Open Recommendations

Rec. 3: The DoD OIG recommended that the Director of the Audit Division for the U.S. Special Operations Command Office of the Inspector General develop and implement controls to track each auditors continuing professional education compliance on a quarterly basis to help ensure that auditors complete sufficient continuing professional education hours in a 2-year reporting period.

Rec. 4: The DoD OIG recommended that the Director of the Audit Division for the U.S. Special Operations Command Office of the Inspector General develop a tool, such as an audit risk assessment template, to help ensure that the auditors assess audit risk in accordance with Generally Accepted Government Auditing Standard 8.05.

The Commissioner, Internal Revenue Service, should evaluate available options to prioritize the scanning of historical documents to realize cost savings and comply with Office of Management and Budget and National Archives and Records Administration mandates to convert all paper documents to digital format by December 2030.

(U) Rec. 1.a: Report is Classified.

(U) Rec. 1.b: Report is Classified.

(U) Rec. 2: Report is Classified.

The Commission conduct an information security risk assessment and develop and implement comprehensive written policies and procedures for all areas of the information security program.

The Commission develop and implement a quality review system to review and revise information security policies and procedures on an annual basis, in accordance with previously established Commission standards.

Identify how the remaining IIJA workforce training and development funds will be used and the goals and outcomes expected from their use.

Establish and implement a control to track the amount of S&E and Business Operations funds expended for IIJA Section 40803(c)(7).

We recommend that the Orphaned Wells Program Office establish milestones for the Osage Nation's execution of its performance goals in its development grants and ensure it has made progress in meeting those performance goals before awarding phase 3 funds.

We recommend that the Orphaned Wells Program Office establish milestones for the Osage Nation's execution of the implementation grants and ensure it has made progress in plugging orphaned wells before awarding phase 3 funds.

Apply population change factors, such as projected growth and trends of sorting and delivery center locations, as part of its Financial Rigor Tests for the investments.

Perform inspections and complete route adjustments where needed as part of the required annual process within the year prior to estimating the Financial Rigor Tests related to sorting and delivery center investments.

Require tracking, reconciling, and reporting of operating costs throughout the Sorting & Delivery Center project, with adjustments to investment calculations for significant changes; and delegate responsibility for the oversight of financial performance over routes related to the project.

Update the Facility Security Risk Management Program Internal Operating Procedure (IOP) to include.
• Additional guidance on how to implement the Interagency Security Committee’s (ISC) Standard’s Facility Security Level (FSL) criteria.
• A process for documenting the Chief, Physical Security’s approval of the FSL.
• A requirement for supporting documentation and justification for each assigned score, including source references or observed conditions that could impact certain criteria.
• A requirement for documented justifications for any deviations from the Design Basis Threat (DBT) baseline scores identified by ISC.
• A requirement that security incident data be reviewed, analyzed, and attached as…

Develop and implement policies and procedures for centrally obtaining, tracking, and analyzing security incident reports agency-wide.

Develop and implement standard operating procedures (SOPs) that instruct CORs on the invoice approval process, to include a requirement that CORs document their reconciliation of invoices with detailed timesheets before security guard contract invoices are paid.

Recover or otherwise resolve the $158,880.29 in questioned costs from security guard vendors as a result of insufficient documentation.

Provide training on the new documentation requirements to any COR responsible for security guard contracts.

Recover or otherwise resolve the $9,093.65 in questioned costs from the security guard vendor at the Truman Presidential Library related to unallowable supply and material charges.

Provide specific guidance to CORs responsible for security guard contracts or, as appropriate, issue a contract modification which further clarifies the allowable uses for the “Additional Services” Contract Line Item Numbers (CLINs), and processes required to use available funds for other purposes.

Develop and implement a plan for restricting user access for Large Institution Supervision Coordinating Committee and Large and Foreign Banking Organization users in OASIS consistent with the need-to-know requirement in Board policy and the Federal Reserve Administrative Manual and National Institute of Standards and Technology’s least privilege principle.

Define an access approach for the eventual transition of the Community Banking Organization and Regional Banking Organization portfolios into OASIS appropriate for the Community Banking Organization and Regional Banking Organization supervisory framework and based on users’ need to know.

Update existing OASIS guidance to clarify how examiners should use sensitive file folders, including expectations for the types of files that should be stored in the folders and who should have access to the folders.