Open Recommendations

4. We recommend that the Deputy Secretary of Commerce ensure the program defines and executes schedule management controls in accordance with the Department's Acquisition Project Management Policy DAO-208-16 and GAO's Schedule Assessment Guide.

5. We recommend that the Deputy Secretary of Commerce direct the program to work with the contractor to ensure the Department receives the full value of monthly reports by including sufficient information for monitoring cost compared to budget and managing changes to schedule and cost baselines, thereby putting funds for those deliverables to better use.

6. We recommend that the Deputy Secretary of Commerce ensure the Department facilitates the collection of lessons learned from the NOAA financial applications' implementation and incorporates those lessons into plans and procedures for the NIST and Census implementations.

We recommend that the Office of the Chief Information Officer extend the capability of its data loss prevention solution to include rule-based analysis to detect and prevent the exfiltration of sensitive data from the subject system in accordance with industry best practices.

We recommend that the Office of the Chief Information Officer regularly test the Department's data loss prevention capability to ensure that sensitive data in the subject system is protected against data exfiltration attempts.

We recommend that the Office of the Chief Information Officer evaluate data communication protocols in use by the subject system that are vulnerable to exploitation and implement controls to mitigate identified vulnerabilities.

We recommend that the Office of the Chief Information Officer ensure the implementation and annual testing of contractually required data loss prevention controls on all cloud systems containing sensitive data.

We recommend that the Office of the Chief Information Officer establish controls to ensure that only FedRAMP-approved cloud-computing services are authorized to access the Department's network and that non?FedRAMP?approved cloud-computing services in use are discontinued and blocked from access to Department network resources in accordance with the Department's acceptable use policy.

We recommend that the Office of the Chief Information Officer ensure all existing non-Foundation Cloud Hosting Services contracts are migrated to an approved enterprisewide cloud-hosting procurement or modified to incorporate OCIO requirements and best practices for procuring cloud services, as recommended by the Chief Acquisition Officer and Chief Information Officer Councils and OCIO policy.

Conduct a review of the convalescence claims for hip and knee replacements and
resurfacing completed from February 7, 2021, through August 31, 2022, and take
appropriate actions to correct convalescence periods and ensure monetary benefits are
accurate.

BOP should reassess its policies to ensure that SHU round documentation is preserved for the possible use of such documentation as original evidence in criminal and administrative investigations and proceedings. As part of this reassessment, the BOP should, among other things, consider (1) adjusting its records retention schedule for SHU round forms; and (2) amending its policies to ensure that staff responding to crime scenes associated with inmate misconduct also collect evidence of potentially related staff misconduct, such as SHU round documentation, and account for the possible use of such evidence as original evidence in criminal and administrative investigations and…

BOP should modify its policies regarding SHU round forms, including BOP Program Statement 5500.14, Section 310, to refer employees to the document retention schedule for SHU round forms, or otherwise ensure that its employees across all institutions are aware of the retention schedule.

BOP should ensure that all Special Investigative Services Staff, Executive Management Staff, staff involved with evidence collection and preservation, and other relevant staff are trained/advised on how to preserve SHU logs and to recognize when they may be needed as original evidence in criminal or administrative investigations and proceedings, e.g., when there is an escape or death in custody and the original log may reflect who purportedly conducted round counts during the pertinent time period.

Revise procedures for reviewing and approving grant application packages to add steps to verify that the applications are complete and accurate.

Assess the CARES Act-funded airport development grants identified in this report that did not meet award requirements and recover the $27 million or identify the rationale for acceptance of these costs.

Strengthen internal controls to verify that all reimbursement requests comply with FAAs two-tier manual review process for CARES Act funds. This may include requiring Delphi controls are correctly established and maintained.

Assess the 35 invoices"comprising $18.7 million in questioned costs"that did not receive sufficient review under the CARES Act guidance and seek recovery of any portion that is determined to be improper and/or unallowable or provide justification for approving the payments.

Require FAA field offices to collect, review, and maintain required price and cost analyses before making grant awards. Implementation of this recommendation could result in funds put to better use of $10.6 million.

Revise the Agencys policies for collecting, reviewing, and approving Buy American Preferences waivers to require the waiver requests to be timely, complete, and accurate, and define the extraordinary circumstances that would allow grant recipients to deviate from Buy American requirements. Implementation of this recommendation could result in funds put to better use of $49.6 million.

After revising Buy American policies, develop and implement Buy American Preferences waiver training for field offices.

We recommend that the Contracting Officer require the Association to update its APM to direct local plans to ensure that all debarred and suspended providers in its local area are added to their local provider databases and flagged as debarred or suspended, even if the providers have not previously submitted FEHBP claims (including adding Non-Par providers on the OPM OIG listing, if necessary) so claims paid to them will be flagged if presented to the local Plans as required by the Guidelines.

We recommend that the Contracting Officer require the Association to update its APM to include other (non-SSN) matching criteria available on the OPM OIG debarred or suspended provider listing for potential partial matches for flagging purposes in its DPF and local plan provider databases. The Association should also provide training to its local plans to ensure that they understand the importance of these additional matching criteria.

We recommend that the Contracting Officer require the Association to update its claims processing system with edits to ensure that claim lines with telehealth-related POS and modifier codes suspend for review prior to payment.

Fully implement the 90-day closeout process for National Small Business Week as outlined in SOP 90 75 5, as amended, and resolve the identified closeout discrepancy between the fiscal agent and the Office of Strategic Affairs for business week 2023.

Determine the allowability of $1.354 million in ineligible questioned costs detailed on pages 27 to 38 of the audit report and recover any amount that is unallowable.