Open Recommendations

We recommend that the Chairman develop and implement regular, comprehensive, and effective required training on preventing and reporting sexual harassment for all nonsupervisory employees that incorporates elements from the EEOC 2023 Promising Practices, including a larger emphasis on the Agency’s prohibition for retaliation of any kind.

We recommend that the Chairman develop and implement regular, comprehensive, and effective required training for all supervisors and executives on preventing and reporting sexual harassment that incorporates elements from the EEOC’s 2023 Promising Practices, including a larger emphasis on the Agency’s prohibition for retaliation of any kind.

We recommend that the Chairman develop and implement a plan to routinely analyze the FDIC’s sexual harassment training, ensure that it is current, and measure the impact that training is having on reducing harassment and retaliation in the Agency.

Initiate actions to establish requirements for recipients (or third-party auditors) for how manufacturers' rolling stock documentation will be reviewed when conducting pre-award and post-delivery audits.

Initiate actions to establish requirements for recipients (or third-party auditors) to maintain pre-award and post-delivery audit documentation in a manner that protects manufacturers' sensitive data while also providing supporting evidence of the work described in the audit.

Initiate actions to establish requirements for recipients (or their auditors) to document their verification of suppliers' Buy America information.

Develop and implement Buy America policies or guidance as to how to account for hardware and domestic shipping costs when computing domestic content percentages.

Develop and implement Buy America policies or guidance detailing when to initiate Buy America rolling stock compliance reviews and apply the corrective actions (i.e., specific conditions and remedies for noncompliance) described in the Uniform Grant Guidance.

Update relevant policies and procedures for appraiser roster management so that they align with each other and with regulations and reflect HUD practice. At a minimum, the policies and procedures should clearly cover appraiser roster status, license expiration, disciplinary actions, removals, data accuracy, and documentation.

Maintain historical data for each appraiser record, including history on expiration dates, when appraisers are moved on or off the appraiser roster and when they are and are not allowed to be assigned to conduct appraisals.

Improve quality assurance processes by adding steps to verify that the appraiser roster is accurate and reliable over time through testing of its logic-based system controls and data fields.

Evaluate the postmarking policy and adjust as necessary to ensure that all mail-in ballots receive a postmark.

Develop qualitative and quantitative performance measures to evaluate the effectiveness of the following: Configuration Management plan and change control activities.

Perform a cost benefit analysis of introducing automation to support the testing of system contingency plans; and apply the appropriate risk mitigation strategy.

Fully implement its processes for information system back up for General Support System Cloud.

Include controls in future debt management system modernization efforts to address system limitations causing overpayments to not be recovered via Cross-Program Recovery or transferred to another liable individual for recovery.

Pending automation improvements, remind employees of circumstances when a manual action is needed to initiate cross-program recovery or transfer a debt to another liable individual for recovery.

FHFA should develop and implement policies and procedures to oversee FHFA’s background reinvestigation process, including oversight controls over FHFA’s service provider.

FHFA should update the service level agreement between FHFA and the service provider to include requirements for the service provider to provide background reinvestigation status reports on a regular basis.

FHFA should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA and OPM standards.

FHFA-OIG's Chief Information Officer should implement a process to monitor and ensure that background reinvestigations for relevant employees and contractors are conducted timely in accordance with FHFA-OIG and OPM standards.

FHFA-OIG's Chief Information Officer should establish and implement a process to make suitability adjudicative determinations and take suitability actions for covered positions in accordance with OPM’s regulation under Title 5 CFR, Part 731.103.

FHFA should disable accounts of nonprivileged users who have been inactive for over 365 days, as required by the FHFA customer controls for the cloud system.

FHFA should work with the cloud system’s vendor to implement software updates that automatically disable user accounts after 365 days of inactivity, as required by the FHFA customer controls for the cloud system.

FHFA should update the customer controls for the cloud system to include a procedure for regular reviews of non-privileged users’ access.