Open Recommendations

We recommend that CFTC enforce the use of centrally billed accounts for travel cards used for international travel.

We recommend that CFTC develop and implement a comprehensive policy that mandates the immediate deactivation of all purchase and travel cards upon notification by HR of an employee’s separation or transfer. Additionally, instituting a regular monitoring system to track and validate the deactivation status of charge cards for all separated employees is recommended. Monthly reviews of charge card activity reports should also be conducted to identify any lapses in the deactivation process to prevent unauthorized use.

We recommended that CFTC review, revise, and update all travel policies to align with the current requirements of the Federal Travel Regulations, OMB directives, and the Government Charge Card Abuse Prevention Act.

We recommend the official Acting Chief Operating Officer for FSA continue to solicit, analyze, and incorporate feedback regarding the completion, submission, and processing of the 2025–2026 FAFSA until FSA confirms that issues with the FAFSA process have been resolved.

We recommend the official Acting Chief Operating Officer for FSA ensure that when the FAFSA process undergoes significant revisions in subsequent award years, FSA use the positive practices it implemented for soliciting and incorporating feedback in the 2025–2026 FAFSA process.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that GiveDirectly, Inc., corrects the material weaknesses in
internal control over financial reporting detailed on pages 32 to 34 of the audit report.

We recommend that USAID's Office of Acquisition and Assistance Cost, Audit and Support Division/Contract Audit Management Branch verify that GiveDirectly, Inc., corrects the instances of material
noncompliances detailed on pages 32 to 34 of the audit report.

We recommend that USAID/Uganda verify that Ministry of Finance, Planning and Economic Development corrects the seven material weaknesses in internal control detailed on pages 36, 42-46, 50-51 and 55 of the audit report.

We recommend that USAID/Uganda verify that Ministry of Finance, Planning and Economic Development corrects the 14 instances of material noncompliance detailed on pages 58 to 86 of the audit report.

We recommend that USAID/Mozambique verify that Centro de Aprendizagem e Capacitao da Sociedade Civil corrects the one material weakness in internal control identified on pages 25 and 28 of the audit report.

We recommend that USAID/Southern Africa determine the allowability of $205,140 in questioned costs ($169,956 ineligible, $35,184 unsupported) on pages 20, 25, 27, and 28 of the audit report and recover any amount that is unallowable.

We recommend that USAID Southern Africa verify that Africa Resource Centre NPC corrects the one material weakness in internal control detailed on pages 33 and 34 of the audit report.

We recommend that USAID/Southern Africa verify that Africa Resource Centre NPC corrects the five instances of material noncompliance detailed on pages 37 to 46 of the audit report.

(U) Rec. 1.a: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to identify all critical and non-critical software on the DoD Information Network that is subject to Office of Management and Budget-required self-attestation requirements.

(U) Rec. 1.b: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to obtain Office of Management and Budget-required self-attestations from software providers or implement an Office of Management and Budget?approved alternative solution for all identified third-party software on the DoD Information Network.

(U) Rec. 1.c: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to establish a plan of action and milestones to obtain all remaining Office of Management and Budget-required third-party provider self-attestations and request an extension from the Office of Management and Budget deadline.

(U) Rec. 1.d: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to implement a process, such as periodic reviews of the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are accurately reporting the system authorization status for non?national security systems in accordance with DoD guidance.

(U) Rec. 1.e: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to update the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that it captures compliance information for all controls associated with Inspector General Federal Information Security Modernization Act of 2014 reporting metrics for their non-national security systems.

(U) Rec. 1.f: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to develop and implement a process, such as periodic reviews of the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials implemented the necessary National Institute of Standards and Technology information system controls and accurately reported the status for all non-national security systems.

(U) Rec. 1.g: The DoD OIG recommended that the DoD Chief Information Officer direct DoD Components, including the Coast Guard, in coordination with the DoD Component Chief Information Security Officers, Chief Information Officers, and Authorizing Officials, to require officials to develop a plan of action and milestones for non-national security systems that have not implemented all Inspector General Federal Information Security Modernization Act of 2014 reporting metrics-related controls or those systems with a low implementation percentage (for example, below 75 percent), and track the completion of the plans until such controls are implemented or have elevated to an acceptable level…

(U) Rec. 2: The DoD OIG recommended that the DoD Chief Information Officer direct the Army Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 3: The DoD OIG recommended that the DoD Chief Information Officer direct the Navy Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 4: The DoD OIG recommended that the DoD Chief Information Officer direct the Air Force Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 5: The DoD OIG recommended that the DoD Chief Information Officer direct the Coast Guard Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.

(U) Rec. 6: The DoD OIG recommended that the DoD Chief Information Officer direct the Defense Security Cooperation Agency Chief Information Officer, in coordination with their Chief Information Security Officer and Authorizing Officials, to review the Enterprise Mission Assurance Support Service, or an equivalent system, to ensure that officials are correctly reporting the system authorization status for their non-national security systems and update the status for any miscategorized systems.