Open Recommendations

STB management should request its financial management service provider to:
Reevaluate the inclusion of account balances that were excluded in the Other Liabilities footnote, or
Disaggregate (i.e., separately report) intragovernmental other liabilities balances reported as a single line item on the balance sheet that are not included in the footnote so that the total amounts reported for Other Liabilities on the balance sheet and in the footnote agree.

STB management should ensure that its review process includes procedures to disaggregate material balances reported in the financial statements and footnotes, agree balances to source documents, agree the footnotes to the principal financial statements, and verify the mathematical accuracy of all statements and schedules included in the financial statement package.

STB management's review and certification of the financial statements and footnotes should be clearly documented and indicate what was reviewed, when the review was performed, and who performed the review for each reporting period.

STB financial management should complete training relating to the preparation and/or review of financial statements and footnotes to improve management's understanding of Federal reporting requirements and to ensure that the financial statements and footnotes are complete, accurate, and appropriately presented.

STB should perform a review of 100 percent of employee benefit elections and Official Personnel Folders (OPFs) to ensure they are complete and accurate.

STB should develop policies and procedures that include the performance of periodic reviews of employees' OPFs to ensure that they are complete and accurate.

STB should address missing or unavailable supporting documentation with its shared service provider to ensure that document retrieval tools are available and are working properly to allow retrieval of all stored documents.

STB should obtain replacement documentation for employee forms and other documentation that have been determined to be incomplete or irretrievable from databases and other electronic sources following management's initial and periodic routine reviews.

STB management should implement and enforce its existing policies and procedures requiring the periodic review of all open obligations to ensure that closeout of completed contracts, including the de-obligation of funds and return of the balances for any advanced payments, is performed regularly and timely.

Clearly identify and publicly publish MSHA's jurisdiction, including obtaining any needed legal opinion from the U.S. Department of Labor Office of the Solicitor on the U.S. territories and the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, requesting any needed legislative changes.

Revise MSHA's implementation plan for when it will begin inspecting mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands and begin implementing the plan. The revised plan should address: (1) when enforcement of the Mine Act and MSHA regulations will begin; (2) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field office nearby); (3) whether additional training will occur and how (e.g., in-person, virtual, hybrid, via grants, et cetera); and (4) how funding will be obtained to conduct required MSHA activities in FY 2025

Develop and implement a plan to enforce the Mine Act in the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, having first obtained legal authority verifying they are still under MSHA's jurisdiction. If the legal authority opines MSHA has jurisdiction over them, MSHA's plan should address: (1) whether future legislative changes to the Mine Act are needed and requests to Congress; (2) when enforcement of the Mine Act and MSHA regulations will begin; (3) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field…

Verify mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands have properly submitted their Part 50 data to MSHA.

Update the status history for all mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands, including to reflect the periods for which they were operational. This should include adjustments needed after verifying the mines properly submitted their Part 50 data.

Update the mine status criteria to address the types of support (e.g., mine visit observation, closure notice submitted by operator, MSHA analysis of Part 50 data, et cetera) needed to put a mine in "abandoned" status and require support be documented in the related mine file.

Develop guidance for what to do with mines that have been issued a mine identification number and remained in "new mine" status for long periods of time because they never started operations.

Correct mine statuses for any mines that do not adhere to guidance and criteria updates made in response to this alert memorandum, which includes updating the mine status criteria requirements and developing guidance for mines remaining in "new mine" status for long periods of time.

Develop guidance on when mine identification numbers can be deactivated and reactivate any mine identification numbers in MSHA's system that do not adhere to that guidance.

Remove the exclusion of CAVs limitation from the public "inspections" dataset or transparently state any existing limitation(s) on the download description section of MSHA's website.

Develop and implement a culture transformation plan to ensure the integrity and ethical values expected are enforced throughout MSHA.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Enforce existing policies to ensure that all users are included within quarterly user access reviews.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Design, document, and implement controls to grant system application access upon requested and approved business need and maintain evidence of such user access requests.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Enforce independent review of personnel’s system access and redesign existing policies and procedures in order to perform the review of all personnel’s access each fiscal year.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.

The Chief Information Officer should continue to comply with Treasury’s preliminary guidance on generative AI by identifying accesses to external domains and internet platforms from traffic logs and updating rulesets to restrict further access to these sites so the IRS is not inadvertently revealing sensitive and non-public information outside of the IRS.

The Chief Data and Analytics Officer should accelerate standing up the new governance structure and processes to ensure the safe, secure, and trustworthy development and use of artificial intelligence.