Open Recommendations

Document and implement a process to validate that server policies and/or related automated scripts are configured and running as desired when introducing a new server to the NCUA information technology environment.

We recommend that the NPS develop and implement policies and procedures that provide guidance for appropriately estimating the cost of maintenance projects.

We recommend that the NPS include accurate estimates for all existing and future work orders based on the guidance developed under Recommendation 5.

The auditors recommend that Chief Information Officer require the Department and FSA to take immediate correctiveactions to implement enhanced monitoring procedures to allow for timely review of system authorization packages andappropriate authorization prior to submission into CSAM.

The auditors recommend that the Chief Information Officer require the Department to develop and implement an effectivequality control review process for its policies and procedures.

The auditors recommend that the Chief Information Officer require the Department and Federal Student Aid to takeimmediate corrective actions to remove users from the PIV exempt list.

The auditors recommend that the Chief Information Officer require the Department to take immediate corrective actions forestablishing quality control policies, procedures, and additional processes to ensure that user onboarding, elevated andnon-elevated user access forms are properly completed, tracked, and maintained for records.

The auditors recommend that the Chief Information Officer require that the Department and FSA to take immediatecorrective actions to ensure appropriate resources and funding are available and dedicated to complete implementation ofthe required EL1 and EL2 event logging maturities.

The auditors recommend that the Chief Information Officer require the Department to update Department PIA processes,quality control procedures, and monitoring controls to validate, track, and enforce the timely completion and review ofPIAs.

Develop clear guidance on running business reports out of Community Affairs Reporting and Events System, including the use of filters.

We recommend that the Kentucky Cabinet for Health and Family Services, Department for Medicaid Services file invoices for and collect from manufacturers rebates totaling $15,611,770 ($11,209,642 Federal share) for single-source and top-20 multiple-source physician-administered drugs and refund the Federal share of rebates collected.

We recommend that the Kentucky Cabinet for Health and Family Services, Department for Medicaid Services strengthen its internal controls to ensure that all eligible physician-administered drugs are invoiced for rebate.

We recommend that the Kentucky Cabinet for Health and Family Services, Department for Medicaid Services ensure that all physician-administered drugs eligible for rebates after our audit period are processed for rebates.

We recommend that the Kentucky Cabinet for Health and Family Services, Department for Medicaid Services work with CMS to determine whether the other claims for multiple-source physician-administered drugs, totaling $5,967,128 ($4,281,678 Federal share), were eligible for rebates and, if so, determine the rebates due and, upon receipt of the rebates, refund the Federal share of the rebates collected.

We recommend that Novitas Solutions, Inc., work with CMS to ensure that its final settlement of contract costs reflects a decrease in Medicare nonqualified costs of $84,291 for CYs 2016 through 2018.

Bureau for Asia coordinate with USAID/Regional Development Mission for Asia, USAID/Central Asia Regional, and USAID/Philippines, Pacific Islands, and Mongolia to review and revise each mission's procedures to incorporate guidance on integrating C-TIP during strategy, project, and activity design.

Bureau for Asia coordinate with USAID/Regional Development Mission for Asia, USAID/Central Asia Regional, and USAID/Philippines, Pacific Islands, and Mongolia to review and revise each mission's mission orders to incorporate guidance on designating C-TIP Coordinators, assigning responsibilities, and using C-TIP Coordinators. As part of this review, each mission should (1) designate C-TIP Coordinator(s) in its mission orders and (2) insert C-TIP Coordinator responsibilities into the position descriptions and annual work objectives for designated C-TIP Coordinators.

Bureau for Asia coordinate with USAID/Regional Development Mission for Asia, USAID/Central Asia Regional, and USAID/Philippines, Pacific Islands, and Mongolia to develop and implement an action plan to bring each mission's monitoring and enforcement practices for acquisition and assistance awards into compliance with trafficking in persons regulations, policies, and procedures.

We recommend that the Puerto Rico Department of Health develop written policies and procedures to use sources other than the Puerto Rico Demographic Registry to identify deceased enrollees.

We recommend that the Puerto Rico Department of Health identify capitation payments made after the audit period on behalf of deceased enrollees and refund to the Federal Government the Federal share of any unallowable payments.

We recommend that the Puerto Rico Department of Health refund $6,979,822 to the Federal Government.

We recommend that the Puerto Rico Department of Health establish a process with ASES to ensure ASES ceases making payments to MCOs on behalf of enrollees after their deaths are recorded in DOH's eligibility system and recoups unallowable payments made on behalf of deceased enrollees.

We recommend that the Puerto Rico Department of Health develop written policies and procedures to ensure that DOH staff periodically update, at least monthly, DOH's eligibility system with data on deaths recorded in the Puerto Rico Demographic Registry.

We recommend that the Puerto Rico Department of Health identify capitation payments made on behalf of enrollees with a date of death in the DMF before the month covered by the capitation payments, estimated as $885,123 in Federal Medicaid funds, and refund to the Federal Government the Federal share of any unallowable payment.

We recommend that the Substance Abuse and Mental Health Services Administration improve its policies and procedures for awarding CCBHC-E grants to ensure that clinics comply with Federal requirements by establishing required time frames to verify that clinics met certification eligibility requirements, and processes to verify whether clinics entered into agreements with DCOs to provide certain services.