Open Recommendations

Determining and maintaining relevant documentation to support each SV/JV;

Use of specific and accurate SV/JV descriptions; and

Timely review and approval of SVs/JVs for accuracy and propriety. (modified repeat)

Complete the Trust Accounting Handbook to clearly reflect the assumptions used in the Trust Obligation and Liability Model and the Monthly Obligation and Liability Calculator, including establishing control activities; finalize materiality thresholds applied; update accounting transactions, and clearly identify periods when adjustments will be made regardless of materiality. (new)

Develop for a more standardized, secure, and automated method to estimate the Trust obligations and Trust Service Award Liability that ensures minimal human errors. As part of the ongoing CNCS’s transition to shared service, coordinate with the service provider to determine methods that would enhance the security and quality of the existing estimation models. (new)

Strengthen controls to ensure the Trust modeling is performed by trained personnel to:

Conduct detailed analysis and validation of data sources.

Review and ensure the reasonableness of assumptions used and document the rationale behind estimation assumptions.

Compare estimates with subsequent results to assess the reliability of the assumptions and data used to develop estimates.

Document and implement policies and procedures to include the following:

Establish a thorough and robust quality control process to ensure that the Trust Obligation and Liability Model (TOLM) and Monthly Obligation and Liability Calculator (Calculator) are reviewed by qualified CNCS personnel prior to relying on its outputs to record transactions. All errors identified for which management ultimately decided against making updates to the TOLM or Calculator should be documented along with an explanation as to how management arrived at the final decision;

Perform monthly reviews and reconciliations of the recorded new and outstanding obligations to ensure the accounting information is valid and proper;

Review obligation amounts to ensure amounts accurately reflect the status of the obligation;

Review obligations to verify that amounts, timeframe (i.e., grant dates are correctly reflected in the obligation);

Perform complete reconciliations of all outstanding obligations monthly, and ensure any discrepancies identified are promptly researched and resolved. (repeat)

Coordinate with the Office of the Chief Risk Officer (OCRO) to properly identify the National Service Trust Fund’s financial reporting risks and incorporate those risks into the OCRO’s annual testing of key controls. (modified repeat)

Develop a succession plan to ensure the required expertise is available in anticipation of planned employee turnover, particularly with respect to the complex trust calculations. CNCS needs to:

Train, mentor, and work to retain qualified employees;

Cross-train employees so that knowledge of the model will reside with multiple staff rather than with one person; and

Enforce the agency-wide information security program across the enterprise and improve performance monitoring to ensure controls are operating as intended at all facilities. (repeat)

Strengthen and refine the process for communicating CNCS facility-specific control deficiencies to CNCS facility personnel, and coordinate remediation of the control deficiencies. (repeat)

Strengthen and refine the process for holding system owners and information system security officers accountable for remediation of control deficiencies and ensuring that the appropriate security posture is maintained for CNCS information systems. (repeat)

Strengthen and refine the process for holding contractors accountable for remediation of control deficiencies in CNCS information systems. (repeat)

Implement all detailed recommendations in the FY 2019 FISMA Evaluation report. (repeat)

Develop, implement and document procedures to identify all CNCS grantees that are required to submit single audit reports with their due dates. (new)