Open Recommendations

We recommend the DHS Office of the Chief Information Officer remove applications from component mobile devices that are prohibited by DHS policy, applications with unmitigated security risk, and applications that do not meet business needs.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure: • all user-installed applications are evaluated for security risks to the mobile device or data security and for compliance with Department policy before allowing their use; and • user-installed applications are managed and monitored on a routine basis.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to improve the vulnerability management process and to ensure: • tools used for credentialed scans can detect known vulnerabilities; • credentialed scans are completed and assessed in accordance with DHS guidance; • plans to address vulnerabilities are created and implemented promptly in accordance with DHS guidance; and • the risk of noncompliant enterprise-level system settings is formally accepted or mitigated.

We recommend I&A’s Directorate of Technology and Data Services update its policies and procedures for notification of official foreign travel to incorporate DHS Office of the Chief Information Officer guidance and ensure mobile devices receive proper authorization for international travel.

We recommend the DHS Office of the Chief Information Officer develop and implement policies and procedures to ensure mobile devices are configured with minimal features and applications based on mission needs.

We recommend I&A’s Directorate of Technology and Data Services coordinate with DHS Office of the Chief Information Officer to develop and implement a memorandum of understanding that clearly defines roles, responsibilities, and accountability for the inventory management of I&A mobile devices.

We recommend the DHS Office of the Chief Information Officer update and implement policies and procedures to improve its mobile device management to ensure: • OCIO-issued mobile devices are enrolled in the mobile device management system; • documentation is required for devices that receive waivers from the policy; • all reported lost, stolen, and disposed-of I&A mobile devices are unenrolled from the mobile device management system; • all lost or stolen mobile devices and those I&A no longer needs are reported to the Office of the Chief Information Officer to be remotely wiped by the mobile device management system; and…

We recommend I&A’s Directorate of Technology and Data Services coordinate with the DHS Office of the Chief Information Officer to develop and implement policies and procedures to improve the management of mobile services and ensure: • all mobile devices without a business need are unenrolled from mobile services; • mobile service overage charges are incurred in support of mission needs; and • mobile device use is routinely monitored and reported to prevent paying for unnecessary devices and services.

The VA Loma Linda Healthcare System Director ensures the Chief of Staff signs peer review designation memoranda within three days of determining a peer review is needed as outlined in Veterans Health Administration policy.

The VA Loma Linda Healthcare System Director ensures that focused professional practice evaluations for initial appointments and additional privileges are completed in accordance with Veterans Health Administration policy and monitors for compliance.

The VA Loma Linda Healthcare System Director ensures the Chief of Staff signs peer review designation memoranda within three days of determining a peer review is needed as outlined in Veterans Health Administration policy.

The VA Loma Linda Healthcare System Director ensures that focused professional practice evaluations for initial appointments and additional privileges are completed in accordance with Veterans Health Administration policy and monitors for compliance.

Restricted due to sensitive information.

Restricted due to sensitive information.

We recommend the Director of FEMA’s Individual Assistance Division ensure the National Board resolves the $425 million in questioned costs associated with the Emergency Food and Shelter Program-Humanitarian Relief funding during the grant closeout process by collecting supporting documentation, determining whether the costs are allowable, and recouping any costs that are not allowable.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate resolve the $16.5 million in questioned costs associated with the Shelter and Services Program funding identified in our report. FEMA should collect supporting documentation, determine whether the costs are allowable, recoup any costs that are not allowable, and upload the necessary information to the FEMA Grants Outcomes system of record.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate review payment requests during the grant closeout process for all Shelter and Services Program awards in FY 2023 and FY 2024 to minimize the reimbursement of unsupported costs. FEMA should collect supporting documentation, determine whether the costs are allowable, and upload the necessary information to the FEMA Grants Outcomes system of record.

We recommend the Assistant Administrator of FEMA’s Grant Programs Directorate develop and implement controls to ensure FEMA officials and grant recipients use FEMA Grants Outcomes as the system of record to maintain required documentation supporting all phases of the grants management lifecycle.

We recommend the Director of FEMA’s Individual Assistance Division and the Assistant Administrator of FEMA’s Grant Programs Directorate establish a review process to ensure there was no duplication of FY 2023 funding between the Emergency Food and Shelter Program-Humanitarian Relief and the Shelter and Services Program. FEMA should recoup any duplicate payments identified.

Ensure that disposition plans are approved for all terminated awards USAID Southern Africa managed.

Implement internal controls, such as closeout audits, to verify that high-value assets purchased under awards are properly accounted for at the time of award closeout, in accordance with thresholds established in Federal requirements.

Enforce the requirement for the White Plains Main Post Office management to monitor fuel card purchases, including annotating all high-risk fuel transactions with an appropriate comment.

We recommend that USAID determine the allowability of $55,154 in ineligible questioned costs identified on pages 19 and 30 of the audit report and recover any amount that is unallowable.

We recommend that USAID verify that Christian Health Association of Kenya corrects the one instance of material noncompliance detailed on pages 43 to 44 of the audit report.

Seek industry input on current xEVAS contract requirements to maintain competition as needed
in the future.