Open Recommendations

Conduct a detailed review of all payroll processed in 2018 and 2019 to identify payroll over and underpayments and complete this review within six months of the issuance of this report.

To the extent consistent with the law, reimburse employees that were identified as underpaid and attempt to recover payment from all employees that were identified as overpaid in the above review.

Ensure that LSC unallowable costs are charged to funding sources other than LSC and reflected within the financial software to provide an audit trail.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

IHS should extend policies to address more types of perpetrators, victims, and abuse;

IHS should conduct additional outreach to Tribal communities to inform them of patient rights, solicit community concerns, and address barriers to reporting of patient abuse.

IHS should ensure that the new incident reporting system is effective and addresses the risks identified in the current system;

IHS should designate a central owner in IHS headquarters to ensure clear roles and responsibilities for shared ownership in implementing patient protection policies, and managing and responding to abuse reports;

IHS should continue to actively promote an organizational culture of transparency and work to resolve barriers to staff reporting of abuse

Perform a comprehensive review of FAA's root cause analysis training to ensure it meets Agency expectations. Modify training, as appropriate, based on the review and require inspectors to complete the course(s) or offer inspectors access to industry-based training programs.

Bureau of the Fiscal Service (Fiscal Service) management should finalize policies and procedures to review audit logs of production DB2 servers.

Bureau of the Fiscal Service (Fiscal Service) management should implement an oversight process to ensure that designated Fiscal Service personnel: a. Reviews the security logs for the UNIX and DB2 servers hosting the Payment Information Repository (PIR), Judgment Fund Internet Claim System (JFICS), and Security Payment System (SPS) applications on a pre-defined frequency, as indicated in the Fiscal Service Baseline Security Requirements (BLSR). b. Formally documents completion of their reviews and any escalations to the Information System Security Office (ISSO), and c. Retains the audit logs and documentation of its reviews for 18 months, as required by the BLSR.

Bureau of the Fiscal Service (Fiscal Service) management should periodically review Fiscal Service management's implementation and operation of the review the security audit logs for the UNIX and DB2 servers hosting the Payment Information Repository (PIR), Judgment Fund Internet Claim System (JFICS), and Secure Payment System (SPS) applications to determine that Fiscal Service management completes the reviews on a pre-defined basis, documents completion of the reviews and escalations, and maintains such documentation.

Bureau of the Fiscal Service (Fiscal Service) management should establish an effective enforcement process or mechanism to ensure that (a) UNIX and DB2 events and monitoring controls are followed, and (b) Fiscal Service management has confidence it consistently reviews for potential unauthorized or inappropriate activity.

Bureau of the Fiscal Service (Fiscal Service) management should develop and implement documentation to assign responsibility for ensuring adequacy of UNIX and database security and baseline settings.