Open Recommendations

We recommend the Chief Information Officer (CIO): Develop and implement a process to create and maintain target and current cybersecurity profiles.

We recommend the CIO: Develop and implement controls to validate information within the Cybersecurity Assessment Management tool.

We recommend DOL OIG: Implement a control to help ensure that all interconnection service agreements or related documents are reviewed in accordance with the DOL Cybersecurity Policy Portfolio.

We recommend DOL OIG: Implement a baseline deviation monitoring process for its general support
system.

We recommend the CIO: Ensure all systems comply with the Cybersecurity Policy Portfolio requirements for session timeouts.

We recommend the CIO: Ensure the adherence to DOL logical access policies and procedures.

We recommend the CIO: Establish mechanisms to ensure that logical access controls are implemented and effective.

We recommend the CIO: Design and implement a process to ensure identity and access management internal control documentation is retained to support its system of internal controls and operational needs, as required by Government Accountability Office’s Standards for Internal Control in the Federal Government.

We recommend the CIO: Develop and implement effective data exfiltration controls to ensure unauthorized data does not leave the DOL network.

Develop and communicate guidance that explains what detail should be included in a valid justification for every Veterans Benefits Management System for Rating override.

Develop and implement a plan to reestablish an overrides quality review process that provides individualized feedback for claims processors.

Develop and implement a plan to monitor the effectiveness of override reviews and continue to address areas and trends that are found to need improvement.

Identify the business need for the override review tab and, if there is one, develop and implement requirements for updating and using it.

Develop and implement a plan that addresses the limitations of the aggregate dashboard.

Take appropriate actions to monitor the collection of the remaining 11 restitutions identified in our audit and the 3 restitutions from our prior audit, as appropriate.

Review the remaining 1,440 restitutions in the restitution tracking tool and the remaining 15 restitutions reported as errors in our prior audit to determine whether the Agency is monitoring the collection of the restitution as required and take corrective actions when appropriate.

Identify the factors contributing to employees not properly recording and monitoring the collection of restitutions and implement appropriate corrective actions.

Direct ODJFS to review the identified questionable SNAP participant data anomalies to determine whether monthly benefits of $13.3 million are unallowable and recover benefits, as appropriate.

Direct ODJFS to ensure its Death Master File subscription remains active and properly interfaces with its SNAP benefit eligibility system.

Direct ODJFS to determine whether its review of the identified SNAP participant data anomalies identified any other control weaknesses and, if so, resolve them.

Direct ODJFS to ensure its SNAP participant data review process detects and resolves the identified anomalies, as appropriate.

Direct ODJFS to conduct training to prevent recurrence of the identified anomalies, as appropriate.

Include an assessment of ODJFS’s SNAP participant data review process as part of FNS Midwest Regional Office relevant oversight activities.

Establish written policies and procedures to prepare a reconciliation of the state’s general ledger detail to actual grant and state matching expenses reported on the FFR.

Update grant financial management policies and procedures to include consistently using unique grant identification number when recording grant and state matching expenditures.