Open Recommendations

Establish policies and procedures to perform an annual review of the inventory to ensure AmeriCorps' Information System Inventory includes all information systems used or operated by an agency, an agency contractor, or another organization on behalf of an agency. (New)

Upgrade to a supported version of the application software and revise the references to the supported software in the Business Impact Analysis or accept the risk of not updating the software by documenting the exposure risk in a formal risk acceptance memo signed by the Authorizing Official. (New)

Develop and implement an effective monitoring mechanism to track the progress of Authorization to Operate letters within the three-year review window and ensure timely approval of the System Security Plans. (New)

Complete an authorization package that covers the Administrative Resource Center Financial System (New)

Enhance and implement core and specialized training to develop competencies in authorization packages for external vendor systems such as Administrative Resource Center Financial System. (New)

Finalize and issue the Incident Response Plan for FY 2023. (New)

Establish and implement a process and an effective monitoring mechanism to track the progress of Incident Response Plan annual reviews ensuring timely completion and updates, adapting the evolving cybersecurity threats, maintaining effective response capabilities, and reflecting the current agency operations and system environment. (New)

Develop a comprehensive project plan and roadmap to meet the logging requirements in accordance with OMB M-21-31. (New)

Upgrade and configure its Security Information and Event Management tool to capture all log requirements in accordance with OMB M-21-31. (New)

Implement a tool to closely track the timely completion and review of an annual Disaster Recovery Exercise/Contingency Plan Test conducted to account for all information systems. (New)

Develop and implement standard operating procedures for Disaster Recovery Exercise/Contingency Plan Test coverage of external vendors systems including Administrative Resource Center Financial System. (New)

Enhance and implement core and specialized training programs targeted at the Authorizing Official, System Owner, and Information System Security Officer to develop competencies in contingency planning for external vendor systems. (New)

Complete the three steps in accomplishing Business Impact Analysis in accordance with NIST SP 800-34, Revision 1 and ensure the application adheres to the minimum requirements. (New)

Develop a contingency plan and perform Business Impact Analysis for Administrative Resource Center Financial System. (New)

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

This recommendation contains sensitive information that should not be made public. Therefore, we are not including the wording for this recommendation.

We recommend the Principal Deputy Assistant Secretary for Employment and Training work with Oregon, Louisiana, Delaware, and Mississippi to ensure the appropriate return of approximately $105.1 million in TFFF reimbursements for first-week regular UI compensation paid that were associated with ineligible weeks.

We recommend the Principal Deputy Assistant Secretary for Employment and Training establish a deadline by which states are required to perform a timely review of past drawdowns and provide evidence that drawdowns were for reimbursement of eligible first-week regular UI compensation paid by the state for claim weeks that fell within the TFFF program period.

We recommend the Principal Deputy Assistant Secretary for Employment and Training reassess the eligibility of all states with waiting week provisions according to their state laws to ensure that the waiting week was not in effect when states accessed TFFF funds prior to December 31, 2020.

We recommend the Principal Deputy Assistant Secretary for Employment and Training ensure that any state drawdowns of the remaining almost $5 billion ($4,948,811,006) in TFFF funds are only for the reimbursement of first-week regular UI compensation paid by the state that fall within the TFFF program period (March 27, 2020, through September 6, 2021).

We recommend the Principal Deputy Assistant Secretary for Employment and Training establish written procedures and deadlines for the timely return of funding for TFFF and future similar programs and consult with OMB and Treasury officials to execute the proper return of unused funds that remain within states’ accounts.

We recommend the Principal Deputy Assistant Secretary for Employment and Training capture lessons learned from the TFFF program and use the information to develop effective internal control procedures to ensure states meet program requirements, including eligibility, and have sufficient infrastructure in place to pay claimants’ UI benefits without delay for similar temporary emergency UI programs that may be established in the future.

We recommend the Principal Deputy Assistant Secretary for Employment and Training capture lessons learned from the TFFF program and use the information to develop and implement controls to ensure the methodology and procedures are documented and maintained for estimating allotments and subsequent adjustments for similar temporary emergency UI programs that may be established in the future.

We recommend the Principal Deputy Assistant Secretary for Employment and Training: Develop and implement risk tolerance for the amount of participants being served under the WIOA Adult, Youth, and Dislocated Workers program.

We recommend the Principal Deputy Assistant Secretary for Employment and Training: Resolve the $265,040 in questioned costs associated with ineligible participants and ineligible payments