Open Recommendations

We recommend the FEC establish and implement a formal fraud risk assessment process aligned with OMB Circular A-123 and the GAO Green Book. The process should include identifying and assessing fraud risks, evaluating related control activities, assessing residual fraud risk, documenting results within the annual ICR, establishing formal governance and recurring assessment procedures, and providing fraud risk management training to responsible personnel.

We recommend the FEC establish and document an enterprise-wide policy governance framework that defines ownership, accountability, and requirements for periodic review and updating of directives, policies, and procedures, including mandatory review upon significant legal or regulatory changes.

We recommend the FEC update the identified directives, policies, and procedures to align with current statutes, regulations, OMB guidance, and National Archives and Records Administration approved records schedules.

We recommend the FEC integrate policy governance with internal control and ERM processes to ensure outdated or noncompliant policies are identified, tracked, and addressed as part of the Agency’s risk management and internal control monitoring activities.

We recommend the FEC establish and implement a formal, risk-based methodology for evaluating internal control deficiencies, including defined criteria for assessing magnitude, likelihood, and impact, and require consistent application of this methodology to assess deficiencies identified through the ICR process and determine their significance and impact on agency objectives.

We recommend the FEC redesign the ICR template to improve clarity, completeness, and usability by ensuring a logical linkage between control objectives, associated risks (including fraud risks), control activities, and the evaluation of control effectiveness. The revised template should also require documentation of identified control deficiencies and planned corrective actions to support consistent, risk-based internal control assessments in accordance with OMB Circular A-123 and GAO Green Book.

We recommend the FEC implement a quality assurance review process over ICR submissions to ensure documentation is sufficient, complete, and in compliance with OMB Circular A 123 and GAO Green Book requirements, prior to acceptance.

We recommend the FEC provide formal training and detailed guidance to assessable unit staff on how to properly document internal control assessment worksheets in accordance with OMB Circular A-123 and GAO Green Book requirements.

Revise policies and procedures to track and maintain supporting documentation to ensure expenditures are adequately supported prior to reporting financial information to ARC.

Work with ARC to resolve the questioned costs totaling $44,989 for unsupported ARC funded Contractual and Other cost.

Work with ARC to resolve the questioned costs totaling $15,000 for unsupported non-ARC matching Contractual cost.

Revise policies and procedures for financial reporting to ensure costs incurred under a federal award are tracked within the GL, regularly reconciled against previously reported amounts and the approved budget, and reviewed prior to submission.

Work with ARC to resolve the questioned costs of $3,857 for non-ARC Matching cost share.

Revise policies and procedures to ensure the timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

Develop formal subrecipient agreement procedures to ensure that all subrecipient agreements are reviewed for completeness and include all required elements in accordance with 2 CFR 200.332 prior to execution.

Develop standardized subrecipient agreement templates that incorporate all required Uniform Guidance data elements, including Federal award identification, required disclosures, access to records provisions, and subaward closeout requirements.

Remediate servers that are not compliant with configuration standards and ensure periodic compliance scanning of servers.

Remediate databases that are not compliant with configuration standards and ensure quarterly compliance and vulnerability scanning of databases.

Define intervals for review of database audit logs and vulnerability scan results and ensure regular collection and review of database audit logs in accordance with policy.

The Chief, Taxpayer Services, should review procedures and system programming specific to tax compliance to ensure that initial and continuous suitability reviews function as intended.

The Chief, Taxpayer Services, should Identify individuals with either an incomplete or ineligible citizenship
status and ensure that follow-up to verify their status has been completed.

The Chief, Taxpayer Services, should review programming specific to citizenship verification and consider
including this check in continuous suitability reviews.

The Chief, Taxpayer Services, should continue to identify and request that participants who are subject to fingerprinting requirements, and are not under continuous monitoring, submit their fingerprints and are enrolled in the FBI’s Rap Back Service.

The Chief, Taxpayer Services, should establish a systemic method of identifying IRS employees during initial and continuous suitability checks.

We recommend the Chief Information Officer (CIO): Develop and implement a process to create and maintain target and current cybersecurity profiles.