Open Recommendations

Update its QC plan and related processes and procedures to align with requirements for (1) loan file reviews, including requirements to obtain new credit reports, reverify borrower information, and obtain appraisal field reviews; (2) documenting review results, including maintaining data on findings; (3) assessment of findings; (4) mitigation of findings; (5) reporting findings internally to lender management; and (6) reporting findings to HUD when required.

Provide annual training to its staff and management on HUD requirements for lender QC programs and provide proof of training to HUD.

Review the six EPD loans not previously selected for review and submit the results to HUD, including all findings of fraud or material misrepresentation, along with any other material findings that it is unable to mitigate. If required, Flat Branch should execute indemnification agreements or reimburse claims paid to help protect the FHA insurance fund from unacceptable risk.

Obtain credit reports and reverify borrower information for up to 279 EPD reviews performed and evaluate the risk of both new findings identified and existing findings contained in its QC files to confirm whether it self-reported to HUD all findings of fraud or material misrepresentation, along with any other material findings that its records did not show have been acceptably mitigated. If required, Flat Branch should execute indemnification agreements or reimburse claims paid to help protect the FHA insurance fund from unacceptable risk.

Evaluate its QC files for the 29 post-closing QC reviews in which it identified material findings to confirm whether it self-reported to HUD all findings of fraud or material misrepresentation, along with any other material findings that its records did not show have been acceptably mitigated. If required, Flat Branch should execute indemnification agreements or reimburse claims paid to help protect the FHA insurance fund from unacceptable risk.

Provide indemnification agreements or documentation to support the two loans in which it missed material deficiencies and the three loans in which it identified material findings that it did not acceptably mitigate or self-report to HUD. Implementation of this recommendation will protect the FHA insurance fund from an estimated loss of $228,793.

(U) Rec. 1: The DoD OIG recommended that the Chief of Naval Operations, in coordination with the Commander of the U.S. Transportation Command and the Maritime Administrator of the U.S. Department of Transportation, conduct an annual review of the current recapitalization strategy, revise the strategy based on known limiting factors, and develop viable milestones based on those factors to ensure that the Navy is capable of meeting readiness requirements in the event of a contingency.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments, Risk Assessments, and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable federal standards.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure System Security Plans reflect the status of security control implementations and risks are accurately reported to support a comprehensive risk management program across the organization.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system owners and Information System Security Officers follow procedures for establishing, tracking, and updating Plans of Action and Milestones (POA&Ms) for all known risks and weaknesses including those identified during security control assessments.

We recommended the Assistant Secretary for Information and Technology implement measures to ensure that system stewards and other officials responsible for system level POA&Ms are closing items with relevant support that shows sufficient remediation of the identified weakness.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access. Remove unnecessary and inactive accounts on systems and networks.

We recommend the Assistant Secretary for Information and Technology coordinate with system owners and local system management to ensure the consistent monitoring and reviewing of privileged accounts, service accounts, and accounts for individuals with access to source code repositories are performed across VA systems and platforms.

We recommend the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security configuration baselines on domain controllers, operating systems, databases, application, and network devices.

We recommended the Assistant Secretary for Information and Technology ensure established change control procedures are consistently followed for testing and approval of system changes for VA applications and networks.

We recommended the Assistant Secretary for Information and Technology implement and consistently enforce established procedures for preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations.

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for establishing, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. Ensure privileged activity is monitored on all systems and applications.