Open Recommendations

CMS should pursue additional strategies—such as educating providers and pharmacies—to increase access to and use of lower-cost hepatitis C drugs in Medicare Part D.

Evaluate efficiency at the 10 facilities to identify inefficiencies in the mail flow (e.g., facility layout/location, space constraints, customer and service impacts, and equipment relocation costs) and, based on the results, consider properly aligning the impacted facilities to efficiently meet the challenges they face based on changes in market demand.

OIG recommends that until all 11 recommendations (see Appendix A for a list of the 11 recommendations) addressed to the Bureau of Near Eastern Affairs (NEA) referenced in this report (AUD-AOQC-22-33) are implemented and closed, the Under Secretary for Political Affairs monitor NEAs compliance responses to OIG and verify, at least quarterly, that the responses (a) are provided to OIG within the established due dates and (b) contain complete and accurate status updates that include either evidence of implementation or detailed corrective action plans with actual or proposed target dates for achieving these actions.

Recommendation 9: We recommended the Assistant Administrator for Protective Services, in coordination with the Ames Protective Services Office Chief and Ames Center Director: Within the next 3 years, conduct a Center-wide security vulnerability risk assessment, including the districts outside Ames Campus, to ensure compliance with federal and NASA requirements. 

Recommendation 10: We recommended the Assistant Administrator for Protective Services, in coordination with the Ames Protective Services Office Chief and Ames Center Director: Identify and implement mitigation strategies and resource requirements to address the security vulnerability assessment risks.

Review unprocessed felony referrals identified in this report, take corrective action as needed, and report the efforts taken to the OIG.

Update and publish VA directives and handbooks associated with the Homeland Security Presidential Directive 12 Program and VA’s personnel security and suitability program as required by VA’s enterprise directives management procedures.

Determine the allowability of the questioned transactions and recover $7,148,093, if applicable.

Develop a framework for directing DHS components to deploy staff to support missions, including non-centrally funded, unplanned, or emergency operations, for which DHS resources are needed.

Develop a volunteer deployment strategy that includes provisions for supporting volunteers, regardless of funding source.

Enforce requirements for components to obtain authority to operate, resolve critical and high-risk vulnerabilities, and apply sufficient resources to mitigate security weaknesses.

Revise DHS 4300A Policy, Handbook, and Ongoing Authorization methodology to incorporate applicable changes from NIST SpecialPublications, including SP 800-37, Revision 2, SP 800-53 Revision 5, and SP 800-137A to maintain consistency between the documents.

The Chief Information Officer continue pursuit of transitioning to a single asset management system that addresses its program needs to track accountable and consumable IT property and establish a detailed implementation plan with target dates to transition to a single asset management system for accountable and consumable IT property as currently captured in Cireson and Jumpstock.

Enact a formal procedure to review all VBA compensation awards not already reviewed by the OIG that were completed since January 1, 2020, with debts due to reduced disability levels, take corrective action as appropriate, and report the results to the OIG.

Develop a mechanism to review the effectiveness of the recommendations periodically and a process for determining what additional measures, if any, are needed.

Embassy Oslo should require the Embassy Employee Association board to conduct its oversight responsibilities in accordance with Department standards.

Embassy Oslo, in coordination with Regional Information Management Center Frankfurt and the Bureau of Information Resource Management, should bring the embassy’s high frequency radio equipment into compliance with Department standards.

Develop and implement a process to evaluate existing Boeing airplane flight manuals to determine whether they contain required normal, non-normal, and emergency procedures that are necessary for the safe operation of the aircraft. Within this process, include methods to determine what corrective actions are needed if deficiencies are identified.

Develop and implement a documented process to identify what information manufacturers must include in airplane flight manuals.

Develop written procedures to maintain documents for Special Purpose, Disaster, or other similar grants. If the documents for requests and approvals of COVID-19 quarterly report extensions can be retrieved, keep them in a central location.

Ensure that OPP and OCE Policies and Procedures Manual are updated and complete, including policies and procedures for the oversight and monitoring of Disaster Program funds, which would include LSC CARES Act Funds.

Complete revisions and publish the OFAS Accounting Procedures Manual (LSC is currently working to complete and publish the draft OFAS Accounting Procedures Manual), including bank account verification policies and procedures.

We recommend the Office of the Chief Security Officer develop and implement a suitability policy for AOC employees and consolidate and implement revisions, as appropriate, to the current contractor suitability policy. Additionally, develop and implement a standardized timeline for policy revision and update within the current Fiscal Year.

We recommend that the Centers for Medicare & Medicaid Services revise 42 CFR section 405.980 and corresponding manual instructions related to the reopening period for claims to be consistent with statutory provisions contained in section 1870 of the Social Security Act, which allows Medicare contractors to determine whether overpayments were made and to begin to collect them for 5 years following the year payments were made.

We recommend that the Centers for Medicare & Medicaid Services establish a mechanism to reopen claims when OIG starts an audit so that CMS can collect overpayments consistent with the 5-year timeframe contained in section 1870 of the Social Security Act.