Open Recommendations

Remedy $24,810 in unsupported gift card purchases for which the YWCA of Seattle could not produce adequate documentation.

Ensure that the YWCA of Seattle establishes controls to ensure expenditures charged to the subawards are allowable and adequately supported.

Work with the Washington COM to ensure its policies and procedures for collecting and reporting subrecipient performance data align with the OVC's guidance, to include communicating clear instructions to subrecipients on how to report VOCA grant-funded performance data into the Washington COM's victim tracking database.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that Kenya Red Cross Society corrects the one instance of material noncompliance detailed on pages 25 and 27 of the audit report.

Rec. 1: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Defense Industrial Base Cybersecurity Assessment Center Director, develop and implement a quality assurance process that will ensure that all requirements in the Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) authorization process are successfully met before a candidate C3PAO is authorized to perform Cybersecurity Maturity Model Certification Level 2 assessments.

Rec. 2.a: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify that the Cyber AB has signed Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) Agreements and Codes of Professional Conduct for every authorized C3PAO within 30 days of the date of this report or revoke the C3PAO's authorization to perform CMMC Level 2 assessments until the documents are received.

Rec. 2.c: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify that the quality control leads (QCL) for every authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) meet the certification requirement within 30 days of the date of this report, and, for any of the C3PAO's QCLs who are not certified, revoke the authorization for those C3PAOs to perform CMMC Level 2 assessments until the C3PAOs provide support the QCLs…

Rec. 2.d: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify the employment status of the on?staff CMMC certified assessors and certified quality control leads (QCL) by requesting and reviewing employment records to confirm that CMMC certified assessors and certified QCLs are part of the candidate Cybersecurity Maturity Model Certification Third?Party Assessment Organization's staff and are assigned those specific roles and responsibilities.

Rec. 2.e: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify the employment status of the CMMC certified assessors and certified quality control leads of all previously authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAOs) using the methodology defined in Recommendation 2 .d within 30 days of the date of this report and revoke the C3PAO's authorization to perform CMMC Level 2 assessments if the employment status cannot be verified.

Rec. 3.a: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Develop and implement a formal reauthorization process for the Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAO) that includes a review and verification for all requirements in the C3PAO authorization process.

Rec. 5.b: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Develop and implement a process to ensure Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAO) immediately notify both the CMMC Program Management Office and Cyber Accreditation Body of any changes associated with any of the requirements in the C3PAO authorization process.

Rec. 3.c: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Revise the CMMC assessment guides to further define the requirement for disabling inactive accounts to include group accounts.

The District Director, in conjunction with the Deputy District Director, develops a contingency coverage plan to ensure oversight during periods of vet center director vacancies.

The District Director monitors district leaders compliance with completion of morbidity and mortality reviews for client deaths by suicide, including timeliness, as required.

The District Director ensures district leaders are aware of the Readjustment Counseling Service policy requirements to provide oversight of morbidity and mortality review completion, including panel member assignments, participation of affected vet center staff, report completion, reporting of completion delays, and information dissemination.

The District Director determines reasons vet center counselors did not complete safety plan components for clients assessed at intermediate or high suicide risk level in either acute, chronic, or both categories; ensures completion of safety plans for all active clients assessed at intermediate or high suicide risk levels; and monitors compliance across all zone vet centers.

The District Director determines reasons staff did not document providing safety plans to clients, ensures all active clients assessed at intermediate or high suicide risk levels receives a safety plan, and monitors compliance across all zone vet centers.

The OIG recommends facility leaders ensure staff understand procedures for cleaning equipment and continue to monitor the physical separation of clean and dirty items in storage spaces.

The OIG recommends that primary care leaders incorporate feedback from primary care staff and include them in process improvement projects.

Communicate to locations with electric vehicle infrastructure that policy regarding reporting safety hazards also includes electric vehicle infrastructure.

Continue to recruit and retain individuals with relevant financial management and/or accounting skills, train, as well as cross-train existing resources on financial management standards, concepts, policies, and procedures.

Enhance controls for the Department and the components to identify, analyze, and respond to risks and/or significant changes to operations and financial reporting processes.

Enhance controls for the Department and the components to monitor and evaluate the design and effectiveness of existing controls and enhance communication between the Department and components.

Enhance monitoring capabilities related to existing deficiencies to address existing design deficiencies and improve operating effectiveness of the related controls in a timely manner. Specifically, management should consider a baseline (current year) assessment and compare against management's design (future state) of the internal control system to address the objectives and risks of the Department.

Develop new and/or enhance existing training for procurement personnel and other stakeholders to more accurately respond to the prepayment and accrual data calls and record expenses appropriately, including consideration of the completeness and accuracy of data call responses.