Open Recommendations

(U) Rec. 4.d: The DoD OIG recommended that the Principal Director of Defense Pricing and Contracting, Office of the Under Secretary of Defense for Acquisition and Sustainment develop and implement plans, in coordination with the Principal Deputy Chief Information Officer, Office of the DoD Chief Information Officer, to ensure that contracting officers are aware of the DoD technical experience requirements for contracting officer's representatives who monitor contractor cybersecurity services or accept cybersecurity deliverables.

(U) Rec. 4.e: The DoD OIG recommended that the Principal Director of Defense Pricing and Contracting, Office of the Under Secretary of Defense for Acquisition and Sustainment direct the Defense Acquisition Regulations Council to revise Defense Federal Acquisition Regulation Supplement Part 239, "Acquisition of Information Technology," Subpart 239.71, "Security and Privacy for Computer Systems," to reflect current DoD cybersecurity policies.

(U) Rec. 5: The DoD OIG recommended that the Defense Acquisition University President revise the DoD contracting officer's representative training curriculum and materials, in coordination with the Principal Director of Defense Pricing and Contracting and the Director of the Defense Contract Audit Agency, to include detailed instructions for contracting officer's representatives to review and validate that contractor payment requests, including interim vouchers, are commensurate with performance to prevent improper payments.

We recommend that the CBP Commissioner and the ICEDirector coordinate with the DHS Secretary to contract with an independent,federally funded research and development center to complete a fullassessment of the staffing needs at the Southwest border and strategicallyimplement recommendations based on the assessment. The assessmentshould:• review existing staffing models and methodology for deploying personnelat the Southwest border and across the country and the impact ofcontinuously relying on details and overtime to temporarily fill staffinggaps; and• include factors within and outside of DHS’ control that are affectingworkloads and exacerbating staffing challenges to identify solutions thecomponents can accomplish as well as those…

We recommend that the CBP Commissioner and the ICE Director communicate the duties and responsibilities of the SBCC moreeffectively to frontline staff.

Develop an infrastructure strategy to increase the overall effectiveness of facilities management. The strategy should align infrastructure decisions with the BOP's mission; include one or more methodologies for allocating resources; and include short, medium, and long-range planning goals. As part of this strategy, the BOP should consider incorporating a portfolio-based repair model; a retention or disposal decision model; and business case analyses for new construction, as appropriate.

Develop and implement key performance indicators to track whether the BOP is meeting its infrastructure goals.

Establish an automated and comprehensive inventory for managing and tracking software licenses.

Develop and implement a comprehensive software licensing policy that includes a methodology for analyzing and maintaining software usage data to determine the software license needs of the agency.

Determine the allowability of the questioned transactions and recover $14,886,138, if applicable.

We recommend that the Office of Refugee Resettlement include a review of compliance by ICFs and EISs with all background check requirements and facility access as a part of ORR's routine site visit monitoring.

We recommend that the Centers for Medicare & Medicaid Services work with the MACs to recover $35,560 in improper payments made to providers for the 128 sampled enrollee days that did not meet Medicare requirements. 

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Conduct medical reviews of psychotherapy services, including services provided via telehealth, to verify that the services are documented and billed in accordance with Medicare requirements.

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Implement system edits for psychotherapy services, including services provided via telehealth, to prevent payments for services that were billed incorrectly.

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Strengthen educational efforts to make providers aware of educational materials on how to meet Medicare requirements and guidance for psychotherapy services, including services provided via telehealth.

Now that CMS has reinstituted most program integrity measures, we also recommend that CMS work with the MACs to take the following steps, which if in effect during the audit period could have saved Medicare an estimated $579,667,510 during that period: Review MAC jurisdictions' LCD requirements for psychotherapy services to identify which provisions effectively promote program integrity, and consider additional steps that CMS could undertake to ensure appropriate coverage and payment for psychotherapy services across all jurisdictions.

Establish and implement a maintenance technician workforce plan that considers factors such as average training time, training requirements, and staffing turnover for a period longer than 1 year.

Include in its quarterly review process, privileged accounts with access to cybersecurity devices such as firewalls and the SIEM tool.

Complete the risk-based selection and procurement of additional audit logging tools needed to strengthen audit logging tools, retention, and visibility to fully implement the minimum logging requirements stipulated in OMB M-21-31.

Acquire the additional resources needed to fully implement the minimum logging requirements stipulated in OMB M-21-31.

Complete implementation of OMB M-21-31 to achieve past due Event Logging 1 and 2 maturity levels and to meet the Event Logging 3 maturity due by August 27, 2023.

We recommend that the GSA Administrator, FAS Commissioner, and Associate Administrator of the Office of Government-wide Policy address the problems with the TDR data and usage as described in this report within 1 year of report issuance. To do so, GSA should, at a minimum: conduct a comprehensive assessment of all TDR data; verify the accuracy and completeness of all TDR data; implement a verification process to ensure that TDR data is accurate and complete when it is submitted by MAS contractors; require the contractors that are not submitting complete and accurate data to correct their data or suspend their…

Embassy Juba should submit its FY 2022 annual Statement of Assurance in accordance with Department standards.

Embassy Juba should install signage at the Consular Section’s public entrance with all information required by Department guidance.

Embassy Juba should bring its consular cashiering operations into compliance with Department standards.