Open Recommendations

Determine the allowability of costs questioned in this report, as summarized in Appendix 2, and recover any amounts deemed unallowable.

We recommend that Aetna, Inc. refund to the Federal Government the $632,070 of overpayments.

We recommend that Aetna, Inc. determine, for the remaining 159 enrollee-years in the potentially mis-keyed diagnosis code high-risk group not reviewed as part of this audit, whether the medical records in each case support the diagnosis for the unrelated condition and refund any resulting overpayments to the Federal Government.

We recommend that Aetna, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that Aetna, Inc. continue to examine its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.

The DFC Chief Information Officer must prioritize efforts to enhance DFC's existing vulnerability management process to ensure sufficient identification, prioritization, and remediation of critical and high vulnerabilities in a timely manner in accordance with DFC's policy.

The DFC Chief Information Officer must implement the necessary oversight to monitor Cybersecurity Security Assessment and Management(CSAM) to ensure that SSPs are reviewed and authorized in accordance with the timeliness requirements in DFC's policy.

Prioritize the definition and incorporation of a cybersecurity risk tolerance into the agency's cybersecurity policies, procedures, and processes, as appropriate.

Ensure all required attributes are consistently documented within the agency's cybersecurity risk register.

Document and implement a process to consistently inventory the Board's web applications, including its public-facing websites.

Document and implement a process to consistently inventory and prioritize the Board's third-party systems, including the identification of subcontractors.

Enforce the agency's iOS Update and Device Inactivity Policy to ensure that agency services are denied to mobile devices that are out of compliance.

Develop, document, and implement a process to review and update the Board's privacy impact assessments.

Ensure that the process to update privacy impact assessments is adequately resourced for effective implementation.

Maintain a comprehensive schedule for testing current contingency plans, documenting test procedures, and maintaining relevant updates to the contingency plan.

in coordination with the Vice President, Organization Development, establish and document a workforce plan that describes key recruitment, retention, and performance measurement activities. At a minimum, the plan should address strategic priorities, include workforce goals and objectives, identify stakeholder roles and responsibilities, and define a process for periodic review and updates.

Develop a process to track employee and contractor training and certifications to monitor progress toward addressing the skills gaps identified in periodic skills assessments.

Follow-up with recipients who did not submit their final annual report as required by April 30, 2023, and take action to recover funds.

Review the 210 RRF award recipients currently marked in the PPP loan data as potentially fraudulent or ineligible that were not selected for post award review.

Extend the record retention period and notify all RRF award recipients in writing in accordance with 2 CFR 200.334.

Assess the post award review process and manpower requirements to ensure post award reviews are conducted in a prompt manner. Use the results of the assessment to improve processing times to ensure reviews are completed before the statute of limitations expire.

Take immediate administrative actions to recover improper payments from the 5 hotels and 18 recipients found to be ineligible, for a total of 23 ineligible award recipients identified totaling $39 million.

Establish and implement procedures to recover unused funds or recover funds paid to ineligible recipients and prioritize this effort.

To address concerns in the COVID-19 EIDL program, we recommend the Administrator direct the Associate Administrator for the Office of Capital Access to perform a comprehensive cost-benefit analysis, consistent with federal regulations, to include periodic comparisons of costs incurred and amounts collected on the portfolio of COVID-19 EIDLs of $100,000 or less to assess whether collection costs exceed recovery amounts.

To address concerns in the COVID-19 EIDL program, we recommend the Administrator direct the Associate Administrator for the Office of Capital Access to reevaluate and amend as appropriate the April 27, 2022 decision to end active collections contingent on the outcome of the more comprehensive cost-benefit analysis.