Open Recommendations

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII. Status The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprisewide. Analysis

Implement multifactor authentication mechanisms for all privileged users who access information systems that process, store, or transmit PII. Status The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprisewide. Analysis

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Modify business procedures, using systems such as the Consolidated Claims Experience or other applications, to better inform claims specialists of necessary actions when SSI recipients do not provide required information and evidence for OASDI claims.

Test its disaster recovery plan at least annually.

We recommend that CMS require hospitals to use condition codes 49 or 50 on claims for a device-replacement procedure that resulted from a recall or premature failure, regardless of whether the hospital received a reportable credit prior to billing for the device replacement procedure.

We recommend that CMS, under the assumption that the prior recommendation will be implemented, instruct Medicare contractors to implement a postpayment review process to ensure that hospitals have adjusted claims, as required, for the device credits they received.

We recommend that CMS obtain device credit listings from manufacturers and determine whether providers reported the credits as required by Medicare regulations.

We recommend that CMS, as an alternative to our third, fourth, and fifth recommendations, consider eliminating the current Medicare requirements for reporting device credits by reducing IPPS and OPPS payments for cardiac device replacement procedures.

Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO), the Office of the Chief Information Security Officer (OCISO), and component IT and financialmanagement, design and implement an effective internal control process to review service organization risks to ensure that ineffective ITGCs performed by service organizations are evaluated and appropriate compensating controls are designed and implemented by DHS and component management

Improve or reinforce existing policies, procedures, and related internal controls over financial information, including preparation of the Agency Financial Report.

Update policies and procedures to clearly define how the review of refund liquidations and administrative refunds is achieved.

Finalize the Drawback Handbook to document designed control activities over TFTEA drawback claims.

Complete a robust risk assessment related to TFTEA drawback claims

Update policies and procedures to clearly define how the review of accelerated payments and drawback liquidations is achieved.

Track and monitor the progress made in liquidating legacy drawback claims to support timely liquidation in accordance with the requirements of CFR 191

Enhance the destruction module in the system of record;

Design and implement a control to mitigate the risk of inaccurate updates to property records after initial seizure.

Provide training and enforce accountability for adherence to policies and procedures

Design and implement controls over grant obligations for the lost wages assistance program to ensure compliance with the Presidential Memorandum.

Develop new policies, or improve and reinforce existing policies, procedures, and related internal controls, that:a. the underlying data to actuarially derived estimates is reviewed timely;b. information derived from the systems used in the operations of controls is determined to be complete and accurate;c. risks related to the methods, models, assumptions, and data elements are assessed each year to identify, plan, and respond to changes; andd. changes to the methods, models, assumptions, and data elements are sufficiently documented.

Design and implement controls to ensure compliance with the Presidential Memorandum