Open Recommendations

Direct MSU to strengthen the administrative and management internal controls and procedures surrounding its Award Cash Management $ervice reconciliation process. Updated controls could include: • Requiring MSU to develop a formal procedure regarding how to calculate the appropriate amount of funding to draw down on NSF awards with expiring appropriations. This procedure should ensure that MSU documents how it determined the appropriate amount to draw down and returns any unused funds to NSF in a timely manner. • Requiring an individual who is independent from the standard Award Cash Management $ervice drawdown process to perform periodic reconciliations of Award Cash…

Direct MSU to verify that all of its current subaward policies accurately reflect its subaward invoice approval requirements.

Direct MSU to implement internal controls that require personnel to create contract service agreements to support all consultant services and maintain the agreements throughout the contract’s period of performance and after its expiration date in accordance with its record retention policies.

Direct MSU to conduct annual travel expense reporting trainings for individuals who may travel for sponsored projects. The annual training should emphasize all Travel – Meals and Lodging requirements included in MSU’s Business Procedures Manual, including the requirement to use University purchase cards.

Develop and implement an IT modernization plan. This plan should:i. document an inventory of all legacy systems in operation at the CPSCii. identify the cost associated with the operations and maintenance of thelegacy systems in operation in the current environment at the CPSCiii. identify the resources necessary to modernize each CPSC legacy system(e.g., migrating to a Commercial-Off-The-Shelf solution or shared servicessolution, moving to a cloud environment, etc.)iv. analyze potential opportunities to save money, improve operations, andimprove security through modernizing the CPSC’s legacy systems

Develop and establish a process to monitor the implementation of the IT modernizationplan by documenting the objectives, goals, tasks, milestones, metrics, and funding sourcesassociated with management’s modernization efforts.

Establish and implement a policy and procedure to manage the cloud computing, sharedservices, and third-party system inventory necessary for transitioning to a consumptionbasedservice model.

The CPSC should develop and implement policies and procedures to periodically reviewsecurity packages from external service providers (such as those hosting cloud, sharedservices, and third-party systems) to ensure that the risks posed by the external serviceprovider are within the CPSC’s risk appetite and tolerance.

The CPSC should review the external service provider’s customer responsibility matrices,select, tailor, implement the relevant security controls from those matrices and thendocument (and periodically reassess) those controls to support the ongoing authorizationto operate and use decision.

Software that is no longer supported or receiving regular security updates from the vendor should be upgraded to supported versions with relevant security patches.

KPMG recommends that FAA management require privileged users on the Windows virtual machine environment to authenticate using MFA. If it is not technically feasible, then we recommend that Windows security settings are updated to require a minimum password length for privileged accounts to 16 characters and maximum password age to be updated to 60 days.

KPMG recommends that FAA management design and implement documented control activities to monitor the effective operation of its existing process controls related to:
Provisioning of new access requests for the service organization's system; and
Monitoring FAA employees' access to the service organization's system.

KPMG recommends that FAA management take measures to ensure that FAA has sufficient control operator personnel available to support the annual recertification of FAA employees with system access within the reporting timeline prescribed by DOT.

KPMG recommends that FAA design and implement a procedure to identify and timely record contracting actions within the general ledger that were executed outside of the standard business process (i.e., CO authorizations documented outside of the procurement system).

KPMG recommends that FAA update its procurement policy to define the period of time permitted to document a contractors oral agreement.

KPMG recommends that FAA reinforce existing controls, to review individual lease payment schedules upon lease commencement or modification to ensure that the schedules are consistent with the underlying terms of the lease.

KPMG recommends that FAA design and implement procedures within its existing PP&E Accrual to obtain a complete listing of trailing costs related to completed assets and accrue for such assets that have remaining CIP balances as of the period-end.

KPMG recommends that management design and implement procedures to verify the completeness and accuracy of the non-LOI accrual average billing cycle data input used in the estimate calculation.

KPMG recommends that ESC management review and update the journal voucher control log reconciliation process to ensure it is properly designed to identify all potential deviations from policy throughout the fiscal year.

KPMG recommends that ESC management create monitoring procedures over the journal voucher control log to ensure complete and accurate documentation over manual journal vouchers is maintained.

KPMG recommends that MARAD management, in conjunction with their accounting service provider, ESC, develop a PP&E roll forward control that contains all activity within the relevant PP&E accounts by disclosure category, including additions, annual cost adjustments, year to date depreciation, capitalizations from construction in progress to other categories, and retirements.

Update the Commission’s compliance policies to incorporate all key elements in the AbilityOne and FAR regulations regarding contract performance which includes product quality. Further, add procedural guidance, including documentation requirements, that is complete and sufficient to implement the policies. Key elements include the following: a. NPA quality systems in place to furnish products that meet Government specificationsunder the contract and correct product deficiencies prior to delivery;b. Reporting of quality complaints including handling of inquiries and disputes; andc. Monitoring and evaluation of NPA compliance with these requirements.

The Commission should determine and develop written documentation of criteria/metrics, data needed from all stakeholders (i.e., NPAs, CNAs, and Federal customers), reporting tools and/or mechanisms, and procedures needed to monitor, evaluate, and assess NPA compliance withcontract performance requirements including strict adherence to quality standards. This should include documentation of this evaluation and assessment of NPA compliance in PLIMS.

Develop and implement written procedures that provide Commission requirements and guidelines to CNAs regarding quality control processes they have established to oversee and assist NPAs to ensure successful contract performance and compliance in furnishing a product to the Government. This should include all key elements (e.g., assessment and tracking of quality complaints, types of technical assistance provided to NPAs, documentation requirements, and frequency of interactions with NPAs) and ensure data provided to the Commission is comparable and sufficient to inform their decision-making.

(U) Rec. A.1.a: The DoD OIG recommended that the Under Secretary of Defense for Policy issue a memorandum formalizing the transfer of responsibility for global health engagement from the Assistant Secretary of Defense for Special Operations and Low-Intensity Conflict to the Assistant Secretary of Defense for Strategy, Plans, and Capabilities.