Open Recommendations

Update the Facility Security Risk Management Program Internal Operating Procedure (IOP) to include.
• Additional guidance on how to implement the Interagency Security Committee’s (ISC) Standard’s Facility Security Level (FSL) criteria.
• A process for documenting the Chief, Physical Security’s approval of the FSL.
• A requirement for supporting documentation and justification for each assigned score, including source references or observed conditions that could impact certain criteria.
• A requirement for documented justifications for any deviations from the Design Basis Threat (DBT) baseline scores identified by ISC.
• A requirement that security incident data be reviewed, analyzed, and attached as…

Develop and implement policies and procedures for centrally obtaining, tracking, and analyzing security incident reports agency-wide.

Develop and implement standard operating procedures (SOPs) that instruct CORs on the invoice approval process, to include a requirement that CORs document their reconciliation of invoices with detailed timesheets before security guard contract invoices are paid.

Recover or otherwise resolve the $158,880.29 in questioned costs from security guard vendors as a result of insufficient documentation.

Provide training on the new documentation requirements to any COR responsible for security guard contracts.

Recover or otherwise resolve the $9,093.65 in questioned costs from the security guard vendor at the Truman Presidential Library related to unallowable supply and material charges.

Provide specific guidance to CORs responsible for security guard contracts or, as appropriate, issue a contract modification which further clarifies the allowable uses for the “Additional Services” Contract Line Item Numbers (CLINs), and processes required to use available funds for other purposes.

Develop and implement a plan for restricting user access for Large Institution Supervision Coordinating Committee and Large and Foreign Banking Organization users in OASIS consistent with the need-to-know requirement in Board policy and the Federal Reserve Administrative Manual and National Institute of Standards and Technology’s least privilege principle.

Define an access approach for the eventual transition of the Community Banking Organization and Regional Banking Organization portfolios into OASIS appropriate for the Community Banking Organization and Regional Banking Organization supervisory framework and based on users’ need to know.

Update existing OASIS guidance to clarify how examiners should use sensitive file folders, including expectations for the types of files that should be stored in the folders and who should have access to the folders.

Develop guidance that
a. defines the need-to-know principle and how it should be applied when granting user access to confidential supervisory information in OASIS.
b. describes the expectations for performing the Board’s annual access review process for OASIS, including designating responsibility for performing the attestation to individuals with knowledge of the user’s roles and responsibilities, such as the user’s supervisor or other possible alternatives.

The Assistant Director ensures staff maintain a consistently clean environment throughout the facility to prevent repeat environment of care findings.

Executive leaders review the change in laboratory scheduling practices and minimize its effect on clinic efficiency.

The Executive Director ensures staff consistently label reusable medical equipment to show it is clean and ready for use.

The Executive Director ensures staff consistently label reusable medical equipment to show it is clean and ready for use.

The Director ensures staff keep the environment clean and safe.

The Director ensures Healthcare Technology Management Service staff inspect, test, and properly document all medical equipment maintenance per their required schedule.

The Director ensures staff implement processes to prevent repeat environment of care findings identified in this report.

Facility leaders ensure service-level workflows include each staff members role in the communication of test results process.

Review the $22,504 in unsupported expenses for the contractual invoices and remedy any unallowable costs.

Ensure the Kentucky Small Business Development Center posts service hours including service center addresses on their website and have visible SBDC signage at service center locations in accordance with the terms and conditions of the award.

Ensure the Kentucky Small Business Development Center implements a process to ensure all personnel funded by federal grant funds are notified of their whistleblower protection rights in accordance with 41 U.S.C. §4712.

Review reported client counseling hours for fiscal year 2024 and correct any errors or discrepancies.

Reconcile capital infusion transaction submissions reported in the fourth quarter of fiscal year 2024 from the Kentucky Small Business Development Center’s performance data system with SBA’s data collection system to ensure capital infusion transactions are reported correctly.

We recommend the Vice President, Projects and Outages, develop a process for identifying and evaluating key assumptions of, and risks to, nonroutine projects prior to approval.