Open Recommendations

We recommend that the New York City provider based upon the results of this audit, exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation.

We recommend that the New York City provider develop policies and procedures to ensure that: o treatment plans contain all required elements, are maintained and are signed by the treating physician, o the performing therapists and supervising physicians comply with the requirements related to incident-to services, o psychotherapy services are conducted by therapists that meet Medicare qualification requirements, o time spent on psychotherapy services is documented, and o treatment notes are signed and maintained to support the services billed.

CMS should Encourage Part D plans to increase access to and use of biosimilars.

CMS should Monitor Part D plans’ submitted formularies to determine whether they discourage beneficiaries from using biosimilars

(U) Rec. 2.b: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security develop operations security training requirements on the risks of sharing DoD information on non-DoD-controlled systems and add these requirements to the existing training requirements described in DoD Instruction 8170.01, Online Information Management and Electronic Messaging, August 24, 2021, and DoD Directive, 5205.02E, DoD Operations Security (OPSEC) Program, June 20, 2012, (Incorporating Change 2, August 20, 2020).

(U) Rec. 3.a: The DoD OIG recommended that the Commanders of the U.S. Africa Command, U.S. Central Command, U.S. European Command, U.S. Indo-Pacific Command, and U.S. Southern Command issue command-level guidance clarifying the use of non-DoD-controlled electronic messaging systems. This guidance should include: i. any area of responsibility-specific conditions that permit personnel to use non-DoD-controlled messaging systems; ii. what information can be shared over the electronic messaging system; iii. how personnel are to maintain records generated on non-DoD systems in accordance with records management regulations; iv. how to report any security violations or misuse of a system; v. a process…

(U) Rec. 3.b: The DoD OIG recommended that the Commanders of the U.S. Africa Command, U.S. Central Command, U.S. European Command, U.S. Indo-Pacific Command, and U.S. Southern Command establish risk assessment procedures to evaluate and monitor combatant command use of current and emerging information technologies to identify opportunities for use and to assess risks in accordance with DoD Instruction 8170.01, "Online Information Management and Electronic Messaging," August 24, 2021.

(U) Rec. 3: Recommendation is Classified.

(U) Rec. 4: Recommendation is Classified.

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; CSOSA has determined that this recommendation contains information that is limited official use or classified.]

Ensure that the Cloud Resource Center's inventory of cloud projects in the configuration and production phases is comprehensive and periodically maintained.

Develop and implement a process to ensure that the FedRAMP Project Management Office has an accurate inventory of FedRAMP-approved cloud systems used by the Board.

Ensure that the Board’s information security continuous monitoring standards and associated procedures provide consistent guidance on continuous monitoring frequencies and associated documentation review requirements for cloud service providers.

Require the SAAO to develop and implement a policy to ensure Operating Administrations (OA) meet Uniform Guidance's requirements for Federal awarding agencies.

Require the SAAO to develop and implement processes to ensure that OAs confirm its recipients' single audits and reporting packages are completed and timely submitted to the Federal Audit Clearinghouse (FAC).

Require the SAAO to develop and implement processes that ensure OAs download single audit reports from FAC's Image Management System and OAs identify and track single audit findings directly related to their programs.

Require the SAAO to develop and implement processes that ensure OAs issue timely management decisions on all single audit findings affecting their programs.

Require the SAAO to develop and implement processes that ensure OAs follow up on single audit findings and verify that OAs recipients took appropriate and timely corrective actions.

We recommend FEMA’s Associate Administrator of the Office of Response and Recovery integrate component records managementpolicy into program-specific declarations guidance to specify the records that should be created and maintained in official declaration request files. The program-specific guidance should require the Office of Response and Recovery to maintain, in the official file, senior officials’ decision rationale when the regional offices’ and program offices’ recommendations differ.

We recommend FEMA’s Associate Administrator of the Office of Response and Recovery ensure that component records managementpolicies are adhered to both at Headquarters and Regional offices to validate that each declaration request package is accurate, complete, and in compliance with Federal regulations.

The Commissioner, Wage and Investment Division, should ensure that programming is updated to systemically reject electronic submissions of Forms 2848 and 8821 when missing one of the five essential elements (name, address, signature, etc.) without manually mailing a rejection letter.

The Commissioner, Wage and Investment Division, should develop a process to systemically pull all controlled inventory for each Accounts Management site for the Accounts Management Inventory Report (AMIR) to ensure consistency, reduce human error, and increase efficiencies