Open Recommendations

Coordinate with MHMR to develop policies and procedures to ensure it retains indirect cost rate proposals and related supporting documentation, only includes allowable costs in the total direct costs base when applying its approved indirect cost rate to the grants, and is reporting its indirect costs information on FFRs submitted each quarter.

Coordinate with MHMR to ensure that the matching requirement is met.

Coordinate with MHMR to develop policies and procedures to ensure it maintains adequate records, including supporting documentation for its matching costs and it is reporting matching expenses on FFRs submitted each quarter.

Remedy $8,361 in unsupported contractor costs under Grant Number 15PJDP 22 GG 03809 DGCT.

Remedy $10,077 in unsupported other direct costs, including $7,009 under Grant Number 2020 DC BX 0110, $895 under Grant Number 2020 AR BX 0082, $364 under Grant Number 15PBJA 21 GG 03978 MENT, and $1,809 under Grant Number 15PJDP 22 GG 03809 DGCT.

Remedy $74,840 in unsupported matching costs under Grant Number 2020 DC BX 0110.

Remedy $116,254 in unallowable other direct costs, including $26,941 under Grant Number 2020 DC BX 0110, $79,726 under Grant Number 2020 AR BX 0082, $4,809 under Grant Number 15PBJA 21 GG 03978 MENT, and $4,778 under Grant Number 15PJDP 22 GG 03809 DGCT.

Remedy $39,712 in unallowable indirect costs, including $6,480 under Grant Number 2020 DC BX 0110, $24,802 under Grant Number 2020 AR BX 0082, and $8,430 under Grant Number 15PBJA 21 GG 03978 MENT.

Recover COVID-19 EIDL funds provided to the two ineligible borrowers.

Determine the allowability of the questioned ineligible amount of $194,233, on page 11 of the audit report and recover any amount that is unallowable

We recommend that GSA’s Chief Financial Officer and Chief Information Officer conduct a comprehensive assessment of GSA’s CIO-IT Security-19-97, IT Security Procedural Guide: Robotic Process Automation (RPA) Security, (RPA policy) to ensure, among other things, that its monitoring controls are effectively designed and implemented.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop oversight mechanisms to enforce compliance with the RPA policy and ensure that controls are operating effectively.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if they address bot and non-person entity access. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if the security controls need to be updated. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop a comprehensive process for removing bot custodian and bot developer access for decommissioned bots and GSA systems that: aligns with GSA’s CIO-IT Security-01-07, IT Security Procedural Guide: Access Control (AC) (access control policy); tracks and documents that access has been removed; and incorporates the process into the RPA policy.

Make ERM implementation a priority by providing the ERM team the resources it needs to ensure ERM reaches maturity no later than the planned date of FY 2028, in accordance with its current ERM Implementation Plan.

Ensure as SSA is working toward reaching maturity that the ERMC is providing leadership over the ERM program and that key Circular A-123 requirements are completed. For example, key requirements should include regular evaluation of SSA’s risk appetite and risk tolerance levels and ERMC communications in support of an Agency-wide risk culture.

Perform a risk-based allocation of resources based on system categorization.

Incorporate the system level risk assessment results into the organization-wide cybersecurity and privacy risk assessment.

Integrate the information security architecture with the development lifecycle.

Implement qualitative or quantitative measures to measure, report on, and monitor the information security and SCRM performance of organizationally defined products, systems, and services provided by external providers.

Implement qualitative or quantitative measures used to gauge the effectiveness of its component authenticity policies and procedures and ensures that data supporting the metrics is obtained accurately, consistently, and in a reproducible format.

Allocate resources in a risk-based manner.

Implement qualitative or quantitative measures on the effectiveness of the configuration management plan.

Ensure flaw remediation is centrally managed.