Open Recommendations

Follow up with AIPs that did not submit reports for the 148 required $200,000 Indemnity Reviews in CY 2022 and (1) determine whether the $61.9 million in questioned, unsupported indemnity cost were supported and allowable, and (2) recover any costs determined to be unsupported and unallowable.

Review CYs 2019 through 2023 and follow up with AIPs for unsubmitted reports for the required $200,000 Indemnity Reviews and, if adequate support is not provided, recover the unsupported indemnity amounts.

Develop and implement a process and procedures to regularly reconcile the required $200,000 Indemnity Reviews with the associated completion reports submitted by AIPs.

We recommend SSA include terms or conditions in all contracts that require that contractors identified as having significant security responsibilities complete role based security training before they perform their assigned duties and, at least, each fiscal year thereafter.

We recommend SSA implement data validation controls before it processes the role based privacy training assignments to prevent errors and avoid confusion between different components.

We recommend SSA develop and implement a process to send stakeholders routine reminders to update personnel information and periodically validate that all stakeholder information is accurate.

Conduct a study to establish minimum loan thresholds for performing site visits, implement policies and procedures based the results of that study, and perform site visits to help facilitate appropriate liquidation of collateral on defaulted COVID-19 EIDLs in an effort to maximize collections.

Verify all delinquent COVID-19 EIDL obligors are reported to credit bureaus in a timely manner.

Confer with the DOJ to establish a reasonable standard for referral of delinquent COVID-19 EIDLs to the DOJ for litigation.

Complete efforts to develop and implement program-level goals and metrics for both the Regional and Significant Service Provider Examination Programs. This should include finalizing and implementing the Inherent Risk Methodology Analysis.

The Chief, Taxpayer Services, should perform a study to determine whether a new kiosk program that uses updated technology, or deploys laptops to TACs, would provide effective and efficient self-service options to taxpayers.

Evaluate which staff should have access to and should update the Consult Toolbox when records are requested or received and update the Consult Business Rules and Uses of the Consult Package Standard Operating Procedure to reflect necessary changes.

Include controls within the Consult Toolbox to prevent errors and improve data quality, including controls on administrative closure of low-risk consults and documenting the records-retrieval method.

Update consult closure policies and procedures to clarify requirements for administrative closure and determine whether metrics for the percentage of records received should be a requirement and included in policy.

Determine whether Veterans Health Administration facilities community care offices should continue to be required to use the administrative closure report for oversight of administratively closed consults, and if not, determine what reports should be required.

Evaluate the workload of community care staff to determine the most efficient way to structure and execute their duties.

Determine if there are mechanisms to identify standardization opportunities and increase efficiency for improving records return processes.

Ensure community care staff follow procedures to reduce duplicate records received.

Evaluate ways to increase use of provider electronic records portals to reduce reliance on electronic fax when retrieving medical records.

Consider increased implementation of technologies to improve records processing once received to reduce the manual renaming of electronic files and uploading of records into the electronic health record.

Ensure records from the Joint Longitudinal Viewer are uploaded into the electronic health record.

The Medical Center Director ensures staff store clean and soiled utility items separately, maintain cleanliness, and dispose of expired items.

Finalize and implement policies and procedures for creating and maintaining current and target cybersecurity profiles in alignment with National Institute of Standards and Technology Cybersecurity Framework Guidance.

Finalize and implement a comprehensive Risk Management Strategy that defines roles and responsibilities, enterprise risk priorities, objectives, and communication protocols, including third-party risk considerations.

Continue to develop and implement an Enterprise Risk Management program based on National Institute of Standards and Technology and Enterprise Risk Management Playbook (Office of Management and Budget Circular A- 123, Section II requirement) guidance.