Open Recommendations

Review and update the Guide to ensure it is consistent with the provisions of 41 CFR 109

Revises the Order to clearly define all oversight roles and responsibilities in the ECP;

Revises the Order to clearly define all oversight roles and responsibilities in the ECP;

We recommend that the Manager, ORNL Site Office, direct the Contracting Officer to:3. Determine the allowability of costs questioned in this report, as summarized in Appendix 2, and recover any amounts deemed unallowable.

We recommend that the Manager, ORNL Site Office, direct the Contracting Officer to:4. Ensure that actions related to real estate are approved by appropriate Department personnel.

Determine the allowability of costs questioned in this report, as summarized in Appendix 2, and recover any amounts deemed unallowable.

We recommend that Aetna, Inc. refund to the Federal Government the $632,070 of overpayments.

We recommend that Aetna, Inc. determine, for the remaining 159 enrollee-years in the potentially mis-keyed diagnosis code high-risk group not reviewed as part of this audit, whether the medical records in each case support the diagnosis for the unrelated condition and refund any resulting overpayments to the Federal Government.

We recommend that Aetna, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that Aetna, Inc. continue to examine its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.

The DFC Chief Information Officer must prioritize efforts to enhance DFC's existing vulnerability management process to ensure sufficient identification, prioritization, and remediation of critical and high vulnerabilities in a timely manner in accordance with DFC's policy.

The DFC Chief Information Officer must implement the necessary oversight to monitor Cybersecurity Security Assessment and Management(CSAM) to ensure that SSPs are reviewed and authorized in accordance with the timeliness requirements in DFC's policy.

Prioritize the definition and incorporation of a cybersecurity risk tolerance into the agency's cybersecurity policies, procedures, and processes, as appropriate.

Ensure all required attributes are consistently documented within the agency's cybersecurity risk register.

Document and implement a process to consistently inventory the Board's web applications, including its public-facing websites.

Document and implement a process to consistently inventory and prioritize the Board's third-party systems, including the identification of subcontractors.

Enforce the agency's iOS Update and Device Inactivity Policy to ensure that agency services are denied to mobile devices that are out of compliance.

Develop, document, and implement a process to review and update the Board's privacy impact assessments.

Ensure that the process to update privacy impact assessments is adequately resourced for effective implementation.

Maintain a comprehensive schedule for testing current contingency plans, documenting test procedures, and maintaining relevant updates to the contingency plan.

in coordination with the Vice President, Organization Development, establish and document a workforce plan that describes key recruitment, retention, and performance measurement activities. At a minimum, the plan should address strategic priorities, include workforce goals and objectives, identify stakeholder roles and responsibilities, and define a process for periodic review and updates.

Develop a process to track employee and contractor training and certifications to monitor progress toward addressing the skills gaps identified in periodic skills assessments.

Follow-up with recipients who did not submit their final annual report as required by April 30, 2023, and take action to recover funds.

Review the 210 RRF award recipients currently marked in the PPP loan data as potentially fraudulent or ineligible that were not selected for post award review.

Extend the record retention period and notify all RRF award recipients in writing in accordance with 2 CFR 200.334.