Open Recommendations

We recommend that the OCIO develop and implement a process to evaluate all systems' Authorizations to Operate annually for accuracy and completeness to ensure systems are operating with a valid authorization determined by actual residual risk.

We recommend that the OCIO develop and implement a process to conduct quality control reviews at least annually to ensure that all systems within the official system of record (Cyber Security Assessment and Management system) have an accurate operating status.

We recommend that the OCIO, in addition to ongoing continuous monitoring, develop and implement a policy to direct system owners to test all of the controls for their systems at least every 3 years.

We recommend that the OCIO develop and implement a policy to verify that bureaus and offices perform control assessments every 3 years.

We recommend that the OCIO develop and implement a review process that includes, at minimum, verifying that system owners have completed required testing for a sample of controls for each system before accepting the annual assurance statement.

We recommend that the OCIO develop and implement a comprehensive quality control plan to perform required quarterly reviews of Plans of Action and Milestones in the official system of record to ensure that bureaus and offices address them in a timely manner, close them as appropriate, and continuously monitor and track them.

We recommend that the FWS require the Department to develop and implement an internal control mechanism to ensure the program income method is properly applied and reported in accordance with grant award approvals and regulations.

We recommend that the FWS require the Department to amend all open subaward agreements to date to include all required elements.

Define and communicate policies and procedures to ensure that its products, system components, systems, and services comply with its cybersecurity and SCRM requirements. This recommendation includes:

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

Incorporate the EPA's certification test report expectations set forth in the April 2022 corrective action list into the 2023 revisions to the New Source Performance Standards for residential wood heaters.

Develop and adopt an EPA cord wood test method that is supported by data to provide the public reasonable assurance that certified appliances meet emission standards.

Establish mechanisms to promote independence between emissions testing labs and third-party certifiers.

Develop and implement procedures to verify that airport sponsors have provided evidence satisfactory to FAA that the airport sponsor has or will obtain good title to land, prior to requesting reimbursement for costs associated with noise compatibility land acquisition. Implementing this recommendation could put up to $2,077,796 in funds to better use by requiring that only costs associated with completed noise land acquisitions are reimbursed.

Update and implement procedures to require airport sponsors to maintain Noise Land Inventory and Reuse Plans in electronic format available for FAA review, upon request.

Require all airport sponsors that have acquired noise land to identify noise land eligible for disposal via sale and verify that noise land sales revenues are used in accordance with Federal law. Based on our review of five airports, implementing this recommendation could put up to $38,530,768 in funds to better use by generating revenue that could be reinvested in the program.

Update guidance to clarify for airport sponsors when noise land should be considered no longer needed for eligible current or planned airport purposes and disposed of in accordance with FAA policy.

Update guidance for Noise Land Inventory and Reuse Plans to require that the Noise Land Inventory include original acquisition dates, estimated or final completion dates for proposed or completed methods of disposal, and the date of FAA approval.

Update guidance for Noise Land Inventory and Reuse Plans to require that the Noise Land Inventory include the Federal share of the sale price at the time of sale and how sales proceeds were used. Implementing this recommendation could put up to $66,160 in funds to better use by properly accounting for noise land disposal proceeds in accordance with Federal law.

Update the Noise Land Management and Requirements for Disposal of Noise Land or Development Land Funded with AIP policy to establish a reasonable schedule for FAA Airport District Offices and Regional Offices to review Noise Land Inventory and Reuse Plans for accuracy and consistency with FAA policy.

Require the Rhode Island T.F. Green International Airport, Phoenix Sky Harbor International Airport, and Harry Reid International Airport to develop and submit for FAA's approval current Noise Land Inventory and Reuse Plans after implementation of recommendations 4, 7, and 8.

We recommend that the Centers for Medicare & Medicaid Services notify appropriate providers (i.e., those for whom CMS determines this audit constitutes credible information of potential overpayments) so that the providers can exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation.

We recommend that the Centers for Medicare & Medicaid Services review at-risk payments made to at-risk providers during and after our audit period to determine whether payments for procedure code G0483 complied with Medicare requirements and recover any overpayments.

We recommend that the Centers for Medicare & Medicaid Services expand program safeguards to prevent and detect at-risk payments to at-risk providers for the definitive drug testing service with the highest reimbursement amount (procedure code G0483), which could have saved up to $215.8 million for our audit period.

CMS should require MAOs to definitively indicate on MA encounter data records when they have denied payment for a service on a claim.