Open Recommendations

A requirement to provide a fact-specific description of the purpose of the JE, along with adequate supporting documentation.

Validate and ensure JEs are properly supported, documented, and are readily available for examination. (Modified Repeat)

KPMG recommends that DOT management design and implement procedures to consistently and timely perform and document user account access reviews as required by standards for effective internal control systems and/or internal policy.

KPMG recommends that DOT management design and implement procedures related to the retention of appropriate supporting evidence of internal controls, including but not limited to, access administration, access recertification, audit log review, and patch management.

Ensure policies and procedures governing the provisioning and de-provisioning of access to information systems are followed in a timely manner and documentation of completion of these processes is maintained.

Establish a means of documenting all users who have access to systems, and all users who had their systems access revoked.

Prepare audit logging and monitoring procedures for databases within application boundaries. Review audit logs on a pre-defined periodic basis for violations or suspicious activity and identify individuals responsible for follow up or elevation of issues to the appropriate team members for review. The review of audit logs should be documented for record retention purposes.

Establish a means of documenting a list of users with significant information system responsibilities to ensure the listing is complete and accurate and the appropriate training is completed.

Enforce existing policy developed by OPM, vendors or federal agencies requiring mandatory security configuration settings and implement a process to periodically validate the settings are appropriate.

Develop interface / data transmission design documentation that specifies data fields being transmitted, controls to ensure the completeness and accuracy of data transmitted, and definition of responsibilities.

Perform a comprehensive periodic review of the appropriateness of personnel with access to systems.

Document access rights to systems to include roles, role descriptions, privileges or activities associated with each role and role or activity assignments that may cause a segregation of duties conflict.

Establish a mechanism to systematically track all configuration items that are migrated to production in order to produce a complete and accurate listing of all configuration items. Further, develop, document, implement, and enforce requirements and processes to periodically validate that all configuration items migrated to production are authorized and valid.

KPMG recommends FAA design and implement procedures to consistently and timely perform and document user account access reviews as required by standards for effective internal control systems and/or internal policy.

Report on the overall performance and progress of the 2501 Program, using grantee information from Recommendation 15, to measure and assess the level of performance the 2501 Program accomplished.

OIG recommends that the Bureau of the Comptroller and Global Financial Services, in coordination with the Bureau of Administration, develop and implement a corrective action plan that identifies the underlying reasons for the deficiencies with overseas data included in the Digital Accountability and Transparency Act Files and that identifies strategies and milestones for implementing them, to address the underlying deficiencies.

OIG recommends that the Bureau of the Comptroller and Global Financial Services update its Data Quality Plan related to reconciling Digital Accountability and Transparency Act of 2014 data to ensure that quality control procedures are performed to assess the quality of the data included in all files, including files created from Government-wide systems.

Determine the allowability of the questioned transactions and recover $9,236,974, if applicable.

Rec. A.1.a: The DoD OIG recommended that the Assistant Secretary of Defense for Health Affairs, in coordination with the Director of the Defense Health Agency and the Service Surgeons General, establish consistent policies and procedures to manage suicide risk screening and referral as part of the medical process for transitioning Service members. At a minimum, the policies and procedures should designate an organization to have responsibility for the clinical implementation of the policy.

Rec. A.1.b: The DoD OIG recommended that the Assistant Secretary of Defense for Health Affairs, in coordination with the Director of the Defense Health Agency and the Service Surgeons General, establish consistent policies and procedures to manage suicide risk screening and referral as part of the medical process for transitioning Service members. At a minimum, the policies and procedures should designate an organization to have oversight responsibility for mental health assessment processes for transitioning Service members.

Rec. A.1.c: The DoD OIG recommended that the Assistant Secretary of Defense for Health Affairs, in coordination with the Director of the Defense Health Agency and the Service Surgeons General, establish consistent policies and procedures to manage suicide risk screening and referral as part of the medical process for transitioning Service members. At a minimum, the policies and procedures should establish a standard mental health assessment and suicide risk screening process to be used by all Services.

Rec. A.2.a: The DoD OIG recommended that the Director of the Defense Health Agency, in collaboration with the Office of the Assistant Secretary of Defense for Health Affairs Director of Mental Health Policy and Oversight and the Director of the DoD and Veteran's Affairs Collaboration Office, identify the causes for the breaks in arranging for continuous mental health care for all Service members in care who are transitioning from the military health system to the Veteran's Health Administration and create and implement solutions to increase the number of Service members who have continuous care arranged between the military health system…

Continue the system modernization efforts that provide VA with the capability to generate the required DATA Act reporting files containing the necessary elements to meet compliance with the DATA Act. Ensure the modernization will provide the following: a. Accurate reporting of object class, program activity codes, program activity names, and all other elements required by the DATA Act. b. Award identification to allow VA to be able to develop a File C and reconcile the File C to both summary level data (Files A and B) and award level data (File D). c. Reconciliations with subsidiary systems. d. A mechanism…

3. Improve researching of all root causes of differences between the VBA source systems and the monthly GTAS balances as part of their File B reconciliations. Also, differences should be accumulated and assessed at an aggregate level. The total differences either allocated to programs, reclassified out of other programs, or attributed to MinX JVs should be researched and reported as part of the SAO sub-certification process.

Continue mapping efforts and ensure programs without entitlement codes are recorded with the correct program activity codes and names rather than defaulting to Compensation.