Open Recommendations

Provide clarification to state agency staff on their discretion to prioritize non- per- and polyfluoroalkyl substances over per- and polyfluoroalkyl substances projects, based on the most serious risk to human health.

Provide supplemental guidance to the EPA regions and the state revolving fund managers on processing transfers between the Drinking Water State Revolving Fund and Clean Water State Revolving Fund involving Infrastructure Investment and Jobs Act funds to address emerging contaminants.

Provide additional training on the supplemental guidance to EPA regional and state agency staff in a timely manner.

(U) Rec. 1: Report is Classified.

(U) Rec. 2: Report is Classified.

We recommend the FSA Chief Operating Officer— Assess FSA’s planned resourcing to ensure institutional compliance with Section 117 reporting requirements and make changes, as appropriate.

We recommend the FSA Chief Operating Officer— Develop and implement a monitoring plan, policies, and procedures, along with a related timeframe for doing so, that includes a risk-based framework and activities designed to assist with detecting inaccuracies, incomplete submissions, or instances of non-reporting and that motivates institutions to comply with the requirements of Section 117.

We recommend the FSA Chief Operating Officer— Require an annual certification, to cover the preceding year, from a high-level official at all institutions receiving Title IV funds certifying full compliance with Section 117 reporting requirements.

We recommend the FSA Chief Operating Officer— Include edit checks in the Department’s Section 117 reporting portal system or implement other data monitoring processes that would ensure: (1) institutions are properly classifying gifts and contracts as restricted based on answers to related questions, (2) all restricted gifts and contracts include required descriptions, and (3) potential duplicate entries are flagged for further review.

We recommend the FSA Chief Operating Officer— Ensure that the portal includes adequate descriptors of country names for those that may be confusing (e.g., North Korea).

We recommend the FSA Chief Operating Officer— Develop a more efficient process for preparing data for posting on the website.

Direct FAA to update its policies and procedures and implement corresponding controls and processes to align with the Department's new requirements for mobile device management identified in its Information Technology Implementation Memo (ITIM) 2023-009, and verify completion.

Direct FAA to develop and implement a process to identify and maintain an accurate mobile device inventory in accordance with National Institute for Standards and Technology (NIST) Special Publications 800-124, and verify completion.

Direct USMMA to update its policies and procedures and implement corresponding controls and processes to align with the Department's new requirements for mobile device management identified in its ITIM 2023-009, and verify completion.

Direct USMMA to develop and implement a process to conduct vulnerability assessments on its mobile device solution component and update the solution with the latest available patches/software updates to address specific vulnerabilities in accordance with NIST SP 800-124, and verify completion.

Direct FAA to update and enforce its process to identify and disconnect mobile and MIFI devices with zero usage (considering mission-critical exceptions) in accordance with Executive Order 13589, and verify completion. Completing this recommendation could put up to $422,838.60 to better use.

KPMG recommends that FAA management formally communicate to procurement system users' supervisors their responsibility to ensure that the system administrators are notified by the individual users or their supervisors when individuals separate from FAA.

KPMG recommends that FAA management provide procurement system administrators additional resources or tools, such as a reviewer checklist, to help facilitate adequate review of the procurement system New User ID Form and the annual procurement system User Recertification Request Forms prior to provisioning or recertifying user access to the procurement system, to include verifying that users are provisioned with the appropriate roles and approval thresholds.

KPMG recommends that FAA management design and implement a monitoring control to ensure procurement system administrators consistently verify that the procurement system new user and recertification forms were completed appropriately and signed by the authorized supervisor or COR for all active users prior to provisioning or recertifying user access to the procurement system.

KPMG recommends that FAA management implement measures to ensure the timely and accurate completion of the annual recertification of FAA employees with access to the service organization's payroll system, in accordance with the reporting timeline prescribed by DOT (e.g., identifying specific individuals to serve as backup control operators, modifying the annual recertification timeline, or adopting other effective measures).

KPMG recommends that FAA design and implement a procedure to identify and timely record contracting actions within the general ledger that were executed outside of the standard business process (i.e., CO authorizations documented outside of the procurement system).

KPMG recommends that FAA design and implement a procedure to periodically assess the risk associated with the final project allocations of costs incurred for project obligations with both capitalized and expensed costs, particularly when there has been a change in the scope of the project or there have been de-obligations of project funding. If management determines the risk related to the cost allocation is material, perform additional procedures to respond to the risk identified and determine if adjustments to project cost allocations are necessary.

KPMG recommends that FAA ensure that its detailed financial reporting procedures for identifying and disclosing intragovernmental lease payments are consistent with its existing SFFAS 54 accounting policy for intragovernmental leases.

KPMG recommends that FAA management enforce its existing grant monitoring control procedures, such as strengthen quarterly inactive obligation reviews and requiring regions to certify completion of their dashboard review periodically and consider prioritizing the review of potential inactive grants based on historical grantee disbursement activity.

KPMG recommends that FAA management design and implement a procedure to review Q4 IIJA grant expense activity, used in the additional IIJA accrual, for outliers in the data (e.g., journal vouchers or unusually large invoices).