Open Recommendations

Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media)

We recommend that USAID/Uganda verify that Ministry of Finance Planning and Economic Development corrects the sixteen instances of material noncompliance detailed on pages 51 to 54, 56 to 68, 71 to 78, and 79 to 82 of the audit report.

Correct the 189 errors, as appropriate.

Ensure a future systems modernization roadmap includes controls to improve payment and redetermination accuracy.

Require that employees use the Web Supplemental Security Income Overpayment Notices Program, when appropriate.

Clarify instructions on resolving diaries requiring manual notices to ensure employees send and document accurate overpayment notices.

Include controls in future debt management system modernization efforts to address system limitations causing overpayments to not be recovered via Cross-Program Recovery or transferred to another liable individual for recovery.

Pending automation improvements, remind employees of circumstances when a manual action is needed to initiate cross-program recovery or transfer a debt to another liable individual for recovery.

Complete efforts to lift the suspension for the External Collection Operation so overpayments that meet the criteria for the Treasury Offset Program may be referred for collection.

Create a diary or revise policies for existing overpayment diaries, as appropriate, that will alert employees to develop for an estate when a deceased recipient has an overpayment and there are no liable persons to whom it should transfer.

FHFA should develop and implement policies and procedures to oversee FHFA’s background reinvestigation process, including oversight controls over FHFA’s service provider.

FHFA should update the service level agreement between FHFA and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.

FHFA should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA and OPM standards.

FHFA-OIG's Chief Information Officer should develop and implement policies and procedures to oversee FHFA-OIG’s background reinvestigation process, including oversight controls over FHFA-OIG’s service provider.

FHFA-OIG's Chief Information Officer should update the service level agreement between FHFA-OIG and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.

FHFA-OIG's Chief Information Officer should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA-OIG and OPM standards.

FHFA-OIG's Chief Information Officer should establish and implement a process to make suitability adjudicative determinations and take suitability actions for covered positions in accordance with OPM’s regulation under Title 5 CFR, Part 731.103.

FHFA should disable accounts of nonprivileged users who have been inactive for over 365 days, as required by the FHFA customer controls for the cloud system.

FHFA should work with the cloud system’s vendor to implement software updates that automatically disable user accounts after 365 days of inactivity, as required by the FHFA customer controls for the cloud system.

FHFA should update the customer controls for the cloud system to include a procedure for regular reviews of non-privileged users’ access.

FHFA should complete the review and update of overdue SSPPs and Customer Control Plans in accordance with the existing related plans of action and milestones (POA&Ms).

FHFA should complete the review, update, and testing of the Capital Models (PolyPaths) ISCP in accordance with the existing related POA&M

Evaluate and document all accounting policies within the combined financial statements to ensure non-GAAP policies are identified and monitored at least annually for quantitative and qualitative impacts.

Evaluate and document the accounting implications of all unusual arrangements within the Federal Government, including alternative financing arrangements and regulatory assets and liabilities.

Enhance existing Southwestern processes to ensure that all substantially completed projects are transferred from CWIP to PP&E for financial reporting purposes.