Open Recommendations

EXIM's Office of External Engagement should identify and implement due diligence activities, as needed, to mitigate the potential risks based upon its risk profile, such as determining when character, reputational, and transaction integrity (CRTI) reviews or other ethical, legal, law enforcement, Office of Inspector General, or non-public source reviews are needed.

Define in policy
a. the process that examiners should use to request access to files in the Supervision Examination System.
b. the criteria that managers and regional analysts should use to assess whether a need to know exists in accordance with the least privilege principle.
c. the requirement that regional analysts document an examiner’s need to know before granting access to supervision files in the Supervision Examination System.
d. consequences for accessing confidential supervisory information without a need to know or providing access to confidential supervisory information when a need to know does not exist.

Update the document handling directive to require supervision staff to share files by emailing Supervision Examination System links.

Develop and require training for CFPB staff involved in the examination process for the policy and guidance resulting from recommendations 1 and 2.

Update the guidance for prioritizing and scheduling examinations to reflect the current link sharing practice and to limit access to the supporting analysis to those with a need to know.

Update the guidance for managing breaches of confidential supervisory information to include expectations for
a. assessing and documenting the level of harm associated with a breach.
b. counseling, training, or taking other measures to hold CFPB staff responsible for breaches accountable, as appropriate, and documenting such actions.
c. analyzing the causes of breaches to identify trends and implement appropriate control adjustments, as necessary.

Develop required training on the updated guidance after it is implemented.

Update the CFPB’s confidential information breach response directive to
a. provide guidance for assessing the risk to institutions affected by breaches of confidential supervisory information and notifying those institutions.
b. define the roles and responsibilities for those involved in the process.

Rec. 1.a: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness revise and reissue policy requiring the Military Departments to follow a uniform process to identify, notify, and report child abuse allegations to parents or legal guardians across all DoD-sanctioned activities, including child development centers.

Rec. 1.b: The DoD OIG recommended that the Under Secretary of Defense for Personnel and Readiness revise and reissue policy requiring the Military Departments to follow a uniform process to maintain parental or legal guardian notification documentation for child abuse allegations across all DoD-sanctioned activities, including child development centers.

Rec. 2.a: The DoD OIG recommended that, when the revised DoD policy is issued, the Chief, Army Child and Youth Services revise and reissue policy to align with the requirements established in the updated DoD policy in Recommendation 1 requiring uniform parental or legal guardian notifications of child abuse allegations.

Rec. 2.b: The DoD OIG recommended that, when the revised DoD policy is issued, the Deputy Chief of Naval Operations revise and reissue policy to align with the requirements established in the updated DoD policy in Recommendation 1 requiring uniform parental or legal guardian notifications of child abuse allegations.

Rec. 2.c: The DoD OIG recommended that, when the revised DoD policy is issued, the Director, Marine and Family Programs revise and reissue policy to align with the requirements established in the updated DoD policy in Recommendation 1 requiring uniform parental or legal guardian notifications of child abuse allegations.

Rec. 2.d: The DoD OIG recommended that, when the revised DoD policy is issued, the Director, Air Force Policy and Resources revise and reissue policy to align with the requirements established in the updated DoD policy in Recommendation 1 requiring uniform parental or legal guardian notifications of child abuse allegations.

Embassy Muscat should bring its public diplomacy grants into compliance with Department standards.

Embassy Muscat should bring the Consular Section's workload management into compliance with Department standards.

Embassy Muscat, in coordination with the Bureau of Overseas Buildings Operations and Bureau of Consular Affairs, should bring the Consular Section's physical space into compliance with Department standards.

Embassy Muscat should complete audits of controlled consular supplies in accordance with Department standards.

Embassy Muscat should reply to congressional correspondence in accordance with Department standards.

Embassy Muscat should comply with all Department Motor Vehicle Safety Management Program standards for incidental drivers under chief of mission authority.

Embassy Muscat should bring its contracting officer's representative program into compliance with Department standards.

Embassy Muscat should enforce the requirement for vendors to register in the System for Award Management.

Embassy Muscat should close out procurement files in accordance with Department standards.

Embassy Muscat should manage its property in accordance with Department standards.

Embassy Muscat should bring its safety, health, and environmental management program into compliance with Department standards.