Open Recommendations

4. Control Weakness over Third-Party Oversight for XP2 Application Hosted by Fiserv (NCUA IT-20-04) We noted that in performing its risk assessment, management did not adequately evaluate the System and Organization Controls (SOC) 1 report over Fiserv’s XP2 application service provider environment. Specifically, management’s risk assessment did not:a. Identify and evaluate the NCUA’s design and operating effectiveness of the Complementary User Entity Controls (CUECs) identified within the SOC 1 report.b. Identify and evaluate the complementary subservice organization controls (CSOCs) identified within the SOC 1 report.c. Obtain and perform an assessment of a bridge/gap letter to determine whether coverage was provided…

The Under Secretary for Health ensures a review of policies related to the role and training requirements of chaperones for sensitive examinations and takes action as appropriate.

Determine the allowability of the questioned transactions and recover $5,130,999, if applicable.

Complete the Risk Assessment process as required by NIST 800-37, re-evaluate the Risk Management Framework to make in more fluent to leverage day-to-day processes in place for completing the risk assessment, and determine how to best implement an organization-wide governance process for monitoring and reporting on risks.

Document the process in place to monitor required flaw remediation to resolution and enhance the flaw remediation process to require approvals if risks cannot be mitigated to an acceptable level in a timely manner. In addition, develop timeframes and monitoring on the timeliness of applying patch updates.

Establish a formal process to capture and track data related to wildland fire activities to ensure completion of all preparedness activities and mitigation efforts.

Ensure oversight activities related to wildland fire management such as review and approval of the contractor's Wildland Fire and Health Plan, performance of formal assessments, and verification of mitigation efforts through operational awareness

We recommend the U.S. Border Patrol Chief and Office of Field Operations Executive Assistant Commissioner ensure the Canine Program has enough certified canine instructors and adequate training aids to provide proficiency training for canines after they are deployed. This should include:• implementing a process to ensure sufficient staff are available to provideall training needs to U.S. Border Patrol and the Office of Field Operationscanine teams; and• creating a systemic schedule and plan for pseudo and actual narcoticreplacement for every U.S. Border Patrol sector and Office of FieldOperations field office within the time recommended by the Laboratoriesand Scientific Services Directorate. (See…

We recommend the Executive Director of the Laboratories and Scientific Services Directorate conduct a study to determine the appropriate time for replacement of pseudo and actual narcotics to limit the constant expiration of these training aids. Pseudo and actual narcotic replacement cycles should be updated according to the results of the Laboratories and Scientific Services Directorate study.

We recommend the U.S. Border Patrol Associate Chief of Law Enforcement Operations and Office of Field Operations Director of Tactical Operations update the Canine Program policies to provide adequate oversight to ensure program needs are being met. The policies should include:• record retention timelines for all training documents to beconsistent with the CBP Records General Schedule or provideadequate documentation on retention policies after consultationwith record retention personnel to determine the appropriateapproach;• a systematic schedule and plan for pseudo and actual narcotictraining aids (see Recommendation 2.); and• development of standard operating policies, procedures, andquality assurance measures for use of the Canine…

Fiscal Service management perform a review of the current system environment against the Configuration Management Database (CMDB) to ensure that all information system components are inventoried.

Fiscal Service management perform a risk assessment over the subject matter and determine the appropriate personnel to be responsible for monitoring and updating the Configuration Management Database (CMDB).

Fiscal Service management update policy and procedures related to recommendations 5-1 and 5-2 and disseminate the documentation to enforce such policy and procedures.

Conduct experience study over for theSpouse age difference for seriatim andphase out liability for unlocatable missingparticipant assumptions.

We recommend the DHS Chief Procurement Officer improve its written procedures to ensure only those contracts awarded through other than full and open competition are included in the required report.

We recommend the DHS Chief Financial Officer, with advice from the Office of General Counsel, develop written procedures for generating the required report to sufficiently identify, review, and validate noncompetitive grant award information

OIG recommends that the Bureau of Administration update the Foreign Affairs Manual to require use of the internal controls developed in response to Recommendation 1 in this OIG report.

OIG recommends that the Bureau of Diplomatic Security, in coordination with the Bureau of Administration, (a) update any bureau-specific motor vehicle procedures in place to comply with the Foreign Affairs Manual and Bureau of Administration guidance within 90 days of final report issuance; and (b) establish a process to review and update these procedures, as appropriate, at least annually thereafter.

OIG recommends that the Bureau of Administration, in coordination with the Fleet Management Council, develop and implement a method to accurately record and verify vehicle identification numbers in the Integrated Logistics Management System.

OIG recommends that the Bureau of Administration, in coordination with the Fleet Management Council, develop and implement a methodology for posts to use when considering the disposal of an unarmored motor vehicle and codify the methodology in the Foreign Affairs Manual. The methodology should include a quantitative minimum for vehicle age, use, and maintenance costs. The methodology should also require posts to conduct and document a disposal analysis to ensure the vehicle meets the necessary criteria for disposal.

We recommend the DHS Chief Information Officer coordinate with CBP and USCIS to establish a process for reliable interchange of information between data systems used to process and track aliens in the PACR and HARP programs.

We recommend that the Louisiana Department of Health promptly provide notice and cancel the eligibility of beneficiaries identified with income over the allowable limit.

Invest in methods and technologies for removing defunct spacecraft. As part of this effort, conduct a study evaluating the technical merit and cost to investing in active debris removal systems and technologies.

We recommend that the California Department of Health Care Services ensure that the selected provider complies with Federal and State requirements for providing and claiming reimbursement for OTP services.

We recommend that the California Department of Health Care Services verify that the selected provider implements corrective action plans that were approved by the State agency.