Open Recommendations

8. We recommend that the Department's General Counsel direct the Chief of the Ethics Law and Programs Office to develop and implement a written process to identify and track conflict-of-interest risks and ensure risk assessment results are used to inform ethics training and guidance given.

We recommend that the FWS require the Department to provide accounting detail of license revenues used as investment principal.

We recommend that the FWS require the Department to ensure wildlife management area staff are informed of boundaries and their responsible land areas.

We recommend that the FWS require the Department to implement policies and procedures that ensure the Department maintains control over license revenue funds when they are invested.

We recommend that the FWS require the Department to analyze and provide justification regarding the allowability of the Iowa Treasurer of State to invest restricted license revenue.

We recommend that the FWS require the Department to resolve any potential diversion of license revenue.

We recommend that the FWS require the Department to implement activities aimed at eliminating encroachment on wildlife management areas, including-but not limited to-clearly marking and delineating boundaries in areas where wildlife management areas border residential areas.

We recommend that the FWS require the Department to implement activities aimed at eliminating illegal dumping on lands acquired or maintained with WSFR grants or license revenues.

Develop and implement adequate procedures and controls to ensure that (1) staff issues notices of violation and default within 15 calendar days of the inspection report release date and (2) the Office of Multifamily Asset Management and Portfolio Oversight is made aware when notices are not issued within 15 calendar days after the inspection report release date and takes action as appropriate to ensure that future notices are issued in a timely manner.

Include language in future notices of violation and default clearly stating that owners are required to inspect all units (including vacant units), common areas, grounds, building systems, and sites as part of the owner survey and require owners to include sufficient detail in the surveys to show (1) when the survey was conducted and (2) that the survey was a complete survey of the project.

Develop and implement adequate policies, procedures, and controls to ensure that owner certifications and surveys and other relevant documents related to properties that fail inspections or are noted as having EHS deficiencies are maintained and retrievable from an easily accessible location.

Develop and implement adequate controls to ensure that HUD staff with the appropriate level of authority approves extensions to the notices of violation and default cure periods in writing and that documentation is maintained to support such approvals.

Modify the queries used to generate the schedules of properties that accompany the reports to Congress to consider a larger range of dates to ensure that properties that failed consecutive inspections are appropriately identified on all applicable schedules.

Assess and streamline the processes for preparing, reviewing, and approving the reports as appropriate to ensure that the reports are submitted to Congress on or before the required due date.

Implement adequate procedures and controls to ensure that documentation is maintained to support that the reports were submitted to Congress.

Develop and require all users to complete Electronic/Technical Surveillance Tracking System training and maintain documentation of training completion.

Develop a verification process for annual physical equipment inventories to account for all equipment as required by the Inspection Service Manual.

Resolve Electronic/Technical Surveillance Tracking System functionality errors preventing users from temporarily transferring, temporarily assigning, and recording the final disposition of law enforcement surveillance equipment, including digital signature capability.

1) Review all postal inspectors with assigned equipment and validate they are active employees, 2) retrieve equipment from postal inspectors who separated from the agency, and 3) update the status and assignment of all equipment in the Electronic/Technical Surveillance Tracking System.

Implement audit logs containing user activity for creating, assigning, editing, and removing user roles in the Electronic/Technical Surveillance Tracking System.

Finalize and implement a comprehensive formalized enterprise-wide cloud computing strategy that, at minimum, addresses the following:• Alignment with federal guidance and directives such as Cloud Smart and Executive Order 14028. • Prioritization of the use of FedRAMP-authorized systems. • Identification of workforce requirements needed to support cloud procurement, implementation, and risk management.• Management of risks related to the use of cloud computing services such as secure cloud architecture, data governance, and incident management processes.

Develop and implement policies, procedures, and standards that are consistent with the NCUA’s cloud computing strategy and address, at minimum, the following: • Coordination, identification, and clarification of responsibilities and processes across all stakeholders for IT service contract reviews, service level agreements alignment and monitoring, and cloud service incident management. • Specific criterion for the prioritization, selection, and use of cloud computing services. • Periodic review of contract clauses included for cloud computing services to confirm documentation supporting security requirements are clearly identified to the vendor and security and operational risks are appropriately managed.

Develop comprehensive guidance and training for grantees on how to prepare the PR 29 report to ensure that the information collected is reliable, accurate, timely, and in compliance with the Uniform Administrative Guidance for Grants and Cooperative Agreements, specifically 2 CFR 200.302(a)(b) and 2 CFR 200.303

Follow up with the four grantees without adequate supporting documentation and assess their compliance with the financial management requirements in 2 CFR 200.302(b)(3), which require the financial management system of each non-Federal entity to provide for records that adequately identify the source and application of funds for federally funded activities.

Update the CPD Monitoring Handbook to incorporate the review of the PR 29 report when performing financial monitoring reviews.