Open Recommendations

Implement all detailed recommendations in the FY 2019 FISMA Evaluation report. (repeat)

Develop, implement and document procedures to identify all CNCS grantees that are required to submit single audit reports with their due dates. (new)

Develop, implement and document procedures on timely follow-up for those grantees whose audits have become past due, and to ascertain why report submission was late, when the audit report will be submitted to the Federal Audit Clearinghouse, and what corrective action has been taken to prevent a report submission delay in future. (new)

Develop a practice to capture the single audit data to assess the effectiveness of the single audit report submission for all its grantees. (new)

Develop, implement and document procedures for implementing Office of Budget and Management (OMB) approved single audit report submission extensions, so that OMB approved extension approvals are documented and tracked as part of the single audit monitoring process. (new)

Update the Single Audit Resolution Policy to: Reflect the current monitoring process to track all audit findings related to CNCS-funded grants, and   Address CNCS’s responsibilities as the cognizant/oversight agency and how these responsibilities would be carried out. (new)

Develop and implement procedures to monitor the effectiveness of the single audit monitoring process in accordance with the Uniform Grant Guidance, 2 Code of Federal Regulation §200.513 Responsibilities, (a) (3) (iv), related to monitoring the effectiveness of single audit findings follow-up and the effectiveness of single audits in improving grantee accountability and in their use by CNCS in making award decisions. (new)

Consider changes in conditions or programs that require further research and analysis. Update the assumptions when necessary.

Ensure obligations are sufficiently supported (i.e., by documentary evidence); and

Implement a peer review process to carry out the necessary quality control reviews of the Trust Obligation and Liability Model and the Monthly Obligation and Liability Calculator. (repeat)

We recommend that DHS Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO), the Office of the Chief Information Security Officer (OCISO), and Component IT and financial management, complete a comprehensive risk analysis and develop a mitigation plan to reduce risks related to ITGC and application control deficiencies.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Document access rights to systems to include roles, role descriptions and privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Establish a methodology to systematically track all configuration items that are migrated to production and be able to produce a complete and accurate listing of all configuration items for both internal and external audit purposes, which will in turn support closer monitoring and management of the configuration management process.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

Grant Thornton recommends that the Office of the Chief Information Officer (OCIO), in coordination with system owners, enforce and monitor the implementation of corrective actions to: Develop interface / data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.

We recommend that the Centers for Medicare & Medicaid Services: take action to ensure that all registered nurses’ supervisory visits of hospice aides are documented in accordance with applicable CMS regulations and interpretive guidelines.

We recommend that the Centers for Medicare & Medicaid Services: promote hospices’ compliance with the condition-of-participation standard that requires registered nurses to visit hospice beneficiaries’ homes at least once every 14 days to assess the quality of care and services provided by hospice aides, which could include: o working with State survey agencies and accreditation organizations to increase emphasis on oversight of this requirement, o educating hospices about the requirements associated with this standard, and o making this standard a quality measure.