Open Recommendations

Direct Cornell to strengthen its policies, procedures, and internal control processes
for applying its indirect cost rates to ensure it applies appropriate indirect cost
rates, including rates established in NSF budgets, to only those direct costs that it
should include in its Modified Total Direct Cost base per its applicable Negotiated
Indirect Cost Rate Agreement(s).

Direct Cornell to implement additional procedures to ensure that it performs—and
appropriately documents its performance of—risk assessments in compliance with
federal requirements for pass-through entities and Cornell’s internal policies

Direct Cornell to develop additional resources for subawardees that provide
guidance on how to ensure they appropriately account for and invoice expenses on a
cost-reimbursement basis consistent with subaward terms and conditions.

Direct Cornell to implement additional policies or procedures to ensure that
subawardees complete and submit—and that Cornell reviews and maintains—any
progress, technical, or other reports that Cornell requires per the subaward terms
and conditions.

Direct Cornell to implement additional procedures and/or internal controls, as
necessary, to ensure it complies with its internal policies when overseeing costs
charged to NSF awards. The updated controls should ensure Cornell verifies that it
and its personnel:
Use the correct procurement method and collect and approve all necessary
documentation prior to payment.

Submit expense reports and claim per diem at the lodging location rate prior to
approving travel expenses for reimbursement.

Appropriately tag all equipment charged to NSF awards for inclusion in Cornell’s
biennial physical inventory account.

The Farm Credit Administration conduct a cost-benefit analysis that addresses whether to maintain the current Emergency Operations Center given the improvements needed, alternatives available that would address long-term needs, and potential opportunities with ongoing modernization efforts for information technology equipment.

The Office of Agency Services, in coordination with the Office of Information Technology, develop Emergency Operations Center policies and procedures, that include:
• criteria for approving personnel working at the site,
• evacuation and drills,
• physical security controls, and
• coordination with the Farm Credit System Building Association and applicable Farm Credit Administration offices.

The Office of Agency Services coordinate with the Farm Credit System Building Association to complete the following at the Emergency Operations Center: [redacted] and determine if the current practices are efficient, effective, and meet the Agency’s needs.

The Office of Agency Services review and update the Continuity of Operations Plan, including appendices, and file it in a centralized location that is accessible to applicable Farm Credit Administration personnel.

The Office of Agency Services and Office of Information Technology develop a cohesive testing, training, and exercise plan that incorporates the Emergency Operations Center and includes a revised activation checklist for the Emergency Operations Center.

We recommend that the NOAA Deputy Under Secretary for Operations and the Assistant
Administrator for Satellite and Information Services consider monitoring and reporting the progress of the GOES-17 test to the joint agency program management council.

We recommend that the NOAA Deputy Under Secretary for Operations and the Assistant Administrator for Satellite and Information Services consider elevating the risk of a continuity gap in geostationary satellite data to the NESDIS Enterprise Risk Board.

We recommend that the NOAA Deputy Under Secretary for Operations and NESDIS consider developing off-ramps and contingency plans for the GeoXO program to reduce risk.

We recommend that the NOAA Deputy Under Secretary for Operations and NESDIS consider distinguishing between mitigation and contingency plans in the risk management database for the GeoXO program.

We recommend that the NOAA Deputy Under Secretary for Operations and NESDIS consider adding specific fields for triggers in the risk management database for the GeoXO program.

We recommend that the NOAA Deputy Under Secretary for Operations and the Assistant Administrator for Satellite and Information Services consider evaluating alternatives to the current life extension option to manage the risk of a continuity gap in geostationary satellite data.

Review and update VHA Directive 1660.07, “Medical Sharing/Affiliate National Program Office,” to delegate all required program office responsibilities for the community-based outpatient clinic contracts throughout the program’s life cycle to an appropriate headquarters-level office or collaboration of offices, as defined in VHA Directive 1217, “VHA Operating Units” and VA’s Acquisition Lifecycle Framework.

Develop and implement procedures for a headquarters-level office to monitor overall compliance with contract requirements and use the results to reassess program policies or contract requirements.

Develop a formal feedback process, such as a program life cycle review process, for contracting officers and contracting officer representatives, medical facilities, and contractors who work on community-based outpatient clinic contracts to provide lessons learned, issues encountered, and other feedback about establishing new clinics and the performance at the clinics.

Conduct an assessment of contractor compliance with all active community-based outpatient clinic contracts, then evaluate whether the community-based outpatient clinic contract performance metrics are measurable, reasonable, and attainable.

Coordinate with the Office of General Counsel to determine whether creating a separate contract line item from the operational costs for contracted community-based outpatient clinics to pay start-up costs, including construction costs, would assist in the administration of these contracts and increase competition among contractors; then update the community-based outpatient clinic performance work statement template to reflect any change made as a result of this consideration.

Assess how medical centers create and maintain the billable roster for community-based outpatient clinic contracts; based on the results, develop and implement efficient, accurate, and consistent procedures for developing and maintaining the billable rosters.

Coordinate with the VA medical centers that have VA-contracted community-based outpatient clinics to conduct a risk assessment to evaluate the responsibilities, time requirements, and qualifications of community-based outpatient clinic contracting officer representatives; then publish clear guidance or recommendations for facilities to make sure they have appropriately experienced, trained, and certified staff to oversee the performance of community-based outpatient clinic contracts.

Assess the certification levels of the CORs assigned to all CBOC contracts and make recommendations to the medical centers for assigning appropriately experienced CORs or to provide any additional training or assistance to existing CORs, if necessary.

Develop and implement procedures to require VA medical centers and contracting offices to verify that the Office of Information Technology can meet start-up requirements for new community-based outpatient clinic locations as part of the contract review process.