Open Recommendations

Develop and conduct contingency plan and incident response testing exercises that include and/or mimic a ransomware event and incorporate the lessons learned into the site’s recovery and response capabilities.

"Develop and implement a process to perform continuous monitoring activities to
fully evaluate third-party providers’ information technology environments for security changes or threats."

Conduct an analysis or risk assessment that evaluates ransomware threats and the cost to fully recover from a ransomware event, including considerations in the Department’s guidance on Analyzing Ransomware Risk: A Blueprint for Quantification.

The Mint Director ensures the Mint considers additional procedures to oversee refiners including, but not limited to, obtaining and periodically reviewing documentation from the Mint’s approved refineries, such as the LBMA-required third party audits and supporting documentation, to ensure that refineries are sourcing gold responsibly in accordance with U.S. law and the best interests of the U.S. Government.

The Mint Director ensures the Mint within 30 days of issuance of this report, develops a plan that outlines the steps and controls the Mint will implement to comply with Public Law 99-185 and Public Law 109-145 in the production of gold coins which includes a review of the Mint’s current methodology to ensure it complies with U.S. law. As part of this review, the Mint should publish its procedures for acquiring newly mined U.S. gold in the Federal Register. Furthermore, the Mint needs to update its website for accuracy and its BOAs and operating procedures to ensure that these…

Treasury’s Risk and Control Group (RCG) work with OCA management to consider all information available when answering risk assessment questions to ensure adequate completion and conclusion of susceptibility for these program-specific risk assessments.

Treasury’s RCG require OCA management to conduct and provide an updated analysis and justification memo that takes into consideration known and likely improper payments made to recipients at all levels as reflected in audits and other information, that might impact its conclusion on whether payment recapture audits are cost-effective for its pandemic relief programs.

We recommend the DHS Chief Financial Officer ensure that FEMA conducts testing and reporting of improper payments plus unknown payments of the Public Assistance Validate As You Go program in compliance with the Payment Integrity Information Act of 2019.

We recommend the DHS Chief Financial Officer ensure that DHS’ Risk Management and Assurance Division follows OMB requirements for programs that do not comply with the Payment Integrity Information Act of 2019, as stated in Appendix C of OMB Circular A-123.

Rec. 2: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness update DoD Directive 1344.10 to include a requirement for the Services and the National Guard Bureau to provide guidance and training on partisan and nonpartisan political activities to all Service members at least each presidential election year.

Finalize the improper payment alignment strategy for Old-Age, Survivors, and Disability Insurance computations overpayment deficiency dollars.

Update Handbook 4000.1 to require servicers to share information regarding foreclosure moratoriums with borrowers.

Review the two loans in our sample that did not receive appropriate servicing and take administrative actions if appropriate.

(U) Rec. A.1: The DoD OIG recommended that the Commander of the U.S. Army Sustainment Command revalidate the Care of Supplies in Storage requirements in Army Technical Manual 38-470 to determine whether the requirements are operationally realistic and cost effective for Army Prepositioned Stock and revise Army Technical Manual 38-470, as appropriate.

(U) Rec. A.2.a: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to take action to enforce or relieve the Army Prepositioned Stock-5 contractor of Care of Supplies in Storage requirements based on guidance from the Commander of the Army Sustainment Command's implementation of Recommendation A.1 to revalidate Army Technical Manual 38-470 requirements.

(U) Rec. A.2.b: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to coordinate with the Army Prepositioned Stock-5 Administrative Contracting Officer and Contracting Officer's Representatives to update surveillance procedures to require Contracting Officer's Representatives to conduct periodic checks of the Global Combat Support System-Army to provide reasonable assurance that all pieces of Army Prepositioned Stock-5 equipment have a correct maintenance service plan listed in the system.

(U) Rec. A.2.c: The DoD OIG recommended that the Executive Director for the Army Contracting Command-Rock Island direct the Procuring Contracting Officer for the Army Prepositioned Stock-5 contract to coordinate with the Army Prepositioned Stock-5 Administrative Contracting Officer and Contracting Officer's Representatives to develop and implement surveillance plans to include Contracting Officer's Representatives verifying that the Army Prepositioned Stock-5 contractor determined whether all required Basic Issue Items and Components of End Items are on hand for each piece of Army Prepositioned Stock-5 equipment being repaired before allowing the contractor to declare the equipment fully mission capable.

(U) Rec. A.3: The DoD OIG recommended that the Area Support Group-Kuwait Commander coordinate with the Executive Director of the Army Contracting Command-Rock Island to modify the Area Support Group-Kuwait Directorate of Public Works contract to ensure that all Army Prepositioned Stock-5 controlled humidity facilities are in compliance with Army Technical Manual 38-470, including managing the humidity settings to be within 30- to 50-percent relative humidity.

(U) Rec. B.2: The DoD OIG recommended that the Executive Director of the Army Contracting Command-Rock Island request the Defense Contract Audit Agency perform a review of the 50 invoices totaling $133,401,705.89 to verify whether contractor-reported direct and indirect costs were allowable, allocable, and reasonable.

We recommend that the Chief Financial Officer for the Department develop and implement procedures to ensure that thesampling populations of drawdowns are complete for the basis of calculating the improper payment and unknown paymentestimates.

We recommend that the Chief Financial Officer for the Department ensure changes made for the query design concerningthe use of three filters, are implemented in subsequent years for programs that are required to produce an improper paymentestimate.

We recommend that the Chief Financial Officer for the Department, for programs that require them, design and implementimproper payment and unknown payment sampling and estimation plans that are appropriate for the sampling of paymentsbased on accurate sampling populations and result in reliable estimates. The improper payment and unknown paymentsampling and estimation plans should also include language stating why sampling populations in Stage 1 may not matchsampling population in Stage 2 and explain the statistical impact on the estimates.

We recommend that the Chief Financial Officer for the Department implement its quality assurance checklist to ensure theproper details from the drawdown population are accurately included on the extrapolation sheet.

We recommend that the Chief Financial Officer for the Department, in conjunction with the acting Chief Financial Officer forFSA, develop sampling and estimation plans for the Pell and Direct Loan programs that will produce reliable estimates.Specifically, the plan should (a) produce appropriate and accurate confidence intervals around a statistically valid pointestimate; (b) consistent with 31 U.S.C. section 3352(c)(1)(A), produce an estimate that is otherwise appropriate using amethodology approved by the Director of OMB; or (c) consistent with OMB Circular A-123 Appendix C, Part II, B(2), include adetailed explanation as to why it is not possible to produce a statistically-valid point…

(U) Rec. 1.a: The DoD OIG recommended that the DoD Chief Information Officer develop, in coordination with the Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment, a DoD?wide Supply Chain Risk Management strategy as required by the National Institute of Standards and Technology guidance.