Open Recommendations

Review obligation amounts to ensure amounts accurately reflect the status of the obligation;

Review obligations to verify that amounts, timeframe (i.e., grant dates are correctly reflected in the obligation);

Perform complete reconciliations of all outstanding obligations monthly, and ensure any discrepancies identified are promptly researched and resolved. (repeat)

Coordinate with the Office of the Chief Risk Officer (OCRO) to properly identify the National Service Trust Fund’s financial reporting risks and incorporate those risks into the OCRO’s annual testing of key controls. (modified repeat)

Develop a succession plan to ensure the required expertise is available in anticipation of planned employee turnover, particularly with respect to the complex trust calculations. CNCS needs to:

Train, mentor, and work to retain qualified employees;

Cross-train employees so that knowledge of the model will reside with multiple staff rather than with one person; and

Enforce the agency-wide information security program across the enterprise and improve performance monitoring to ensure controls are operating as intended at all facilities. (repeat)

Strengthen and refine the process for communicating CNCS facility-specific control deficiencies to CNCS facility personnel, and coordinate remediation of the control deficiencies. (repeat)

Strengthen and refine the process for holding system owners and information system security officers accountable for remediation of control deficiencies and ensuring that the appropriate security posture is maintained for CNCS information systems. (repeat)

Strengthen and refine the process for holding contractors accountable for remediation of control deficiencies in CNCS information systems. (repeat)

Implement all detailed recommendations in the FY 2019 FISMA Evaluation report. (repeat)

Develop, implement and document procedures to identify all CNCS grantees that are required to submit single audit reports with their due dates. (new)

Develop, implement and document procedures on timely follow-up for those grantees whose audits have become past due, and to ascertain why report submission was late, when the audit report will be submitted to the Federal Audit Clearinghouse, and what corrective action has been taken to prevent a report submission delay in future. (new)

Develop a practice to capture the single audit data to assess the effectiveness of the single audit report submission for all its grantees. (new)

Develop, implement and document procedures for implementing Office of Budget and Management (OMB) approved single audit report submission extensions, so that OMB approved extension approvals are documented and tracked as part of the single audit monitoring process. (new)

Update the Single Audit Resolution Policy to: Reflect the current monitoring process to track all audit findings related to CNCS-funded grants, and   Address CNCS’s responsibilities as the cognizant/oversight agency and how these responsibilities would be carried out. (new)

Develop and implement procedures to monitor the effectiveness of the single audit monitoring process in accordance with the Uniform Grant Guidance, 2 Code of Federal Regulation §200.513 Responsibilities, (a) (3) (iv), related to monitoring the effectiveness of single audit findings follow-up and the effectiveness of single audits in improving grantee accountability and in their use by CNCS in making award decisions. (new)

Consider changes in conditions or programs that require further research and analysis. Update the assumptions when necessary.

Ensure obligations are sufficiently supported (i.e., by documentary evidence); and

Implement a peer review process to carry out the necessary quality control reviews of the Trust Obligation and Liability Model and the Monthly Obligation and Liability Calculator. (repeat)

We recommend that DHS Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO), the Office of the Chief Information Security Officer (OCISO), and Component IT and financial management, complete a comprehensive risk analysis and develop a mitigation plan to reduce risks related to ITGC and application control deficiencies.