Open Recommendations

Design and implement a formal review process to ensure corrective actions plans developed, implemented, and published are adequately addressing the true root causes of improper and unknown payments.

Verify that Co-Impact corrects the four instances of material noncompliance detailed on pages 22 to 27 of the audit report.

Embassy Kuala Lumpur should comply with Department and federal grants management standards for awards managed by the Political Section.

Embassy Kuala Lumpur, in coordination with the Bureau of Consular Affairs and the Bureau of Overseas Buildings Operations, should provide a wheelchair-accessible entryway and consular interview window for consular applicants.

Embassy Kuala Lumpur, in coordination with the Bureau of Consular Affairs and the Bureau of Overseas Buildings Operations, should provide protection from the elements for consular applicants.

Embassy Kuala Lumpur’s consular managers should adjudicate more immigrant and nonimmigrant visa cases, in accordance with Department guidance.

Embassy Kuala Lumpur should cross-train Consular Section locally employed staff and officers in U.S. citizen services functions in accordance with Department standards.

Embassy Kuala Lumpur should bring its property management program into compliance with Department standards.

Embassy Kuala Lumpur should review and update its motor vehicle policy, if necessary, in accordance with Department standards.

Embassy Kuala Lumpur should bring the motor pool preventive maintenance program into compliance with Department standards.

Embassy Kuala Lumpur should maintain contract files and complete mandatory performance reviews in accordance with Department standards.

Embassy Kuala Lumpur should close out procurement files in accordance with Department standards.

Embassy Kuala Lumpur, in coordination with the Bureau of Administration, should review unauthorized commitments totaling $78,990 for travel related service fees to determine whether they should be ratified in accordance with Department standards.

Embassy Kuala Lumpur should bring its cashier operations into compliance with Department standards.

Embassy Kuala Lumpur should provide workplace safety training in accordance with Department standards.

Embassy Kuala Lumpur should bring its furniture and appliance pool program into compliance with Department standards.

Embassy Kuala Lumpur should use the Inventory and Logistics Management System loanable property module to issue and track information technology assets.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the NIST Risk Management Framework. Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system stewards and Information System Security Officers follow procedures for establishing, tracking, and updating Plans of Action and Milestones for all known risks and weaknesses including those identified during security control assessments.

We recommended the Assistant Secretary for Information and Technology implement controls to ensure that system stewards and responsible officials obtain appropriate documentation prior to closing Plans of Action and Milestones.

We recommended the Assistant Secretary for Information and Technology develop mechanisms to ensure system security plans reflect current operational environments, include an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including control assessments on a risk-based rotation or as needed. Such updates will ensure all required information is included and accurately reflects the current environment.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security standards on domain controls, operating systems, databases, applications, and network devices.

We recommended the Assistant Secretary for Information and Technology implement periodic reviews to minimize accounts and permissions in excess of required functional responsibilities, and to remove unauthorized or unnecessary accounts.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.