Open Recommendations

USAID/Bosnia and Herzegovina's agreement officer determine the allowability of $272, 885 in questioned costs ($241 ineligible and $272,644 unsupported) on pages 10 and 14 of the audit report and recover any amount that is unallowable.

We recommend that OPM perform a gap analysis to identify the monitoring, inventory, and management tools that it needs to implement automated infrastructure management as required by the DCOI and OMB.

We recommend that OPM install automated power metering in all of its data centers in accordance with the requirements in the DCOI.

We recommend that OPM assess the current state of its infrastructure to accurately report data center metrics, including the correct number of data centers (including non-tiered spaces), the correct operational status of data centers, and accurate energy usage.

Perform a review of all Plans of Action and Milestone (POA&M) items closed during the audit period to include supporting documentation and re-approve their closure.

Revise current security weakness management policies and procedures (documenting within a revision history table) to require documented evidence such as calendar appointments, meeting minutes, etc. in support of POA&M closure decisions to be uploaded into CSAM.

Work with the OA CIOs to review current assessment and authorization processes and implement a validation process to ensure updated security plans, ATOs and risk assessments are reviewed and updated to reflect all system (including privacy) controls, vulnerabilities, and that current risks are clearly presented to the authorizing officials.

Work with the OA CIOs to develop mechanisms to ensure updated system security plans and assessments of security controls (that were previously assessed as not satisfied or partially satisfied) reflect current operational environments, including an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated.

Document OA subnets and OA responsibilities for devices and systems operating on the Common Operating Environment.

Document and implement network segmentation to reduce the attack surface or susceptibility of vulnerable and sensitive OA assets in the Common Operating Environment.

Work with OAs to remediate outstanding identity and access management weaknesses through implementation and closure of POA&Ms and control assessments to determine whether these risks were addressed.

We recommend that the State agency ensure all MCOs implement edits to appropriately reduce or deny claims for other PPCs.

We recommend that the State agency work with the five MCOs to determine the portion of the $16,734,145 that was unallowable for claims containing PPCs and its impact on current- and future-year capitation payment rates.

We recommend that the State agency consider enforcing the provision in its contracts that allows liquidated damages to be imposed on the five MCOs due to their failure to process claims in accordance with Federal laws and regulations.

We recommend that the State agency require all its MCOs to implement policies and procedures to prohibit payments for inpatient hospital services related to treating PPCs for all provider payment methodologies.

We recommend that the State agency require all its MCOs to review all claims for inpatient hospital services that were paid after our audit period to determine whether any payments for services related to treating PPCs were unallowable and adjust future capitation payment rates for any unallowable payments identified.

We recommend that the State agency include specific measures in its contracts that would allow the State agency to recoup funds from all MCOs when contract provisions and Federal and State requirements are not met—a measure that, if incorporated, could result in cost savings for Medicaid.

We recommend that the State agency strengthen its monitoring of all its MCOs to ensure the MCOs comply with Federal and State requirements and its managed-care contracts relating to the nonpayment of PPCs.

Coordinate with the Office of the General Counsel to standardize the carrying of firearms by NASA civil servants in an Agency-wide policy while also addressing the appropriate situations when NASA contractors may carry their government-issued weapons off NASA property.

Require ADSEF to regularly perform checks against SSA national death information to ensure deceased individuals are not receiving benefits. Review cases identified through the audit and establish claims for overpayments, as appropriate.

(U) Rec. 3: The DoD OIG recommended that the Military Service Secretaries and the Marine Corps Commandant require the additive manufacturing leads to implement a process that compiles a complete list of all parts produced using additive manufacturing and parts waiting for approval to share within each Military Service and update the list as needed.

Determine the allowability of the questioned transactions and recover $1,005,222.00, if applicable.

Coordinate with the Corps to Further establish review controls where power accountants review individual projects at year end to ensure Construction in Progress projects are placed in service in a timely manner. Coordinate with the Corps to Establish review controls to ensure IDC is recorded only for eligible projects. Coordinate with the Corps to enhance existing procedures over review of power reports to ensure that all applicable revenue is included for each project. Coordinate with the Corps to Enhance existing procedures and related controls to ensure that items in the Construction in Progress accounts are placed in service in a…

Require that all suspicious orders reports be sent to DEA headquarters.