Open Recommendations

Take appropriate action to pursue potential revenue opportunities for the 155 non-moving inventory items, valued at nearly $304,000, in funds be put to better use, identified in this audit.

Take appropriate action to remedy the $39,000 overstatement in the inventory management system for the 44 inventory items identified in this audit.

Verify that Family Health International 360 corrects the instance of material noncompliance detailed on page 21 of the audit report.

FHFA’s Chief Information Officer should establish and implement guidance for performing National Institute of Standards and Technology Cybersecurity Framework 2.0 activities through policies and procedures.

FHFA’s Chief Information Officer should ensure that Privileged Account Request eWorkflows are fully completed and approved for all privileged FHFA General Support System user accounts prior to granting access.

FHFA’s Chief Information Officer should ensure all applicable Organizational Units are included in the automated process that disables inactive accounts after 35 days.

FHFA’s Chief Information Officer should disable inactive Active Directory accounts after a period of 35 days of inactivity.

FHFA’s Chief Information Officer should create a Plan of Action and Milestones to establish when the annual Disaster Recovery Procedures for FHFA Production Systems exercise will be conducted and when the new system owners will be assigned and trained on their roles and responsibilities related to FHFA General Support System, Office of General Counsel Matter Management Tracking System, and the FHFA Status Tracking and Reporting system.

FHFA’s Chief Information Officer should schedule and conduct an annual Disaster Recovery Procedures for FHFA Production Systems exercise for the FHFA General Support System, Office of General Counsel Matter Management Tracking System, and the FHFA Status Tracking and Reporting system, and ensure new system owners are trained to execute them.

Establish policies and procedures for administrative and financial management including determining the allowability and allocability of costs, record retention, procurement, internal control, tracking of costs by approved budget categories, reconciliation of costs to financial reports, and timely submission of performance progress and financial reports in accordance with the Uniform Guidance and grant agreement.

Work with ARC to resolve the questioned cost totaling $456,942 for ARC funded costs.

Work with ARC to resolve the questioned cost totaling $75,000 for non-ARC matching cost share.

Revise and resubmit the SF-270 and the related reimbursement table to reflect the accurate budget category of Contractual cost instead of Personnel.

Work with ARC to resolve the questioned cost totaling $1,167 for non-ARC Matching cost share

We recommend that the Grantee develop and implement formal written policies and procedures surrounding the management of Federal awards, in accordance with the Uniform Guidance.

We recommend that the Grantee work with ARC, to resolve the $45,000 of questioned costs.

We recommend that the Grantee work with ARC, to resolve the $35,000 of questioned costs.

We recommend that the Grantee work with ARC to resolve $12,775 of unallowed pre-award cost following the resolution of Recommendation 3 as the funds are included as part of the $35,000 questioned in Finding 2025-002.

The OIG recommends that the DNFSB update the agency’s DFW Plan to reflect current practices.

The OIG recommends that the DNFSB create supporting implementation guidance with emphasis on staff roles and responsibilities.

The OIG recommends that the DNFSB engage the testing contractor to improve communications with program staff and supervisors regarding random test site selections.

Update its policy to include monitoring Federal Protective Service’s physical security inspections of Agency offices.

Regularly reconcile its list of offices to the Agency's official list of offices to ensure all applicable offices are periodically inspected.

Work with office management to properly resolve the 101 security findings that were improperly remediated.

Revise policy to require that managers document corrective actions.