Open Recommendations

Embassy Kinshasa should control and account for all leftover construction materials in accordance with Department standards.

Embassy Kinshasa should dispose of medications and controlled substances in accordance with Department guidelines.

Embassy Kinshasa should conduct inspections of the cafeteria in accordance with Department standards.

Embassy Kinshasa should complete all information systems security officer responsibilities in accordance with Department standards.

Embassy Kinshasa should schedule regular local Information Technology Configuration Control Board meetings to evaluate non-approved technology for use on Department networks.

Embassy Kinshasa should manage its inventory of mobile devices in accordance with Department standards, including holding employees accountable for lost or missing U.S. government-issued property.

Embassy Kinshasa should relocate the telecommunications demarcation point outside the limited access area server room in accordance with Department standards.

Embassy Kinshasa should repair its high-frequency radio and conduct radio checks in accordance with Department standards.

Embassy Kinshasa should require locally employed staff to complete information assurance training in accordance with Department standards.

Embassy Kinshasa should install access control software and monitor its non-enterprise networks.

Embassy Kinshasa should develop, implement, and update standard operating procedures for capturing, sharing, transferring, and retaining information related to its Diplomatic Technology programs in accordance with Department standards.

We recommend that NRC management investigate methods of identifying inactive user accounts and improving its internal controls over inactivity to ensure that it disables network user accounts after 90 days of inactivity.

The Portfolio Risk Management Office should enhance transparency in decision-making by establish a formal process for documenting rationales behind timeline changes and delays and provide public-facing updates on major transactions through a structured reporting mechanism.

The Office of General Counsel should update the Watch List procedures to include examples of risks warranting mitigating measures and what mitigating measures can be applied to parties when there is a match.

The Office of General Counsel should implement documentation requirements for actions taken as a result of Watch List matches, to include support for taking mitigating measures.

The Office of General Counsel should update the Watch List procedures to include examples of a suspicion and reputation of untrustworthy behavior and to add parties based on referrals from other agencies.

The Office of General Counsel should update the Watch List procedures to align with actual practices regarding parties EXIM determines should no longer be on the Watch List; the standards for deactivation or removal, including when there is a match to a party that should be deactivated or removed; and in the case of deactivation what the implications are for future searches and reactivation.

The Office of General Counsel, in coordination with the Office of the Chief Information Officer, should implement a process for automatically deactivating or removing parties that have been on the Watch List over 10 years without a match.

The Office of General Counsel should state and implement a requirement in the procedures and develop a process to concurrently notify OIG whenever there are new parties added to the Watch List, there are true matches on the Watch List, and there are parties removed or deactivated from the Watch List.

The Office General Counsel, in coordination with the Office of Communications, should upload the Watch List system of record notice to EXIM’s public website.

We recommend that APHIS identify and correct the RBIS algorithm to ensure inspection due dates are properly calculated and recorded in eFile.

We recommend that APHIS establish and provide additional training on dog breeder inspections to inspectors and supervisors, to include proper classification of NCIs and required inspection procedures for dog breeders.

We recommend that APHIS develop and implement a process to ensure that inspectors are consistent throughout their inspection of the dog breeder’s facility to reduce the occurrence of missed items for review.

We recommend that APHIS establish a formal process to track and review open complaints to ensure all complaints are closed prior to the established deadlines. If the complaint is not closed by the deadline, APHIS should ensure reasons are documented in eFile.

We recommend that APHIS perform a risk assessment of the complaint process to evaluate and determine whether APHIS has correctly prioritized resources to manage the identified risks. We also recommend APHIS implement additional processes as necessary to ensure adequate coverage.