Open Recommendations

Update the existing policy and implement adequate controls to ensure that the statement ofassurances provided by the program offices are adequately documented and reviewed forcompleteness and accuracy to provide a sufficient basis to support the Administrator’s statementof assurance.

Implement the defined processes for [REDACTED].

Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Document access rights to systems to include roles, role descriptions, privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Establish a mechanism to systematically track all configuration items that are migrated to production in order to produce a complete and accurate listing of all configuration items. Further, develop, document, implement, and enforce requirements and processes to periodically validate that all configuration items migrated to production are authorized and valid.

Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings, implement a process to periodically validate the settings are appropriate and ensure that proper baselines are scanned.

Develop interface / data transmission design documentation that specifies definition of responsibilities, as well as on-going system balancing requirements.

STB management should review the current version of the Office of Management and Budget (OMB) Circular A-136 to independently verify that all required footnotes are included and bring any omissions to the service providers attention so that errors or omissions can be corrected.

STB management should review the service providers Financial Statement and Notes Review Checklist to verify that the checklist is up to date and includes all required elements per OMB and Treasury guidance and then complete the checklist independently. Alternatively, STB management should develop and complete its own review checklist based on current Treasury and OMB reporting requirements.

STB management should request its financial management service provider to: Reevaluate the inclusion of account balances that were excluded in the Other Liabilities footnote, or Disaggregate (i.e., separately report) intragovernmental other liabilities balances reported as a single line item on the balance sheet that are not included in the footnote so that the total amounts reported for Other Liabilities on the Balance Sheet and in the footnote agree.

STB management should ensure that its review process includes procedures to disaggregate material balances reported in the financial statements and footnotes, agree balances to source documents, agree the footnotes to the principal financial statements, and verify the mathematical accuracy of all statements and schedules included in the financial statement package.

STB should perform routine reviews of employee benefit elections and Official Personnel Folders (OPFs) to ensure they are complete and accurate.

STB should address missing or unavailable supporting documentation with its shared service provider to ensure that document retrieval tools are available and are working properly to allow retrieval of all stored documents.

STB should obtain replacement documentation for employee forms and other documentation that has been determined to be incomplete or irretrievable from databases and other electronic sources.

KPMG recommends FAA design and implement procedures to consistently and timely perform and document user account access reviews as required by standards for effective internal control systems and/or internal policy.

KPMG recommends FAA design and implement procedures to consistently and timely notify account administrators of separations as required by internal policy.

We recommend that California Physicians' Service, Inc. refund to the Federal Government the $2,033,039 of estimated net overpayments.

We recommend that California Physicians' Service, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that California Physicians' Service, Inc. examine its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.

Ensure that TRLA’s Employee Handbook is updated to reflect the current policies described in the Collective Bargaining Agreement.

CMS should use data to identify nursing homes or nursing home characteristics that are associated with a higher use of psychotropic drugs and focus oversight on nursing homes in which trends may signal inappropriate use.