Open Recommendations

We recommend the Vice President, Safety and Shared Services, continue taking steps to enhance identification and awareness of the Contractor Oversight Representatives’ roles and responsibilities.

We recommend the Vice President, Safety and Shared Services, take steps to verify audits of safety performance are completed and documented in compliance with the Tennessee Valley Authority Standard Programs and Processes 18.004, Contractor Safety Management.

Update relevant policies or procedures to include processes for transitioning assets through the inventory life cycle, including
a. identifying IT assets that have completed their life cycle as ready for disposal or requiring a justification for retaining those assets.
b. establishing a schedule for asset disposal, implementing measures to monitor the asset disposal schedule, and reporting on the agency’s progress for fulfilling disposal expectations once established.

Update relevant policies or procedures to establish systematic methods for storing and organizing IT assets, including
a. formally designating rooms for certain assets and defining and implementing security measures for each storage room based on the room’s designated assets.
b. organizing rooms to ensure that in stock assets containing hard drives are not mixed with those designated as pending disposal and creating a plan to systematically stage and prepare IT assets for disposal, including confirmation that the assets designated as pending disposal do not contain hard drives before disposing of them.

We recommend that the Grantee develop and implement written policies and procedures surrounding the management of federal awards, in accordance with the Uniform Guidance.

We recommend that the Grantee retain documentation that substantiates travel expenses and the basis for determining the value of in-kind match contribution.

We recommend that the Grantee works with ARC, to resolve the $2,562 of questioned cost.

Develop and maintain cybersecurity profile(s) that define key elements of the Board’s current and target cybersecurity program in alignment with the Board’s organizational risk tolerance, mission objectives, and threat environment.

Evaluate the dual-use model for the Board’s mobile devices, in accordance with the Board’s security objectives and risk tolerance, and review and update the Information Technology Resources Use policy as appropriate.

Strengthen mobile device security controls to enforce content and data protection policies.

Determine what enterprise risk management roles, responsibilities, and strategy components should be defined and leveraged for the development and maintenance of cybersecurity profiles.

Develop and maintain cybersecurity risk registers to aggregate, normalize, and prioritize cybersecurity risks.

Develop policies and procedures to create and maintain cybersecurity profiles.

Perform a review of previously granted risk acceptance memorandums to determine whether they were based on a complete review of the system or common controls (as required by National Institute of Standards and Technology Special Publication 800-37, Revision 2) and perform additional risk analysis and/or compensating controls as needed for affected systems.

Ensure that risk acceptance memorandums reflect an assessment of qualitative and quantitative cybersecurity risks, as applicable.

Evaluate options to perform ongoing information continuous monitoring activities commensurate with the current threat environment.

We recommend the Vice President, Generation Projects and Outage Management, evaluate the practice, including the risk to warranty and cost, of TVA performing tuning in place of the contractor.

We recommend the Vice President, Generation Projects and Outage Management, educate project support personnel, as applicable, on their roles and responsibilities.

Establish policies and procedures to track and maintain sub-recipient documentation to ensure expenditures are adequately supported prior to reporting financial information to ARC.

Work with ARC to resolve the questioned cost totaling $46,617 for unsupported ARC funded Personnel, Fringe Benefits, and Supplies cost.

Work with ARC to resolve the questioned cost totaling $20,000 for unsupported non-ARC matching Other cost.

Establish policies and procedures to track and reconcile cost incurred throughout the grant
period to ensure complete and accurate financial reporting.

Work with ARC to revise reported projects costs for ARC funded and non-ARC match costs.

We recommend that the Grantee establish policies and procedures to ensure timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

We recommend that the Grantee establish policies and procedures for the timely preparation and submission of progress reports in accordance with the Uniform Guidance and grant agreement.