Open Recommendations

Establish and implement controls to require that awardees (financial and procurement) register in SAM at the time of award.

Develop, document, and implement a process to ensure that de-obligations of grants with canceled funds are reported to Financial Assistance Broker System (FABS), when they occur and not when they are administratively closed-out.

We recommend that the SAO and EXIM’s DATA Act Working Group determine the root cause of the errors in EXIM-provided data identified during the testing of the second quarter FY 2021 Files D1 and D2, and take necessary corrective action to: (a) correct the errors for records shown in USASpending.gov; (b) identify the risk of reporting incorrect data for each data element containing the error; and (c) update the policies and procedures for recording data in Comprizon, FPDS, and FABS to address the risks and include adequate verification and validation review processes performed by the data owner and a supervisor…

We recommend that the SAO and EXIM’s DATA Act Working Group continue to improve the design of its review of the procurement award data in FPDS and financial assistance award data submissions to FABS by identifying the root cause for the exceptions in those data elements for which EXIM is responsible, and by developing more effective review procedures for those data elements, as well as the data elements that the SAO and DATA Act Working Group identify as having a high risk of not being accurate, complete, or reported timely.

We recommend that the SAO and EXIM’s DATA Act Working Group review EXIM’s policies and procedures for submitting contract award data in FPDS, including procedures for reviewing and confirming the accuracy of the CAR, to ensure proper design and compliance with FAR guidelines for timeliness. Update the policies and procedures based on this review, as necessary, to ensure EXIM meets FAR timeliness guidelines.

We recommend that the SAO in coordination with the OCFO continue to implement its corrective action plan to ensure that object class codes are accurately and completely reported in all financial and award data submissions (Files B and C).

Begin submitting financial assistance award data into Financial Assistance Broker System and its File C.

The Office of Administration should incorporate into their weekly practice the review of contract awards to ensure procurement awards are approved in FPDS-NG within 3 business days of the contract award signed date.

The Office of Administration should update the DQP to include a procedure to perform and prepare reconciliation analyses to identify the activity that occurred between when the original contract/modification was awarded, when File D1 was generated, and when FPDS-NG reports are pulled to validate the amounts reported in File D1 for Current Total Value of Award and Potential Total Value of Award data elements. If the reconciliation process demonstrates these errors occur due to timing differences, RMA also recommends the Office of Administration work with Treasury to address this gap in the testing guidance to ensure these timing differences are…

We recommend that the Chief Acquisition Officer ensure internal control on approval and coordination with PRISM support required to appropriately bypass FPDS-NG when modifying a document via the double-dash process (a 90000 administrative action modification) is implemented. Moreover, clearly document in the Supplement to NARA 501, Procurement Guide, that the double-dash contract modification is a 90000 administrative action.

Refund to the Federal Government the $6,401,297 of estimated net overpayments.

Identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

Continue its examination of existing compliance procedures to identify areas where improvements can be made to ensure diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.

Develop and apply solutions to ensure FEMA fully complies with the new DATA Act requirements in OMB Memorandum M-20-21 for reportingcumulative COVID-19 outlays on a monthly basis and linking spending to emergency and disaster appropriations through the Disaster Emergency Fund Code data element. Ensure the solutions produce complete and accurate data elements that can be independently traced and verified to an auditable file.

Develop and apply solutions to improve the implementation and use of the government-wide financial data standards for procurement andfinancial assistance data elements that had an accuracy error rate of 10 percent or more.

Evaluate the feasibility of offering hiring and retention incentives for high-demand Public Health Service and General Schedulehealthcare professionals. Provide evaluation results.

Evaluate staffing in Immigration and Customs Enforcement units supporting Immigration Health Service Corps personnel to ensure there areadequate staff to expedite processing applications for medical positions. Provide evaluation results.

Update the USCIS pandemic plan to incorporate additional technology guidance and lessons learned during the COVID-19 pandemic.

Update the USCIS pandemic plan to incorporate additional technology guidance and lessons learned during the COVID-19pandemic.

Develop, document, and implement a process for determining and defining system boundaries in accordance with the National Institute of Standards and Technology guidance (Risk Management ii/iii).

Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: IT system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media) (Risk Management ii/iii).

Complete an assessment of information security risks related to the identified deficiencies and document a corresponding priority listing to address identified information security deficiencies and their associated recommendations. A corrective action plan should be developed that documents the priorities and timing requirements to address these deficiencies (Risk Management iv/v/vi).

Develop and implement a formal strategy to address information security risk management requirements as prescribed by the National Institute of Standards and Technology guidance (Risk Management iv/v/vi).

Develop and implement an Enterprise Risk Management (ERM) program based on the National Institute of Standards and Technology and ERM Playbook (Office of Management and Budget Circular A-123, Section II requirement) guidance. This includes establishing a cross-departmental risk executive (function) lead by senior management to provide both a departmental and organization level view of risk to the top decision makers within the CPSC (Risk Management iv/v/vi).

Develop and implement an information security architecture that supports the Enterprise Architecture. (Risk Management vii).