Open Recommendations

We recommend that BOR update the ratesetting standard operating procedures to reflect the current process for calculating the ratesetting schedules.

We recommend that BOR Develop standard operating procedures for all schedules used in the ratesetting process.

We recommend that BOR implement routine sampling of micropurchase transactions at the Central California, Northern California, and South-Central California Area Offices to ensure compliance with applicable laws, regulations, policies, and procedures.

We recommend that the PBS NCR Regional Commissioner take immediate actions to address the fire safety deficiencies at the GSA HQ building by: promptly ensuring that all fire doors are inspected, repaired, or replaced for proper functionality and compliance with safety standards and fire codes; strengthening oversight to ensure that the building’s operations and maintenance contractor is complying with contract requirements, including, but not limited to, fire safety requirements; expediting the corrective action for the fire safety deficiency identified during the Management Analysis and Review System review, dated January 6, 2023, by coordinating pre-fire planning activities with the local fire…

We recommend that the PBS NCR Regional Commissioner take immediate actions to improve management oversight of its facilities to reassess compliance with Architectural Barriers Act Accessibility Standards and Occupational Safety and Health Administration requirements at the GSA HQ building by: reviewing designated wheelchair-accessible restrooms to ensure individuals with disabilities have easy access and adjusting any restroom doors to fall within the acceptable range for accessibility; addressing the functionality and compliance of all elevators, ensuring that each elevator is equipped with an automatic verbal announcement feature; and, stabilizing the handrail for the wheelchair ramp at the entrance of the building.

FHFA’s Chief Information Officer should restrict user access to the folders and files on FHFA’s network in accordance with least privilege principle.

FHFA’s Chief Information Officer should ensure that personnel are trained on standard and privileged user FHFA authentication and identification policies.

FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure that multifactor authentication is required to access FHFA’s network. If there are no viable solutions, document any risk-based decisions, including compensating controls.

FHFA’s Chief Information Officer should use the secure access method recommended by FHFA’s cloud service provider to access the FHFA cloud environment.

FHFA’s Chief Information Officer should identify and implement a solution, in coordination with vendors, to ensure multifactor authentication is required for privileged users to access FHFA’s cloud environment. If there are no viable solutions, document any risk-based decisions, including compensating controls.

FHFA’s Chief Information Officer should identify and implement a solution to detect and monitor the transfer of large amounts of data moving across FHFA’s network.

FHFA’s Chief Information Officer should identify and implement a solution to detect and prevent controlled unclassified information or personally identifiable information from being transferred outside of FHFA’s network to personal accounts on email and cloud-based storage services.

FHFA’s Chief Information Officer should determine whether resources can be made available to implement a data loss prevention system to prevent the exfiltration of controlled unclassified information.

FHFA’s Chief Information Officer should reevaluate the former Acting Chief Information Officer’s risk acceptance related to portable software programs, and implement security controls to detect and prevent users from downloading and running unapproved software on FHFA’s system in accordance with National Institute of Standards and Technology and FHFA’s Rules of Behavior.

FHFA’s Chief Information Officer should monitor and respond to unauthorized software downloads in accordance with FHFA’s Common Control Plan.

FHFA’s Chief Information Officer should identify and secure the resources necessary to remediate identified internal critical, high, and medium exploitable vulnerabilities on the FHFA servers, workstations, and other devices in compliance with Cybersecurity and Infrastructure Security Agency Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022).

FHFA’s Chief Information Officer should develop a Plan of Action and Milestones to track the remediation of past due Cybersecurity and Infrastructure Security Agency Known Exploitable Vulnerabilities in accordance with Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022). FHFA’s Office of Technology and Information Management should implement compensating controls (i.e., isolating systems with un-remediated vulnerabilities) to mitigate the risk of the vulnerabilities.

FHFA’s Chief Information Officer should prioritize existing Office of Technology and Information Management resources based on the Plan of Action and Milestones to ensure that Cybersecurity and Infrastructure Security Agency Known Exploitable Vulnerabilities are remediated in accordance with Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 and FHFA’s Office of Technology and Information Management Vulnerability Management Process, Revision 2.7 (September 7, 2022).

FHFA’s Chief Information Officer should implement security controls to lock down USB ports so that only authorized USB devices are allowed.

We recommend that EAC require the DOS to implement procedures to ensure property purchased with federal funds is used, managed, and disposed of properly.

Require that the PLUS system for receiving, processing, and assigning applications tracks applications and captures application intake, screening, and status, including key dates; captures data on the type of underwriter used; includes a portal for receiving documents and communicating with lenders; and generates FHA loan numbers. This will allow HUD to identify, monitor, and address processing delays and issues on a continuous basis; evaluate its performance and processes; and manage future challenges.

Update policies and procedures to include methods that will be used when applications exceed underwriter capacity, align intake and screening processes, and explain when timeframes will be enforced, including in PLUS.

Issue an industry wide letter to reinforce how intake, screening, and enforcement of timeframes will be handled.

We recommend that the Centers for Medicare & Medicaid Services direct the MACs to recover from hospitals the portion of the $382,032 in identified overpayments for the sampled claims during our audit period that are within the 4-year reopening period in accordance with CMS's policies and procedures.

We recommend that the Centers for Medicare & Medicaid Services educate hospitals on correctly counting the hours of mechanical ventilation and submitting claims with correct procedure and diagnosis codes, which could have saved an estimated $79,354,175 for our audit period.