Open Recommendations

KPMG recommends that DOT management conduct monitoring to assess whether control operators are performing control activities in accordance with policy.

We recommend that Kentucky identify ways to address the challenges related to meeting the requirements for conducting monthly caseworker visits, including consulting with ACF.

We recommend that Kentucky conduct the name-based checks on the one applicant and one adolescent household member identified by our audit as lacking the required checks and reiterate to staff the importance of adhering to the policies and procedures requiring background checks to be completed before approving foster homes.

We recommend that Kentucky conduct FBI fingerprint checks on the five applicants and other household members identified by our audit as lacking completed checks.

STB management should review the current version of OMB Circular A-136 to independently verify that all required footnotes are included and bring any omissions to the service provider's attention so that errors or omissions can be corrected.

STB management should review the service provider's Financial Statement and Notes Review Checklist to verify that the checklist is up to date and includes all required elements per OMB and Treasury guidance and then complete the checklist independently. Alternatively, STB management should develop and complete its own review checklist based on current Treasury and OMB reporting requirements.

STB management should request its financial management service provider to:
Reevaluate the inclusion of account balances that were excluded in the Other Liabilities footnote, or
Disaggregate (i.e., separately report) intragovernmental other liabilities balances reported as a single line item on the balance sheet that are not included in the footnote so that the total amounts reported for Other Liabilities on the Balance Sheet and in the footnote agree.

STB management should ensure that its review process includes procedures to disaggregate material balances reported in the financial statements and footnotes, agree balances to source documents, agree the footnotes to the principal financial statements, and verify the mathematical accuracy of all statements and schedules included in the financial statement package.

Management's review and certification of the financial statements and footnotes should be clearly documented and indicate what was reviewed, when the review was performed, and who performed the review for each reporting period.

STB should perform a review of 100% of employee benefit elections and Official Personnel Folders (OPFs) to ensure they are complete and accurate.

STB should develop policies and procedures that include the performance of periodic reviews of employees' Official Personnel Folders to ensure that they are complete and accurate.

STB should obtain replacement documentation for employee forms and other documentation that have been determined to be incomplete or irretrievable from databases and other electronic sources following management's initial and periodic routine reviews.

We recommend that STB implement and enforce its existing policies and procedures requiring the periodic review of all open obligations to ensure that closeout of completed contracts, including the de-obligation of funds and return of the balances for any advanced payments, is performed regularly and timely.

KPMG recommends that FAA management design and perform procedures to consistently approve and document new or modified user account and recertification requests and timely remove separated users as required by internal policy and standards for effective internal control systems.

Implement a mechanism in order to associate hardware and software assets with application boundaries.

Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Ensure policies and procedures governing the provisioning and de- provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Document access rights to systems to include roles, role descriptions, privileges or activities associated with each role, and role or activity assignments that may cause a segregation of duties conflict.

Establish a mechanism to systematically track all configuration items that are migrated to production in order to produce a complete and accurate listing of all configuration items. Further, develop, document, implement, and enforce requirements and processes to periodically validate that all configuration items migrated to production are authorized and valid.

Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings, implement a process to periodically validate the settings are appropriate and ensure that proper baselines are scanned.

Develop interface / data transmission design documentation that specifies definition of responsibilities, as well as on-going system balancing requirements.

Review all current open obligations and identify all contracts entered into without proper authorization and have the EAC and/or service provider contracting officer ratify the contracts. Ensure that the authorization is properly documented.

EXIM’s Chief Management Officer, in coordination with the Vice President for Administrative Services Division, should develop an action plan, including a cost benefit analysis, to address the EXIM headquarters turnstile access issues identified in this report.

EXIM’s Chief Management Officer, in coordination with the Vice President for Administrative Services Division, should finalize the updated EXIM Building Security Policy and ensure the final version of the revised Policy mandates EXIM employee use of the turnstiles at EXIM headquarters.