Open Recommendations

A requirement to provide a fact-specific description of the purpose of the JE, along with adequate supporting documentation.

Documentation needed to support JEs and how it will be maintained. (Modified Repeat).

Validate and ensure JEs are properly supported, documented, and are readily available for examination. (Modified Repeat)

Validate that the underlying data used in the accrual methodology, such as the use of grantee Undelivered Order balances to allocate accrual amounts, is reliable by ensuring previously reported conditions are remediated and recommendations are implemented. (New)

Perform a risk assessment over the current state of the conversion to ARC and work jointly with ARC, senior leadership, Office of Chief Risk Officer, and functional groups affected by the risk to develop a mitigation strategy and execute a realistic and properly designed corrective action plan. (New)

Continue coordinating with ARC to ensure that its accounting platform is compatible with AmeriCorps’ operations and the type of accounting transactions that AmeriCorps processes. (Modified Repeat)

Conduct a review of transactions processed in Momentum and already migrated to Oracle through interface or reported in Oracle using journal entries, to ensure that correct object class codes were applied. (New)

Establish controls and training to ensure that each functional office/unit performs independent assessment of internal controls to inform the CEO’s statement of assurance, even if unfavorable outcomes are expected. This proactive approach will promote the early detection of potential findings and allow for prompt remediation. (New)

Develop and implement audit readiness procedures to ensure that audit information is complete, accurate, has undergone proper quality control procedures, and readily available or can be retrieved timely. The audit readiness procedures should include audit coordination protocol with ARC that clearly define roles and responsibilities of all parties involved in the process. (New)

Continue working with Administrative Resource Center to review and correct AmeriCorps’ balances in detail to ensure they are properly supported and that balances migrated to the ARC platform are complete, accurate, and reliable. (Modified Repeat)

Strengthen its policies and procedures over the processing of JEs going forward now that AmeriCorps has transitioned to the shared service environment. The policies and procedures should cover the following:

Strengthen its policies and procedures over the processing of JEs going forward now that AmeriCorps has transitioned to the shared service environment. The policies and procedures should cover the following:

A policy as to when it is appropriate to use a JE and approval procedures for JEs recorded to ensure segregation of duties

A requirement to provide a fact-specific description of the purpose of the JE, along with adequate supporting documentation.

A requirement to provide a fact-specific description of the purpose of the JE, along with adequate supporting documentation.

Validate and ensure JEs are properly supported, documented, and are readily available for examination. (Modified Repeat)

KPMG recommends that DOT management design and implement procedures to consistently and timely perform and document user account access reviews as required by standards for effective internal control systems and/or internal policy.

KPMG recommends that DOT management design and implement procedures related to the retention of appropriate supporting evidence of internal controls, including but not limited to, access administration, access recertification, audit log review, and patch management.

Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

Develop interface / data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.

Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.