Open Recommendations

Continue to provide training and collaborate with program office staff, as needed, to ensure the timely and complete reconciliation of the population of transactions used for estimating improper payments to the general ledger is performed.

Collaborate with the responsible staff involved in the payment integrity reporting process to ensure timely and complete reconciliations are performed on the populations subject to sampling for improper payment reviews.

Formally document and implement appropriate preventative and monitoring controls prior to approval of 7(a) loan guaranty purchases.

Exercise effective management review controls over the statistician’s work by verifying that the documentation of the sampling and estimation methodology plans comprehensively outlines the details of the implemented sampling and extrapolation methodology, while maintaining statistical validity.

Design and document adequate review procedures to ensure that the results of the sample meet the PIIA objectives.

We recommend that the Administration for Children and Families work with State agencies to ensure compliance with Federal requirements to report missing children episodes to law enforcement for entry into the NCIC database in a timely manner.

The Commissioner, Wage and Investment, should prioritize funding and implementation of automated processing of Forms 1040-X to increase efficiencies and reduce taxpayer burden.

Coordinate with the Information Technology organization to prevent generating transcripts for manual refunds less than $100 and adjust the frequency that some transcripts are generated to help management get through the inventory more efficiently.

Coordinate with the Information Technology organization to explore adding Taxpayer Relations inventories into the CII, so that all Accounts Management inventory is located in the same inventory management system.

Review the four $200,000 Indemnity Reviews identified for CY 2020 in California and Florida, and if adequate support is not provided, recover $1,082,604 in indemnity payments.

To strengthen HHS' enterprise-wide cybersecurity program, based on our reviews across the Department, we recommend that HHS continue to work with the OpDivs to implement automated CDM solutions to increase awareness and improve mitigation efforts across all of HHS.

To strengthen HHS' enterprise-wide cybersecurity program, based on our reviews across the Department, we recommend that HHS confirm that the OpDivs contingency plan testing is being performed within the timeframe required by HHS policy.

We recommend that the HHS OCIO work with the OpDivs to ensure that all OpDivs implement the capability to deny access to mobile devices, such as smartphones and tablets, from connecting to the network if the device's software is outdated.

We recommend that the HHS OCIO work with the OpDivs to ensure that all OpDivs complete its discovery of all information systems and maintain an up- to-date inventory of systems, software, and licenses.

We recommend that the HHS OCIO work with the OpDivs to ensure that all OpDivs complete its discovery of all information systems and maintain an up- to-date inventory of systems, software, and licenses.

We recommend that the HHS OCIO work with the OpDivs to ensure that all OpDiv's SCRM policies and procedures are being consistently implemented across the organization and ensure their execution.

We recommend that the HHS OCIO work with the OpDivs to ensure that all OpDivs finalize and implement draft policies and procedures to include the review of suppliers or contractors for risks to the organization's systems and system components.

We recommend that the HHS OCIO work with the OpDivs to ensure that all OpDivs implement the requirement to resolve high and critical vulnerabilities within 30 and 15 days respectively and create POA&Ms to monitor and resolve the weakness in a timely manner.

We recommend that the HHS OCIO work with the OpDivs to ensure that secure configuration settings are being maintained as defined by existing policy.

We recommend that the HHS OCIO work with the OpDivs to ensure that all operational systems have multifactor or an alternative strong authentication mechanism (PIV or an Identity Assurance Level (IAL)3/Authenticator Assurance Level (AAL) 3 credential) for both privileged and non-privileged users.

We recommend that the HHS OCIO work with the OpDivs to ensure that policies and procedures for identity and access management are being consistently implemented and proper safeguards (i.e., logging, monitoring, review of privileged user activity) are developed across the Department to ensure their execution.

Rec. 1.c: The DoD OIG recommended that the Secretary of the Army, as the DoD Executive Agent identified in DoD Directive 4705.01E, validate proper delegation of DoD Executive Agent responsibilities and create oversight and reporting mechanisms that verify the proper execution of DoD Executive Agent delegated tasks. At a minimum, the oversight and reporting mechanisms should include a requirement for the Army Deputy Chief of Staff for Logistics to annually produce a report on the performance of Executive Agent roles and responsibilities for delivery to the Secretary of the Army and the Assistant Secretary of Defense for Sustainment.

Rec. 2.a.1: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment review and update DoD Directive 4705.01E to update the Assistant Secretary of Defense for Sustainment's oversight responsibilities over the Executive Agent to include that the assessment of the Executive Agent's effectiveness required in Enclosure 2, paragraph 2c, be produced in writing.

Rec. 2.a.2: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment review and update DoD Directive 4705.01E to update the Assistant Secretary of Defense for Sustainment's oversight responsibilities over the Executive Agent to include written communication to the DoD Executive Agent and DoD Components when nonperformance of responsibilities is identified.

Rec. 2.b: The DoD OIG recommended that the Under Secretary of Defense for Acquisition and Sustainment review and update DoD Directive 4705.01E to correct the internal references in Enclosures 2 and 3.