Open Recommendations

Treasury OIG should confirm if the transactions noted as unsupported expenditures within Aggregate Reporting less than $50,000 can be supported. If support is not provided, Treasury OIG should recoup the funds or request that Bergen County management provide support for replacement expenses, not previously charged, that were eligible during the CRF period of performance. Further, based on Bergen County's responsiveness to Treasury OIG's requests and its ability to provide sufficient documentation and/or replace unsupported transactions charged to the CRF with valid expenditures, we recommend Treasury OIG determine the feasibility of conducting an audit for the Aggregate Reporting less than $50,000…

The Commissioner, Large Business and International Division, should develop a process to **************************************************************************** *************************************************************************************************** *****************************************************.

Request that the contractor perform a self-audit of local VA claims.

Ensure that CIS establishes written policies and procedures related to tracking victim services and quarterly performance reporting, including a secondary review of the quarterly performance reports prior to submission, and distributes them to relevant personnel.

Require that CIS establish written policies and procedures to properly account for reimbursements by specific funding source.

Ensure that CIS develops and implements a formal process for allocating personnel costs of staff who work on multiple projects to the appropriate funding sources, including maintaining documentation to support the budgeted allocation percentages and reviewing after-the-fact time charged to the programs.

Coordinate with Arizona CJC to enhance its policies and procedures to ensure compliance with DOJ Grants Financial Guide subrecipient monitoring requirements, including that subrecipient financial information and subrecipient performance reports are adequately reviewed.

Coordinate with Arizona CJC to enhance its policies and procedures to ensure that Arizona CJC maintains documentation pertinent to subrecipient monitoring and develops a monitoring process to ensure subrecipients take action to address deficiencies found through audits and onsite reviews.

We recommend that USAID's Chief Information Officer develop and
implement procedures to document deviations from Agency policy on security control assessments, including acceptance of the risk of such deviations.

We recommend that USAID's Chief Information Officer implement accurate automated dashboards to provide enterprise-wide metrics to inform top management of its information technology risks.

We recommend that USAID's Chief Information Officer establish and implement a process to track the progress of conducting annual reviews and related lessons learned from the implementation of its Information Security Continuous Monitoring Strategy.

We recommend that USAID's Chief Information Officer update the
event logging checklist to include details of event logging level 3 (advanced) applicability and implement requirements as specified by Office of Management and Budget Memorandum M-21-31.

(U) Rec. A.1: Report is Classified.

(U) Rec. A.2: Report is Classified.

(U) Rec. A.4: Report is Classified.

(U) Rec. B.1: Report is Classified.

(U) Rec. B.2: Report is Classified.

(U) Rec. C.1: Report is Classified.

(U) Rec. 1.b: The DoD OIG recommended that the Assistant Secretary of the Navy (Research, Development, and Acquisition) direct PMA-231 to evaluate all unresolved operational test deficiencies, determine whether action was taken to correct the deficiencies, and if not, determine if the deficiencies should stay unresolved. If the deficiencies should be resolved, develop and implement a plan to correct the deficiencies that impact mission accomplishment. PMA-231 should request that the Operational Test and Evaluation Force, confirm the correction of deficiencies.

(U) Rec. 1: Report is Classified.

(U) Rec. 2: Report is Classified.

(U) Rec. 3: Report is Classified.

CMS should implement additional safeguards to ensure that remote patient monitoring is used and billed appropriately in Medicare.

CMS should require that remote patient monitoring be ordered and that information about the ordering provider be included on claims and encounter data for remote patient monitoring.

CMS should develop methods to identify what health data are being monitored.