Open Recommendations

Design and implement a control to mitigate the risk of inaccurate updates to property records after initial seizure.

Provide training and enforce accountability for adherence to policies and procedures

Design and implement controls over grant obligations for the lost wages assistance program to ensure compliance with the Presidential Memorandum.

Develop new policies, or improve and reinforce existing policies, procedures, and related internal controls, that:a. the underlying data to actuarially derived estimates is reviewed timely;b. information derived from the systems used in the operations of controls is determined to be complete and accurate;c. risks related to the methods, models, assumptions, and data elements are assessed each year to identify, plan, and respond to changes; andd. changes to the methods, models, assumptions, and data elements are sufficiently documented.

Design and implement controls to ensure compliance with the Presidential Memorandum

We recommend the DHS Under Secretary for the Office ofStrategy, Policy, and Plans establish an oversight mechanism to ensureDepartment components implement DHS Policy Directive 045-05 as required including:1. Providing annual domestic violence awareness training for lawenforcement officers and their supervisors;2. Orally advising all law enforcement officers, during quarterlyfirearms qualifications, of their duty to report when lawenforcement contacts them concerning engagement in domesticviolence; and3. Ensuring all law enforcement officers annually completeLautenberg Amendment certifications.

KPMG recommends that DOT management design and implementprocedures to consistently and timely perform and document user account accessreviews as required by standards for effective internal control systems and/orinternal policy.

We recommend that NARA Chief Financial Officer report the ADA violation in accordance with 31 U.S.C. Section 1351,1517(b) and OMB Circular A-11, Section 145.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Develop interface / data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Document access rights to systems to include roles, role descriptions and privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

We recommend that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

KPMG recommended that FAA management design and Implement procedures to consistently and timely perform and document user account access reviews as required by standards for effective internal control systems and/or internal policies.

Enhance its sampling program to increase the frequency of inspector samples where needed (e.g., by implementing a risk-based approach).

We recommend that Edward W. Sparrow Hospital based on the results of this audit, exercise reasonable diligence to identify, report, and return any overpayments in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation

We recommend that Edward W. Sparrow Hospital strengthen controls to ensure full compliance with Medicare requirements; specifically, ensure that all inpatient beneficiaries meet Medicare requirements for inpatient hospital services and evaluation and management services are supported in the medical records.

Resume processing undocumented aliens at the seven ports of entry currently redirecting them to other ports, or formally re-designate the ports to exclude undocumented aliens.

We recommend SSA identify all current disability beneficiaries with incorrect medical diary reason codes in the Disability Control File and take appropriate action to update/correct the errors so the matching process identifies all borrowers with medical improvement not expected status.

We recommend that Cahaba work with CMS to ensure that its final settlement of contract costs reflects an increase in Medicare pension cost of $593,158 for CYs 2014 through 2016.

We recommend that OPM work with the OCFO to establish internal procedures for properly reviewing and verifying the accuracy and completeness of the working capital schedules reported in the AAS by FFS and ER HMO carriers.