Open Recommendations

Treasury OIG should confirm the transactions noted as unsupported or ineligible expenditures within Contracts greater than or equal to $50,000, Aggregate Reporting less that $50,000, and Aggregate Payments to Individuals are recouped or reallocated to other eligible uses by Bucks County in conformity with Treasury's Guidance. Based on Bucks County's responsiveness to Treasury's OIG's requests and its ability to provide sufficient documentation, we recommend Treasury OIG determine the feasibility of conducting an audit for Contract greater than or equal to $50,000, Aggregate Reporting less than $50,000, and Aggregate Payments to individuals. Castro also identified other matters throughout the course of…

Add the 915,534 records to the DMF

Develop a plan to add the remaining records to the Death Master File (for example, add the records 117 years after the Numident date of birth).

Review the 84 current payment status cases and take appropriate action (for example, terminate improper payments)

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to identify all instances where two different individuals’ Numident records are cross-referred and uncross-refer the records.

Review all cases where the Numident records of beneficiaries in current payment status are cross-referred to deceased individuals’ Numident records and take action to correct the records.

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to review the 2.4 million non-current payment status beneficiaries whose cross-referred Numident records contain death information, and input death information on their cross-referred record, as appropriate.

Implement controls to prevent similar errors from occurring in the future.

The VA Houston Health Care System Director ensures that staff document offering VA-issued devices for participation in virtual mental health appointments in patients electronic health records.

The VA Houston Health Care System Director conducts a review of providers lethal means safety assessment and planning with the patient, identifies barriers to effective lethal means safety discussions, and takes action as warranted.

The VA Houston Health Care System Director reviews staffs compliance with high-risk flag patient care requirements, to include updating and reviewing safety plans, following up on failed contacts, and completing suicide risk assessments.

We recommend that the Chief Operating Officer of FSA ensure that budget requests and lifecycle cost estimates forSABER-related projects are submitted and approved according to FSA’s Management Review 1 SOP and FSA’s otherestablished policies and procedures, and that they are properly maintained.

We recommend that the Chief Operating Officer of FSA ensure that FSA Acquisition officials follow the Department’sContract Monitoring Directive, specifically pertaining to COR Appointment Memorandums, deliverable monitoring, contractpayment records, contract monitoring plans, and QASPs for the FTI SABER system contracts we reviewed.

We recommend that the Chief Operating Officer of FSA ensure that all future SABER-related contract deliverables,including the FTI Infrastructure deliverables, are clearly defined in the contracts, related modifications, or as anattachment to contracts and related modifications to ensure proper tracking, monitoring, and contractor performance.

We recommend that the Chief Operating Officer of FSA clearly define who is responsible for supervising each part of theCOR’s performance for SABER-awarded contracts and hold the contracting officers accountable for the overall monitoringof the contracts awarded by FSA, including the FTI Module, FTI SAIG, and FTI Infrastructure contracts.

We recommend that the Chief Operating Officer of FSA require that the data fields that FSA defines as primary in theSABER risk registers be completed as appropriate, and data fields in decision logs be completed.

We recommend that the Chief Operating Officer of FSA fix the technical issues to reduce data loss in SABER riskregisters and other risk registers.

Review the installed applications on all issued laptops to ensure no unauthorized software is present.

Review the FMC "user" setting population to ensure each "user" is properly configured in compliance with FMC's approved GPOs.

Review Active Directory settings to ensure unauthorized software cannot be installed, including the Print Driver settings.

Regular software audits should be scheduled on all issued laptops to ensure compliance with FMC approved software policy.

Security Awareness training should be provided annually to all FMC users on the risks of downloading software.

Security Awareness training should be provided to all network administrators on the importance of secure configuration management on user devices.

Perform the procedures and associated controls identified in the SCRM SOP. The SOP lists fourteen procedures to perform.

During its annual review for changes to Commission Order (CO)-112, Acquisitions, include verbiage that all IT acquisitions should follow the SCRM SOP by reference.