Open Recommendations

Subsequently remind agencies with late-filed SSRs or CAPs of best practices at least 60 days prior to their next scheduled filing due date, and that they may request a filing extension at least 30 days before their scheduled due date if extenuating circumstances exist.

Offer standardized training to any new HOA on the safeguard review process and best practices for submitting agency documentation.

Update policies to require follow-up with State agencies concerning any unsubmitted mitigation plans after their mitigation plan due dates have passed.

Develop procedures to ensure that finding information is accurately documented in the PFR, the SRR, and eCase as well as that case updates, case notes, relevant correspondence, and mitigation plan receipt dates are accurately documented in eCase.

Send an annual reminder to all State agencies to notify staff of their responsibility to report data incidents within 24 hours of identification.

Provide documentation to support that HAP was appropriately paid to the owners for the 66 units that had more than one stop payment. If additional HAP was inappropriately paid, the Authority should pursue collection from the applicable owners or reimburse its HCV Program from non-Federal funds.

Review its records to confirm whether it had cases of children with EBLLs during our audit period and work with the owner(s) of the HCV Program units to provide required documentation to HUD.

Work with HUD's OLHCHH to provide technical assistance to the Authority's staff to develop and implement procedures and controls for monitoring owners for compliance with HUD's EBLL requirements and attempting to collaborate with local health departments to identify cases of EBLL in children under 6 years of age under its HCV Program.

We recommend that IAF's chief information officer develop and implement a plan, including tools and other resources, to remediate critical and high vulnerabilities within the timeframes specified in the agency's "Information System Security Program Standard Operating Procedures" (February 2022).

We recommend that IAF's chief information officer update the agency's system security plan to include controls in National Institute of Standards and Technology Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations."

Ensure that the CCI develop, implement, and disseminate written policies and procedures specific to: The VOCA-funded program administration

Ensure that the CCI develop, implement, and disseminate written policies and procedures specific to: Ensuring the integrity and accuracy of its victim records and ensuring its performance reports are accurate.

Ensure that the CCI develop, implement, and disseminate written policies and procedures specific to: Ensure adequate controls over transactions being approved by designated approvers and segregation of duties are implemented, including in cases where the designated approver is also the requester.

Ensure that the CCI develop, implement, and disseminate written policies and procedures specific to: Allocating costs in proportion to the benefits obtained or another reasonable basis.

Ensure that the CCI develop, implement, and disseminate written policies and procedures specific to: Reconciliation of programmatic activities affecting financial outlays, to ensure that any victim direct assistance is utilized fully and that associated costs for any unused assistance is refunded to the CCI's VOCA funds appropriately.

Ensure that the CCI: Re-evaluate its stated goal of serving 300 new and unduplicated victims to ensure the goal is attainable for future VOCA subaward applications.

Ensure that the CCI: Develop controls within its fiscal policies and procedures to ensure adequate supporting documentation is maintained for all VOCA-funded transactions.

Remedy CCI's unsupported questioned costs totaling $9,448.

Ensure that the Nevada DCFS incorporates controls to verify the accuracy of its subrecipients' quarterly performance reports.

Revise its procedures to ensure all electronic storage media containing sensitive or classified information, including hard drives that are extracted from computers slated for destruction, are appropriately accounted for, tracked, timely sanitized, and destroyed.

Implement controls to ensure its electronic storage media are marked with the appropriate National Security Information (NSI) classification level markings, in accordance with applicable policies and guidelines.

USAID West Bank and Gaza verify that Tech2Peace corrects the 3 instances of material noncompliance detailed on pages 25 to 27 of the audit report.

Verify that Moona - A Space for Change, corrects the two instances of material noncompliance detailed on pages 23 and 24 of the audit report.

We recommend that MCC's Chief Information Officer take the following action:
Recommendation 1. Implement level 3 event logging requirements in accordance with Office of Management and Budget Memorandum M-21-31.

Develop and communicate guidance on post-award spot checks to include a more detailed definition of spot checks, illustrative procedures and opportunities for their use, and procedures for appropriately communicating their results, when warranted.