Open Recommendations

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Modify business procedures, using systems such as the Consolidated Claims Experience or other applications, to better inform claims specialists of necessary actions when SSI recipients do not provide required information and evidence for OASDI claims.

We recommend that CMS require hospitals to use condition codes 49 or 50 on claims for a device-replacement procedure that resulted from a recall or premature failure, regardless of whether the hospital received a reportable credit prior to billing for the device replacement procedure.

We recommend that CMS, under the assumption that the prior recommendation will be implemented, instruct Medicare contractors to implement a postpayment review process to ensure that hospitals have adjusted claims, as required, for the device credits they received.

We recommend that CMS obtain device credit listings from manufacturers and determine whether providers reported the credits as required by Medicare regulations.

We recommend that CMS, as an alternative to our third, fourth, and fifth recommendations, consider eliminating the current Medicare requirements for reporting device credits by reducing IPPS and OPPS payments for cardiac device replacement procedures.

Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO), the Office of the Chief Information Security Officer (OCISO), and component IT and financialmanagement, design and implement an effective internal control process to review service organization risks to ensure that ineffective ITGCs performed by service organizations are evaluated and appropriate compensating controls are designed and implemented by DHS and component management

Improve or reinforce existing policies, procedures, and related internal controls over financial information, including preparation of the Agency Financial Report.

Update policies and procedures to clearly define how the review of refund liquidations and administrative refunds is achieved.

Finalize the Drawback Handbook to document designed control activities over TFTEA drawback claims.

Complete a robust risk assessment related to TFTEA drawback claims

Update policies and procedures to clearly define how the review of accelerated payments and drawback liquidations is achieved.

Track and monitor the progress made in liquidating legacy drawback claims to support timely liquidation in accordance with the requirements of CFR 191

Enhance the destruction module in the system of record;

Design and implement a control to mitigate the risk of inaccurate updates to property records after initial seizure.

Provide training and enforce accountability for adherence to policies and procedures

Design and implement controls over grant obligations for the lost wages assistance program to ensure compliance with the Presidential Memorandum.

Develop new policies, or improve and reinforce existing policies, procedures, and related internal controls, that:a. the underlying data to actuarially derived estimates is reviewed timely;b. information derived from the systems used in the operations of controls is determined to be complete and accurate;c. risks related to the methods, models, assumptions, and data elements are assessed each year to identify, plan, and respond to changes; andd. changes to the methods, models, assumptions, and data elements are sufficiently documented.

Design and implement controls to ensure compliance with the Presidential Memorandum

We recommend the DHS Under Secretary for the Office ofStrategy, Policy, and Plans establish an oversight mechanism to ensureDepartment components implement DHS Policy Directive 045-05 as required including:1. Providing annual domestic violence awareness training for lawenforcement officers and their supervisors;2. Orally advising all law enforcement officers, during quarterlyfirearms qualifications, of their duty to report when lawenforcement contacts them concerning engagement in domesticviolence; and3. Ensuring all law enforcement officers annually completeLautenberg Amendment certifications.

KPMG recommends that DOT management design and implementprocedures to consistently and timely perform and document user account accessreviews as required by standards for effective internal control systems and/orinternal policy.

We recommend that NARA Chief Financial Officer report the ADA violation in accordance with 31 U.S.C. Section 1351,1517(b) and OMB Circular A-11, Section 145.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Develop interface / data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.