Open Recommendations

Include contract flexibility on future SLS acquisitions that will allow NASA to pivot to other commercial alternatives.

For each Artemis SLS rocket under EPOC, add compensation to the DST contract such as incentive fees for when the contractor achieves specific cost saving goals.

Ensure Government Mandatory Inspection Points and government oversight teams remain throughout the EPOC transition period.

We recommend that CMS conduct an analysis of its hospital transfer payment policy for discharges to PAC and expand the policy as necessary.

We recommend that the Manager, BHSO:1. Direct BNL to ensure its property management policies and procedures are consistent with 41 CFR 109 requirements.

We recommend that the Manager, BHSO:2. Review and assess the adequacy and effectiveness of BNL’s property management program.

We recommend that the Acting Director, Office of Asset Management:3. Review and update the Guide to ensure it is consistent with the provisions of 41 CFR 109.

Direct BNL to ensure its property management policies and procedures are consistent with 41 CFR 109 requirements

Review and assess the adequacy and effectiveness of BNL’s property management program

Review and update the Guide to ensure it is consistent with the provisions of 41 CFR 109

Revises the Order to clearly define all oversight roles and responsibilities in the ECP;

Revises the Order to clearly define all oversight roles and responsibilities in the ECP;

We recommend that the Manager, ORNL Site Office, direct the Contracting Officer to:3. Determine the allowability of costs questioned in this report, as summarized in Appendix 2, and recover any amounts deemed unallowable.

We recommend that the Manager, ORNL Site Office, direct the Contracting Officer to:4. Ensure that actions related to real estate are approved by appropriate Department personnel.

Determine the allowability of costs questioned in this report, as summarized in Appendix 2, and recover any amounts deemed unallowable.

We recommend that Aetna, Inc. refund to the Federal Government the $632,070 of overpayments.

We recommend that Aetna, Inc. determine, for the remaining 159 enrollee-years in the potentially mis-keyed diagnosis code high-risk group not reviewed as part of this audit, whether the medical records in each case support the diagnosis for the unrelated condition and refund any resulting overpayments to the Federal Government.

We recommend that Aetna, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that Aetna, Inc. continue to examine its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.

The DFC Chief Information Officer must prioritize efforts to enhance DFC's existing vulnerability management process to ensure sufficient identification, prioritization, and remediation of critical and high vulnerabilities in a timely manner in accordance with DFC's policy.

The DFC Chief Information Officer must implement the necessary oversight to monitor Cybersecurity Security Assessment and Management(CSAM) to ensure that SSPs are reviewed and authorized in accordance with the timeliness requirements in DFC's policy.

Prioritize the definition and incorporation of a cybersecurity risk tolerance into the agency's cybersecurity policies, procedures, and processes, as appropriate.

Ensure all required attributes are consistently documented within the agency's cybersecurity risk register.

Document and implement a process to consistently inventory the Board's web applications, including its public-facing websites.

Document and implement a process to consistently inventory and prioritize the Board's third-party systems, including the identification of subcontractors.