Open Recommendations

Establish Supervision’s objectives for the onboarding process for transitioning depository institutions.

Establish clear roles and responsibilities at the headquarters level for overseeing Supervision’s onboarding process.

Develop and implement an officewide policy that describes management’s expectations for onboarding depository institutions that transition to the CFPB’s supervisory oversight. The policy should articulate
a. key onboarding steps that OSE should take before and after a depository institution transitions.
b. expected time frames for completing the key steps.
c. guidance on coordinating with the prudential regulator of the onboarding institution, including discussion topics; documentation needs; and the process for managing preexisting supervisory issues, such as MRAs and enforcement actions.

Develop methods to monitor OSE’s execution of the onboarding process, including
a. a tracking mechanism to determine whether the key onboarding steps have been completed.
b. a process for obtaining feedback from the depository institutions that transitioned regarding the effectiveness of the onboarding process.
c. a forum for the regional offices to share their experiences regarding the onboarding process to drive continuous improvement.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should update internal guidance and develop more robust training to ensure that employees perform adequate research of tax accounts to identify outstanding tax debt prior to initiating manual refunds or credit elects.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should request the necessary programming changes to ensure that the duplicate return freeze and the telephone excise tax freeze code function appropriately. In addition, request programming changes to ensure that overpayments from undelivered refunds and interest offset appropriately.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should analyze the 8,452 individual and 31,967 business cases that we identified and determine whether additional programming or procedural errors exist in the process of offsetting refunds and credit elects. Take appropriate corrective action to prevent erroneous refunds and credit elects in the future.

The Chief Information Officer should ensure that the requested programming changes are implemented by January 2026.

The Chief, Taxpayer Services, and Chief, Tax Compliance Officer, should remove the erroneous LLC indicator from the 76 sole proprietorship accounts.

We recommend that the Centers for Medicare & Medicaid Services instruct the SSAs to follow up with the five nursing homes (three nonprofit and two Government-owned) that may not have complied with Federal requirements to verify that they have taken corrective actions.

We recommend that the Health Resources and Services Administration require the OPTN IT system contractor to remediate the 22 vulnerabilities identified and verify that the 22 vulnerabilities identified were remediated.

We recommend that the Health Resources and Services Administration require the OPTN IT system contractor to improve network monitoring by implementing NIST SP 800-53, Revision 5, for the OPTN IT system, to include data loss prevention technology to prevent unauthorized exfiltration of information (Control SC-7(10)) and red-team exercises to simulate attempts by adversaries to compromise organizational systems (Control CA-8(2)).

We recommend that the Health Resources and Services Administration implement procedures to help ensure that the OPTN IT system contractor maintains compliance with federally required cybersecurity controls policies and standards on a continuing basis.

Update the DNA Accounting Manual to align with LSC requirements in 45 C.F.R. 1631.12(d) that prohibit giving or selling assets to DNA employees and/or Board members.

Update the current DNA Company Vehicle policy section on permissible use to:
Provide more detail on what constitutes personal use,
Clearly define commuting to/from work as personal use, and
Inform employees that the value associated with personal use will be accounted for as a fringe benefit in accordance with IRS regulations.

Implement controls to ensure that entries for transactions are adequately referenced in the general ledger, and source documents are traceable to the general ledger. Grant codes should be coded in the accounting system and included with supporting documentation.

Implement a process to ensure that only LSC-allowable expenses are allocated to LSC, in accordance with LSC requirements and guidance.

Update the DNA Accounting Manual to include procedures for obtaining LSC approvals when using more than $25,000 of LSC funds for contracts, purchases/leases of personal property, or capital improvements.

Establish and maintain a proper recordkeeping system that enables DNA to maintain contract files and perform regular backups of electronic records and systems stored offsite or in a virtual environment with easy-to-use restoration options.

Update the DNA Accounting Manual to include a section on costs that are unallowable per LSC regulations, including how to identify and address unallowable costs.

Provide training on identifying and recording unallowable costs to DNA accounting staff and any other personnel responsible for approving purchases or disbursements.

Update the DNA Accounting Manual to assign bank reconciliation duties ensuring segregation of duties so employees who initiate or transmit electronic transactions, have no access to cash, are not check signers, and have no bookkeeping duties.

Establish adequate segregation of duties to:
Ensure cash receipts procedures require that two employees open the mail, and
Ensure the cash receipts log is signed and dated by the preparer and the reviewer.

Establish adequate segregation of duties to ensure employees who take deposits to the bank:
Are not involved with opening the mail or recording cash receipts, and
Do not have access to the DNA Accounting System.

Implement procedures to ensure that bank reconciliations are signed and dated on the date the reconciliation was performed and the bank reconciliation review was performed and documented.