Open Recommendations

The Director of FinCEN should update FinCEN’s BSA data SOPs to require a review to ensure FinCEN personnel appropriately maintain MOUs and related documentation. Ensure the update specifies that decision matrices are appropriately maintained.

The Director of FinCEN should update FinCEN’s BSA data SOPs to require that FinCEN identify and permit designees to sign MOUs in lieu of FinCEN’s Director and FinCEN personnel and external agency officials record the execution date on MOUs.

The IPA recommended that OCIO management reinforces policy requirements (through training or other means) for completing periodic monthly reviews of FARS OS privileged user access.

The IPA recommended that OCIO management performs ongoing monitoring to hold responsible control operators accountable for timely completion of such control activities.

The IPA recommended that Fiscal Service management reinforce policy requirements (through training or other means) for removing logical access of terminated and transferred Fiscal Service employees and contractors within 2 business days of their separation date.

The IPA recommended that Fiscal Service management perform ongoing monitoring to hold responsible control performers accountable for timely completion of such control activities

The IPA recommended that Fiscal Service develop and implement documentation to assign responsibility for ensuring adequacy of UNIX and database security and baseline settings.

The IPA recommended that Fiscal Service update existing UNIX and database configuration security baseline documents to ensure that these documents fully incorporate and enforce the components of the DISA STIGs. Management should document any deviations from the STIGs and note compensating controls that mitigate the security risk to an acceptable level.

The IPA recommended that Fiscal Service develop, document, and implement policies, procedures, and controls to conduct periodic reviews of actual UNIX and database settings against the security configuration baselines.

The IPA recommended that Fiscal Service provide logging and monitoring of security related events to include the retention of evidence of reviews performed.

The IPA recommended that Fiscal Service develop a baseline of essential security settings and specify that baseline as the standard to be observed.

The IPA recommended that Fiscal Service implement corrective actions to address all vulnerabilities associated with the baseline enforcement to include removing the three default user accounts on UNIX servers.

The IPA recommended that Fiscal Service perform a review of the current system environment against the CMDB.

The IPA recommended that Fiscal Service perform a risk assessment over the subject matter and determine the appropriate personnel to be responsible for monitoring and updating the CMDB.

The IPA recommended that Fiscal Service update policy and procedures related to the above recommendations and disseminate the documentation to enforce such policy and procedures.

We recommend that BLM develop policies and procedures for identifying and tracking helium-producing wells to ensure helium agreements are established and enforce agreement clauses for annual reporting.

We recommend that BLM resolve the $48,000 in uncollected penalties.

We recommend that BLM establish a records management system for tracking helium agreements.

We recommend that BLM develop policies and procedures for monitoring helium agreements to ensure they are current.

We recommend that BLM conduct a thorough review of royalty payment data to identify potential delinquencies and resolve any delinquencies identified, including resolving the $851,000 of potential delinquencies previously reported.

We recommend that BLM develop policies and procedures for identifying, tracking, and following up on delinquent companies.

We recommend that BLM establish a policy for conducting reviews of helium companies to conform to ONRR practices, including establishing a risk-based strategy and independent verification of company-provided production data to assist the Federal Leased Lands team in performing efficient oversight of helium companies, which would put the team's $96,385 in estimated yearly salary expenses associated with inefficient oversight practices to better use in the future.

The Executive Director ensures staff receive education about badge holders’ responsibilities in preventing unauthorized access to VA facilities and computer systems and safeguarding electronic databases including electronic health care records.

The Executive Director ensures staff monitor patient care areas for expired, damaged, and contaminated medications and remove them as needed.

The Executive Director ensures staff store medications in pharmaceutical grade refrigerators.