors and improve data quality, including controls on administrative closure of low-risk consults and documenting the records-retrieval method.

Update consult closure policies and procedures to clarify requirements for administrative closure and determine whether metrics for the percentage of records received should be a requirement and included in policy.

Determine whether Veterans Health Administration facilities’ community care offices should continue to be required to use the administrative closure report for oversight of administratively closed consults, and if not, determine what reports should be required.

Evaluate the workload of community care staff to determine the most efficient way to structure and execute their duties.

Determine if there are mechanisms to identify standardization opportunities and increase efficiency for improving records return processes.

Ensure community care staff follow procedures to reduce duplicate records received.

Evaluate ways to increase use of provider electronic records portals to reduce reliance on electronic fax when retrieving medical records.

Consider increased implementation of technologies to improve records processing once received to reduce the manual renaming of electronic files and uploading of records into the electronic health record.

Ensure records from the Joint Longitudinal Viewer are uploaded into the electronic health record.

The Medical Center Director ensures staff store clean and soiled utility items separately, maintain cleanliness, and dispose of expired items.

Finalize and implement policies and procedures for creating and maintaining current and target cybersecurity profiles in alignment with National Institute of Standards and Technology Cybersecurity Framework Guidance.

Finalize and implement a comprehensive Risk Management Strategy that defines roles and responsibilities, enterprise risk priorities, objectives, and communication protocols, including third-party risk considerations.

Continue to develop and implement an Enterprise Risk Management program based on National Institute of Standards and Technology and Enterprise Risk Management Playbook (Office of Management and Budget Circular A- 123, Section II requirement) guidance.

Develop and implement policies and procedures for developing and maintaining a comprehensive and accurate inventory of data and corresponding metadata for the Consumer Product Safety Commission data types.

Fully implement, assess, and maintain secure configuration settings in accordance with defined configuration management policy and security configuration baseline procedures.

Update all relevant Information Security Continuous Monitoring policies, procedures, and supporting documentation based on latest National Institute of Standard and Technology guidance.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

Update and maintain a complete Critical Software Inventory that staff may utilize to fulfill their responsibilities and provide transparency and tracking.

Create or update guidance to implement policies and procedures to guide and govern supply chain risk management activities related to attestations.

Ensure all responsible staff receive appropriate training on attestation roles and responsibilities.

Update PBGC's process documentation to properly align with OMB requirements for software producers who cannot attest to adhering to the secure software development practices within their attestations and ensure PBGC effectively follows this process.

Contact OMB to obtain additional guidance to determine if an exception, waiver, or if the Corporation should discontinue the use of software for outstanding attestations.

Incorporate Office of Strategic Infrastructure LMD representatives with property expertise
into the programs and projects at the contract’s onset to ensure procurement officials receive
sufficient support.

Review Artemis-related contracts that are not delegated to DCMA for contractor-held property
management to determine whether NASA can leverage the delegations already in place to
consolidate government property administration tasks.

District leaders and the Detroit, Escanaba, and Cincinnati Vet Center Directors collaborate with the supporting VA medical facility to determine reasons for noncompliance with staff participation on the mental health executive council, take action as indicated, and monitor compliance.

District leaders and the Fort Wayne, Escanaba, and Cincinnati Vet Center Directors determine reasons for noncompliance with completing four hours of external clinical consultation for clinically complex cases per month, ensure a process is implemented, and monitor compliance.

District leaders and the Detroit and Escanaba Vet Center Directors determine reasons for noncompliance with employees completing select trainings in the required time frame, ensure completion, and monitor compliance.

District leaders and the Fort Wayne, Detroit, Escanaba, and Cincinnati Vet Center Directors determine reasons for noncompliance with completion of an outreach plan with all required strategic components, ensure completion, and monitor compliance.

District leaders and the Escanaba Vet Center Director determine reasons for noncompliance with annual fire or safety inspections, ensure completion, and monitor compliance.

District leaders and the Fort Wayne, Detroit, and Escanaba Vet Center Directors determine reasons for noncompliance with having an annual risk and vulnerability assessment completed by VA police or local law enforcement, ensure completion, and monitor compliance.

District leaders and the Cincinnati Vet Center Director determine reasons for noncompliance with annual automated external defibrillator servicing by VA medical center biomedical engineering, ensure completion, and monitor compliance.

District leaders and the Detroit and Escanaba Vet Center Directors determine reasons for noncompliance with having a current emergency and crisis plan that includes required components, ensure completion, and monitor compliance.

The Readjustment Counseling Service Chief Officer reviews the administrative site visit protocol and Veterans Health Administration requirements related to inconsistencies in frequency for risk and vulnerability assessments and updates the administrative site visit protocol as indicated.

The Readjustment Counseling Service Chief Officer reviews the administrative site visit protocol and Veterans Health Administration requirements related to automated external defibrillator annual servicing and updates the administrative site visit protocol as indicated.

1. We recommend that the Cannon House
Office Building Renewal Project’s
contracting officials require the
Construction Manager as Constructor to
obtain an explanation on subcontractors’
non-responsiveness to the Office of
Inspector General’s audit request.

We recommend that the Architect of the
Capitol’s contracting officials use
contractual remedies to ensure
compliance with the Examination of
Records clause

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.