Open Recommendations

Remedy $80,550 in duplicate victim compensation payments.

Remedy $66,653 in unallowable questioned costs associated with victim compensation payments.

Remedy the $4,400 in unsupported questioned cost associated with a victim compensation payment.

Ensure the Maryland GOCPP updates its CICB Manual to: (1) require that the supporting files for claims contain written justification for any deviation from the CICB's policy on processing decisions, and (2) reflect the applicable and accurate statutory award limits established by the state of Maryland.

Update policies, and procedures related to monitoring and oversight of internal controls related to journal entries, to ensure internal consistency with, and clear definition of, those journal entries that are processed by the service provider; and to define the required documentation to be maintained to evidence CPSC reviews of journal entries.

ML - 1: Design and implement a control to identify, analyze, and respond to risks related to the validity of open obligations.

ML - 2: Establish procedures and recurring communication with the appropriate stakeholders to assist in the identification and de-obligation of stale undelivered orders.

ML - 3: Design a control to identify, analyze, and respond to risks related to the reporting of leases.

ML - 4: Establish recurring communication with the appropriate stakeholders.

Work with the Illinois Department of Human Services to ensure it accurately charges expenditures related to Social Security Administration programs.

We recommend that management design and implement controls that respond to the risks associated with the reliability of key underlying data and code used in developing the subsidy re-estimates. Such review should be documented and maintained.

We recommend that management: 1. Evaluate, design, and implement security management controls to ensure that corrective actions remediate the risk and address the root cause of findings and quality reviews over the POA&M closure documentation are conducted to confirm that the noted deficiencies are fully addressed to prevent future reoccurrences.

We recommend that management evaluate, design, and implement logical access controls and provide training and oversight over access provisioning, removal and/or deactivation of access, periodic reviews and recertifications of access, and adherence to password and security setting requirements, segregation of duties, and least privileged principles.

We recommend that management evaluate, design, and implement change management controls to ensure the Department’s system change management process identifies and categorizes the types of changes that impact the system, data, and configurations in addition to defining and documenting the change descriptions and requirements for testing, approvals, documentation, audit trails, and retention for each system change.

We recommend that management evaluate, design, and implement computer operations controls to develop and implement formal procedures addressing controls over changes to production jobs and schedules and the monitoring of actions taken by the generic/shared job processing account in the job scheduling tool.

We recommend that management ensure that controls are operating effectively over the complete and timely review of SOC reports to ensure the scope adequately covers the controls in place at the service organization, including the CUECs presented in such reports. Furthermore, management should implement and execute controls designed to address those CUECs in a timely manner.

We recommend that management implement key monitoring controls to ensure that corrective action plans are implemented to remediate control deficiencies identified in a timely manner. In addition, increase oversight, review, and accountability over the process among various offices and directorates within the Department.

Develop and implement a formal, documented grant closeout process that includes clear policies and procedures aligned with federal requirements.

Provide training to relevant staffs on the new grant closeout policies and procedures to ensure consistent understanding and application across all grant programs.

Update the NARA 111, NARA Directives, for the development, approval, and maintenance of internal policies and SOPs.

Ensure a NARA executive oversees and monitors the periodic review and update of the policies and SOPs.

Update the travel policy and continue efforts to ensure that all written policies and procedures are reviewed and revised in a timely manner.

We recommend that FWS require the Department to resolve the $36,588 ($27,443 Federal share) in questioned costs related to inequitably allocated leave charges billed to the Wildlife and Sport Fish Restoration Program.

We recommend that FWS require the Department to develop an internal mechanism to ensure that all subawards over $30,000 are reported through SAM.gov, as required under 2 C.F.R. 170, Appendix A(a)

We recommend that FWS require the Department to develop and implement a written policy for leave allocation consistent with 2 C.F.R. 200.405(d) and 200.431(b).