Open Recommendations

Determine the allowability of the questioned ineligible amount of $194,233, on page 11 of the audit report and recover any amount that is unallowable

We recommend that GSA’s Chief Financial Officer and Chief Information Officer conduct a comprehensive assessment of GSA’s CIO-IT Security-19-97, IT Security Procedural Guide: Robotic Process Automation (RPA) Security, (RPA policy) to ensure, among other things, that its monitoring controls are effectively designed and implemented.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop oversight mechanisms to enforce compliance with the RPA policy and ensure that controls are operating effectively.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if they address bot and non-person entity access. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer review all system security plans that bots currently interact with to determine if the security controls need to be updated. Update the system security plans, as needed.

We recommend that GSA’s Chief Financial Officer and Chief Information Officer develop a comprehensive process for removing bot custodian and bot developer access for decommissioned bots and GSA systems that: aligns with GSA’s CIO-IT Security-01-07, IT Security Procedural Guide: Access Control (AC) (access control policy); tracks and documents that access has been removed; and incorporates the process into the RPA policy.

Make ERM implementation a priority by providing the ERM team the resources it needs to ensure ERM reaches maturity no later than the planned date of FY 2028, in accordance with its current ERM Implementation Plan.

Ensure as SSA is working toward reaching maturity that the ERMC is providing leadership over the ERM program and that key Circular A-123 requirements are completed. For example, key requirements should include regular evaluation of SSA’s risk appetite and risk tolerance levels and ERMC communications in support of an Agency-wide risk culture.

Implement qualitative or quantitative measures to measure, report on, and monitor the information security and SCRM performance of organizationally defined products, systems, and services provided by external providers.

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missinghardware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the hardware inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to capture the missingsoftware data elements for each identified system and assess whether other information systems may be missing similaror related data elements.

The auditors recommend that the Chief Information Officer require the Department and FSA to further define the oversightcontrols that are in the current policy to ensure all Departmental systems consistently utilize the inventory template whencompleting/updating the software inventory.

The auditors recommend that the Chief Information Officer require the Department and FSA to review and approve theUSDS-MaxED/AidVntge and EDAWSEW MOU. Furthermore, the Department and FSA should update existingprocedures and ensure all MOUs reflect the appropriate two-year review cycle.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement a process tomonitor that PRDs are reviewed and signed prior to the security investigation.

The auditors recommend that the Chief Information Officer require the Department and FSA to implement an automationprocess to centrally document, track, and share risk designation and screening information.

The auditors recommend that the Chief Information Officer require the Department and FSA to reinforce their process fordocumenting the authorization, review, and approval of PUAs.

The auditors recommend that the Chief Information Officer require the Department and FSA to develop enhanced monitoring controls to ensure proper internal controls mechanisms and processes are strictly enforced.

The auditors recommend that the Chief Information Officer require Departmental Principal Offices re-evaluate the use ofPIV alternates/exemptions across the organization, and modify onboarding procedures, as needed, to support a newstrategic direction which aligns with HSPD-12.

Treasury OIG should confirm the transactions noted as unsupported or ineligible expenditures within Contracts greater than or equal to $50,000, Aggregate Reporting less that $50,000, and Aggregate Payments to Individuals are recouped or reallocated to other eligible uses by Bucks County in conformity with Treasury's Guidance. Based on Bucks County's responsiveness to Treasury's OIG's requests and its ability to provide sufficient documentation, we recommend Treasury OIG determine the feasibility of conducting an audit for Contract greater than or equal to $50,000, Aggregate Reporting less than $50,000, and Aggregate Payments to individuals. Castro also identified other matters throughout the course of…

Add the 915,534 records to the DMF

Develop a plan to add the remaining records to the Death Master File (for example, add the records 117 years after the Numident date of birth).

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to identify all instances where two different individuals’ Numident records are cross-referred and uncross-refer the records.

Review all cases where the Numident records of beneficiaries in current payment status are cross-referred to deceased individuals’ Numident records and take action to correct the records.

Maximize technology (for example, develop automated program that compares Numident name, date of birth, sex designation, place of birth, parents’ names) to review the 2.4 million non-current payment status beneficiaries whose cross-referred Numident records contain death information, and input death information on their cross-referred record, as appropriate.