Open Recommendations

HUD OCIO should a) resolve the conflicts between its Inventory of Automated Systems (IAS) policy and web applications policy to clarify if web applications will be inventories in IAS, the web application Sharepoint site, or both; and b) implement the chosen resolution to this conflict to develop a consistent inventory of web applications (IG FISMA metric 1).

HUD OCIO should implement an automated governance, risk, and compliance tool to manage risk from all sources across the three tiers of the organization in a timely manner. This recommendation updates FY 2021 FISMA recommendation number 5 (IG FISMA metrics 5, 9, and 10).

HUD OCIO should employ automation to maintain a timely and accurate view of security configuration information for all systems connected to its network (IG FISMA metric 20).

HUD OCIO should demonstrate that it can implement its defined security responses if a baseline configuration is changed without authorization. This can be shown by either a response to a real incident if one happens or through a testing exercise if there are no applicable incidents (IG FISMA metric 23).

HUD OCIO should review its security training program and determine whether it should provide general cybersecurity awareness training to external users of its systems and data (IG FISMA metric 44).

Determine the allowability of $103,913 in unsupported questioned costs on page 14 of the audit report and recover any amount that is unallowable.

Implement additional policies, processes, and/or procedures to ensure that NSF assigns program element, thematic, account, budget object class, and/or other codes consistent with its Guidance for Coding of Mid-scale Research Infrastructure Awards for all awards NSF includes within its Mid-scale Research Infrastructure portfolio.

Revise existing internal guidance and procedures that Integrated Project Teams can use to improve the review, approval, and oversight process for Mid-scale Research Infrastructure awards.

Update and/or develop external Mid-scale Research Infrastructure guidance for proposing organizations to identify and/or clarify NSF’s expectations for the proposal, award, monitoring, and reporting activities required for different types of Mid-scale Research Infrastructure awards.

Implement a formal process for documenting NSF’s oversight, as well as the performance of the activities funded under Mid-scale Research Infrastructure awards, and for appropriately storing and archiving this documentation within NSF’s eJacket system (or another appropriate system) on a timely basis.

Produce and provide additional training to Integrated Project Teams responsible for overseeing Mid-scale Research Infrastructure awards.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that ICF Macro, Inc., corrects the one material weakness in
internal control detailed on page 8 of the audit report.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management BranchVerify that Chemonics International, Inc. corrects the material
weaknesses in internal control detailed on pages 11 to 12 of the audit report.

We recommend that National Government Services, Inc. develop and deliver additional education to auditors and audit supervisors regarding applicable criteria and review requirements.

We recommend that National Government Services, Inc. develop and implement enhanced procedures so that supervisors are better qualified to detect incorrect audit adjustments.

We recommend that Novitas develop and implement enhanced procedures so that supervisors are better qualified to detect incorrect audit adjustments.

Develop and enhance procedures for travel charge card terminations to ensure the timely closure of travel charge card accounts for separated employees.

Review and, as necessary, adjust the individually billed accounts to ensure compliance with the established credit limits in the NRC Plan.

Establish a process for conducting periodic reviews of travel charge card accounts to strengthen oversight and monitoring of individually billed accounts and help ensure adherence to the credit limits defined in the NRC Plan.

Develop and implement procedures for periodic reviews of the credit limits for centrally billed travel accounts and adjust these limits, as necessary, for the anticipated operational need.

Determine if the $47,791 in questioned costs for first and business class travel are allowable and provide the corrective actions taken on any costs deemed disallowed.

(U) Rec. 1.a: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C?17 System Program Manager to develop controls to ensure the accuracy of Chief Financial Officer reports.

(U) Rec. 1.b: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct the C-17 contracting officer to require Boeing to notify the contracting officer of price increases of 25 percent or higher than the proposed price.

(U) Rec. 1.c: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center require that the C?17 contracting officer reviews spare parts prices throughout the execution of the C?17 performance?based logistics contract, determine whether price increases of 25 percent or above occurred, and obtain justification of the price increase from Boeing.

(U) Rec. 1.d: The DoD OIG recommended that the Commander of the Air Force Life Cycle Management Center direct that the C?17 contracting officer review or delegate the review of invoices to determine whether spare parts prices are allowable and reasonable before payment.