Open Recommendations

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Document access rights to systems to include roles, role descriptions and privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

KPMG recommended that FAA management design and Implement procedures to consistently and timely perform and document user account access reviews as required by standards for effective internal control systems and/or internal policies.

Enhance its sampling program to increase the frequency of inspector samples where needed (e.g., by implementing a risk-based approach).

We recommend that Edward W. Sparrow Hospital based on the results of this audit, exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation

We recommend that Edward W. Sparrow Hospital strengthen controls to ensure full compliance with Medicare requirements; specifically, ensure that all inpatient beneficiaries meet Medicare requirements for inpatient hospital services and evaluation and management services are supported in the medical records.

Resume processing undocumented aliens at the seven ports of entry currently redirecting them to other ports, or formally re-designate the ports to exclude undocumented aliens.

We recommend SSA identify all current disability beneficiaries with incorrect medical diary reason codes in the Disability Control File and take appropriate action to update/correct the errors so the matching process identifies all borrowers with medical improvement not expected status.

We recommend that Cahaba work with CMS to ensure that its final settlement of contract costs reflects an increase in Medicare pension cost of $593,158 for CYs 2014 through 2016.

We recommend that OPM work with the OCFO to establish internal procedures for properly reviewing and verifying the accuracy and completeness of the working capital schedules reported in the AAS by FFS and ER HMO carriers.

We recommend that OPM establish PBM transparency standards for all new, renewed, or amended contracts that are specific to community-rated HMOs.

We recommend that OPM develop formal policies to ensure that site visits are conducted every three years for FEHBP carriers in accordance with its control to meet OMB Circular A-123 requirements. If the time and costs to perform the site visits outweigh the benefits, OPM should modify its controls and report new procedures to mitigate risks for the FEHBP payment process.

We recommend that OPM eliminate the self-certification process for FEDVIP and implement an enrollment verification process that requires documentation to prove family member relationships at the time of enrollment. In the meantime, BENEFEDS, as the sole enrollment portal for FEDVIP, should have the authority to request eligibility documentation that includes marriage and birth certificates.

We recommend that OPM develop standard performance metrics with penalties to be included in all new or renewed contracts with FEDVIP carriers.

We recommend that RS implement internal controls to ensure that all staff responsible for processing disability cases, including but not limited to Medical Specialists, Paralegals, and Legal Administrative Specialists, take the required training to perform their job functions and that supporting documentation for completed training is maintained.

We recommend that RS establish a plan to complete the Medical Call-ups that are past the annual review period and stop any payments for which annuitants are no longer eligible.

We recommend that RS ensure that Medical Call-ups are conducted timely and that supporting documentation is maintained.

We recommend that RS investigate the cases due for Medical Call-ups in FY 2019 to determine if improper payments were made and immediately initiate any funds recovery, if applicable.

We recommend that Retirement Services continue to work with OPM's Office of the Chief Information Officer to establish a modernized Information Technology system that has capabilities to ensure the proper tracking of cases throughout the disability process.

We recommend that the Chief Information Officer require the Department to establish oversight controls to ensure that POA&Ms are assigned with the required criticality impact levels and remediation is conducted within the required timeframes.

We recommend that the Chief Information Officer require the Department to develop and implement a Department-wide ICT supply chain risk management strategy to include the supply chain risk tolerance, acceptable supply chain risk mitigation strategies, and foundational practices.

We recommend that the Chief Information Officer require the Department to develop a process to evaluate and routinely monitor supply chain risks associated with the development, acquisition, maintenance, and disposal of systems and products.

We recommend that the Chief Information Officer require the Department to establish and automate procedures to ensure all Department-wide IT inventories are accurate, complete, and periodically tested for accuracy. Include steps to establish that all IT contracts are reviewed and verified for applicable privacy, security, and access provisions.