Open Recommendations

We recommend that the Chief Financial Officer enhance existing policies to establish a formal grant accrual risk management framework to help ensure consistent standards across HUD with regard to the development, review, and execution of the grant accrual and validation.

We recommend that the Deputy Assistant Secretary for Operations of Community Planning and Development enhance CPDs existing Grant Accrual Standard Operating Procedures to strengthen governance within CPD and to effectively work within the framework established by the OCFO in recommendation 1A. The updated procedures should include increased ownership and oversight over the reviews, authorizations, approvals, and changes to the CPD grant accrual estimates and methodology.

The Railroad Retirement Board should initiate discussions with the Department of Treasury to pursue changes to Railroad Retirement Board's reporting requirements to provide for a different reporting structure for the assets held by NRRIT.

The Railroad Retirement Board’s Bureau of Fiscal Operations should implement a note disclosure checklist for quality assurance and review to better incorporate the annual federal financial requirements into RRB's quality assurance process to ensure its financial
reporting is complete and accurate

The Railroad Retirement Board’s Bureau of Fiscal Operations should Initiate discussions with the
Department of Treasury to determine the proper accounting treatment for unusual or Railroad Retirement Board specific transactions.

Perform an assessment of employee resources in the Office of Financial Management, Planning, and Evaluation, and other relevant financial process areas to ensure an appropriate complement of resources are in place to manage accounting and reporting matters as they arise and through their normal course of business.

Provide training and supervision for personnel on financial management matters that affect the financial statements, including adhering to accounting policies and procedures, as appropriate, performing key internal control functions in support of financial reporting.

Develop desktop manuals to assist personnel in meeting their assigned responsibilities.

Improve the risk assessment process at the financial statement assertion and process level to ensure that CPSC management is appropriately capturing significant changes in the control environment and subsequently responding to those risks.

Implement key monitoring controls over the financial reporting process and develop robust policies and procedures to increase oversight, review, and accountability of accounting events at the process level to ensure the successful implementation of an effective internal control environment.

Improve the communication process between offices within the CPSC to ensure relevant and necessary financial reporting information requirements are communicated timely to achieve financial reporting requirements.

Enhance design, policies, and procedures related to monitoring and oversight of internal controls related to journal entries.

Review the existing roles for both journal entries and the compensating control of journal entry log recordation, and update as appropriate to ensure segregation of duties.

Provide training on the importance of internal control and segregation of duties based on updated policies and procedures.

Document their understanding of the acquisition process and determination of the appropriate recognition date of PP&E in order to update and enhance policies and procedures to align with the requirements of the applicable financial reporting standards.

Design and implement processes and controls in accordance with those updated policies and procedures to ensure PP&E balances are completely and accurately recorded in the general ledger.

Establish recurring communication with the appropriate stakeholders to ensure necessary information is available for analysis.

Design and implement processes and controls for accountable property to ensure accountable property is completely and accurately tracked.

Formalize and document a policy over prepaid expenses, including consideration of compliance with Generally Accepted Accounting Principles.

Design a control to identify, analyze, and respond to risks related to the reporting of pre-paid expenses.

We recommend that HHS update its enterprise architecture system inventory and software/hardware asset inventories to include the information systems and components that are active on the HHS network. HHS should utilize the inventories to continuously monitor assets and identify and remediate vulnerabilities timely to better manage the risks to these assets.

We recommend that HHS complete implementation of a cybersecurity risk management strategy to assess and respond to identified risks within the agency and identified across OpDivs, watch for new risks, and monitor risks and confirm implementation. The strategy should define a standardized process to accept and monitor risks that cannot be adequately mitigated.

We recommend that HHS require OpDivs incorporate analyses of security impacts of significant changes prior to implementation to measure its impacts to the organizations' security and enterprise architecture and confirm implementation.

We recommend that HHS require OpDivs to implement an effective SCRM program that meets the defined standards across HHS and confirm implementation is consistent with established standard. This should include requiring OpDivs to assess vendors and submit said monitoring results to HHS to assist with tracking and monitoring components on the network.

We recommend that HHS require OpDivs to establish oversight of background investigations performed for employees and contractors with logical access across the agency and perform continuous monitoring for new and existing users to ensure OpDivs are aware of the investigation status of their users.