Open Recommendations

We recommend that USAID's Deputy Administrator for Policy and Programming: Direct the Bureau for Latin America and the Caribbean to develop and implement an action plan to ensure missions' compliance with Automated Directives System Chapter 206 and 303 requirements for pre-award risk management procedures that includes steps to make sure (a) overseas leadership at posts designated as covered countries are aware of their responsibility to implement and document compliance with Automated Directives System Chapter 206, including the determination process (i.e., post advance review), and (b) all signed certification and assurance statements required by Automated Directives System Chapter 303 Section 3.8…

We recommend that USAID's Assistant Administrator for the Bureau for Management: Direct the Office of Acquisition and Assistance to incorporate reference to USAID's Risk Appetite Statement and enterprise risk management guidance, including the seven-step risk management process found in Automated Directives System 596, into the agency's pre-award risk management procedures in Automated Directives System Chapter 303.

1. We recommended that the Department's Senior Procurement Executive and Director of Acquisition Management conduct an acquisition management review to assess the FirstNet Authority acquisition functions and determine if adequate contract files exist to properly support decisions.

2. We recommended that the Department's Senior Procurement Executive and Director of Acquisition Management review the actions taken to execute the contract and task order modifications identified in this report and determine whether, under law, Federal Acquisition Regulation (FAR) and/or Department policy, actions should be taken to review, revoke, or revise the warrants used to execute the modifications.

3. We recommended that the Department's Senior Procurement Executive and Director of Acquisition Management determine whether, in order to comply with applicable federal and Department regulations, FirstNet Authority should be required to submit all future contract awards and modifications to the Department for review prior to award.

4. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to ensure the required justification and pricing analysis are conducted and documented for all contract modifications to ensure compliance with FAR section 43.1.

5. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to ensure compliance with FAR section 32.104 by determining if (1) AT&T will not be able to bill for the first delivery of products for a substantial time after work must begin (normally 6 months) and (2) the expenses for contract performance during the predelivery period will have a significant impact on AT&T's working capital when using contract financing.

6. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to ensure compliance with Commerce Acquisition Manual 1301.71 and obtain legal reviews from the Department's Contract Law Division for all contract modifications when the services are materially changing.

7. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to leverage the remediation options in the contract to hold AT&T accountable and take the necessary actions to address deficiencies when AT&T is either not on track to meet or not meeting contract terms.

8. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to revise FirstNet Authority's Acquisition Review Board Review Process and Procedures to define what is considered a "significant modification" and to ensure results of ARB meetings are documented in compliance with FAR section 4.803.

9. We recommended that the Assistant Secretary of Commerce for Communications and Information and NTIA Administrator direct FirstNet Authority's Chief Executive Officer to ensure the Chief Procurement Officer provides oversight to verfy that contract modifications are sufficiently supported, justified, in compliance with the FAR, and in the best interests of the government and first responders.

Update the Bank Secrecy Act scope tasks and questions within the Modern Examination and Risk Identification Tool to ensure examiners complete and document all necessary steps during Bank Secrecy Act examinations and direct examiners to use additional external guidance such as the National Supervision Policy Manual, Examiner’s Guide, and Federal Financial Institutions Examination Council BSA/AML Manual, as needed.

Meet with the Financial Crime Enforcement Network (FinCEN), no less often than annually, to discuss the operation of the Memorandum of Understanding and to identify any issues or adjustments that may be required. Document any revised agreements and update the agency’s policies to communicate the FinCEN reporting requirements and information needed from the regions and the Office of National Examinations and Supervision.

Develop and implement an efficient process that ensures the completeness, accuracy, timeliness, and validity of information obtained from the agency’s Modern Examination and Risk Identification Tool, such as establishing reports, to meet the agency’s Bank Secrecy Act reporting objectives, including communicating information in accordance with the Memorandum of Understanding and other agreement(s) with the Financial Crimes Enforcement Network.

Revise the content of the NCUA’s Enforcement Manual to include current policies, procedures, and responsibilities for the NCUA’s formal enforcement actions and ensure its content is consistent with other agency policies. Regularly review this guidance for continued relevance and effectiveness in achieving the agency’s objectives.

We recommend that OPM issue an improper payment estimate for the Federal Employees Health Benefits Program's that will allow them to be in compliance with the four PIIA requirements for future reporting years.

We recommend that Retirement Services develop and implement additional cost-effective corrective actions, aimed at the root causes of improper payments, to further reduce the improper payments rate.

Implement steps to prevent the inadvertent activation of circuit breakers at all VA data centers, such as updating the physical security controls policy to require protective covers and explicit warning labels.

Implement annual testing of Hines Information Technology Center contingency and restoration procedures following a power loss to ensure all stakeholders are aware of their responsibilities in accordance with revised information system contingency plan procedures.

(U) Rec. A.1: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer, in coordination with the Washington Headquarters Services Director, develop, resource, and implement a records management program that includes records management training for all personnel in accordance with Federal and DoD records management requirements.

(U) Rec. A.2: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Officer implement a formal after?action review process to determine the success and effectiveness of the Defense Digital Services' engagements.

(U) Rec. A.3: The DoD OIG recommended that the Washington Headquarters Services Director ensure that each head of a Washington Headquarters Services?serviced Component has established and resourced a records and information management program within their organization in accordance with DoD policies.

(U) Rec. B.1.a: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools are necessary to meet the mission requirements of the Defense Digital Service;

(U) Rec. B.1.b: The DoD OIG recommended that the Chief Digital and Artificial Intelligence Office Chief Information Officer and Authorizing Official, in coordination with the Defense Information Systems Agency Chief Information Officer, assess the hardware, software, cloud services, networks, and any other tools used by the Defense Digital Service since 2015 to determine whether the hardware, software, cloud services, and other tools are approved for use by the DoD.

(U) Rec. B.1.c: This recommendation is Controlled Unclassified Information